All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS
@ 2023-02-27  6:05 KP Singh
  2023-02-27  6:05 ` [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh
  2023-02-27  6:29 ` [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS Greg KH
  0 siblings, 2 replies; 5+ messages in thread
From: KP Singh @ 2023-02-27  6:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: pjt, evn, jpoimboe, tglx, x86, hpa, peterz, pawan.kumar.gupta,
	kim.phillips, alexandre.chartre, daniel.sneddon, corbet, bp,
	linyujun809, kpsingh, jmattson, mingo, seanjc, andrew.cooper3,
	José Oliveira, Rodrigo Branco, stable

When plain IBRS is enabled (not enhanced IBRS), the logic in
spectre_v2_user_select_mitigation() determines that STIBP is not needed.

The IBRS bit implicitly protects against cross-thread branch target
injection. However, with legacy IBRS, the IBRS bit is cleared on
returning to userspace for performance reasons which leaves userspace
threads vulnerable to cross-thread branch target injection against which
STIBP protects.

Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for
enabling STIBP (through seccomp/prctl() by default or always-on, if
selected by spectre_v2_user kernel cmdline parameter).

Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Reported-by: José Oliveira <joseloliveira11@gmail.com>
Reported-by: Rodrigo Branco <rodrigo@kernelhacking.com>
Cc: stable@vger.kernel.org
Signed-off-by: KP Singh <kpsingh@kernel.org>
---
 arch/x86/kernel/cpu/bugs.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index cf81848b72f4..44e22cda7fb3 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1133,14 +1133,18 @@ spectre_v2_parse_user_cmdline(void)
 	return SPECTRE_V2_USER_CMD_AUTO;
 }
 
-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
 {
-	return mode == SPECTRE_V2_IBRS ||
-	       mode == SPECTRE_V2_EIBRS ||
+	return mode == SPECTRE_V2_EIBRS ||
 	       mode == SPECTRE_V2_EIBRS_RETPOLINE ||
 	       mode == SPECTRE_V2_EIBRS_LFENCE;
 }
 
+static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+{
+	return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
+}
+
 static void __init
 spectre_v2_user_select_mitigation(void)
 {
@@ -1203,12 +1207,20 @@ spectre_v2_user_select_mitigation(void)
 	}
 
 	/*
-	 * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
-	 * STIBP is not required.
+	 * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
+	 * is not required.
+	 *
+	 * Enhanced IBRS also protects against cross-thread branch target
+	 * injection in user-mode as the IBRS bit remains always set which
+	 * implicitly enables cross-thread protections.  However, in legacy IBRS
+	 * mode, the IBRS bit is set only on kernel entry and cleared on return
+	 * to userspace. This disables the implicit
+	 * cross-thread protection, so allow for STIBP to be selected in that
+	 * case.
 	 */
 	if (!boot_cpu_has(X86_FEATURE_STIBP) ||
 	    !smt_possible ||
-	    spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+	    spectre_v2_in_eibrs_mode(spectre_v2_enabled))
 		return;
 
 	/*
@@ -2340,7 +2352,7 @@ static ssize_t mmio_stale_data_show_state(char *buf)
 
 static char *stibp_state(void)
 {
-	if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
 		return "";
 
 	switch (spectre_v2_user_stibp) {
-- 
2.39.2.637.g21b0678d19-goog


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP
  2023-02-27  6:05 [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS KP Singh
@ 2023-02-27  6:05 ` KP Singh
  2023-02-27  6:30   ` Greg KH
  2023-02-27 19:58   ` [tip: x86/urgent] " tip-bot2 for KP Singh
  2023-02-27  6:29 ` [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS Greg KH
  1 sibling, 2 replies; 5+ messages in thread
From: KP Singh @ 2023-02-27  6:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: pjt, evn, jpoimboe, tglx, x86, hpa, peterz, pawan.kumar.gupta,
	kim.phillips, alexandre.chartre, daniel.sneddon, corbet, bp,
	linyujun809, kpsingh, jmattson, mingo, seanjc, andrew.cooper3,
	stable

Explain why STIBP is needed with legacy IBRS as currently implemented
(KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.

Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Cc: stable@vger.kernel.org
Signed-off-by: KP Singh <kpsingh@kernel.org>
---
 Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 3fe6511c5405..4d186f599d90 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -479,8 +479,16 @@ Spectre variant 2
    On Intel Skylake-era systems the mitigation covers most, but not all,
    cases. See :ref:`[3] <spec_ref3>` for more details.
 
-   On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
-   IBRS on x86), retpoline is automatically disabled at run time.
+   On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS
+   or enhanced IBRS on x86), retpoline is automatically disabled at run time.
+
+   Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
+   boot, by setting the IBRS bit, and they're automatically protected against
+   Spectre v2 variant attacks, including cross-thread branch target injections
+   on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+
+   Legacy IBRS systems clear the IBRS bit on exit to userspace and
+   therefore explicitly enable STIBP for that
 
    The retpoline mitigation is turned on by default on vulnerable
    CPUs. It can be forced on or off by the administrator
@@ -504,9 +512,12 @@ Spectre variant 2
    For Spectre variant 2 mitigation, individual user programs
    can be compiled with return trampolines for indirect branches.
    This protects them from consuming poisoned entries in the branch
-   target buffer left by malicious software.  Alternatively, the
-   programs can disable their indirect branch speculation via prctl()
-   (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
+   target buffer left by malicious software.
+
+   On legacy IBRS systems, at return to userspace, implicit STIBP is disabled
+   because the kernel clears the IBRS bit. In this case, the userspace programs
+   can disable indirect branch speculation via prctl() (See
+   :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
    On x86, this will turn on STIBP to guard against attacks from the
    sibling thread when the user program is running, and use IBPB to
    flush the branch target buffer when switching to/from the program.
-- 
2.39.2.637.g21b0678d19-goog


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS
  2023-02-27  6:05 [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS KP Singh
  2023-02-27  6:05 ` [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh
@ 2023-02-27  6:29 ` Greg KH
  1 sibling, 0 replies; 5+ messages in thread
From: Greg KH @ 2023-02-27  6:29 UTC (permalink / raw)
  To: KP Singh
  Cc: linux-kernel, pjt, evn, jpoimboe, tglx, x86, hpa, peterz,
	pawan.kumar.gupta, kim.phillips, alexandre.chartre,
	daniel.sneddon, corbet, bp, linyujun809, jmattson, mingo, seanjc,
	andrew.cooper3, José Oliveira, Rodrigo Branco, stable

On Mon, Feb 27, 2023 at 07:05:40AM +0100, KP Singh wrote:
> When plain IBRS is enabled (not enhanced IBRS), the logic in
> spectre_v2_user_select_mitigation() determines that STIBP is not needed.
> 
> The IBRS bit implicitly protects against cross-thread branch target
> injection. However, with legacy IBRS, the IBRS bit is cleared on
> returning to userspace for performance reasons which leaves userspace
> threads vulnerable to cross-thread branch target injection against which
> STIBP protects.
> 
> Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for
> enabling STIBP (through seccomp/prctl() by default or always-on, if
> selected by spectre_v2_user kernel cmdline parameter).
> 
> Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
> Reported-by: José Oliveira <joseloliveira11@gmail.com>
> Reported-by: Rodrigo Branco <rodrigo@kernelhacking.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: KP Singh <kpsingh@kernel.org>
> ---
>  arch/x86/kernel/cpu/bugs.c | 26 +++++++++++++++++++-------
>  1 file changed, 19 insertions(+), 7 deletions(-)
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP
  2023-02-27  6:05 ` [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh
@ 2023-02-27  6:30   ` Greg KH
  2023-02-27 19:58   ` [tip: x86/urgent] " tip-bot2 for KP Singh
  1 sibling, 0 replies; 5+ messages in thread
From: Greg KH @ 2023-02-27  6:30 UTC (permalink / raw)
  To: KP Singh
  Cc: linux-kernel, pjt, evn, jpoimboe, tglx, x86, hpa, peterz,
	pawan.kumar.gupta, kim.phillips, alexandre.chartre,
	daniel.sneddon, corbet, bp, linyujun809, jmattson, mingo, seanjc,
	andrew.cooper3, stable

On Mon, Feb 27, 2023 at 07:05:41AM +0100, KP Singh wrote:
> Explain why STIBP is needed with legacy IBRS as currently implemented
> (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.
> 
> Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
> Cc: stable@vger.kernel.org
> Signed-off-by: KP Singh <kpsingh@kernel.org>
> ---
>  Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)


Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [tip: x86/urgent] Documentation/hw-vuln: Document the interaction between IBRS and STIBP
  2023-02-27  6:05 ` [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh
  2023-02-27  6:30   ` Greg KH
@ 2023-02-27 19:58   ` tip-bot2 for KP Singh
  1 sibling, 0 replies; 5+ messages in thread
From: tip-bot2 for KP Singh @ 2023-02-27 19:58 UTC (permalink / raw)
  To: linux-tip-commits; +Cc: KP Singh, Borislav Petkov (AMD), x86, linux-kernel

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     e02b50ca442e88122e1302d4dbc1b71a4808c13f
Gitweb:        https://git.kernel.org/tip/e02b50ca442e88122e1302d4dbc1b71a4808c13f
Author:        KP Singh <kpsingh@kernel.org>
AuthorDate:    Mon, 27 Feb 2023 07:05:41 +01:00
Committer:     Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Mon, 27 Feb 2023 19:02:47 +01:00

Documentation/hw-vuln: Document the interaction between IBRS and STIBP

Explain why STIBP is needed with legacy IBRS as currently implemented
(KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.

Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Signed-off-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230227060541.1939092-2-kpsingh@kernel.org
---
 Documentation/admin-guide/hw-vuln/spectre.rst | 21 +++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 3fe6511..4d186f5 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -479,8 +479,16 @@ Spectre variant 2
    On Intel Skylake-era systems the mitigation covers most, but not all,
    cases. See :ref:`[3] <spec_ref3>` for more details.
 
-   On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
-   IBRS on x86), retpoline is automatically disabled at run time.
+   On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS
+   or enhanced IBRS on x86), retpoline is automatically disabled at run time.
+
+   Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
+   boot, by setting the IBRS bit, and they're automatically protected against
+   Spectre v2 variant attacks, including cross-thread branch target injections
+   on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+
+   Legacy IBRS systems clear the IBRS bit on exit to userspace and
+   therefore explicitly enable STIBP for that
 
    The retpoline mitigation is turned on by default on vulnerable
    CPUs. It can be forced on or off by the administrator
@@ -504,9 +512,12 @@ Spectre variant 2
    For Spectre variant 2 mitigation, individual user programs
    can be compiled with return trampolines for indirect branches.
    This protects them from consuming poisoned entries in the branch
-   target buffer left by malicious software.  Alternatively, the
-   programs can disable their indirect branch speculation via prctl()
-   (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
+   target buffer left by malicious software.
+
+   On legacy IBRS systems, at return to userspace, implicit STIBP is disabled
+   because the kernel clears the IBRS bit. In this case, the userspace programs
+   can disable indirect branch speculation via prctl() (See
+   :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
    On x86, this will turn on STIBP to guard against attacks from the
    sibling thread when the user program is running, and use IBPB to
    flush the branch target buffer when switching to/from the program.

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2023-02-27 19:59 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-27  6:05 [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS KP Singh
2023-02-27  6:05 ` [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh
2023-02-27  6:30   ` Greg KH
2023-02-27 19:58   ` [tip: x86/urgent] " tip-bot2 for KP Singh
2023-02-27  6:29 ` [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS Greg KH

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.