[PATCH v2 3/3] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

[PATCH v2 3/3] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

[Jiri Kosina]

From: Jiri Kosina <jkosina@suse.cz>

STIBP is a feature provided by certain Intel ucodes / CPUs. This feature
(once enabled) prevents cross-hyperthread control of decisions made by
indirect branch predictors.

Enable this feature if

- the CPU is vulnerable to spectre v2
- the CPU supports SMT
- spectre_v2 mitigation autoselection is enabled (default)

After some previous discussion, this patch leaves STIBP on all the time,
as wrmsr on crossing kernel boundary is a no-no. This could perhaps later
be a bit more optimized (like disabling it in NOHZ, experiment with
disabling it in idle, etc) if needed.

Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
 arch/x86/kernel/cpu/bugs.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 40bdaea97fe7..535b006dc50d 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -325,6 +325,12 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 	return cmd;
 }
 
+static bool __init stibp_needed(void)
+{
+	return (cpu_smt_control != CPU_SMT_NOT_SUPPORTED &&
+			boot_cpu_has(X86_FEATURE_STIBP));
+}
+
 static void __init spectre_v2_select_mitigation(void)
 {
 	enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -344,6 +350,12 @@ static void __init spectre_v2_select_mitigation(void)
 
 	case SPECTRE_V2_CMD_FORCE:
 	case SPECTRE_V2_CMD_AUTO:
+		if (stibp_needed()) {
+			/* Enable STIBP on SMT-capable systems */
+			pr_info("Spectre v2 cross-process SMT mitigation: Enabling STIBP\n");
+			x86_spec_ctrl_base |= SPEC_CTRL_STIBP;
+			wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+		}
 		if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
 			mode = SPECTRE_V2_IBRS_ENHANCED;
 			/* Force it so VMEXIT will restore correctly */
-- 
Jiri Kosina
SUSE Labs

Re: [PATCH v2 3/3] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

[Peter Zijlstra]

On Mon, Sep 03, 2018 at 02:45:31PM +0200, Jiri Kosina wrote:

> +static bool __init stibp_needed(void)
> +{
> +	return (cpu_smt_control != CPU_SMT_NOT_SUPPORTED &&
> +			boot_cpu_has(X86_FEATURE_STIBP));
> +}

Should that not be:

	((cpu_smt_control != CPU_SMT_NOT_SUPPORTED) ||
	 (cpu_smt_control != CPU_SMT_FORCE_DISABLED)) &&
	boot_cpu_has(X86_FEATURE_STIBP);

instead?

Re: [PATCH v2 3/3] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

[Peter Zijlstra]

On Mon, Sep 03, 2018 at 04:34:44PM +0200, Peter Zijlstra wrote:
> On Mon, Sep 03, 2018 at 02:45:31PM +0200, Jiri Kosina wrote:
> 
> > +static bool __init stibp_needed(void)
> > +{
> > +	return (cpu_smt_control != CPU_SMT_NOT_SUPPORTED &&
> > +			boot_cpu_has(X86_FEATURE_STIBP));
> > +}
> 
> Should that not be:
> 
> 	((cpu_smt_control != CPU_SMT_NOT_SUPPORTED) ||

s/||/&&/

> 	 (cpu_smt_control != CPU_SMT_FORCE_DISABLED)) &&
> 	boot_cpu_has(X86_FEATURE_STIBP);
> 
> instead?

Re: [PATCH v2 3/3] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

[Thomas Gleixner]

On Mon, 3 Sep 2018, Peter Zijlstra wrote:
> On Mon, Sep 03, 2018 at 04:34:44PM +0200, Peter Zijlstra wrote:
> > On Mon, Sep 03, 2018 at 02:45:31PM +0200, Jiri Kosina wrote:
> > 
> > > +static bool __init stibp_needed(void)
> > > +{
> > > +	return (cpu_smt_control != CPU_SMT_NOT_SUPPORTED &&
> > > +			boot_cpu_has(X86_FEATURE_STIBP));
> > > +}
> > 
> > Should that not be:
> > 
> > 	((cpu_smt_control != CPU_SMT_NOT_SUPPORTED) ||
> 
> s/||/&&/
> 
> > 	 (cpu_smt_control != CPU_SMT_FORCE_DISABLED)) &&
> > 	boot_cpu_has(X86_FEATURE_STIBP);
> > 
> > instead?

At least. Ideally we update it when SMT control is switched. There is no
point to have it enabled when SMT is set to DISABLED, but then we need to
set it when enabled again. With the minimal logic above its speculatively
enabled even when not required.

Thanks,

	tglx