linux-kernel - [PATCH RFC] x86/speculation: Clarify Spectre-v2 mitigation when STIBP/IBPB features are unsupported

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200121160257.302999-1-vkuznets@redhat.com>
Date:   Tue, 21 Jan 2020 17:02:57 +0100
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     x86@...nel.org
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Tyler Hicks <tyhicks@...onical.com>,
        Waiman Long <longman@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: [PATCH RFC] x86/speculation: Clarify Spectre-v2 mitigation when STIBP/IBPB features are unsupported

When STIBP/IBPB features are not supported (no microcode update,
AWS/Azure/... instances deliberately hiding SPEC_CTRL for performance
reasons,...) /sys/devices/system/cpu/vulnerabilities/spectre_v2 looks like

  Mitigation: Full generic retpoline, STIBP: disabled, RSB filling

and this looks imperfect. In particular, STIBP is 'disabled' and 'IBPB'
is not mentioned while both features are just not supported. Also, for
STIBP the 'disabled' state (SPECTRE_V2_USER_NONE) can represent both
the absence of hardware support and deliberate user's choice
(spectre_v2_user=off)

Make the following adjustments:
- Output 'unsupported' for both STIBP/IBPB when there's no support in
  hardware.
- Output 'unneeded' for STIBP when SMT is disabled/missing (and this
  switch_to_cond_stibp is off).

RFC. Some tools out there may be looking at this information so by
changing the output we're breaking them. Also, it may make sense to
separate kernel and userspace protections and switch to something like

  Mitigation: Kernel: Full generic retpoline, RSB filling; Userspace:
   Vulnerable

for the above mentioned case.

Signed-off-by: Vitaly Kuznetsov <vkuznets@...hat.com>
---
 Documentation/admin-guide/hw-vuln/spectre.rst | 3 +++
 arch/x86/kernel/cpu/bugs.c                    | 9 +++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index e05e581af5cf..2b8a42d0c57b 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -385,6 +385,7 @@ The possible values in this file are:
     an x86 only feature. For more details see below.
 
   ===================   ========================================================
+  'IBPB: unsupported'   IBPB is not supported by hardware
   'IBPB: disabled'      IBPB unused
   'IBPB: always-on'     Use IBPB on all tasks
   'IBPB: conditional'   Use IBPB on SECCOMP or indirect branch restricted tasks
@@ -396,6 +397,8 @@ The possible values in this file are:
     only feature. For more details see below.
 
   ====================  ========================================================
+  'STIBP: unsupported'  STIBP is not supported by hardware
+  'STIBP: unneeded'     STIBP is not needed because SMT is disabled
   'STIBP: disabled'     STIBP unused
   'STIBP: forced'       Use STIBP on all tasks
   'STIBP: conditional'  Use STIBP on SECCOMP or indirect branch restricted tasks
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 8bf64899f56a..d72a36fe042b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1496,7 +1496,10 @@ static char *stibp_state(void)
 
 	switch (spectre_v2_user) {
 	case SPECTRE_V2_USER_NONE:
-		return ", STIBP: disabled";
+		if (boot_cpu_has(X86_FEATURE_STIBP))
+			return ", STIBP: disabled";
+		else
+			return ", STIBP: unsupported";
 	case SPECTRE_V2_USER_STRICT:
 		return ", STIBP: forced";
 	case SPECTRE_V2_USER_STRICT_PREFERRED:
@@ -1505,6 +1508,8 @@ static char *stibp_state(void)
 	case SPECTRE_V2_USER_SECCOMP:
 		if (static_key_enabled(&switch_to_cond_stibp))
 			return ", STIBP: conditional";
+		else
+			return ", STIBP: unneeded";
 	}
 	return "";
 }
@@ -1518,7 +1523,7 @@ static char *ibpb_state(void)
 			return ", IBPB: conditional";
 		return ", IBPB: disabled";
 	}
-	return "";
+	return ", IBPB: unsupported";
 }
 
 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
-- 
2.24.1