Messages in this thread |  | | Subject | Re: [PATCH v2 5/8] x86/speculation: Add basic support for IBPB | From | KarimAllah Ahmed <> | Date | Sun, 21 Jan 2018 19:29:43 +0100 |
| |
On 01/21/2018 07:06 PM, Borislav Petkov wrote:
> On Sun, Jan 21, 2018 at 09:49:06AM +0000, David Woodhouse wrote: >> From: Thomas Gleixner <tglx@linutronix.de> >> >> Expose indirect_branch_prediction_barrier() for use in subsequent patches. >> >> [karahmed: remove the special-casing of skylake for using IBPB (wtf?), >> switch to using ALTERNATIVES instead of static_cpu_has] >> [dwmw2: set up ax/cx/dx in the asm too so it gets NOP'd out] >> >> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> >> Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de> >> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> >> --- >> arch/x86/include/asm/cpufeatures.h | 1 + >> arch/x86/include/asm/nospec-branch.h | 16 ++++++++++++++++ >> arch/x86/kernel/cpu/bugs.c | 7 +++++++ >> 3 files changed, 24 insertions(+) >> >> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h >> index 8c9e5c0..cf28399 100644 >> --- a/arch/x86/include/asm/cpufeatures.h >> +++ b/arch/x86/include/asm/cpufeatures.h >> @@ -207,6 +207,7 @@ >> #define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* AMD Retpoline mitigation for Spectre variant 2 */ >> #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ >> >> +#define X86_FEATURE_IBPB ( 7*32+16) /* Using Indirect Branch Prediction Barrier */ > Right, and as AMD has a separate bit for this in CPUID_80000008_EBX[12], > we probably don't really need the synthetic bit here but simply use the > one at (13*32+12) - word 13. > >> #define X86_FEATURE_AMD_PRED_CMD ( 7*32+17) /* Prediction Command MSR (AMD) */ >> #define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ >> #define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* Fill RSB on context switches */ >> diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h >> index 4ad4108..c333c95 100644 >> --- a/arch/x86/include/asm/nospec-branch.h >> +++ b/arch/x86/include/asm/nospec-branch.h >> @@ -218,5 +218,21 @@ static inline void vmexit_fill_RSB(void) >> #endif >> } >> >> +static inline void indirect_branch_prediction_barrier(void) > I like ibp_barrier() better. > >> +{ >> + unsigned long ax, cx, dx; >> + >> + asm volatile(ALTERNATIVE("", >> + "movl %[msr], %%ecx\n\t" >> + "movl %[val], %%eax\n\t" >> + "movl $0, %%edx\n\t" >> + "wrmsr", >> + X86_FEATURE_IBPB) >> + : "=a" (ax), "=c" (cx), "=d" (dx) >> + : [msr] "i" (MSR_IA32_PRED_CMD), >> + [val] "i" (PRED_CMD_IBPB) >> + : "memory"); >> +} > Btw, we can simplify this a bit by dropping the inputs and marking the 3 > GPRs as clobbered: > > alternative_input("", > "mov $0x49, %%ecx\n\t" > "mov $1, %%eax\n\t" > "xor %%edx, %%edx\n\t" > "wrmsr\n\t", > X86_FEATURE_IBPB, > ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory")); > > > The "memory" clobber is probably not really needed but it wouldn't > hurt... > > Also, above says: > >> switch to using ALTERNATIVES instead of static_cpu_has] > Why? > > if (static_cpu_has(X86_FEATURE_IBPB)) > wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0); > > It can't get any more readable than this. Why even f*ck with > alternatives?
Because static_cpu_has is an indirect branch which will cause speculation and we have to avoid that.
David told me that Peter was working on a fix for static_cpu_has to avoid the speculation but I do not know what is the status of this.
> >> + >> #endif /* __ASSEMBLY__ */ >> #endif /* __NOSPEC_BRANCH_H__ */ >> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c >> index 390b3dc..96548ff 100644 >> --- a/arch/x86/kernel/cpu/bugs.c >> +++ b/arch/x86/kernel/cpu/bugs.c >> @@ -249,6 +249,13 @@ static void __init spectre_v2_select_mitigation(void) >> setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); >> pr_info("Filling RSB on context switch\n"); >> } >> + >> + /* Initialize Indirect Branch Prediction Barrier if supported */ >> + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL) || >> + boot_cpu_has(X86_FEATURE_AMD_PRED_CMD)) { >> + setup_force_cpu_cap(X86_FEATURE_IBPB); >> + pr_info("Enabling Indirect Branch Prediction Barrier\n"); > We don't really need the pr_info as "ibpb" will appear in /proc/cpuinfo. >
Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
|  |