[Xen-devel] [PATCH for-4.11] x86/spec_ctrl: Updates to retpoline-safety decision making

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

All of this is as recommended by the Intel whitepaper:

https://software.intel.com/sites/default/files/managed/1d/46/Retpoline-A-Branch-Target-Injection-Mitigation.pdf

The RSB-alternative bit in MSR_ARCH_CAPABILITIES may be set by a hypervisor to
indicate that the virtual machine may migrate to a processor which isn't
retpoline-safe.  Introduce a shortened name (to reduce code volume), treat it
as authorative in retpoline_safe(), and print its value along with the other
ARCH_CAPS bits.

The exact processor models which do have RSB semantics which fall back to BTB
predictions are enumerated, and include Kabylake and Cannonlake.  Leave a
printk() in the default case to help identify cases which aren't covered.

The exact microcode versions from Broadwell RSB-safety are taken from the
referenced microcode update file (adjusting for the known-bad microcode
versions).  In practice, this means that all Broadwell hardware with
up-to-date microcode will use retpoline in preference to IBRS.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Juergen Gross <jgross@xxxxxxxx>

This should be backported to everywhere which has Spectre mitigations, and
therefore should be considered for 4.11 at this point.
---
 xen/arch/x86/spec_ctrl.c        | 48 +++++++++++++++++++++++++++++++++++------
 xen/include/asm-x86/msr-index.h |  1 +
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
index 5b5ec90..aff06f0 100644
--- a/xen/arch/x86/spec_ctrl.c
+++ b/xen/arch/x86/spec_ctrl.c
@@ -113,12 +113,13 @@ static void __init print_details(enum ind_thunk thunk)
     printk(XENLOG_DEBUG "Speculative mitigation facilities:\n");
 
     /* Hardware features which pertain to speculative mitigations. */
-    printk(XENLOG_DEBUG "  Hardware features:%s%s%s%s%s\n",
+    printk(XENLOG_DEBUG "  Hardware features:%s%s%s%s%s%s\n",
            (_7d0 & cpufeat_mask(X86_FEATURE_IBRSB)) ? " IBRS/IBPB" : "",
            (_7d0 & cpufeat_mask(X86_FEATURE_STIBP)) ? " STIBP"     : "",
            (e8b  & cpufeat_mask(X86_FEATURE_IBPB))  ? " IBPB"      : "",
            (caps & ARCH_CAPABILITIES_IBRS_ALL)      ? " IBRS_ALL"  : "",
-           (caps & ARCH_CAPABILITIES_RDCL_NO)       ? " RDCL_NO"   : "");
+           (caps & ARCH_CAPABILITIES_RDCL_NO)       ? " RDCL_NO"   : "",
+           (caps & ARCH_CAPS_RSBA)                  ? " RBSA"      : "");
 
     /* Compiled-in support which pertains to BTI mitigations. */
     if ( IS_ENABLED(CONFIG_INDIRECT_THUNK) )
@@ -151,6 +152,20 @@ static bool __init retpoline_safe(void)
          boot_cpu_data.x86 != 6 )
         return false;
 
+    if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) )
+    {
+        uint64_t caps;
+
+        rdmsrl(MSR_ARCH_CAPABILITIES, caps);
+
+        /*
+         * RBSA may be set by a hypervisor to indicate that we may move to a
+         * processor which isn't retpoline-safe.
+         */
+        if ( caps & ARCH_CAPS_RSBA )
+            return false;
+    }
+
     switch ( boot_cpu_data.x86_model )
     {
     case 0x17: /* Penryn */
@@ -177,18 +192,37 @@ static bool __init retpoline_safe(void)
          * versions.
          */
     case 0x3d: /* Broadwell */
-        return ucode_rev >= 0x28;
+        return ucode_rev >= 0x2a;
     case 0x47: /* Broadwell H */
-        return ucode_rev >= 0x1b;
+        return ucode_rev >= 0x1d;
     case 0x4f: /* Broadwell EP/EX */
-        return ucode_rev >= 0xb000025;
+        return ucode_rev >= 0xb000021;
     case 0x56: /* Broadwell D */
-        return false; /* TBD. */
+        switch ( boot_cpu_data.x86_mask )
+        {
+        case 2:  return ucode_rev >= 0x15;
+        case 3:  return ucode_rev >= 0x7000012;
+        case 4:  return ucode_rev >= 0xf000011;
+        case 5:  return ucode_rev >= 0xe000009;
+        default: return false;
+        }
+        break;
 
         /*
-         * Skylake and later processors are not retpoline-safe.
+         * Skylake, Kabylake and Cannonlake processors are not retpoline-safe.
          */
+    case 0x4e:
+    case 0x55:
+    case 0x5e:
+    case 0x66:
+    case 0x67:
+    case 0x8e:
+    case 0x9e:
+        return false;
+
     default:
+        printk("Unrecognised CPU model %#x - assuming not reptpoline safe\n",
+               boot_cpu_data.x86_model);
         return false;
     }
 }
diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
index 8416756..c9f44eb 100644
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -42,6 +42,7 @@
 #define MSR_ARCH_CAPABILITIES          0x0000010a
 #define ARCH_CAPABILITIES_RDCL_NO      (_AC(1, ULL) << 0)
 #define ARCH_CAPABILITIES_IBRS_ALL     (_AC(1, ULL) << 1)
+#define ARCH_CAPS_RSBA                 (_AC(1, ULL) << 2)
 
 /* Intel MSRs. Some also available on other CPUs */
 #define MSR_IA32_PERFCTR0              0x000000c1
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel