On Mon, Jul 30, 2018 at 10:56:55AM -0700, Tim Chen wrote: > On 07/26/2018 04:14 AM, Jiri Kosina wrote: > > From: Jiri Kosina <[email protected]> > > > > The article "Spectre Returns! Speculation Attacks using the Return Stack > > Buffer" [1] describes two new (sub-)variants of spectrev2-like attack, > > making use solely of the RSB contents even on CPUs that don't fallback to > > BTB on RSB underflow (Skylake+). > > > > Mitigate userspace-userspace attacks by always unconditionally filling RSB > > on > > context switch when generic spectrev2 mitigation has been enabled. > > > > [1] https://arxiv.org/pdf/1807.07940.pdf > > > > Reviewed-by: Josh Poimboeuf <[email protected]> > > Signed-off-by: Jiri Kosina <[email protected]>
May I suggest: CC: [email protected] ? > > --- > > > > v1 -> v2: > > > > - Fixed typos/capatalization in SpectreRSB name > > - Josh's Reviewed-by > > > > arch/x86/kernel/cpu/bugs.c | 38 +++++++------------------------------- > > 1 file changed, 7 insertions(+), 31 deletions(-) > > > > diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c > > index 5c0ea39311fe..bc8c43b22460 100644 > > --- a/arch/x86/kernel/cpu/bugs.c > > +++ b/arch/x86/kernel/cpu/bugs.c > > @@ -313,23 +313,6 @@ static enum spectre_v2_mitigation_cmd __init > > spectre_v2_parse_cmdline(void) > > return cmd; > > } > > > > -/* Check for Skylake-like CPUs (for RSB handling) */ > > -static bool __init is_skylake_era(void) > > -{ > > - if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && > > - boot_cpu_data.x86 == 6) { > > - switch (boot_cpu_data.x86_model) { > > - case INTEL_FAM6_SKYLAKE_MOBILE: > > - case INTEL_FAM6_SKYLAKE_DESKTOP: > > - case INTEL_FAM6_SKYLAKE_X: > > - case INTEL_FAM6_KABYLAKE_MOBILE: > > - case INTEL_FAM6_KABYLAKE_DESKTOP: > > - return true; > > - } > > - } > > - return false; > > -} > > - > > static void __init spectre_v2_select_mitigation(void) > > { > > enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); > > @@ -390,22 +373,15 @@ static void __init spectre_v2_select_mitigation(void) > > pr_info("%s\n", spectre_v2_strings[mode]); > > > > /* > > - * If neither SMEP nor PTI are available, there is a risk of > > - * hitting userspace addresses in the RSB after a context switch > > - * from a shallow call stack to a deeper one. To prevent this fill > > - * the entire RSB, even when using IBRS. > > + * If spectre v2 protection has been enabled, unconditionally fill > > + * RSB during a context switch; this protects against two independent > > + * issues: > > * > > - * Skylake era CPUs have a separate issue with *underflow* of the > > - * RSB, when they will predict 'ret' targets from the generic BTB. > > - * The proper mitigation for this is IBRS. If IBRS is not supported > > - * or deactivated in favour of retpolines the RSB fill on context > > - * switch is required. > > + * - RSB underflow (and switch to BTB) on Skylake+ > > + * - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs > > */ > > - if ((!boot_cpu_has(X86_FEATURE_PTI) && > > - !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) { > > - setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); > > - pr_info("Spectre v2 mitigation: Filling RSB on context > > switch\n"); > > - } > > + setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); > > + pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context > > switch\n"); > > > > /* Initialize Indirect Branch Prediction Barrier if supported */ > > if (boot_cpu_has(X86_FEATURE_IBPB)) { > > > > Thanks for the patch. Looks good. > > Acked-by: Tim Chen <[email protected]> > > Tim
