From: Borislav Petkov <bp@alien8.de>
To: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: "KP Singh" <kpsingh@kernel.org>,
linux-kernel@vger.kernel.org, pjt@google.com, evn@google.com,
tglx@linutronix.de, mingo@redhat.com,
dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
peterz@infradead.org, pawan.kumar.gupta@linux.intel.com,
kim.phillips@amd.com, alexandre.chartre@oracle.com,
daniel.sneddon@linux.intel.com,
"José Oliveira" <joseloliveira11@gmail.com>,
"Rodrigo Branco" <rodrigo@kernelhacking.com>,
"Alexandra Sandulescu" <aesa@google.com>,
"Jim Mattson" <jmattson@google.com>
Subject: Re: [PATCH] x86/bugs: Allow STIBP with IBRS
Date: Mon, 20 Feb 2023 19:34:59 +0100 [thread overview]
Message-ID: <Y/O9U4KFtXE8Yoyt@zn.tnic> (raw)
In-Reply-To: <20230220182717.uzrym2gtavlbjbxo@treble>
Drop stable@ again.
On Mon, Feb 20, 2023 at 10:27:17AM -0800, Josh Poimboeuf wrote:
> IBRS is only enabled in kernel space. Since it's not enabled in user
> space, user space isn't protected from indirect branch prediction
> attacks from a sibling CPU thread.
>
> Allow STIBP to be enabled to protect against such attacks.
>
> Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Yah, look at that one:
commit 7c693f54c873691a4b7da05c7e0f74e67745d144
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: Tue Jun 14 23:15:55 2022 +0200
x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
Extend spectre_v2= boot option with Kernel IBRS.
[jpoimboe: no STIBP with IBRS]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I'm assuming this was supposed to mean no STIBP in *kernel mode* when
IBRS is selected?
In user mode, STIBP should be selectable as we disable IBRS there.
Close?
If so, pls document it too while at it:
Documentation/admin-guide/hw-vuln/spectre.rst
because we will be wondering next time again.
Like we wonder each time this madness is being touched. ;-(
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
next prev parent reply other threads:[~2023-02-20 18:35 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-20 12:01 [PATCH RESEND] x86/speculation: Fix user-mode spectre-v2 protection with KERNEL_IBRS KP Singh
2023-02-20 12:13 ` Josh Poimboeuf
2023-02-20 12:20 ` KP Singh
2023-02-20 12:34 ` KP Singh
2023-02-20 14:31 ` Borislav Petkov
2023-02-20 15:38 ` Dave Hansen
2023-02-20 19:57 ` Andrew Cooper
2023-02-20 21:10 ` Borislav Petkov
2023-02-20 23:01 ` KP Singh
2023-02-20 23:30 ` Andrew Cooper
2023-02-20 23:45 ` KP Singh
2023-02-21 18:52 ` KP Singh
2023-02-21 10:59 ` Borislav Petkov
2023-02-20 16:34 ` Josh Poimboeuf
2023-02-20 17:46 ` Borislav Petkov
2023-02-20 17:59 ` Josh Poimboeuf
2023-02-20 18:01 ` KP Singh
2023-02-20 18:22 ` Borislav Petkov
2023-02-20 18:44 ` KP Singh
2023-02-20 18:51 ` Borislav Petkov
2023-02-20 18:56 ` KP Singh
2023-02-20 19:02 ` Borislav Petkov
2023-02-20 19:10 ` KP Singh
2023-02-20 18:27 ` [PATCH] x86/bugs: Allow STIBP with IBRS Josh Poimboeuf
2023-02-20 18:28 ` kernel test robot
2023-02-20 18:33 ` KP Singh
2023-02-20 18:59 ` Josh Poimboeuf
2023-02-20 19:04 ` KP Singh
2023-02-20 19:19 ` Josh Poimboeuf
2023-02-20 18:34 ` Borislav Petkov [this message]
2023-02-20 19:09 ` Josh Poimboeuf
2023-02-20 19:16 ` KP Singh
2023-02-20 19:35 ` Josh Poimboeuf
2023-02-20 19:38 ` KP Singh
2023-02-20 19:20 ` Borislav Petkov
2023-02-22 1:20 ` Pawan Gupta
2023-02-22 1:26 ` KP Singh
2023-02-22 1:38 ` Pawan Gupta
2023-02-27 19:59 ` [tip: x86/urgent] x86/speculation: Allow enabling STIBP with legacy IBRS tip-bot2 for KP Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y/O9U4KFtXE8Yoyt@zn.tnic \
--to=bp@alien8.de \
--cc=aesa@google.com \
--cc=alexandre.chartre@oracle.com \
--cc=daniel.sneddon@linux.intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=evn@google.com \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=joseloliveira11@gmail.com \
--cc=jpoimboe@kernel.org \
--cc=kim.phillips@amd.com \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=peterz@infradead.org \
--cc=pjt@google.com \
--cc=rodrigo@kernelhacking.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.