x86/intel/spectre_v4: Deprecate spec_store_bypass_disable=userspace

Enforcing userspace-only spectre_v4 mitigations cannot be done performantly
when retpoline mitigations for spectre_v2 are in force. To do so we would
need to write MSR_IA32_SPEC_CTRL when entering and leaving kernel (i.e. system
calls, interrupts, etc.) Since retpoline is the preferred method of spectre_v2
mitigations exactly because it avoids writing this extremely slow MSR, adding
these two writes for SSBD bit management will make using retpoline pointless.

While there may be some cases where running with speculative storage bypass
enabled in kernel only is better even in presense of the extra writes to
MSR_IA32_SPEC_CTRL we don't expect this to be the case in majority of cases.
Plus removing this mode makes code less unreadable.

Orabug: 28814570

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/arch/x86/kernel/cpu/bugs_64.c b/arch/x86/kernel/cpu/bugs_64.c
index 209cf691efed5e8f74162eae4539c97f5bc5dbe1..45b61d7b294307cc253cb6e304ae3e97629568c1 100644 (file)
--- a/arch/x86/kernel/cpu/bugs_64.c
+++ b/arch/x86/kernel/cpu/bugs_64.c
@@ -127,7 +127,6 @@ __setup("spectre_v2_heuristics=", spectre_v2_heuristics_setup);
 static void __init spectre_v2_select_mitigation(void);
 static enum ssb_mitigation __init ssb_select_mitigation(void);
 static void __init ssb_init(void);
-static bool ssbd_userspace_selected(void);
 static void __init l1tf_select_mitigation(void);
 
 static enum ssb_mitigation ssb_mode = SPEC_STORE_BYPASS_NONE;
@@ -773,8 +772,7 @@ static void __init spectre_v2_select_mitigation(void)
                         */
                        if (!retp_compiler() /* prefer IBRS over minimal ASM */ ||
                            (retp_compiler() && !retpoline_selected(cmd) &&
-                            ((is_skylake_era() && use_ibrs_on_skylake) ||
-                             (ssbd_userspace_selected() && use_ibrs_with_ssbd)))) {
+                            ((is_skylake_era() && use_ibrs_on_skylake)))) {
 
                                /* Start the engine! */
                                ibrs_select(&mode);
@@ -823,11 +821,6 @@ out:
 
 #define pr_fmt(fmt)    "Speculative Store Bypass: " fmt
 
-static bool ssbd_userspace_selected(void)
-{
-       return (ssb_mode == SPEC_STORE_BYPASS_USERSPACE);
-}
-
 /* The kernel command line selection */
 enum ssb_mitigation_cmd {
        SPEC_STORE_BYPASS_CMD_NONE,
@@ -835,7 +828,7 @@ enum ssb_mitigation_cmd {
        SPEC_STORE_BYPASS_CMD_ON,
        SPEC_STORE_BYPASS_CMD_PRCTL,
        SPEC_STORE_BYPASS_CMD_SECCOMP,
-       SPEC_STORE_BYPASS_CMD_USERSPACE,
+       SPEC_STORE_BYPASS_CMD_USERSPACE /* Deprecated */
 };
 
 static const char *ssb_strings[] = {
@@ -843,7 +836,6 @@ static const char *ssb_strings[] = {
        [SPEC_STORE_BYPASS_DISABLE]     = "Mitigation: Speculative Store Bypass disabled",
        [SPEC_STORE_BYPASS_PRCTL]       = "Mitigation: Speculative Store Bypass disabled via prctl",
        [SPEC_STORE_BYPASS_SECCOMP]     = "Mitigation: Speculative Store Bypass disabled via prctl and seccomp",
-       [SPEC_STORE_BYPASS_USERSPACE]   = "Mitigation: Speculative Store Bypass disabled for userspace"
 };
 
 static const struct {
@@ -855,7 +847,7 @@ static const struct {
        { "off",        SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
        { "prctl",      SPEC_STORE_BYPASS_CMD_PRCTL },   /* Disable Speculative Store Bypass via prctl */
        { "seccomp",    SPEC_STORE_BYPASS_CMD_SECCOMP }, /* Disable Speculative Store Bypass via prctl and seccomp */
-       { "userspace",  SPEC_STORE_BYPASS_CMD_USERSPACE }, /* Disable Speculative Store Bypass for userspace */
+       { "userspace",  SPEC_STORE_BYPASS_CMD_USERSPACE }, /* Disable Speculative Store Bypass for userspace (deprecated) */
 };
 
 static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)
@@ -922,8 +914,10 @@ static enum ssb_mitigation __init ssb_select_mitigation(void)
                mode = SPEC_STORE_BYPASS_PRCTL;
                break;
        case SPEC_STORE_BYPASS_CMD_USERSPACE:
+               pr_warn("spec_store_bypass_disable=userspace is deprecated. "
+                       "Disabling Speculative Store Bypass\n");
                if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
-                       mode = SPEC_STORE_BYPASS_USERSPACE;
+                       mode = SPEC_STORE_BYPASS_DISABLE;
                break;
        case SPEC_STORE_BYPASS_CMD_NONE:
                break;
@@ -943,8 +937,7 @@ static void __init ssb_init(void)
        if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
                setup_force_cpu_cap(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE);
 
-       if (ssb_mode == SPEC_STORE_BYPASS_DISABLE ||
-           ssb_mode == SPEC_STORE_BYPASS_USERSPACE) {
+       if (ssb_mode == SPEC_STORE_BYPASS_DISABLE) {
                /*
                 * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD uses
                 * a completely different MSR and bit dependent on family.
@@ -953,11 +946,9 @@ static void __init ssb_init(void)
                case X86_VENDOR_INTEL:
                        x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
                        x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+                       x86_spec_ctrl_priv |= SPEC_CTRL_SSBD;
 
-                       if (ssb_mode == SPEC_STORE_BYPASS_DISABLE) {
-                               x86_spec_ctrl_set(SPEC_CTRL_INITIAL);
-                               x86_spec_ctrl_priv |= SPEC_CTRL_SSBD;
-                       }
+                       x86_spec_ctrl_set(SPEC_CTRL_INITIAL);
 
                        update_cpu_spec_ctrl_all();
                        break;
@@ -1034,7 +1025,6 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
 static int ssb_prctl_get(struct task_struct *task)
 {
        switch (ssb_mode) {
-       case SPEC_STORE_BYPASS_USERSPACE:
        case SPEC_STORE_BYPASS_DISABLE:
                return PR_SPEC_DISABLE;
        case SPEC_STORE_BYPASS_SECCOMP:
@@ -1063,7 +1053,7 @@ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
 
 void x86_spec_ctrl_setup_ap(void)
 {
-       if (boot_cpu_has(X86_FEATURE_IBRS) && ssb_mode != SPEC_STORE_BYPASS_USERSPACE)
+       if (boot_cpu_has(X86_FEATURE_IBRS))
                x86_spec_ctrl_set(SPEC_CTRL_INITIAL);
 
        if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)