lkml.org 
[lkml]   [2022]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip: x86/core] x86/retbleed: Add call depth tracking mitigation
    The following commit has been merged into the x86/core branch of tip:

    Commit-ID: d82a0345cf218f5050f5ad913e1ae6c579105731
    Gitweb: https://git.kernel.org/tip/d82a0345cf218f5050f5ad913e1ae6c579105731
    Author: Thomas Gleixner <tglx@linutronix.de>
    AuthorDate: Thu, 15 Sep 2022 13:11:38 +02:00
    Committer: Peter Zijlstra <peterz@infradead.org>
    CommitterDate: Mon, 17 Oct 2022 16:41:20 +02:00

    x86/retbleed: Add call depth tracking mitigation

    The fully secure mitigation for RSB underflow on Intel SKL CPUs is IBRS,
    which inflicts up to 30% penalty for pathological syscall heavy work loads.

    Software based call depth tracking and RSB refill is not perfect, but
    reduces the attack surface massively. The penalty for the pathological case
    is about 8% which is still annoying but definitely more palatable than IBRS.

    Add a retbleed=stuff command line option to enable the call depth tracking
    and software refill of the RSB.

    This gives admins a choice. IBeeRS are safe and cause headaches, call depth
    tracking is considered to be s(t)ufficiently safe.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://lore.kernel.org/r/20220915111149.029587352@infradead.org
    ---
    arch/x86/kernel/cpu/bugs.c | 32 ++++++++++++++++++++++++++++++--
    1 file changed, 30 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
    index da7c361..e6c23ea 100644
    --- a/arch/x86/kernel/cpu/bugs.c
    +++ b/arch/x86/kernel/cpu/bugs.c
    @@ -787,6 +787,7 @@ enum retbleed_mitigation {
    RETBLEED_MITIGATION_IBPB,
    RETBLEED_MITIGATION_IBRS,
    RETBLEED_MITIGATION_EIBRS,
    + RETBLEED_MITIGATION_STUFF,
    };

    enum retbleed_mitigation_cmd {
    @@ -794,6 +795,7 @@ enum retbleed_mitigation_cmd {
    RETBLEED_CMD_AUTO,
    RETBLEED_CMD_UNRET,
    RETBLEED_CMD_IBPB,
    + RETBLEED_CMD_STUFF,
    };

    static const char * const retbleed_strings[] = {
    @@ -802,6 +804,7 @@ static const char * const retbleed_strings[] = {
    [RETBLEED_MITIGATION_IBPB] = "Mitigation: IBPB",
    [RETBLEED_MITIGATION_IBRS] = "Mitigation: IBRS",
    [RETBLEED_MITIGATION_EIBRS] = "Mitigation: Enhanced IBRS",
    + [RETBLEED_MITIGATION_STUFF] = "Mitigation: Stuffing",
    };

    static enum retbleed_mitigation retbleed_mitigation __ro_after_init =
    @@ -831,6 +834,8 @@ static int __init retbleed_parse_cmdline(char *str)
    retbleed_cmd = RETBLEED_CMD_UNRET;
    } else if (!strcmp(str, "ibpb")) {
    retbleed_cmd = RETBLEED_CMD_IBPB;
    + } else if (!strcmp(str, "stuff")) {
    + retbleed_cmd = RETBLEED_CMD_STUFF;
    } else if (!strcmp(str, "nosmt")) {
    retbleed_nosmt = true;
    } else {
    @@ -879,6 +884,21 @@ static void __init retbleed_select_mitigation(void)
    }
    break;

    + case RETBLEED_CMD_STUFF:
    + if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING) &&
    + spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
    + retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
    +
    + } else {
    + if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
    + pr_err("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n");
    + else
    + pr_err("WARNING: kernel not compiled with CALL_DEPTH_TRACKING.\n");
    +
    + goto do_cmd_auto;
    + }
    + break;
    +
    do_cmd_auto:
    case RETBLEED_CMD_AUTO:
    default:
    @@ -916,6 +936,12 @@ do_cmd_auto:
    mitigate_smt = true;
    break;

    + case RETBLEED_MITIGATION_STUFF:
    + setup_force_cpu_cap(X86_FEATURE_RETHUNK);
    + setup_force_cpu_cap(X86_FEATURE_CALL_DEPTH);
    + x86_set_skl_return_thunk();
    + break;
    +
    default:
    break;
    }
    @@ -926,7 +952,7 @@ do_cmd_auto:

    /*
    * Let IBRS trump all on Intel without affecting the effects of the
    - * retbleed= cmdline option.
    + * retbleed= cmdline option except for call depth based stuffing
    */
    if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
    switch (spectre_v2_enabled) {
    @@ -939,7 +965,8 @@ do_cmd_auto:
    retbleed_mitigation = RETBLEED_MITIGATION_EIBRS;
    break;
    default:
    - pr_err(RETBLEED_INTEL_MSG);
    + if (retbleed_mitigation != RETBLEED_MITIGATION_STUFF)
    + pr_err(RETBLEED_INTEL_MSG);
    }
    }

    @@ -1413,6 +1440,7 @@ static void __init spectre_v2_select_mitigation(void)
    if (IS_ENABLED(CONFIG_CPU_IBRS_ENTRY) &&
    boot_cpu_has_bug(X86_BUG_RETBLEED) &&
    retbleed_cmd != RETBLEED_CMD_OFF &&
    + retbleed_cmd != RETBLEED_CMD_STUFF &&
    boot_cpu_has(X86_FEATURE_IBRS) &&
    boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
    mode = SPECTRE_V2_IBRS;
    \
     
     \ /
      Last update: 2022-10-17 16:55    [W:5.091 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site