Setting the IBRS bit implicitly enables STIBP to protect against
cross-thread branch target injection. With enhanced IBRS, the bit it set
once and is not cleared again. However, on CPUs with just legacy IBRS,
IBRS bit set on user -> kernel and cleared on kernel -> user (a.k.a
KERNEL_IBRS). Clearing this bit also disables the implicitly enabled
STIBP, thus requiring some form of cross-thread protection in userspace.
Enable STIBP, either opt-in via prctl or seccomp, or always on depending
on the choice of mitigation selected via spectre_v2_user.
Reported-by: José Oliveira <joseloliveira11(a)gmail.com>
Reported-by: Rodrigo Branco <rodrigo(a)kernelhacking.com>
Reviewed-by: Alexandra Sandulescu <aesa(a)google.com>
Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Cc: stable(a)vger.kernel.org
Signed-off-by: KP Singh <kpsingh(a)kernel.org>
---
arch/x86/kernel/cpu/bugs.c | 33 ++++++++++++++++++++++-----------
1 file changed, 22 insertions(+), 11 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 85168740f76a..5be6075d8e36 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1124,14 +1124,30 @@ spectre_v2_parse_user_cmdline(void)
return SPECTRE_V2_USER_CMD_AUTO;
}
-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
{
- return mode == SPECTRE_V2_IBRS ||
- mode == SPECTRE_V2_EIBRS ||
+ return mode == SPECTRE_V2_EIBRS ||
mode == SPECTRE_V2_EIBRS_RETPOLINE ||
mode == SPECTRE_V2_EIBRS_LFENCE;
}
+static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+{
+ return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
+}
+
+static inline bool spectre_v2_user_needs_stibp(enum spectre_v2_mitigation mode)
+{
+ /*
+ * enhanced IBRS also protects against user-mode attacks as the IBRS bit
+ * remains always set which implicitly enables cross-thread protections.
+ * However, In legacy IBRS mode, the IBRS bit is set only in kernel
+ * and cleared on return to userspace. This disables the implicit
+ * cross-thread protections and STIBP is needed.
+ */
+ return !spectre_v2_in_eibrs_mode(mode);
+}
+
static void __init
spectre_v2_user_select_mitigation(void)
{
@@ -1193,13 +1209,8 @@ spectre_v2_user_select_mitigation(void)
"always-on" : "conditional");
}
- /*
- * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
- * STIBP is not required.
- */
- if (!boot_cpu_has(X86_FEATURE_STIBP) ||
- !smt_possible ||
- spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ if (!boot_cpu_has(X86_FEATURE_STIBP) || !smt_possible ||
+ !spectre_v2_user_needs_stibp(spectre_v2_enabled))
return;
/*
@@ -2327,7 +2338,7 @@ static ssize_t mmio_stale_data_show_state(char *buf)
static char *stibp_state(void)
{
- if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ if (!spectre_v2_user_needs_stibp(spectre_v2_enabled))
return "";
switch (spectre_v2_user_stibp) {
--
2.39.2.637.g21b0678d19-goog
The following changes since commit ceaa837f96adb69c0df0397937cd74991d5d821a:
Linux 6.2-rc8 (2023-02-12 14:10:17 -0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus
for you to fetch changes up to deeacf35c922da579637f5db625af20baafc66ed:
vdpa/mlx5: support device features provisioning (2023-02-20 19:27:00 -0500)
Note: dropped a patch close to the bottom of the stack at the last
minute so the commits differ but all of these have been in next already.
The dropped patch just added a new query ioctl so not interacting with
anything else in the pull.
----------------------------------------------------------------
virtio,vhost,vdpa: features, fixes
device feature provisioning in ifcvf, mlx5
new SolidNET driver
support for zoned block device in virtio blk
numa support in virtio pmem
VIRTIO_F_RING_RESET support in vhost-net
more debugfs entries in mlx5
resume support in vdpa
completion batching in virtio blk
cleanup of dma api use in vdpa
now simulating more features in vdpa-sim
documentation, features, fixes all over the place
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
----------------------------------------------------------------
Alvaro Karsz (4):
PCI: Add SolidRun vendor ID
PCI: Avoid FLR for SolidRun SNET DPU rev 1
virtio: vdpa: new SolidNET DPU driver.
vhost-vdpa: print warning when vhost_vdpa_alloc_domain fails
Bagas Sanjaya (3):
docs: driver-api: virtio: parenthesize external reference targets
docs: driver-api: virtio: slightly reword virtqueues allocation paragraph
docs: driver-api: virtio: commentize spec version checking
Bo Liu (1):
vhost-scsi: convert sysfs snprintf and sprintf to sysfs_emit
Colin Ian King (1):
vdpa: Fix a couple of spelling mistakes in some messages
Dmitry Fomichev (1):
virtio-blk: add support for zoned block devices
Eli Cohen (6):
vdpa/mlx5: Move some definitions to a new header file
vdpa/mlx5: Add debugfs subtree
vdpa/mlx5: Add RX counters to debugfs
vdpa/mlx5: Directly assign memory key
vdpa/mlx5: Don't clear mr struct on destroy MR
vdpa/mlx5: Initialize CVQ iotlb spinlock
Eugenio Pérez (2):
vdpa_sim: not reset state in vdpasim_queue_ready
vdpa_sim_net: Offer VIRTIO_NET_F_STATUS
Jason Wang (11):
vdpa_sim: use weak barriers
vdpa_sim: switch to use __vdpa_alloc_device()
vdpasim: customize allocation size
vdpa_sim: support vendor statistics
vdpa_sim_net: vendor satistics
vdpa_sim: get rid of DMA ops
virtio_ring: per virtqueue dma device
vdpa: introduce get_vq_dma_device()
virtio-vdpa: support per vq dma device
vdpa: set dma mask for vDPA device
vdpa: mlx5: support per virtqueue dma device
Kangjie Xu (1):
vhost-net: support VIRTIO_F_RING_RESET
Liming Wu (2):
vhost-test: remove meaningless debug info
vhost: remove unused paramete
Michael S. Tsirkin (3):
virtio_blk: temporary variable type tweak
virtio_blk: zone append in header type tweak
virtio_blk: mark all zone fields LE
Michael Sammler (1):
virtio_pmem: populate numa information
Ricardo Cañuelo (1):
docs: driver-api: virtio: virtio on Linux
Sebastien Boeuf (4):
vdpa: Add resume operation
vhost-vdpa: Introduce RESUME backend feature bit
vhost-vdpa: uAPI to resume the device
vdpa_sim: Implement resume vdpa op
Shunsuke Mie (2):
vringh: fix a typo in comments for vringh_kiov
tools/virtio: enable to build with retpoline
Si-Wei Liu (6):
vdpa: fix improper error message when adding vdpa dev
vdpa: conditionally read STATUS in config space
vdpa: validate provisioned device features against specified attribute
vdpa: validate device feature provisioning against supported class
vdpa/mlx5: make MTU/STATUS presence conditional on feature bits
vdpa/mlx5: support device features provisioning
Suwan Kim (2):
virtio-blk: set req->state to MQ_RQ_COMPLETE after polling I/O is finished
virtio-blk: support completion batching for the IRQ path
Zheng Wang (1):
scsi: virtio_scsi: fix handling of kmalloc failure
Zhu Lingshan (12):
vDPA/ifcvf: decouple hw features manipulators from the adapter
vDPA/ifcvf: decouple config space ops from the adapter
vDPA/ifcvf: alloc the mgmt_dev before the adapter
vDPA/ifcvf: decouple vq IRQ releasers from the adapter
vDPA/ifcvf: decouple config IRQ releaser from the adapter
vDPA/ifcvf: decouple vq irq requester from the adapter
vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter
vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
vDPA/ifcvf: allocate the adapter in dev_add()
vDPA/ifcvf: retire ifcvf_private_to_vf
vDPA/ifcvf: implement features provisioning
Documentation/driver-api/index.rst | 1 +
Documentation/driver-api/virtio/index.rst | 11 +
Documentation/driver-api/virtio/virtio.rst | 145 +++
.../driver-api/virtio/writing_virtio_drivers.rst | 197 ++++
MAINTAINERS | 5 +
drivers/block/virtio_blk.c | 468 ++++++++-
drivers/nvdimm/virtio_pmem.c | 11 +-
drivers/pci/quirks.c | 8 +
drivers/scsi/virtio_scsi.c | 14 +-
drivers/vdpa/Kconfig | 30 +
drivers/vdpa/Makefile | 1 +
drivers/vdpa/ifcvf/ifcvf_base.c | 32 +-
drivers/vdpa/ifcvf/ifcvf_base.h | 10 +-
drivers/vdpa/ifcvf/ifcvf_main.c | 162 ++-
drivers/vdpa/mlx5/Makefile | 2 +-
drivers/vdpa/mlx5/core/mr.c | 1 -
drivers/vdpa/mlx5/core/resources.c | 3 +-
drivers/vdpa/mlx5/net/debug.c | 152 +++
drivers/vdpa/mlx5/net/mlx5_vnet.c | 261 +++--
drivers/vdpa/mlx5/net/mlx5_vnet.h | 94 ++
drivers/vdpa/solidrun/Makefile | 6 +
drivers/vdpa/solidrun/snet_hwmon.c | 188 ++++
drivers/vdpa/solidrun/snet_main.c | 1111 ++++++++++++++++++++
drivers/vdpa/solidrun/snet_vdpa.h | 194 ++++
drivers/vdpa/vdpa.c | 110 +-
drivers/vdpa/vdpa_sim/vdpa_sim.c | 233 ++--
drivers/vdpa/vdpa_sim/vdpa_sim.h | 7 +-
drivers/vdpa/vdpa_sim/vdpa_sim_blk.c | 1 +
drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 219 +++-
drivers/vhost/net.c | 5 +-
drivers/vhost/scsi.c | 6 +-
drivers/vhost/test.c | 3 -
drivers/vhost/vdpa.c | 39 +-
drivers/vhost/vhost.c | 2 +-
drivers/vhost/vhost.h | 2 +-
drivers/vhost/vsock.c | 2 +-
drivers/virtio/virtio_ring.c | 133 ++-
drivers/virtio/virtio_vdpa.c | 13 +-
include/linux/pci_ids.h | 2 +
include/linux/vdpa.h | 12 +-
include/linux/virtio_config.h | 8 +-
include/linux/virtio_ring.h | 16 +
include/linux/vringh.h | 2 +-
include/uapi/linux/vhost.h | 8 +
include/uapi/linux/vhost_types.h | 2 +
include/uapi/linux/virtio_blk.h | 105 ++
tools/virtio/Makefile | 2 +-
47 files changed, 3536 insertions(+), 503 deletions(-)
create mode 100644 Documentation/driver-api/virtio/index.rst
create mode 100644 Documentation/driver-api/virtio/virtio.rst
create mode 100644 Documentation/driver-api/virtio/writing_virtio_drivers.rst
create mode 100644 drivers/vdpa/mlx5/net/debug.c
create mode 100644 drivers/vdpa/mlx5/net/mlx5_vnet.h
create mode 100644 drivers/vdpa/solidrun/Makefile
create mode 100644 drivers/vdpa/solidrun/snet_hwmon.c
create mode 100644 drivers/vdpa/solidrun/snet_main.c
create mode 100644 drivers/vdpa/solidrun/snet_vdpa.h