Commit 3ebc1700 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Borislav Petkov
Browse files

x86/bugs: Add retbleed=ibpb 



jmp2ret mitigates the easy-to-attack case at relatively low overhead.
It mitigates the long speculation windows after a mispredicted RET, but
it does not mitigate the short speculation window from arbitrary
instruction boundaries.

On Zen2, there is a chicken bit which needs setting, which mitigates
"arbitrary instruction boundaries" down to just "basic block boundaries".

But there is no fix for the short speculation window on basic block
boundaries, other than to flush the entire BTB to evict all attacker
predictions.

On the spectrum of "fast & blurry" -> "safe", there is (on top of STIBP
or no-SMT):

  1) Nothing		System wide open
  2) jmp2ret		May stop a script kiddy
  3) jmp2ret+chickenbit  Raises the bar rather further
  4) IBPB		Only thing which can count as "safe".

Tentative numbers put IBPB-on-entry at a 2.5x hit on Zen2, and a 10x hit
on Zen1 according to lmbench.

  [ bp: Fixup feature bit comments, document option, 32-bit build fix. ]

Suggested-by: default avatarAndrew Cooper <Andrew.Cooper3@citrix.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
parent d147553b

Documentation/admin-guide/kernel-parameters.txt

+3 −0
Original line number Diff line number Diff line
@@ -5207,6 +5207,9 @@ 
				       disabling SMT if necessary for

				       the full mitigation (only on Zen1

				       and older without STIBP).

			ibpb	     - mitigate short speculation windows on

				       basic block boundaries too. Safe, highest

				       perf impact.

			unret        - force enable untrained return thunks,

				       only effective on AMD f15h-f17h

				       based systems.

arch/x86/entry/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ CFLAGS_REMOVE_common.o = $(CC_FLAGS_FTRACE) 


CFLAGS_common.o			+= -fno-stack-protector



obj-y				:= entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o

obj-y				:= entry.o entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o

obj-y				+= common.o



obj-y				+= vdso/

arch/x86/entry/entry.S

0 → 100644
+22 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Common place for both 32- and 64-bit entry routines.

 */



#include <linux/linkage.h>

#include <asm/export.h>

#include <asm/msr-index.h>



.pushsection .noinstr.text, "ax"



SYM_FUNC_START(entry_ibpb)

	movl	$MSR_IA32_PRED_CMD, %ecx

	movl	$PRED_CMD_IBPB, %eax

	xorl	%edx, %edx

	wrmsr

	RET

SYM_FUNC_END(entry_ibpb)

/* For KVM */

EXPORT_SYMBOL_GPL(entry_ibpb);



.popsection

arch/x86/include/asm/cpufeatures.h

+1 −1
Original line number Diff line number Diff line
@@ -296,7 +296,7 @@ 
#define X86_FEATURE_PER_THREAD_MBA	(11*32+ 7) /* "" Per-thread Memory Bandwidth Allocation */

#define X86_FEATURE_SGX1		(11*32+ 8) /* "" Basic SGX */

#define X86_FEATURE_SGX2		(11*32+ 9) /* "" SGX Enclave Dynamic Memory Management (EDMM) */

/* FREE!				(11*32+10) */

#define X86_FEATURE_ENTRY_IBPB		(11*32+10) /* "" Issue an IBPB on kernel entry */

/* FREE!				(11*32+11) */

#define X86_FEATURE_RETPOLINE		(11*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */

#define X86_FEATURE_RETPOLINE_LFENCE	(11*32+13) /* "" Use LFENCE for Spectre variant 2 */

arch/x86/include/asm/nospec-branch.h

+6 −2
Original line number Diff line number Diff line
@@ -123,14 +123,17 @@ 
 * return thunk isn't mapped into the userspace tables (then again, AMD

 * typically has NO_MELTDOWN).

 *

 * Doesn't clobber any registers but does require a stable stack.

 * While zen_untrain_ret() doesn't clobber anything but requires stack,

 * entry_ibpb() will clobber AX, CX, DX.

 *

 * As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point

 * where we have a stack but before any RET instruction.

 */

.macro UNTRAIN_RET

#ifdef CONFIG_RETPOLINE

	ALTERNATIVE "", "call zen_untrain_ret", X86_FEATURE_UNRET

	ALTERNATIVE_2 "",						\

	              "call zen_untrain_ret", X86_FEATURE_UNRET,	\

		      "call entry_ibpb", X86_FEATURE_ENTRY_IBPB

#endif

.endm
@@ -147,6 +150,7 @@ extern retpoline_thunk_t __x86_indirect_thunk_array[]; 


extern void __x86_return_thunk(void);

extern void zen_untrain_ret(void);

extern void entry_ibpb(void);



#ifdef CONFIG_RETPOLINE