Messages in this thread Patch in this message | | | From | "Maciej S. Szmigiero" <> | Subject | [PATCH] x86/speculation: Fill the RSB on context switch also on non-IBPB CPUs | Date | Tue, 20 Mar 2018 12:17:22 +0100 |
| |
If we run on a CPU that does not have IBPB support RSB entries from one userspace process can influence 'ret' target prediction in another userspace process after a context switch.
Since it is unlikely that existing RSB entries from the previous task match the new task call stack we can use the existing unconditional RSB-filling-on-context-switch infrastructure to protect against such userspace-to-userspace attacks.
This patch brings a change in behavior only for the following CPU types: * Intel pre-Skylake CPUs without updated microcode, * AMD Family 15h model >60h, Family 17h CPUs without updated microcode.
Other CPU types either already do the RSB filling on context switch for other reasons or do support IBPB for more complete userspace-to-userspace protection.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> --- arch/x86/kernel/cpu/bugs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index bfca937bdcc3..777bae86e159 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -280,8 +280,11 @@ static void __init spectre_v2_select_mitigation(void) /* * If neither SMEP nor PTI are available, there is a risk of * hitting userspace addresses in the RSB after a context switch - * from a shallow call stack to a deeper one. To prevent this fill - * the entire RSB, even when using IBRS. + * from a shallow call stack to a deeper one. + * Also, if the CPU does not have IBPB support then one userspace + * process can influence 'ret' target prediction for another + * userspace process. + * To prevent this fill the entire RSB, even when using IBRS. * * Skylake era CPUs have a separate issue with *underflow* of the * RSB, when they will predict 'ret' targets from the generic BTB. @@ -290,7 +293,8 @@ static void __init spectre_v2_select_mitigation(void) * switch is required. */ if ((!boot_cpu_has(X86_FEATURE_PTI) && - !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) { + !boot_cpu_has(X86_FEATURE_SMEP)) || + !boot_cpu_has(X86_FEATURE_IBPB) || is_skylake_era()) { setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); pr_info("Spectre v2 mitigation: Filling RSB on context switch\n"); }
| |