Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964948AbeAJCrP (ORCPT + 1 other); Tue, 9 Jan 2018 21:47:15 -0500 Received: from mga07.intel.com ([134.134.136.100]:50028 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933752AbeAJCrO (ORCPT ); Tue, 9 Jan 2018 21:47:14 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,337,1511856000"; d="scan'208";a="9187244" From: Tim Chen To: Thomas Gleixner , Andy Lutomirski , Linus Torvalds , Greg KH Cc: Tim Chen , Dave Hansen , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , David Woodhouse , Peter Zijlstra , Dan Williams , Paolo Bonzini , Ashok Raj , linux-kernel@vger.kernel.org Subject: [PATCH v3 0/5] IBRS patch series Date: Tue, 9 Jan 2018 18:26:44 -0800 Message-Id: X-Mailer: git-send-email 2.9.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Thanks to all the reviewers. One key feedback I got was we should make this patch series simple, so we can put in basic IBRS functionality first. So I took out the run time control of IBRS, toggling IBRS to firmware call for retpoline and recheck of IBRS feature on microcode reload. We will defer dealing with those complications later. This patch series is integrated with the retpoline patches on x86/tip. The user can opt for ibrs by "spectre_v2=ibrs" instead of "spectre_v2=retpoline" in boot parameter. Otherwise retpoline will be used by default for spectre_v2. The patchset is applied on top of the latest x86/tip with retpoline patches. I've tested the patchset mostly on the 4.15-rc6. As I have just merged the patchset top x86/tip, some bare testing has been done on the x86/tip. Will be doing more testing there. Thomas, I have to switch a check in patch 5 from lockdep_assert_irqs_disabled to WARN_ON_ONCE as it is not available on x86/tip. We should use lockdep_assert_irqs_disabled when we merge back to mainline. + /* should use lockdep_assert_irqs_disabled() when available */ + WARN_ON_ONCE(!irqs_disabled()); Thanks. Tim v3. 1. Use boot parameter spectre_v2=ibrs to opt in for enabling IBRS. 2. Remove run time control of IBRS usage. 3. Remove the patches for IBRS detection on microcode reload, enabling of IBRS for firmware call when using retpoline. v2. 1. Added missing feature enumeration in tools/arch/x86/include/asm/cpufeatures.h 2. Kernel entry macros label cleanup and move them to calling.h 3. Remove unnecessary irqs_diabled check in the mwait. 4. Don't use a bit field base sys control variable to make ibrs enabling simpler and easier to understand. 5. Corrected compile issues for firmware update code. 6. Leave IBPB feature bits out from this patch series and will be added in its own set of patches later. Tim ---patch series details--- This patch series enables the basic detection and usage of x86 indirect branch speculation feature. It enables the indirect branch restricted speculation (IBRS) on kernel entry and disables it on exit. It enumerates the indirect branch prediction barrier (IBPB). The x86 IBRS feature requires corresponding microcode support. It mitigates the variant 2 vulnerability described in https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html If IBRS is set, near returns and near indirect jumps/calls will not allow their predicted target address to be controlled by code that executed in a less privileged prediction mode before the IBRS mode was last written with a value of 1 or on another logical processor so long as all RSB entries from the previous less privileged prediction mode are overwritten. Both retpoline and IBRS provides mitigation against variant 2 attacks, with IBRS being the most secured method but could incur more performance overhead compared to retpoline[1]. If you are paranoid, then set spectre_v2=ibrs as your boot parameter. See: https://docs.google.com/document/d/e/2PACX-1vSMrwkaoSUBAFc6Fjd19F18c1O9pudkfAY-7lGYGOTN8mc9ul-J6pWadcAaBJZcVA7W_3jlLKRtKRbd/pub More detailed description of IBRS is described in the first patch. The patchset is applied on top of the latest x86/tip with retpoline patches. Tim Chen (5): x86/feature: Detect the x86 IBRS feature to control Speculation x86/enter: Create macros to set/clear IBRS x86/enter: Use IBRS on syscall and interrupts x86/ibrs: Create boot option for IBRS x86/idle: Disable IBRS entering idle and enable it on wakeup Documentation/admin-guide/kernel-parameters.txt | 3 + arch/x86/entry/calling.h | 73 +++++++++++++++++++++++++ arch/x86/entry/entry_64.S | 23 ++++++++ arch/x86/entry/entry_64_compat.S | 14 ++++- arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/msr-index.h | 4 ++ arch/x86/include/asm/mwait.h | 13 +++++ arch/x86/include/asm/spec_ctrl.h | 22 ++++++++ arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/scattered.c | 3 + arch/x86/kernel/cpu/spec_ctrl.c | 48 ++++++++++++++++ arch/x86/kernel/process.c | 9 ++- tools/arch/x86/include/asm/cpufeatures.h | 2 + 13 files changed, 214 insertions(+), 3 deletions(-) create mode 100644 arch/x86/include/asm/spec_ctrl.h create mode 100644 arch/x86/kernel/cpu/spec_ctrl.c -- 2.9.4