MIME-Version: 1.0
References: <20230220120127.1975241-1-kpsingh@kernel.org> <20230220121350.aidsipw3kd4rsyss@treble>
 <CACYkzJ5L9MLuE5Jz+z5-NJCCrUqTbgKQkXSqnQnCfTD_WNA7_Q@mail.gmail.com>
 <CACYkzJ6n=-tobhX0ONQhjHSgmnNjWnNe_dZnEOGtD8Y6S3RHbA@mail.gmail.com>
 <Y/OETPFTJbGtCADM@zn.tnic> <3a65d18f-b218-60e7-4748-f1609eb76fd5@citrix.com> <Y/PhxDIVsa4WU5gu@zn.tnic>
In-Reply-To: <Y/PhxDIVsa4WU5gu@zn.tnic>
From:   KP Singh <kpsingh@kernel.org>
Date:   Mon, 20 Feb 2023 15:01:47 -0800
Message-ID: <CACYkzJ6K77T8aFNC0oxcq8-huGZSX8spLpvNDiJQbyYsx5HwNg@mail.gmail.com>
Subject: Re: [PATCH RESEND] x86/speculation: Fix user-mode spectre-v2
 protection with KERNEL_IBRS
To:     Borislav Petkov <bp@alien8.de>
Cc:     Andrew Cooper <andrew.cooper3@citrix.com>,
        Dave Hansen <dave.hansen@intel.com>,
        Josh Poimboeuf <jpoimboe@kernel.org>,
        linux-kernel@vger.kernel.org, pjt@google.com, evn@google.com,
        tglx@linutronix.de, mingo@redhat.com, dave.hansen@linux.intel.com,
        x86@kernel.org, hpa@zytor.com, peterz@infradead.org,
        pawan.kumar.gupta@linux.intel.com, kim.phillips@amd.com,
        alexandre.chartre@oracle.com, daniel.sneddon@linux.intel.com,
        =?UTF-8?Q?Jos=C3=A9_Oliveira?= <joseloliveira11@gmail.com>,
        Rodrigo Branco <rodrigo@kernelhacking.com>,
        Alexandra Sandulescu <aesa@google.com>,
        Jim Mattson <jmattson@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Feb 20, 2023 at 1:10 PM Borislav Petkov <bp@alien8.de> wrote:
>
> On Mon, Feb 20, 2023 at 07:57:25PM +0000, Andrew Cooper wrote:
> > "When IBRS or enhanced IBRS is enabled, STIBP is not needed."
> >
> > This is misleading, if not strictly wrong.  The IBRS bit being set
> > implies STIBP, which reads differently to "not needed".
> >
> >
> > Now - eIBRS is "set once at start of day" which ends up becoming a
> > global implicit STIBP.
>
> Right.
>
> > I think we're discussing the legacy IBRS case here.  i.e. what was
> > retrofitted in microcode for existing parts?
>
> Any IBRS actually. The one which is *not* the automatic, fire'n'forget
> thing.
>
> > The reason why it is "write 1 on each privilege increase, 0 on privilege
> > decrease" is because on some CPUs its an inhibit control, and on some
> > CPUs is a flush (i.e. its actually IBPB).
> >
> > But these same CPUs don't actually have an ability to thread-tag the
> > indirect predictor nicely so STIBP is also horribly expensive under the
> > hood - so much so that we were firmly recommended to clear STIBP/IBRS
> > when going idle so as to reduce the impact on the sibling.
>
> Yap, we do that. And we do the write to 0 for IBRS on exit to
> luserspace, probably for very similar reasons.
>
> > IMO the proper way to do this is to set STIBP uniformly depending on
> > whether you want it in userspace or not, and treat it logically
> > separately to IBRS.  It doesn't hurt (any more) to have both bits set.
>
> So we have this thing:
>
>         /*
>          * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
>          * STIBP is not required.
>          */
>         if (!boot_cpu_has(X86_FEATURE_STIBP) ||
>             !smt_possible ||
>             spectre_v2_in_ibrs_mode(spectre_v2_enabled))
>                 return;
>
> What you propose sounds cleaner but would definitely need more massaging
> of this madness code. So I guess we could do only the
> enable-STIBP-when-IBRS-enabled thing first and do more cleanups later.
>

I do like the idea of decoupling, but yeah this is a bit tangled and
abstracted away from the user. The user currently just selects one of
(note the absence of STIBP in the choices here).

SPECTRE_V2_USER_CMD_NONE,
SPECTRE_V2_USER_CMD_AUTO,
SPECTRE_V2_USER_CMD_FORCE,
SPECTRE_V2_USER_CMD_PRCTL,
SPECTRE_V2_USER_CMD_PRCTL_IBPB,
SPECTRE_V2_USER_CMD_SECCOMP,
SPECTRE_V2_USER_CMD_SECCOMP_IBPB,

and the STIBP mode is selected implicitly based on the kernel's choice
of spectre v2 mitigations. I will fix the default case and we can
eventually decouple STIBP from the v2 kernel mitigation choice.

> Thx.
>
> --
> Regards/Gruss,
>     Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette