x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
authorJosh Poimboeuf <jpoimboe@redhat.com>
Fri, 25 Feb 2022 22:32:28 +0000 (14:32 -0800)
committerBorislav Petkov <bp@suse.de>
Sat, 5 Mar 2022 08:30:47 +0000 (09:30 +0100)
commit0de05d056afdb00eca8c7bbb0c79a3438daf700c
tree5d7e315e4956d1294428564823b3a0e01fa25609
parenteafd987d4a82c7bb5aa12f0e3b4f8f3dea93e678
x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT

The commit

   44a3918c8245 ("x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting")

added a warning for the "eIBRS + unprivileged eBPF" combination, which
has been shown to be vulnerable against Spectre v2 BHB-based attacks.

However, there's no warning about the "eIBRS + LFENCE retpoline +
unprivileged eBPF" combo. The LFENCE adds more protection by shortening
the speculation window after a mispredicted branch. That makes an attack
significantly more difficult, even with unprivileged eBPF. So at least
for now the logic doesn't warn about that combination.

But if you then add SMT into the mix, the SMT attack angle weakens the
effectiveness of the LFENCE considerably.

So extend the "eIBRS + unprivileged eBPF" warning to also include the
"eIBRS + LFENCE + unprivileged eBPF + SMT" case.

  [ bp: Massage commit message. ]

Suggested-by: Alyssa Milburn <alyssa.milburn@linux.intel.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
arch/x86/kernel/cpu/bugs.c