Page MenuHomeFreeBSD

Spectre AKA IBRS

Authored by kib on Jan 24 2018, 2:35 PM.
Referenced Files
Unknown Object (File)
Wed, May 24, 1:45 AM
Unknown Object (File)
Fri, May 12, 6:14 PM
Unknown Object (File)
Sun, May 7, 4:21 AM
Unknown Object (File)
May 3 2023, 6:31 PM
Unknown Object (File)
May 3 2023, 7:23 AM
Unknown Object (File)
Mar 17 2023, 8:18 PM
Unknown Object (File)
Mar 3 2023, 4:23 PM
Unknown Object (File)
Feb 11 2023, 8:08 PM



Coded according to the 336996-001.

Test Plan

Tested on Haswell with recalled microcode.

Diff Detail

rS FreeBSD src repository - subversion
Lint Not Applicable
Tests Not Applicable

Event Timeline

67 ↗(On Diff #38388)

Probably avoiding negative-sense tunables/sysctls is preferred (although we have clfush_disable just above, perhaps maintaining consistency is sensible)

op requested changes to this revision.Jan 24 2018, 9:39 PM
op added inline comments.
831 ↗(On Diff #38388)

According to the CPUID_STDEXT3_IBPD is not IA32_ARCH_CAP_IBRS_ALL?

This revision now requires changes to proceed.Jan 24 2018, 9:39 PM

Nevermind, it's handled.

828 ↗(On Diff #38388)

On processors with enhanced IBRS, an RSB overwrite sequence does not suffice to prevent the
predicted target of a near return from using an RSB entry created in a less privileged predictor mode.
Software can avoid this by enabling SMEP (for transitions from user mode to supervisor mode
) and by maintaining IA32_SPEC_CTRL.IBRS = 1 (for VM exits).

831 ↗(On Diff #38388)

Nope, it's fine, just the CPUID_STDEXT3_IBPD was named misleading.

828 ↗(On Diff #38388)

Re-read the citation and the code where you put the note. Your suggestion would result in doing something which is exactly opposite to what is recommended in the If the IA32_ARCH_CAP_IBRS_ALL bit is set, then RSB reset sequence is useless, while jmp 1f would jump right to the sequence. Instead, the paragraph recommends to enable SMEP as the measure.

We always have SMEP turned on if CPU supports it, there is no such action as turning SMEP on after the kernel is booted. So there is nothing to do in the case of enhanced IBRS.

  • Disable IBPB on return to usermode
  • Ensure that IBPB is enabled on kernel entry before we enable interrupts. Then we do not need to tweak MSRs when re-entering kernel.
  • Except for NMI and MCE, where we preserve previous MSR content on entry and restore on exit, to ensure proper nesting.
  • Disable IBPB around mwait, Intel claims that if any HT has the control enabled, it hurts the whole core performance.

Would it make sense to reference Intel doc 336996-001 somewhere in a comment?

In D14029#295586, @imp wrote:

Would it make sense to reference Intel doc 336996-001 somewhere in a comment?

If this interface is to stay, Intel must move the content of the whitepaper into SDM. I will add a note to specialregs.h for now.

Pre-calculate all IBRS pre-conditions instead of doing it on each kernel entry.
Disable IBRS on return if it was enabled, regardless of the IBRS enable state.

I'm curious: why disable IBPB for userland?

This revision was not accepted when it landed; it landed in state Needs Review.Jan 31 2018, 2:36 PM
This revision was automatically updated to reflect the committed changes.