Print this page
16413 Post-barrier Return Stack Buffer (consider no-eIBRS cases)
16413 Post-barrier Return Stack Buffer (PBRSB) fixes can be detected in HW

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/intel/os/cpuid.c
          +++ new/usr/src/uts/intel/os/cpuid.c
↓ open down ↓ 1667 lines elided ↑ open up ↑
1668 1668          "vaes",
1669 1669          "vpclmulqdq",
1670 1670          "lfence_serializing",
1671 1671          "gfni",
1672 1672          "avx512_vp2intersect",
1673 1673          "avx512_bitalg",
1674 1674          "avx512_vbmi2",
1675 1675          "avx512_bf16",
1676 1676          "auto_ibrs",
1677 1677          "rfds_no",
1678      -        "rfds_clear"
     1678 +        "rfds_clear",
     1679 +        "pbrsb_no"
1679 1680  };
1680 1681  
1681 1682  boolean_t
1682 1683  is_x86_feature(void *featureset, uint_t feature)
1683 1684  {
1684 1685          ASSERT(feature < NUM_X86_FEATURES);
1685 1686          return (BT_TEST((ulong_t *)featureset, feature));
1686 1687  }
1687 1688  
1688 1689  void
↓ open down ↓ 1272 lines elided ↑ open up ↑
2961 2962          } else {
2962 2963                  /*
2963 2964                   * We have no hardware mitigations available to us.
2964 2965                   */
2965 2966                  spec_uarch_flush = spec_uarch_flush_noop;
2966 2967          }
2967 2968          membar_producer();
2968 2969  }
2969 2970  
2970 2971  /*
2971      - * We default to enabling RSB mitigations.
     2972 + * We default to enabling Return Stack Buffer (RSB) mitigations.
2972 2973   *
2973      - * NOTE: We used to skip RSB mitigations with eIBRS, but developments around
2974      - * post-barrier RSB guessing suggests we should enable RSB mitigations always
2975      - * unless specifically instructed not to.
     2974 + * We used to skip RSB mitigations with Intel eIBRS, but developments around
     2975 + * post-barrier RSB (PBRSB) guessing suggests we should enable Intel RSB
     2976 + * mitigations always unless explicitly bypassed, or unless hardware indicates
     2977 + * the bug has been fixed. Intel also says that machines without eIBRS do not
     2978 + * have VMEXIT problems with PBRSB. Basically, if we're Intel and have eIBRS,
     2979 + * we must stuff the RSB in both context switches AND in VMEXIT, unless the
     2980 + * hardware says the PBRSB bug is fixed.  If we're Intel but without eIBRS
     2981 + * (i.e. using retpolines), we must stuff the RSB in context switches, but we
     2982 + * do not have to for VMEXIT.
2976 2983   *
     2984 + * See (pardon broken URL)  https://www.intel.com/content/www/us/en/developer \
     2985 + * /articles/technical/software-security-guidance/advisory-guidance
     2986 + * /post-barrier-return-stack-buffer-predictions.html
     2987 + *
2977 2988   * AMD indicates that when Automatic IBRS is enabled we do not need to implement
2978 2989   * return stack buffer clearing for VMEXIT as it takes care of it. The manual
2979 2990   * also states that as long as SMEP and we maintain at least one page between
2980 2991   * the kernel and user space (we have much more of a red zone), then we do not
2981 2992   * need to clear the RSB. We constrain this to only when Automatic IRBS is
2982 2993   * present.
2983 2994   */
2984 2995  static void
2985      -cpuid_patch_rsb(x86_spectrev2_mitigation_t mit)
     2996 +cpuid_patch_rsb(x86_spectrev2_mitigation_t mit, bool intel_pbrsb_no)
2986 2997  {
2987 2998          const uint8_t ret = RET_INSTR;
2988 2999          uint8_t *stuff = (uint8_t *)x86_rsb_stuff;
     3000 +        uint8_t *vmx_stuff = (uint8_t *)x86_rsb_stuff_vmexit;
2989 3001  
2990 3002          switch (mit) {
2991 3003          case X86_SPECTREV2_AUTO_IBRS:
2992 3004          case X86_SPECTREV2_DISABLED:
     3005 +                /* Don't bother with any RSB stuffing! */
2993 3006                  *stuff = ret;
     3007 +                *vmx_stuff = ret;
2994 3008                  break;
     3009 +        case X86_SPECTREV2_RETPOLINE:
     3010 +                /*
     3011 +                 * The Intel document on Post-Barrier RSB says that processors
     3012 +                 * without eIBRS do not have PBRSB problems upon VMEXIT.
     3013 +                 */
     3014 +                VERIFY(!intel_pbrsb_no);
     3015 +                VERIFY3U(*stuff, !=, ret);
     3016 +                *vmx_stuff = ret;
     3017 +                break;
2995 3018          default:
     3019 +                /*
     3020 +                 * eIBRS is all that's left.  If CPU claims PBRSB is fixed,
     3021 +                 * don't use the RSB mitigation in either case.
     3022 +                 */
     3023 +                if (intel_pbrsb_no) {
     3024 +                        /* CPU claims PBRSB problems are fixed. */
     3025 +                        *stuff = ret;
     3026 +                        *vmx_stuff = ret;
     3027 +                }
     3028 +                VERIFY3U(*stuff, ==, *vmx_stuff);
2996 3029                  break;
2997 3030          }
2998 3031  }
2999 3032  
3000 3033  static void
3001 3034  cpuid_patch_retpolines(x86_spectrev2_mitigation_t mit)
3002 3035  {
3003 3036          const char *thunks[] = { "_rax", "_rbx", "_rcx", "_rdx", "_rdi",
3004 3037              "_rsi", "_rbp", "_r8", "_r9", "_r10", "_r11", "_r12", "_r13",
3005 3038              "_r14", "_r15" };
↓ open down ↓ 254 lines elided ↑ open up ↑
3260 3293                                              X86FSET_TAA_NO);
3261 3294                                  }
3262 3295                                  if (reg & IA32_ARCH_CAP_RFDS_NO) {
3263 3296                                          add_x86_feature(featureset,
3264 3297                                              X86FSET_RFDS_NO);
3265 3298                                  }
3266 3299                                  if (reg & IA32_ARCH_CAP_RFDS_CLEAR) {
3267 3300                                          add_x86_feature(featureset,
3268 3301                                              X86FSET_RFDS_CLEAR);
3269 3302                                  }
     3303 +                                if (reg & IA32_ARCH_CAP_PBRSB_NO) {
     3304 +                                        add_x86_feature(featureset,
     3305 +                                            X86FSET_PBRSB_NO);
     3306 +                                }
3270 3307                          }
3271 3308                          no_trap();
3272 3309                  }
3273 3310  #endif  /* !__xpv */
3274 3311  
3275 3312                  if (ecp->cp_edx & CPUID_INTC_EDX_7_0_SSBD)
3276 3313                          add_x86_feature(featureset, X86FSET_SSBD);
3277 3314  
3278 3315                  if (ecp->cp_edx & CPUID_INTC_EDX_7_0_FLUSH_CMD)
3279 3316                          add_x86_feature(featureset, X86FSET_FLUSH_CMD);
↓ open down ↓ 40 lines elided ↑ open up ↑
3320 3357                  cpuid_enable_auto_ibrs();
3321 3358                  v2mit = X86_SPECTREV2_AUTO_IBRS;
3322 3359          } else if (is_x86_feature(featureset, X86FSET_IBRS_ALL)) {
3323 3360                  cpuid_enable_enhanced_ibrs();
3324 3361                  v2mit = X86_SPECTREV2_ENHANCED_IBRS;
3325 3362          } else {
3326 3363                  v2mit = X86_SPECTREV2_RETPOLINE;
3327 3364          }
3328 3365  
3329 3366          cpuid_patch_retpolines(v2mit);
3330      -        cpuid_patch_rsb(v2mit);
3331 3367          x86_spectrev2_mitigation = v2mit;
3332 3368          membar_producer();
3333 3369  
     3370 +        /*
     3371 +         * Return-stack buffer clearing may need a software-sequence. Discover
     3372 +         * and patch as appropriate, after setting the SPECTREv2 global
     3373 +         * mitigation level.
     3374 +         */
     3375 +        cpuid_patch_rsb(v2mit, is_x86_feature(featureset, X86FSET_PBRSB_NO));
     3376 +        membar_producer();
     3377 +
3334 3378          /*
3335 3379           * We need to determine what changes are required for mitigating L1TF
3336 3380           * and MDS. If the CPU suffers from either of them, then SMT exclusion
3337 3381           * is required.
3338 3382           *
3339 3383           * If any of these are present, then we need to flush u-arch state at
3340 3384           * various points. For MDS, we need to do so whenever we change to a
3341 3385           * lesser privilege level or we are halting the CPU. For L1TF we need to
3342 3386           * flush the L1D cache at VM entry. When we have microcode that handles
3343 3387           * MDS, the L1D flush also clears the other u-arch state that the
↓ open down ↓ 4934 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX