Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753153AbeAJSot (ORCPT + 1 other); Wed, 10 Jan 2018 13:44:49 -0500 Received: from mga06.intel.com ([134.134.136.31]:34656 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751787AbeAJSoq (ORCPT ); Wed, 10 Jan 2018 13:44:46 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,341,1511856000"; d="scan'208";a="19927729" Subject: Re: [PATCH v3 3/5] x86/enter: Use IBRS on syscall and interrupts To: Peter Zijlstra Cc: Thomas Gleixner , Andy Lutomirski , Linus Torvalds , Greg KH , Dave Hansen , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , David Woodhouse , Dan Williams , Paolo Bonzini , Ashok Raj , linux-kernel@vger.kernel.org References: <20180110100457.GA29822@worktop.programming.kicks-ass.net> <26d015ef-c5d4-b529-5c81-97115ec02f48@linux.intel.com> <20180110182856.GQ6176@hirez.programming.kicks-ass.net> From: Tim Chen Message-ID: Date: Wed, 10 Jan 2018 10:44:44 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: <20180110182856.GQ6176@hirez.programming.kicks-ass.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 01/10/2018 10:28 AM, Peter Zijlstra wrote: > On Wed, Jan 10, 2018 at 10:16:20AM -0800, Tim Chen wrote: >> On 01/10/2018 02:04 AM, Peter Zijlstra wrote: > >>> What this Changelog fails to address is _WHY_ we need this. What does >>> this provide that retpoline does not. >>> >> >> Ok. I mentioned that in the cover letter that IBRS is a maximum security >> mode in the CPU itself to directly restrict all indirect branches to prevent SPECTRE v2. >> >> I'll also include such comments in the commit log here. > > That still doesn't say anything useful. Why and where is it better than > retpoline? Why would I ever want to use IBRS? Those are not questions > that have clear answers here. > > From what I can gather of the discussion earlier today is that pre SKL > IBRS is no better than retpoline and a whole lot slower. > > On SKL+ retpoline is mostly there, but has a few dinky holes in and it > _might_ make sense to use IBRS. > > But I feel it needs explaining what the exact holes are (pjt and dwmw2 > had a fair enumeration IIRC) such that people can judge the risk. > > No wishy washy maybe nonsense, clear language. > Retpoline depends on the compiler doing the right thing, finding all instances of indirect jump/call and patching those places with the retpoline construct to defend against spectre v2. For IBRS, the cpu itself restricts all the indirect jumps/calls when IBRS is set. So this is inherently a more secure mode than the retpoline approach. It also helps people who don't have a gcc that don't support retpoline. Tim