Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752593AbeADSSE (ORCPT + 1 other); Thu, 4 Jan 2018 13:18:04 -0500 Received: from mga06.intel.com ([134.134.136.31]:8415 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752320AbeADSSC (ORCPT ); Thu, 4 Jan 2018 13:18:02 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,315,1511856000"; d="scan'208";a="21446951" From: Tim Chen To: Thomas Gleixner , Andy Lutomirski , Linus Torvalds , Greg KH Cc: Tim Chen , Dave Hansen , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , linux-kernel@vger.kernel.org Subject: [PATCH 0/7] IBRS patch series Date: Thu, 4 Jan 2018 09:56:41 -0800 Message-Id: X-Mailer: git-send-email 2.9.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: This patch series enables the basic detection and usage of x86 indirect branch speculation feature. It enables the indirect branch restricted speculation (IBRS) on kernel entry and disables it on exit. It enumerates the indirect branch prediction barrier (IBPB). The x86 IBRS feature requires corresponding microcode support. It mitigates the variant 2 vulnerability described in https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html If IBRS is set, near returns and near indirect jumps/calls will not allow their predicted target address to be controlled by code that executed in a less privileged prediction mode before the IBRS mode was last written with a value of 1 or on another logical processor so long as all RSB entries from the previous less privileged prediction mode are overwritten. Setting of IBPB ensures that earlier code's behavior does not control later indirect branch predictions. It is used when context switching to new untrusted address space. Unlike IBRS, IBPB is a command MSR and does not retain its state. Speculation on Skylake and later requires these patches ("dynamic IBRS") be used instead of retpoline[1]. If you are very paranoid or you run on a CPU where IBRS=1 is cheaper, you may also want to run in "IBRS always" mode. See: https://docs.google.com/document/d/e/2PACX-1vSMrwkaoSUBAFc6Fjd19F18c1O9pudkfAY-7lGYGOTN8mc9ul-J6pWadcAaBJZcVA7W_3jlLKRtKRbd/pub More detailed description of IBRS is described in the first patch. It is applied on top of the page table isolation changes. A run time and boot time control of the IBRS feature is provided There are 2 ways to control IBRS 1. At boot time noibrs kernel boot parameter will disable IBRS usage Otherwise if the above parameters are not specified, the system will enable ibrs and ibpb usage if the cpu supports it. 2. At run time echo 0 > /sys/kernel/debug/ibrs_enabled will turn off IBRS echo 1 > /sys/kernel/debug/ibrs_enabled will turn on IBRS in kernel echo 2 > /sys/kernel/debug/ibrs_enabled will turn on IBRS in both userspace and kernel (IBRS always) [1] https://lkml.org/lkml/2018/1/4/174 Tim Chen (7): x86/feature: Detect the x86 feature to control Speculation x86/enter: MACROS to set/clear IBRS x86/enter: Use IBRS on syscall and interrupts x86/idle: Disable IBRS entering idle and enable it on wakeup x86: Use IBRS for firmware update path x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature x86/microcode: Recheck IBRS features on microcode reload Documentation/admin-guide/kernel-parameters.txt | 4 + arch/x86/entry/entry_64.S | 24 +++ arch/x86/entry/entry_64_compat.S | 9 + arch/x86/include/asm/apm.h | 6 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/efi.h | 16 +- arch/x86/include/asm/msr-index.h | 7 + arch/x86/include/asm/mwait.h | 19 ++ arch/x86/include/asm/spec_ctrl.h | 253 ++++++++++++++++++++++++ arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/microcode/core.c | 6 + arch/x86/kernel/cpu/scattered.c | 11 ++ arch/x86/kernel/cpu/spec_ctrl.c | 124 ++++++++++++ arch/x86/kernel/process.c | 9 +- 14 files changed, 486 insertions(+), 4 deletions(-) create mode 100644 arch/x86/include/asm/spec_ctrl.h create mode 100644 arch/x86/kernel/cpu/spec_ctrl.c -- 2.9.4