From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
"Peter Zijlstra (Intel)" <peterz@infradead.org>,
Borislav Petkov <bp@suse.de>,
Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 5.16 03/37] Documentation/hw-vuln: Update spectre doc
Date: Wed, 9 Mar 2022 17:00:04 +0100 [thread overview]
Message-ID: <20220309155859.188409810@linuxfoundation.org> (raw)
In-Reply-To: <20220309155859.086952723@linuxfoundation.org>
From: Peter Zijlstra <peterz@infradead.org>
commit 5ad3eb1132453b9795ce5fd4572b1c18b292cca9 upstream.
Update the doc with the new fun.
[ bp: Massage commit message. ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/hw-vuln/spectre.rst | 44 ++++++++++++++++--------
Documentation/admin-guide/kernel-parameters.txt | 8 +++-
2 files changed, 36 insertions(+), 16 deletions(-)
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -131,6 +131,19 @@ steer its indirect branch speculations t
speculative execution's side effects left in level 1 cache to infer the
victim's data.
+Yet another variant 2 attack vector is for the attacker to poison the
+Branch History Buffer (BHB) to speculatively steer an indirect branch
+to a specific Branch Target Buffer (BTB) entry, even if the entry isn't
+associated with the source address of the indirect branch. Specifically,
+the BHB might be shared across privilege levels even in the presence of
+Enhanced IBRS.
+
+Currently the only known real-world BHB attack vector is via
+unprivileged eBPF. Therefore, it's highly recommended to not enable
+unprivileged eBPF, especially when eIBRS is used (without retpolines).
+For a full mitigation against BHB attacks, it's recommended to use
+retpolines (or eIBRS combined with retpolines).
+
Attack scenarios
----------------
@@ -364,13 +377,15 @@ The possible values in this file are:
- Kernel status:
- ==================================== =================================
- 'Not affected' The processor is not vulnerable
- 'Vulnerable' Vulnerable, no mitigation
- 'Mitigation: Full generic retpoline' Software-focused mitigation
- 'Mitigation: Full AMD retpoline' AMD-specific software mitigation
- 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
- ==================================== =================================
+ ======================================== =================================
+ 'Not affected' The processor is not vulnerable
+ 'Mitigation: None' Vulnerable, no mitigation
+ 'Mitigation: Retpolines' Use Retpoline thunks
+ 'Mitigation: LFENCE' Use LFENCE instructions
+ 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
+ 'Mitigation: Enhanced IBRS + Retpolines' Hardware-focused + Retpolines
+ 'Mitigation: Enhanced IBRS + LFENCE' Hardware-focused + LFENCE
+ ======================================== =================================
- Firmware status: Show if Indirect Branch Restricted Speculation (IBRS) is
used to protect against Spectre variant 2 attacks when calling firmware (x86 only).
@@ -583,12 +598,13 @@ kernel command line.
Specific mitigations can also be selected manually:
- retpoline
- replace indirect branches
- retpoline,generic
- google's original retpoline
- retpoline,amd
- AMD-specific minimal thunk
+ retpoline auto pick between generic,lfence
+ retpoline,generic Retpolines
+ retpoline,lfence LFENCE; indirect branch
+ retpoline,amd alias for retpoline,lfence
+ eibrs enhanced IBRS
+ eibrs,retpoline enhanced IBRS + Retpolines
+ eibrs,lfence enhanced IBRS + LFENCE
Not specifying this option is equivalent to
spectre_v2=auto.
@@ -599,7 +615,7 @@ kernel command line.
spectre_v2=off. Spectre variant 1 mitigations
cannot be disabled.
-For spectre_v2_user see :doc:`/admin-guide/kernel-parameters`.
+For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
Mitigation selection guide
--------------------------
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5303,8 +5303,12 @@
Specific mitigations can also be selected manually:
retpoline - replace indirect branches
- retpoline,generic - google's original retpoline
- retpoline,amd - AMD-specific minimal thunk
+ retpoline,generic - Retpolines
+ retpoline,lfence - LFENCE; indirect branch
+ retpoline,amd - alias for retpoline,lfence
+ eibrs - enhanced IBRS
+ eibrs,retpoline - enhanced IBRS + Retpolines
+ eibrs,lfence - enhanced IBRS + LFENCE
Not specifying this option is equivalent to
spectre_v2=auto.
next prev parent reply other threads:[~2022-03-09 16:22 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-09 16:00 [PATCH 5.16 00/37] 5.16.14-rc1 review Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 01/37] x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 02/37] x86/speculation: Add eIBRS + Retpoline options Greg Kroah-Hartman
2022-03-09 16:00 ` Greg Kroah-Hartman [this message]
2022-03-09 16:00 ` [PATCH 5.16 04/37] x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 05/37] x86/speculation: Use generic retpoline by default on AMD Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 06/37] x86/speculation: Update link to AMD speculation whitepaper Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 07/37] x86/speculation: Warn about Spectre v2 LFENCE mitigation Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 08/37] x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 09/37] ARM: report Spectre v2 status through sysfs Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 10/37] ARM: early traps initialisation Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 11/37] ARM: use LOADADDR() to get load address of sections Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 12/37] ARM: Spectre-BHB workaround Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 13/37] ARM: include unprivileged BPF status in Spectre V2 reporting Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 14/37] arm64: add ID_AA64ISAR2_EL1 sys register Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 15/37] arm64: cpufeature: add HWCAP for FEAT_AFP Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 16/37] arm64: cpufeature: add HWCAP for FEAT_RPRES Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 17/37] arm64: entry.S: Add ventry overflow sanity checks Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 18/37] arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 19/37] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 20/37] arm64: entry: Make the trampoline cleanup optional Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 21/37] arm64: entry: Free up another register on kptis tramp_exit path Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 22/37] arm64: entry: Move the trampoline data page before the text page Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 23/37] arm64: entry: Allow tramp_alias to access symbols after the 4K boundary Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 24/37] arm64: entry: Dont assume tramp_vectors is the start of the vectors Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 25/37] arm64: entry: Move trampoline macros out of ifdefd section Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 26/37] arm64: entry: Make the kpti trampolines kpti sequence optional Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 27/37] arm64: entry: Allow the trampoline text to occupy multiple pages Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 28/37] arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 29/37] arm64: entry: Add vectors that have the bhb mitigation sequences Greg Kroah-Hartman
2022-03-10 23:27 ` Pavel Machek
2022-03-11 8:15 ` Greg Kroah-Hartman
2022-03-11 8:39 ` Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 30/37] arm64: entry: Add macro for reading symbol addresses from the trampoline Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 31/37] arm64: Add percpu vectors for EL1 Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 32/37] arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 33/37] arm64: Mitigate spectre style branch history side channels Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 34/37] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 35/37] arm64: Use the clearbhb instruction in mitigations Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 36/37] arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-09 16:00 ` [PATCH 5.16 37/37] ARM: fix build error when BPF_SYSCALL is disabled Greg Kroah-Hartman
2022-03-09 19:05 ` [PATCH 5.16 00/37] 5.16.14-rc1 review Guenter Roeck
2022-03-09 20:01 ` Greg Kroah-Hartman
2022-03-09 21:17 ` Greg Kroah-Hartman
2022-03-09 20:23 ` Shuah Khan
2022-03-09 21:17 ` Daniel Díaz
2022-03-09 21:19 ` Daniel Díaz
2022-03-09 21:49 ` Fox Chen
2022-03-10 10:50 ` Bagas Sanjaya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220309155859.188409810@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bp@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.