svn commit: r361588 - in releng/11.4/sys: amd64/amd64 i386/i386 x86/include x86/x86
Konstantin Belousov
kib at FreeBSD.org
Thu May 28 16:34:55 UTC 2020
Author: kib
Date: Thu May 28 16:34:53 2020
New Revision: 361588
URL: https://svnweb.freebsd.org/changeset/base/361588
Log:
MFC r361299, r361302:
MFstable/11 r361558, r361302:
Do not consider CAP_RDCL_NO as an indicator for all MDS vulnerabilities
handled by hardware.
amd64: Add a knob to flush RSB on context switches if machine has SMEP.
Approved by: re (gjb)
Modified:
releng/11.4/sys/amd64/amd64/cpu_switch.S
releng/11.4/sys/amd64/amd64/initcpu.c
releng/11.4/sys/amd64/amd64/support.S
releng/11.4/sys/i386/i386/support.s
releng/11.4/sys/x86/include/x86_var.h
releng/11.4/sys/x86/x86/cpu_machdep.c
Directory Properties:
releng/11.4/ (props changed)
Modified: releng/11.4/sys/amd64/amd64/cpu_switch.S
==============================================================================
--- releng/11.4/sys/amd64/amd64/cpu_switch.S Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/amd64/amd64/cpu_switch.S Thu May 28 16:34:53 2020 (r361588)
@@ -235,6 +235,8 @@ done_load_dr:
movq %rax,(%rsp)
movq PCPU(CURTHREAD),%rdi
call fpu_activate_sw
+ cmpb $0,cpu_flush_rsb_ctxsw(%rip)
+ jne rsb_flush
ret
/*
Modified: releng/11.4/sys/amd64/amd64/initcpu.c
==============================================================================
--- releng/11.4/sys/amd64/amd64/initcpu.c Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/amd64/amd64/initcpu.c Thu May 28 16:34:53 2020 (r361588)
@@ -232,13 +232,27 @@ initializecpu(void)
cr4 |= CR4_FSGSBASE;
/*
+ * If SMEP is present, we only need to flush RSB (by default)
+ * on context switches, to prevent cross-process ret2spec
+ * attacks. Do it automatically if ibrs_disable is set, to
+ * complete the mitigation.
+ *
* Postpone enabling the SMEP on the boot CPU until the page
* tables are switched from the boot loader identity mapping
* to the kernel tables. The boot loader enables the U bit in
* its tables.
*/
- if (!IS_BSP() && (cpu_stdext_feature & CPUID_STDEXT_SMEP))
- cr4 |= CR4_SMEP;
+ if (IS_BSP()) {
+ if (cpu_stdext_feature & CPUID_STDEXT_SMEP &&
+ !TUNABLE_INT_FETCH(
+ "machdep.mitigations.cpu_flush_rsb_ctxsw",
+ &cpu_flush_rsb_ctxsw) &&
+ hw_ibrs_disable)
+ cpu_flush_rsb_ctxsw = 1;
+ } else {
+ if (cpu_stdext_feature & CPUID_STDEXT_SMEP)
+ cr4 |= CR4_SMEP;
+ }
load_cr4(cr4);
if ((amd_feature & AMDID_NX) != 0) {
msr = rdmsr(MSR_EFER) | EFER_NXE;
Modified: releng/11.4/sys/amd64/amd64/support.S
==============================================================================
--- releng/11.4/sys/amd64/amd64/support.S Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/amd64/amd64/support.S Thu May 28 16:34:53 2020 (r361588)
@@ -832,23 +832,27 @@ ENTRY(pmap_pti_pcid_invlrng)
retq
.altmacro
- .macro ibrs_seq_label l
-handle_ibrs_\l:
+ .macro rsb_seq_label l
+rsb_seq_\l:
.endm
- .macro ibrs_call_label l
- call handle_ibrs_\l
+ .macro rsb_call_label l
+ call rsb_seq_\l
.endm
- .macro ibrs_seq count
+ .macro rsb_seq count
ll=1
.rept \count
- ibrs_call_label %(ll)
+ rsb_call_label %(ll)
nop
- ibrs_seq_label %(ll)
+ rsb_seq_label %(ll)
addq $8,%rsp
ll=ll+1
.endr
.endm
+ENTRY(rsb_flush)
+ rsb_seq 32
+ ret
+
/* all callers already saved %rax, %rdx, and %rcx */
ENTRY(handle_ibrs_entry)
cmpb $0,hw_ibrs_ibpb_active(%rip)
@@ -860,8 +864,7 @@ ENTRY(handle_ibrs_entry)
wrmsr
movb $1,PCPU(IBPB_SET)
testl $CPUID_STDEXT_SMEP,cpu_stdext_feature(%rip)
- jne 1f
- ibrs_seq 32
+ je rsb_flush
1: ret
END(handle_ibrs_entry)
Modified: releng/11.4/sys/i386/i386/support.s
==============================================================================
--- releng/11.4/sys/i386/i386/support.s Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/i386/i386/support.s Thu May 28 16:34:53 2020 (r361588)
@@ -819,8 +819,30 @@ msr_onfault:
movl $EFAULT,%eax
ret
-ENTRY(handle_ibrs_entry)
+ .altmacro
+ .macro rsb_seq_label l
+rsb_seq_\l:
+ .endm
+ .macro rsb_call_label l
+ call rsb_seq_\l
+ .endm
+ .macro rsb_seq count
+ ll=1
+ .rept \count
+ rsb_call_label %(ll)
+ nop
+ rsb_seq_label %(ll)
+ addl $4,%esp
+ ll=ll+1
+ .endr
+ .endm
+
+ENTRY(rsb_flush)
+ rsb_seq 32
ret
+
+ENTRY(handle_ibrs_entry)
+ jmp rsb_flush
END(handle_ibrs_entry)
ENTRY(handle_ibrs_exit)
Modified: releng/11.4/sys/x86/include/x86_var.h
==============================================================================
--- releng/11.4/sys/x86/include/x86_var.h Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/x86/include/x86_var.h Thu May 28 16:34:53 2020 (r361588)
@@ -86,6 +86,7 @@ extern int hw_ibrs_ibpb_active;
extern int hw_mds_disable;
extern int hw_ssb_active;
extern int x86_taa_enable;
+extern int cpu_flush_rsb_ctxsw;
struct pcb;
struct thread;
Modified: releng/11.4/sys/x86/x86/cpu_machdep.c
==============================================================================
--- releng/11.4/sys/x86/x86/cpu_machdep.c Thu May 28 14:56:11 2020 (r361587)
+++ releng/11.4/sys/x86/x86/cpu_machdep.c Thu May 28 16:34:53 2020 (r361588)
@@ -1049,11 +1049,11 @@ hw_mds_recalculate(void)
* reported. For instance, hypervisor might unknowingly
* filter the cap out.
* For the similar reasons, and for testing, allow to enable
- * mitigation even for RDCL_NO or MDS_NO caps.
+ * mitigation even when MDS_NO cap is set.
*/
if (cpu_vendor_id != CPU_VENDOR_INTEL || hw_mds_disable == 0 ||
- ((cpu_ia32_arch_caps & (IA32_ARCH_CAP_RDCL_NO |
- IA32_ARCH_CAP_MDS_NO)) != 0 && hw_mds_disable == 3)) {
+ ((cpu_ia32_arch_caps & IA32_ARCH_CAP_MDS_NO) != 0 &&
+ hw_mds_disable == 3)) {
mds_handler = mds_handler_void;
} else if (((cpu_stdext_feature3 & CPUID_STDEXT3_MD_CLEAR) != 0 &&
hw_mds_disable == 3) || hw_mds_disable == 1) {
@@ -1360,3 +1360,7 @@ SYSCTL_PROC(_machdep_mitigations_taa, OID_AUTO, state,
sysctl_taa_state_handler, "A",
"TAA Mitigation state");
+int __read_frequently cpu_flush_rsb_ctxsw;
+SYSCTL_INT(_machdep_mitigations, OID_AUTO, flush_rsb_ctxsw,
+ CTLFLAG_RW | CTLFLAG_NOFETCH, &cpu_flush_rsb_ctxsw, 0,
+ "Flush Return Stack Buffer on context switch");
More information about the svn-src-all
mailing list