From: Tim Chen <tim.c.chen@linux.intel.com> To: David Woodhouse <dwmw2@infradead.org>, mingo@kernel.org, hpa@zytor.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, luto@kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, linux-mm <linux-mm@kvack.org> Subject: Re: [tip:x86/pti] x86/speculation: Use Indirect Branch Prediction Barrier in context switch Date: Mon, 5 Feb 2018 11:35:05 -0800 [thread overview] Message-ID: <a38f70bc-13a0-506a-2b8b-18877e6e6796@linux.intel.com> (raw) In-Reply-To: <1517840309.31953.153.camel@infradead.org> On 02/05/2018 06:18 AM, David Woodhouse wrote: > On Tue, 2018-01-30 at 14:39 -0800, tip-bot for Tim Chen wrote: >> Thanks to the reviewers and Andy Lutomirski for the suggestion of >> using ctx_id which got rid of the problem of mm pointer recycling. > > That one doesn't backport well to 4.9. Suggestions welcome. > Will something like the following work for 4.9 using active_mm? This patch is not really tested, but just want to put it out here to see if this is a reasonable backport. Tim Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> --- diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c index a7655f6..4994db2 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c @@ -9,6 +9,7 @@ #include <asm/tlbflush.h> #include <asm/mmu_context.h> +#include <asm/nospec-branch.h> #include <asm/cache.h> #include <asm/apic.h> #include <asm/uv/uv.h> @@ -75,6 +76,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk) { unsigned cpu = smp_processor_id(); +#ifdef CONFIG_SMP + struct mm_struct *active_mm = this_cpu_read(cpu_tlbstate.active_mm); +#endif if (likely(prev != next)) { if (IS_ENABLED(CONFIG_VMAP_STACK)) { @@ -91,6 +95,28 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, set_pgd(pgd, init_mm.pgd[stack_pgd_index]); } + /* + * Avoid user/user BTB poisoning by flushing the branch + * predictor when switching between processes. This stops + * one process from doing Spectre-v2 attacks on another. + * + * As an optimization, flush indirect branches only when + * switching into processes that disable dumping. This + * protects high value processes like gpg, without having + * too high performance overhead. IBPB is *expensive*! + * + * This will not flush branches when switching into kernel + * threads. It will also not flush if we switch to idle + * thread and back to the same process. It will flush if we + * switch to a different non-dumpable process. + */ + if (tsk && tsk->mm && +#ifdef CONFIG_SMP + next != active_mm && +#endif + get_dumpable(tsk->mm) != SUID_DUMP_USER) + indirect_branch_prediction_barrier(); + #ifdef CONFIG_SMP this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); this_cpu_write(cpu_tlbstate.active_mm, next);
WARNING: multiple messages have this Message-ID (diff)
From: Tim Chen <tim.c.chen@linux.intel.com> To: David Woodhouse <dwmw2@infradead.org>, mingo@kernel.org, hpa@zytor.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, luto@kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, linux-mm <linux-mm@kvack.org> Subject: Re: [tip:x86/pti] x86/speculation: Use Indirect Branch Prediction Barrier in context switch Date: Mon, 5 Feb 2018 11:35:05 -0800 [thread overview] Message-ID: <a38f70bc-13a0-506a-2b8b-18877e6e6796@linux.intel.com> (raw) In-Reply-To: <1517840309.31953.153.camel@infradead.org> On 02/05/2018 06:18 AM, David Woodhouse wrote: > On Tue, 2018-01-30 at 14:39 -0800, tip-bot for Tim Chen wrote: >> Thanks to the reviewers and Andy Lutomirski for the suggestion of >> using ctx_id which got rid of the problem of mm pointer recycling. > > That one doesn't backport well to 4.9. Suggestions welcome. > Will something like the following work for 4.9 using active_mm? This patch is not really tested, but just want to put it out here to see if this is a reasonable backport. Tim Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> --- diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c index a7655f6..4994db2 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c @@ -9,6 +9,7 @@ #include <asm/tlbflush.h> #include <asm/mmu_context.h> +#include <asm/nospec-branch.h> #include <asm/cache.h> #include <asm/apic.h> #include <asm/uv/uv.h> @@ -75,6 +76,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk) { unsigned cpu = smp_processor_id(); +#ifdef CONFIG_SMP + struct mm_struct *active_mm = this_cpu_read(cpu_tlbstate.active_mm); +#endif if (likely(prev != next)) { if (IS_ENABLED(CONFIG_VMAP_STACK)) { @@ -91,6 +95,28 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, set_pgd(pgd, init_mm.pgd[stack_pgd_index]); } + /* + * Avoid user/user BTB poisoning by flushing the branch + * predictor when switching between processes. This stops + * one process from doing Spectre-v2 attacks on another. + * + * As an optimization, flush indirect branches only when + * switching into processes that disable dumping. This + * protects high value processes like gpg, without having + * too high performance overhead. IBPB is *expensive*! + * + * This will not flush branches when switching into kernel + * threads. It will also not flush if we switch to idle + * thread and back to the same process. It will flush if we + * switch to a different non-dumpable process. + */ + if (tsk && tsk->mm && +#ifdef CONFIG_SMP + next != active_mm && +#endif + get_dumpable(tsk->mm) != SUID_DUMP_USER) + indirect_branch_prediction_barrier(); + #ifdef CONFIG_SMP this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); this_cpu_write(cpu_tlbstate.active_mm, next); -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2018-02-05 19:35 UTC|newest] Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-29 22:04 [PATCH] x86/speculation: Use Indirect Branch Prediction Barrier in context switch David Woodhouse 2018-01-30 17:48 ` Josh Poimboeuf 2018-01-30 21:23 ` Tim Chen 2018-01-30 22:00 ` Borislav Petkov 2018-01-30 22:21 ` Thomas Gleixner 2018-01-30 22:55 ` Borislav Petkov 2018-01-31 3:59 ` Josh Poimboeuf 2018-01-31 23:25 ` Tim Chen 2018-01-30 20:38 ` Borislav Petkov 2018-01-30 21:03 ` Tim Chen 2018-01-30 21:57 ` Borislav Petkov 2018-01-30 22:26 ` Tim Chen 2018-01-30 22:43 ` Borislav Petkov 2018-01-31 0:25 ` Tim Chen 2018-01-31 0:41 ` Borislav Petkov 2018-01-30 22:39 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-01-31 7:03 ` Dominik Brodowski 2018-01-31 13:24 ` Josh Poimboeuf 2018-02-01 8:25 ` Christian Brauner 2018-02-01 8:31 ` David Woodhouse 2018-02-01 15:40 ` Josh Poimboeuf 2018-02-04 19:39 ` Dominik Brodowski 2018-02-05 14:18 ` David Woodhouse 2018-02-05 19:35 ` Tim Chen [this message] 2018-02-05 19:35 ` Tim Chen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=a38f70bc-13a0-506a-2b8b-18877e6e6796@linux.intel.com \ --to=tim.c.chen@linux.intel.com \ --cc=dwmw2@infradead.org \ --cc=gregkh@linuxfoundation.org \ --cc=hpa@zytor.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@kernel.org \ --cc=mingo@kernel.org \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.