Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752860AbeAJSQY (ORCPT + 1 other); Wed, 10 Jan 2018 13:16:24 -0500 Received: from mga11.intel.com ([192.55.52.93]:61873 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752785AbeAJSQW (ORCPT ); Wed, 10 Jan 2018 13:16:22 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,341,1511856000"; d="scan'208";a="19920917" Subject: Re: [PATCH v3 3/5] x86/enter: Use IBRS on syscall and interrupts To: Peter Zijlstra Cc: Thomas Gleixner , Andy Lutomirski , Linus Torvalds , Greg KH , Dave Hansen , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , David Woodhouse , Dan Williams , Paolo Bonzini , Ashok Raj , linux-kernel@vger.kernel.org References: <20180110100457.GA29822@worktop.programming.kicks-ass.net> From: Tim Chen Message-ID: <26d015ef-c5d4-b529-5c81-97115ec02f48@linux.intel.com> Date: Wed, 10 Jan 2018 10:16:20 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: <20180110100457.GA29822@worktop.programming.kicks-ass.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 01/10/2018 02:04 AM, Peter Zijlstra wrote: > On Tue, Jan 09, 2018 at 06:26:47PM -0800, Tim Chen wrote: >> Set IBRS upon kernel entrance via syscall and interrupts. Clear it >> upon exit. IBRS protects against unsafe indirect branching predictions >> in the kernel. >> >> The NMI interrupt save/restore of IBRS state was based on Andrea >> Arcangeli's implementation. >> Here's an explanation by Dave Hansen on why we save IBRS state for NMI. >> >> The normal interrupt code uses the 'error_entry' path which uses the >> Code Segment (CS) of the instruction that was interrupted to tell >> whether it interrupted the kernel or userspace and thus has to switch >> IBRS, or leave it alone. >> >> The NMI code is different. It uses 'paranoid_entry' because it can >> interrupt the kernel while it is running with a userspace IBRS (and %GS >> and CR3) value, but has a kernel CS. If we used the same approach as >> the normal interrupt code, we might do the following; >> >> SYSENTER_entry >> <-------------- NMI HERE >> IBRS=1 >> do_something() >> IBRS=0 >> SYSRET >> >> The NMI code might notice that we are running in the kernel and decide >> that it is OK to skip the IBRS=1. This would leave it running >> unprotected with IBRS=0, which is bad. >> >> However, if we unconditionally set IBRS=1, in the NMI, we might get the >> following case: >> >> SYSENTER_entry >> IBRS=1 >> do_something() >> IBRS=0 >> <-------------- NMI HERE (set IBRS=1) >> SYSRET >> >> and we would return to userspace with IBRS=1. Userspace would run >> slowly until we entered and exited the kernel again. >> >> Instead of those two approaches, we chose a third one where we simply >> save the IBRS value in a scratch register (%r13) and then restore that >> value, verbatim. >> > > What this Changelog fails to address is _WHY_ we need this. What does > this provide that retpoline does not. > Ok. I mentioned that in the cover letter that IBRS is a maximum security mode in the CPU itself to directly restrict all indirect branches to prevent SPECTRE v2. I'll also include such comments in the commit log here. Thanks. Tim