.../admin-guide/kernel-parameters.txt | 20 ++++++++++++++----- arch/x86/kernel/cpu/bugs.c | 10 ++++++---- 2 files changed, 21 insertions(+), 9 deletions(-)
AMD's "Technical Guidance for Mitigating Branch Type Confusion,
Rev. 1.0 2022-07-12" whitepaper, under section 6.1.2 "IBPB On
Privileged Mode Entry / SMT Safety" says:
"Similar to the Jmp2Ret mitigation, if the code on the sibling thread
cannot be trusted, software should set STIBP to 1 or disable SMT to
ensure SMT safety when using this mitigation."
So, like already being done for retbleed=unret, the also for
retbleed=ibpb, force STIBP on machines that have it, and report
its SMT vulnerability status accordingly.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb")
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
---
.../admin-guide/kernel-parameters.txt | 20 ++++++++++++++-----
arch/x86/kernel/cpu/bugs.c | 10 ++++++----
2 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index ef9f80b1ddde..c1061e7df55d 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5237,20 +5237,30 @@
Speculative Code Execution with Return Instructions)
vulnerability.
+ AMD-based unret and ibpb mitigations alone do not stop
+ sibling threads influencing the predictions of other sibling
+ threads. For that reason, we use STIBP on processors
+ that support it, and mitigate SMT on processors that don't.
+
off - no mitigation
auto - automatically select a migitation
auto,nosmt - automatically select a mitigation,
disabling SMT if necessary for
the full mitigation (only on Zen1
and older without STIBP).
- ibpb - mitigate short speculation windows on
+ ibpb - [AMD] Mitigate short speculation windows on
basic block boundaries too. Safe, highest
- perf impact.
- unret - force enable untrained return thunks,
+ perf impact. It also enables STIBP if
+ present.
+ ibpb,nosmt - [AMD] Like ibpb, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
+ unret - [AMD] Force enable untrained return thunks,
only effective on AMD f15h-f17h
based systems.
- unret,nosmt - like unret, will disable SMT when STIBP
- is not available.
+ unret,nosmt - [AMD] Like unret, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
Selecting 'auto' will choose a mitigation method at run
time according to the CPU.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 6761668100b9..d50686ca5870 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -152,7 +152,7 @@ void __init check_bugs(void)
/*
* spectre_v2_user_select_mitigation() relies on the state set by
* retbleed_select_mitigation(); specifically the STIBP selection is
- * forced for UNRET.
+ * forced for UNRET or IBPB.
*/
spectre_v2_user_select_mitigation();
ssb_select_mitigation();
@@ -1179,7 +1179,8 @@ spectre_v2_user_select_mitigation(void)
boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
mode = SPECTRE_V2_USER_STRICT_PREFERRED;
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (mode != SPECTRE_V2_USER_STRICT &&
mode != SPECTRE_V2_USER_STRICT_PREFERRED)
pr_info("Selecting STIBP always-on mode to complement retbleed mitigation\n");
@@ -2320,10 +2321,11 @@ static ssize_t srbds_show_state(char *buf)
static ssize_t retbleed_show_state(char *buf)
{
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
- return sprintf(buf, "Vulnerable: untrained return thunk on non-Zen uarch\n");
+ return sprintf(buf, "Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n");
return sprintf(buf, "%s; SMT %s\n",
retbleed_strings[retbleed_mitigation],
--
2.34.1* Kim Phillips <kim.phillips@amd.com> wrote: > Speculative Code Execution with Return Instructions) > vulnerability. > > + AMD-based unret and ibpb mitigations alone do not stop > + sibling threads influencing the predictions of other sibling > + threads. For that reason, we use STIBP on processors > + that support it, and mitigate SMT on processors that don't. > * retbleed_select_mitigation(); specifically the STIBP selection is > - * forced for UNRET. > + * forced for UNRET or IBPB. Nit: could you please capitalize the acronyms & instruction names consistently? Human eyesight is case sensitive. Ie. it should be UNRET and IBPB everywhere. Thanks, Ingo
AMD's "Technical Guidance for Mitigating Branch Type Confusion,
Rev. 1.0 2022-07-12" whitepaper, under section 6.1.2 "IBPB On
Privileged Mode Entry / SMT Safety" says:
"Similar to the Jmp2Ret mitigation, if the code on the sibling thread
cannot be trusted, software should set STIBP to 1 or disable SMT to
ensure SMT safety when using this mitigation."
So, like already being done for retbleed=unret, the also for
retbleed=ibpb, force STIBP on machines that have it, and report
its SMT vulnerability status accordingly.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb")
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
---
v3: "unret and ibpb mitigations" -> "UNRET and IBPB mitigations" (Mingo)
v2: Justify and explain STIBP's role with IBPB (Boris)
.../admin-guide/kernel-parameters.txt | 20 ++++++++++++++-----
arch/x86/kernel/cpu/bugs.c | 10 ++++++----
2 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index bab2b0bf5988..ed6a19ae0dd6 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5260,20 +5260,30 @@
Speculative Code Execution with Return Instructions)
vulnerability.
+ AMD-based UNRET and IBPB mitigations alone do not stop
+ sibling threads influencing the predictions of other sibling
+ threads. For that reason, we use STIBP on processors
+ that support it, and mitigate SMT on processors that don't.
+
off - no mitigation
auto - automatically select a migitation
auto,nosmt - automatically select a mitigation,
disabling SMT if necessary for
the full mitigation (only on Zen1
and older without STIBP).
- ibpb - mitigate short speculation windows on
+ ibpb - [AMD] Mitigate short speculation windows on
basic block boundaries too. Safe, highest
- perf impact.
- unret - force enable untrained return thunks,
+ perf impact. It also enables STIBP if
+ present.
+ ibpb,nosmt - [AMD] Like ibpb, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
+ unret - [AMD] Force enable untrained return thunks,
only effective on AMD f15h-f17h
based systems.
- unret,nosmt - like unret, will disable SMT when STIBP
- is not available.
+ unret,nosmt - [AMD] Like unret, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
Selecting 'auto' will choose a mitigation method at run
time according to the CPU.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 6761668100b9..d50686ca5870 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -152,7 +152,7 @@ void __init check_bugs(void)
/*
* spectre_v2_user_select_mitigation() relies on the state set by
* retbleed_select_mitigation(); specifically the STIBP selection is
- * forced for UNRET.
+ * forced for UNRET or IBPB.
*/
spectre_v2_user_select_mitigation();
ssb_select_mitigation();
@@ -1179,7 +1179,8 @@ spectre_v2_user_select_mitigation(void)
boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
mode = SPECTRE_V2_USER_STRICT_PREFERRED;
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (mode != SPECTRE_V2_USER_STRICT &&
mode != SPECTRE_V2_USER_STRICT_PREFERRED)
pr_info("Selecting STIBP always-on mode to complement retbleed mitigation\n");
@@ -2320,10 +2321,11 @@ static ssize_t srbds_show_state(char *buf)
static ssize_t retbleed_show_state(char *buf)
{
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
- return sprintf(buf, "Vulnerable: untrained return thunk on non-Zen uarch\n");
+ return sprintf(buf, "Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n");
return sprintf(buf, "%s; SMT %s\n",
retbleed_strings[retbleed_mitigation],
--
2.34.1On Mon, Aug 08, 2022 at 09:17:02AM -0500, Kim Phillips wrote:
> AMD's "Technical Guidance for Mitigating Branch Type Confusion,
> Rev. 1.0 2022-07-12" whitepaper, under section 6.1.2 "IBPB On
> Privileged Mode Entry / SMT Safety" says:
>
> "Similar to the Jmp2Ret mitigation, if the code on the sibling thread
> cannot be trusted, software should set STIBP to 1 or disable SMT to
> ensure SMT safety when using this mitigation."
>
> So, like already being done for retbleed=unret, the also for
> retbleed=ibpb, force STIBP on machines that have it, and report
> its SMT vulnerability status accordingly.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
> Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb")
> Signed-off-by: Kim Phillips <kim.phillips@amd.com>
> ---
> v3: "unret and ibpb mitigations" -> "UNRET and IBPB mitigations" (Mingo)
> v2: Justify and explain STIBP's role with IBPB (Boris)
>
> .../admin-guide/kernel-parameters.txt | 20 ++++++++++++++-----
> arch/x86/kernel/cpu/bugs.c | 10 ++++++----
> 2 files changed, 21 insertions(+), 9 deletions(-)
Any specific reason you don't want this also backported to the stable
kernel branches that have the other retbleed fixes in them?
thanks,
greg k-h
AMD's "Technical Guidance for Mitigating Branch Type Confusion,
Rev. 1.0 2022-07-12" whitepaper, under section 6.1.2 "IBPB On
Privileged Mode Entry / SMT Safety" says:
"Similar to the Jmp2Ret mitigation, if the code on the sibling thread
cannot be trusted, software should set STIBP to 1 or disable SMT to
ensure SMT safety when using this mitigation."
So, like already being done for retbleed=unret, the also for
retbleed=ibpb, force STIBP on machines that have it, and report
its SMT vulnerability status accordingly.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb")
Cc: stable@vger.kernel.org # 5.10, 5.15, 5.19
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
---
v4: Cc: stable (Greg K-H)
v3: "unret and ibpb mitigations" -> "UNRET and IBPB mitigations" (Mingo)
v2: Justify and explain STIBP's role with IBPB (Boris)
.../admin-guide/kernel-parameters.txt | 20 ++++++++++++++-----
arch/x86/kernel/cpu/bugs.c | 10 ++++++----
2 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index bab2b0bf5988..ed6a19ae0dd6 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5260,20 +5260,30 @@
Speculative Code Execution with Return Instructions)
vulnerability.
+ AMD-based UNRET and IBPB mitigations alone do not stop
+ sibling threads influencing the predictions of other sibling
+ threads. For that reason, we use STIBP on processors
+ that support it, and mitigate SMT on processors that don't.
+
off - no mitigation
auto - automatically select a migitation
auto,nosmt - automatically select a mitigation,
disabling SMT if necessary for
the full mitigation (only on Zen1
and older without STIBP).
- ibpb - mitigate short speculation windows on
+ ibpb - [AMD] Mitigate short speculation windows on
basic block boundaries too. Safe, highest
- perf impact.
- unret - force enable untrained return thunks,
+ perf impact. It also enables STIBP if
+ present.
+ ibpb,nosmt - [AMD] Like ibpb, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
+ unret - [AMD] Force enable untrained return thunks,
only effective on AMD f15h-f17h
based systems.
- unret,nosmt - like unret, will disable SMT when STIBP
- is not available.
+ unret,nosmt - [AMD] Like unret, but will disable SMT when STIBP
+ is not available. This is the alternative for
+ systems which do not have STIBP.
Selecting 'auto' will choose a mitigation method at run
time according to the CPU.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 6761668100b9..d50686ca5870 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -152,7 +152,7 @@ void __init check_bugs(void)
/*
* spectre_v2_user_select_mitigation() relies on the state set by
* retbleed_select_mitigation(); specifically the STIBP selection is
- * forced for UNRET.
+ * forced for UNRET or IBPB.
*/
spectre_v2_user_select_mitigation();
ssb_select_mitigation();
@@ -1179,7 +1179,8 @@ spectre_v2_user_select_mitigation(void)
boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
mode = SPECTRE_V2_USER_STRICT_PREFERRED;
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (mode != SPECTRE_V2_USER_STRICT &&
mode != SPECTRE_V2_USER_STRICT_PREFERRED)
pr_info("Selecting STIBP always-on mode to complement retbleed mitigation\n");
@@ -2320,10 +2321,11 @@ static ssize_t srbds_show_state(char *buf)
static ssize_t retbleed_show_state(char *buf)
{
- if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {
+ if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||
+ retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
- return sprintf(buf, "Vulnerable: untrained return thunk on non-Zen uarch\n");
+ return sprintf(buf, "Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n");
return sprintf(buf, "%s; SMT %s\n",
retbleed_strings[retbleed_mitigation],
--
2.34.1© 2016 - 2024 Red Hat, Inc.