From: Thomas Gleixner <tglx@linutronix.de> To: LKML <linux-kernel@vger.kernel.org> Cc: x86@kernel.org, Peter Zijlstra <peterz@infradead.org>, Andy Lutomirski <luto@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Jiri Kosina <jkosina@suse.cz>, Tom Lendacky <thomas.lendacky@amd.com>, Josh Poimboeuf <jpoimboe@redhat.com>, Andrea Arcangeli <aarcange@redhat.com>, David Woodhouse <dwmw@amazon.co.uk>, Tim Chen <tim.c.chen@linux.intel.com>, Andi Kleen <ak@linux.intel.com>, Dave Hansen <dave.hansen@intel.com>, Casey Schaufler <casey.schaufler@intel.com>, Asit Mallick <asit.k.mallick@intel.com>, Arjan van de Ven <arjan@linux.intel.com>, Jon Masters <jcm@redhat.com>, Waiman Long <longman9394@gmail.com>, Greg KH <gregkh@linuxfoundation.org>, Dave Stewart <david.c.stewart@intel.com>, Kees Cook <keescook@chromium.org> Subject: [patch V2 25/28] x86/speculation: Add prctl() control for indirect branch speculation Date: Sun, 25 Nov 2018 19:33:53 +0100 Message-ID: <20181125185005.866780996@linutronix.de> (raw) In-Reply-To: <20181125183328.318175777@linutronix.de> [-- Attachment #0: x86-speculation-Create-PRCTL-interface-to-restrict-indirect-branch-speculation.patch --] [-- Type: text/plain, Size: 7496 bytes --] Add the PR_SPEC_INDIRECT_BRANCH option for the PR_GET_SPECULATION_CTRL and PR_SET_SPECULATION_CTRL prctls to allow fine grained per task control of indirect branch speculation via STIBP and IBPB. Invocations: Check indirect branch speculation status with - prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); Enable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); Disable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); Force disable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0); See Documentation/userspace-api/spec_ctrl.rst. Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> --- V1 -> V2: s/INDIR_/INDIRECT_/ in ABI s/INDIR_BRANCH/IB/ for internal functions and defines s/app2app/user/ Merge the DISABLE cases --- Documentation/userspace-api/spec_ctrl.rst | 9 ++++ arch/x86/include/asm/nospec-branch.h | 1 arch/x86/kernel/cpu/bugs.c | 67 ++++++++++++++++++++++++++++++ include/linux/sched.h | 9 ++++ include/uapi/linux/prctl.h | 1 tools/include/uapi/linux/prctl.h | 1 6 files changed, 88 insertions(+) --- a/Documentation/userspace-api/spec_ctrl.rst +++ b/Documentation/userspace-api/spec_ctrl.rst @@ -92,3 +92,12 @@ Speculation misfeature controls * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0); + +- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes + (Mitigate Spectre V2 style attacks against user processes) + + Invocations: + * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); + * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); + * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); + * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0); --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -232,6 +232,7 @@ enum spectre_v2_mitigation { enum spectre_v2_user_mitigation { SPECTRE_V2_USER_NONE, SPECTRE_V2_USER_STRICT, + SPECTRE_V2_USER_PRCTL, }; /* The Speculative Store Bypass disable variants */ --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -566,6 +566,8 @@ void arch_smt_update(void) case SPECTRE_V2_USER_STRICT: update_stibp_strict(); break; + case SPECTRE_V2_USER_PRCTL: + break; } mutex_unlock(&spec_ctrl_mutex); @@ -756,12 +758,50 @@ static int ssb_prctl_set(struct task_str return 0; } +static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) +{ + switch (ctrl) { + case PR_SPEC_ENABLE: + if (spectre_v2_user == SPECTRE_V2_USER_NONE) + return 0; + /* + * Indirect branch speculation is always disabled in strict + * mode. + */ + if (spectre_v2_user == SPECTRE_V2_USER_STRICT) + return -EPERM; + task_clear_spec_ib_disable(task); + task_update_spec_tif(task, TIF_SPEC_IB, false); + break; + case PR_SPEC_DISABLE: + case PR_SPEC_FORCE_DISABLE: + /* + * Indirect branch speculation is always allowed when + * mitigation is force disabled. + */ + if (spectre_v2_user == SPECTRE_V2_USER_NONE) + return -EPERM; + if (spectre_v2_user == SPECTRE_V2_USER_STRICT) + return 0; + task_set_spec_ib_disable(task); + if (ctrl == PR_SPEC_FORCE_DISABLE) + task_set_spec_ib_force_disable(task); + task_update_spec_tif(task, TIF_SPEC_IB, true); + break; + default: + return -ERANGE; + } + return 0; +} + int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, unsigned long ctrl) { switch (which) { case PR_SPEC_STORE_BYPASS: return ssb_prctl_set(task, ctrl); + case PR_SPEC_INDIRECT_BRANCH: + return ib_prctl_set(task, ctrl); default: return -ENODEV; } @@ -794,11 +834,34 @@ static int ssb_prctl_get(struct task_str } } +static int ib_prctl_get(struct task_struct *task) +{ + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) + return PR_SPEC_NOT_AFFECTED; + + switch (spectre_v2_user) { + case SPECTRE_V2_USER_NONE: + return PR_SPEC_ENABLE; + case SPECTRE_V2_USER_PRCTL: + if (task_spec_ib_force_disable(task)) + return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE; + if (test_tsk_thread_flag(task, TIF_SPEC_IB)) + return PR_SPEC_PRCTL | PR_SPEC_DISABLE; + return PR_SPEC_PRCTL | PR_SPEC_ENABLE; + case SPECTRE_V2_USER_STRICT: + return PR_SPEC_DISABLE; + default: + return PR_SPEC_NOT_AFFECTED; + } +} + int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which) { switch (which) { case PR_SPEC_STORE_BYPASS: return ssb_prctl_get(task); + case PR_SPEC_INDIRECT_BRANCH: + return ib_prctl_get(task); default: return -ENODEV; } @@ -978,6 +1041,8 @@ static char *stibp_state(void) return ", STIBP: disabled"; case SPECTRE_V2_USER_STRICT: return ", STIBP: forced"; + case SPECTRE_V2_USER_PRCTL: + return ""; } return ""; } @@ -990,6 +1055,8 @@ static char *ibpb_state(void) return ", IBPB: disabled"; case SPECTRE_V2_USER_STRICT: return ", IBPB: always-on"; + case SPECTRE_V2_USER_PRCTL: + return ""; } } return ""; --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1453,6 +1453,8 @@ static inline bool is_percpu_thread(void #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */ #define PFA_SPEC_SSB_DISABLE 3 /* Speculative Store Bypass disabled */ #define PFA_SPEC_SSB_FORCE_DISABLE 4 /* Speculative Store Bypass force disabled*/ +#define PFA_SPEC_IB_DISABLE 5 /* Indirect branch speculation restricted */ +#define PFA_SPEC_IB_FORCE_DISABLE 6 /* Indirect branch speculation permanently restricted */ #define TASK_PFA_TEST(name, func) \ static inline bool task_##func(struct task_struct *p) \ @@ -1484,6 +1486,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ss TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) +TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable) +TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable) +TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable) + +TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) +TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) + static inline void current_restore_flags(unsigned long orig_flags, unsigned long flags) { --- a/include/uapi/linux/prctl.h +++ b/include/uapi/linux/prctl.h @@ -212,6 +212,7 @@ struct prctl_mm_map { #define PR_SET_SPECULATION_CTRL 53 /* Speculation control variants */ # define PR_SPEC_STORE_BYPASS 0 +# define PR_SPEC_INDIRECT_BRANCH 1 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */ # define PR_SPEC_NOT_AFFECTED 0 # define PR_SPEC_PRCTL (1UL << 0) --- a/tools/include/uapi/linux/prctl.h +++ b/tools/include/uapi/linux/prctl.h @@ -212,6 +212,7 @@ struct prctl_mm_map { #define PR_SET_SPECULATION_CTRL 53 /* Speculation control variants */ # define PR_SPEC_STORE_BYPASS 0 +# define PR_SPEC_INDIRECT_BRANCH 1 /* Return and control values for PR_SET/GET_SPECULATION_CTRL */ # define PR_SPEC_NOT_AFFECTED 0 # define PR_SPEC_PRCTL (1UL << 0)
next prev parent reply index Thread overview: 112+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-11-25 18:33 [patch V2 00/28] x86/speculation: Remedy the STIBP/IBPB overhead Thomas Gleixner 2018-11-25 18:33 ` [patch V2 01/28] x86/speculation: Update the TIF_SSBD comment Thomas Gleixner 2018-11-28 14:20 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-29 14:27 ` [patch V2 01/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 02/28] x86/speculation: Clean up spectre_v2_parse_cmdline() Thomas Gleixner 2018-11-28 14:20 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-29 14:28 ` [patch V2 02/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 03/28] x86/speculation: Remove unnecessary ret variable in cpu_show_common() Thomas Gleixner 2018-11-28 14:21 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-29 14:28 ` [patch V2 03/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 04/28] x86/speculation: Reorganize cpu_show_common() Thomas Gleixner 2018-11-26 15:08 ` Borislav Petkov 2018-11-28 14:22 ` [tip:x86/pti] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() tip-bot for Tim Chen 2018-11-29 14:29 ` [patch V2 04/28] x86/speculation: Reorganize cpu_show_common() Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 05/28] x86/speculation: Disable STIBP when enhanced IBRS is in use Thomas Gleixner 2018-11-28 14:22 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-29 14:35 ` [patch V2 05/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 06/28] x86/speculation: Rename SSBD update functions Thomas Gleixner 2018-11-26 15:24 ` Borislav Petkov 2018-11-28 14:23 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-29 14:37 ` [patch V2 06/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 07/28] x86/speculation: Reorganize speculation control MSRs update Thomas Gleixner 2018-11-26 15:47 ` Borislav Petkov 2018-11-28 14:23 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-29 14:41 ` [patch V2 07/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 08/28] sched/smt: Make sched_smt_present track topology Thomas Gleixner 2018-11-28 14:24 ` [tip:x86/pti] " tip-bot for Peter Zijlstra (Intel) 2018-11-29 14:42 ` [patch V2 08/28] " Konrad Rzeszutek Wilk 2018-11-29 14:50 ` Konrad Rzeszutek Wilk 2018-11-29 15:48 ` Peter Zijlstra 2018-11-25 18:33 ` [patch V2 09/28] x86/Kconfig: Select SCHED_SMT if SMP enabled Thomas Gleixner 2018-11-28 14:24 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-29 14:44 ` [patch V2 09/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 10/28] sched/smt: Expose sched_smt_present static key Thomas Gleixner 2018-11-28 14:25 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-29 14:44 ` [patch V2 10/28] " Konrad Rzeszutek Wilk 2018-11-25 18:33 ` [patch V2 11/28] x86/speculation: Rework SMT state change Thomas Gleixner 2018-11-28 14:26 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 12/28] x86/l1tf: Show actual SMT state Thomas Gleixner 2018-11-28 14:26 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 13/28] x86/speculation: Reorder the spec_v2 code Thomas Gleixner 2018-11-26 22:21 ` Borislav Petkov 2018-11-28 14:27 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 14/28] x86/speculation: Mark string arrays const correctly Thomas Gleixner 2018-11-28 14:27 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 15/28] x86/speculataion: Mark command line parser data __initdata Thomas Gleixner 2018-11-28 14:28 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 16/28] x86/speculation: Unify conditional spectre v2 print functions Thomas Gleixner 2018-11-28 14:29 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 17/28] x86/speculation: Add command line control for indirect branch speculation Thomas Gleixner 2018-11-28 14:29 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 18/28] x86/speculation: Prepare for per task indirect branch speculation control Thomas Gleixner 2018-11-27 17:25 ` Lendacky, Thomas 2018-11-27 19:51 ` Tim Chen 2018-11-28 9:39 ` Thomas Gleixner 2018-11-27 20:39 ` Thomas Gleixner 2018-11-27 20:42 ` Thomas Gleixner 2018-11-27 21:52 ` Lendacky, Thomas 2018-11-28 14:30 ` [tip:x86/pti] " tip-bot for Tim Chen 2018-11-25 18:33 ` [patch V2 19/28] x86/process: Consolidate and simplify switch_to_xtra() code Thomas Gleixner 2018-11-26 18:30 ` Borislav Petkov 2018-11-28 14:30 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 20/28] x86/speculation: Avoid __switch_to_xtra() calls Thomas Gleixner 2018-11-28 14:31 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 21/28] x86/speculation: Prepare for conditional IBPB in switch_mm() Thomas Gleixner 2018-11-25 19:11 ` Thomas Gleixner 2018-11-25 20:53 ` Andi Kleen 2018-11-25 22:20 ` Thomas Gleixner 2018-11-25 23:04 ` Andy Lutomirski 2018-11-26 7:10 ` Thomas Gleixner 2018-11-26 13:36 ` Ingo Molnar 2018-11-26 3:07 ` Andi Kleen 2018-11-26 6:50 ` Thomas Gleixner 2018-11-28 14:31 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 22/28] ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS Thomas Gleixner 2018-11-28 14:32 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 23/28] x86/speculation: Split out TIF update Thomas Gleixner 2018-11-28 14:33 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 24/28] x86/speculation: Prepare arch_smt_update() for PRCTL mode Thomas Gleixner 2018-11-27 20:18 ` Lendacky, Thomas 2018-11-27 20:30 ` Thomas Gleixner 2018-11-27 21:20 ` Lendacky, Thomas 2018-11-28 14:34 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` Thomas Gleixner [this message] 2018-11-28 14:34 ` [tip:x86/pti] x86/speculation: Add prctl() control for indirect branch speculation tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 26/28] x86/speculation: Enable prctl mode for spectre_v2_user Thomas Gleixner 2018-11-26 7:56 ` Dominik Brodowski 2018-11-28 14:35 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-25 18:33 ` [patch V2 27/28] x86/speculation: Add seccomp Spectre v2 user space protection mode Thomas Gleixner 2018-11-25 19:35 ` Randy Dunlap 2018-11-25 20:40 ` Linus Torvalds 2018-11-25 20:52 ` Jiri Kosina 2018-11-25 22:28 ` Thomas Gleixner 2018-11-26 13:30 ` Ingo Molnar 2018-11-26 20:48 ` Andrea Arcangeli 2018-11-26 20:58 ` Thomas Gleixner 2018-11-26 21:52 ` Lendacky, Thomas 2018-11-27 0:37 ` Tim Chen 2018-12-04 1:38 ` Tim Chen 2018-12-04 8:39 ` Jiri Kosina 2018-12-04 9:43 ` Arjan van de Ven 2018-12-04 9:46 ` Arjan van de Ven 2018-12-04 17:20 ` Linus Torvalds 2018-12-04 18:58 ` Tim Chen 2018-11-28 14:35 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-12-04 18:45 ` [patch V2 27/28] " Dave Hansen 2018-11-25 18:33 ` [patch V2 28/28] x86/speculation: Provide IBPB always command line options Thomas Gleixner 2018-11-28 14:36 ` [tip:x86/pti] " tip-bot for Thomas Gleixner 2018-11-26 13:37 ` [patch V2 00/28] x86/speculation: Remedy the STIBP/IBPB overhead Ingo Molnar 2018-11-28 14:24 ` Thomas Gleixner 2018-11-29 19:02 ` Tim Chen 2018-12-10 23:43 ` Pavel Machek
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181125185005.866780996@linutronix.de \ --to=tglx@linutronix.de \ --cc=aarcange@redhat.com \ --cc=ak@linux.intel.com \ --cc=arjan@linux.intel.com \ --cc=asit.k.mallick@intel.com \ --cc=casey.schaufler@intel.com \ --cc=dave.hansen@intel.com \ --cc=david.c.stewart@intel.com \ --cc=dwmw@amazon.co.uk \ --cc=gregkh@linuxfoundation.org \ --cc=jcm@redhat.com \ --cc=jkosina@suse.cz \ --cc=jpoimboe@redhat.com \ --cc=keescook@chromium.org \ --cc=linux-kernel@vger.kernel.org \ --cc=longman9394@gmail.com \ --cc=luto@kernel.org \ --cc=peterz@infradead.org \ --cc=thomas.lendacky@amd.com \ --cc=tim.c.chen@linux.intel.com \ --cc=torvalds@linux-foundation.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \ linux-kernel@vger.kernel.org public-inbox-index lkml Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git