Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Jon Kohler <jon@nutanix.com>
To:     Dave Hansen <dave.hansen@intel.com>
CC:     Jon Kohler <jon@nutanix.com>, David Woodhouse <dwmw@amazon.co.uk>,
        Jiri Kosina <jkosina@suse.cz>,
        Josh Poimboeuf <jpoimboe@redhat.com>,
        Ravi Shankar <ravi.v.shankar@intel.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        "x86@kernel.org" <x86@kernel.org>,
        "H. Peter Anvin" <hpa@zytor.com>, Tony Luck <tony.luck@intel.com>,
        Anthony Steinhauser <asteinhauser@google.com>,
        Mike Rapoport <rppt@kernel.org>,
        Anand K Mistry <amistry@google.com>,
        Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] x86/bugs: wrap X86_FEATURE_RSB_CTXSW with ifdef
 CONFIG_RETPOLINE
Thread-Topic: [PATCH] x86/bugs: wrap X86_FEATURE_RSB_CTXSW with ifdef
 CONFIG_RETPOLINE
Thread-Index: AQHXQ1kgF/owkrgfB06Ny/ycZH9MzKrYLfqAgAAG6oA=
Date:   Fri, 7 May 2021 16:26:57 +0000
Message-ID: <E94CE2D1-4C5D-4C74-950F-0BE5F1C9C937@nutanix.com>
References: <20210507155308.97649-1-jon@nutanix.com>
 <cd3517fb-06c2-9188-1a03-3848db6aba3e@intel.com>
In-Reply-To: <cd3517fb-06c2-9188-1a03-3848db6aba3e@intel.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?XfpkbZbiMMcTS+J0UUxL62YrhtjoLhzpbIeClT8cQ58C0HpIw1L0qosCqoAX?=
 =?us-ascii?Q?CyNlVvRVODTPlpNDXa6CiY8+DEYocxTpvHwbqfXRE3PjuLnmilL9alklOF1/?=
 =?us-ascii?Q?LPZjDkY18nLfY3RGOlRdhAD6ApESDVVkyqAv35x6J/LePJhzJQg2frXKiBUO?=
 =?us-ascii?Q?JNlx/3AbDv0SSGlQMf2qu/2Tw9S/8LS1ojgN2eOoWztWap2uK1W/i8zYQmUp?=
 =?us-ascii?Q?JXZQkSFwY9T5EOHWDv0tWcBwYWvfnQmN2g171jmipEHpOUI/KzDY2e4COqai?=
 =?us-ascii?Q?xu2Qpqgi4OxUA8+fAi46Ry67NPHL+ALrf0rfTqWrDHiiKKx58y2j9kJM0xW3?=
 =?us-ascii?Q?374rkGVbkI42YNXC4xHyYYyk0XbjxWXJe7X1SQ8QoZmt2biGUJWmvso/ag+n?=
 =?us-ascii?Q?gE1wF//x3whh6H/TXHrxY+0t5dgqGk1asADFyRmcHIjQUk7p0TeVdes3PMy2?=
 =?us-ascii?Q?Qrx/tNT0+F+BJbvhscGRHvcgZPnAUIPs2VmSr4k3qlCKVJ8F0gV3jR4871bU?=
 =?us-ascii?Q?xhlf7/v6vovl9Ybi7AJ7liMiBqIo6ykb2JZlyvDM7rqk6hOcnguZTdJySpM0?=
 =?us-ascii?Q?WxHDbmEX4yZlsx1IDpzxgFhap7pO7+UqQyaqmT12WVDFFpdc956ged7BhhhD?=
 =?us-ascii?Q?r0+dCXgqH5uIrCVMKXyH8zQebFN2O1WrtBVjpEtkQslKuencO4v6cOJg5QKD?=
 =?us-ascii?Q?wlaRROY+Ui1EZMNCqWMnEsjy3t5mcgnp2Nrlnj35VAmPDBKmOezrzXt4XQlE?=
 =?us-ascii?Q?0UvxmQ3eOJl4bohYYV9fo8rGkjsZT9hxHUq9+J6GIm76FT4sv6VjRy+Z+qXu?=
 =?us-ascii?Q?qudyG6jfYru/hP4xtqtlwI+gTh89D3aBN3+3eMht9ycbKFg+/Ri18E08WjeA?=
 =?us-ascii?Q?FaoAs9evqQdJ4TDxkduzF+Q9V3ae8OCwqfy9BJKUspoodYWCus5Snu48Bqu9?=
 =?us-ascii?Q?YAJVdmMTs5MUQwQBji7YKqaJp1R8TGWd/BiebhBT6DEr8jcjTdN2RlTCeVGZ?=
 =?us-ascii?Q?HOQ7sK81OLYT+XY3bFodOjqX3oTTwKRtdJjs+y3DUkl/jKkRUw6n7k9+ooxE?=
 =?us-ascii?Q?KKPh8mnRSObi/pr17pZJqUwg8xhaGcwt5OA31rs/xPc7IUg1cvGZ1r8F1JAQ?=
 =?us-ascii?Q?1YAkBF2A7t4Ah/QYKbHx0eKlcNLdJE4xIEHHp4vW5IDlx9mQV0MQBA10BAVD?=
 =?us-ascii?Q?2C52KVt/cMCuoMg0HG1T50rqsUBbRQclb7cf0HnVyLZBpmM2GwRPFKs3HriR?=
 =?us-ascii?Q?22zhmbXk6v87LVmnvYWc4bEyEaQ8NDGbUOJOnY3CqXsZaU1UHsNOBOSBJlht?=
 =?us-ascii?Q?2F1+miRysIeI0SmmJj3mLfVeWVQAvZa/PiTuVnePqVpnGmVtNI965zfRjWnf?=
 =?us-ascii?Q?jovcadJFfmlCXXVK+wAQCNVbu+jG?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <7D6346EF487C484D920E24AFD17A8764@namprd02.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nutanix.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BL0PR02MB4579.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0db950b7-a61a-4500-b674-08d91174ef20
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2021 16:26:57.4233
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: wHUOAQ2ngno3iiETRmXoVX8VpqbH4k6+Jca9lV+urkT/Oh/IJSZ2zG/BJC+oikzETEmB0eU+/DnVLHCTyQ8eNbOPvr314GlBy+6O0cb7KQc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR02MB6176
X-Proofpoint-GUID: rZT6GXSkhDg2fneEkJQydeOLz15c6tnB
X-Proofpoint-ORIG-GUID: rZT6GXSkhDg2fneEkJQydeOLz15c6tnB
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.761
 definitions=2021-05-07_06:2021-05-06,2021-05-07 signatures=0
X-Proofpoint-Spam-Reason: safe
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On May 7, 2021, at 12:02 PM, Dave Hansen <dave.hansen@intel.com> wrote:
>=20
> On 5/7/21 8:53 AM, Jon Kohler wrote:
>> The only place X86_FEATURE_RSB_CTXSW is currently in use is in
>> arch/x86/entry/entry_{32|64}.S, where its use is wrapped with
>> ifdef CONFIG_RETPOLINE. If someone uses a system with
>> X86_FEATURE_IBRS_ENHANCED and compiles without CONFIG_RETPOLINE
>> but still has spectre v2 set to auto, the kernel log will
>> print that eIBRS is enabled and that RSB stuffing is enabled;
>> however, that stuffing would never occur.
>>=20
>> To make this behavior more clear, wrap the enablement of
>> X86_FEATURE_RSB_CTXSW and the resulting log message with ifdef
>> CONFIG_RETPOLINE, such that it is compiled out along with the
>> actions it controls.
>>=20
>> This way seems more correct at first glance as this was the way
>> the code was originally written in fdf82a7856b; however, when
>> enhanced IBRS was added, there was a goto added under
>> SPECTRE_V2_CMD_AUTO which bypasses going through retpoline_auto,
>> where X86_FEATURE_RETPOLINE is set.
>>=20
>> The other option would be to remove the CONFIG_RETPOLINE from
>> the code in entry_{32|64}.S, such that it would always be
>> compiled no matter what, such that these two areas match.
>=20
> This kinda dances around the real issue: Does RSB stuffing have
> mitigation value on enhanced IBRS systems?
>=20
> If yes, then we should make the RSB stuffing code in entry*.S available
> separately from CONFIG_RETPOLINE.
>=20
> If no, is it because eIBRS systems are not vulnerable, or because RSB
> stuffing has no mitigation value?
>=20
> Either way, I'm not sure the approach in this patch is the one we want.

Thanks, Dave, for the prompt response and thats a great question.=20

The way the existing documentation reads in bugs.c, all Sklake+
processors are affected by this, so I'd lean towards "yes" to
your question; however, would love the authorative view from Intel
guru's on this, as RSB stuffing is a bit expensive, would be lovely
to drop it on eIBRS systems! :)

In running down the idea for this patch, I did look at Intel's=20
"Affected Processors: Transient Execution Attacks & Related Security
Issues by CPU" guide, interestingly enough the CVE for spectre RSB
(v5 / 2018-15572) isn't listed, so I had to depend on what was written
in the various previous commits around this topic.

Anyhow, happy to take up a different approach depending on what the
powers that be at Intel say to needing RSB stuffing on eIBRS. In
addition to the chatter here, I'll see if I can poke around more on
my own as well.

Thanks again,
Jon