LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: tglx@linutronix.de, luto@kernel.org, ak@linux.intel.com
Cc: corbet@lwn.net, mingo@redhat.com, bp@alien8.de, x86@kernel.org,
	shuah@kernel.org, gregkh@linuxfoundation.org,
	tony.luck@intel.com, chang.seok.bae@intel.com,
	dave.hansen@linux.intel.com, peterz@infradead.org,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	jarkko.sakkinen@linux.intel.com, Sasha Levin <sashal@kernel.org>
Subject: [PATCH v13 00/16] Enable FSGSBASE instructions
Date: Thu, 28 May 2020 16:13:46 -0400
Message-ID: <20200528201402.1708239-1-sashal@kernel.org> (raw)

Benefits:
Currently a user process that wishes to read or write the FS/GS base must
make a system call. But recent X86 processors have added new instructions
for use in 64-bit mode that allow direct access to the FS and GS segment
base addresses.  The operating system controls whether applications can
use these instructions with a %cr4 control bit.

In addition to benefits to applications, performance improvements to the
OS context switch code are possible by making use of these instructions. A
third party reported out promising performance numbers out of their
initial benchmarking of the previous version of this patch series.

Enablement check:
The kernel provides information about the enabled state of FSGSBASE to
applications using the ELF_AUX vector. If the HWCAP2_FSGSBASE bit is set in
the AUX vector, the kernel has FSGSBASE instructions enabled and
applications can use them.

Kernel changes:
Major changes made in the kernel are in context switch, paranoid path, and
ptrace. In a context switch, a task's FS/GS base will be secured regardless
of its selector. In the paranoid path, GS base is unconditionally
overwritten to the kernel GS base on entry and the original GS base is
restored on exit. Ptrace includes divergence of FS/GS index and base
values.

Security:
For mitigating the Spectre v1 SWAPGS issue, LFENCE instructions were added
on most kernel entries. Those patches are dependent on previous behaviors
that users couldn't load a kernel address into the GS base. These patches
change that assumption since the user can load any address into GS base.
The changes to the kernel entry path in this patch series take account of
the SWAPGS issue.

Changes from v12:
 - Reformat the series to be closer to the reverted codebase for easier
   review.
 - Drop a few of the changes introduced in v8 and v9.


Andi Kleen (2):
  x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions
  x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2

Andy Lutomirski (3):
  x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE
  x86/process/64: Use FSBSBASE in switch_to() if available
  x86/cpu: Enable FSGSBASE on 64bit by default and add a chicken bit

Chang S. Bae (8):
  x86/ptrace: Prevent ptrace from clearing the FS/GS selector
  x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions
  x86/process/64: Use FSGSBASE instructions on thread copy and ptrace
  x86/entry/64: Switch CR3 before SWAPGS in paranoid entry
  x86/entry/64: Introduce the FIND_PERCPU_BASE macro
  x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit
  selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base
    write
  selftests/x86/fsgsbase: Test ptracer-induced GS base write with
    FSGSBASE

Thomas Gleixner (2):
  x86/process/64: Make save_fsgs() public available
  Documentation/x86/64: Add documentation for GS/FS addressing mode

Tony Luck (1):
  x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation

 .../admin-guide/kernel-parameters.txt         |   2 +
 Documentation/x86/x86_64/fsgs.rst             | 199 ++++++++++++++++++
 Documentation/x86/x86_64/index.rst            |   1 +
 arch/x86/entry/calling.h                      |  40 ++++
 arch/x86/entry/entry_64.S                     | 135 +++++++++---
 arch/x86/include/asm/fsgsbase.h               |  45 +++-
 arch/x86/include/asm/inst.h                   |  15 ++
 arch/x86/include/asm/processor.h              |   4 +-
 arch/x86/include/uapi/asm/hwcap2.h            |   3 +
 arch/x86/kernel/cpu/bugs.c                    |   6 +-
 arch/x86/kernel/cpu/common.c                  |  22 ++
 arch/x86/kernel/process.c                     |  10 +-
 arch/x86/kernel/process_64.c                  | 119 +++++++++--
 arch/x86/kernel/ptrace.c                      |  17 +-
 arch/x86/kvm/vmx/vmx.c                        |   2 +-
 tools/testing/selftests/x86/fsgsbase.c        |  24 ++-
 16 files changed, 562 insertions(+), 82 deletions(-)
 create mode 100644 Documentation/x86/x86_64/fsgs.rst

-- 
2.25.1


             reply index

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-28 20:13 Sasha Levin [this message]
2020-05-28 20:13 ` [PATCH v13 01/16] x86/ptrace: Prevent ptrace from clearing the FS/GS selector Sasha Levin
2020-05-28 20:13 ` [PATCH v13 02/16] x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE Sasha Levin
2020-05-28 20:13 ` [PATCH v13 03/16] x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions Sasha Levin
2020-05-28 20:13 ` [PATCH v13 04/16] x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions Sasha Levin
2020-05-28 20:13 ` [PATCH v13 05/16] x86/process/64: Use FSBSBASE in switch_to() if available Sasha Levin
2020-05-28 20:13 ` [PATCH v13 06/16] x86/process/64: Make save_fsgs() public available Sasha Levin
2020-06-18 13:50   ` [tip: x86/fsgsbase] x86/process/64: Make save_fsgs_for_kvm() ready for FSGSBASE tip-bot2 for Thomas Gleixner
2020-05-28 20:13 ` [PATCH v13 07/16] x86/process/64: Use FSGSBASE instructions on thread copy and ptrace Sasha Levin
2020-05-28 20:13 ` [PATCH v13 08/16] x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation Sasha Levin
2020-06-18 13:50   ` [tip: x86/fsgsbase] " tip-bot2 for Tony Luck
2020-05-28 20:13 ` [PATCH v13 09/16] x86/entry/64: Switch CR3 before SWAPGS in paranoid entry Sasha Levin
2020-05-28 20:13 ` [PATCH v13 10/16] x86/entry/64: Introduce the FIND_PERCPU_BASE macro Sasha Levin
2020-05-28 20:13 ` [PATCH v13 11/16] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit Sasha Levin
2020-05-28 20:13 ` [PATCH v13 12/16] x86/cpu: Enable FSGSBASE on 64bit by default and add a chicken bit Sasha Levin
2020-05-28 20:13 ` [PATCH v13 13/16] x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 Sasha Levin
2020-10-26 17:18   ` [PATCH] x86/elf: Fix use of internal macro BIT in uapi header Thiago Macieira
2020-05-28 20:14 ` [PATCH v13 14/16] Documentation/x86/64: Add documentation for GS/FS addressing mode Sasha Levin
2020-06-18 13:50   ` [tip: x86/fsgsbase] " tip-bot2 for Thomas Gleixner
2020-05-28 20:14 ` [PATCH v13 15/16] selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base write Sasha Levin
2020-05-29 14:40   ` Shuah Khan
2020-06-18 13:50   ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2020-05-28 20:14 ` [PATCH v13 16/16] selftests/x86/fsgsbase: Test ptracer-induced GS base write with FSGSBASE Sasha Levin
2020-05-29 14:42   ` Shuah Khan
2020-06-18 13:50   ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2020-06-18 14:18 ` [PATCH v13 00/16] Enable FSGSBASE instructions Thomas Gleixner
2020-06-18 18:08   ` Andy Lutomirski
2020-06-18 18:25     ` Thomas Gleixner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200528201402.1708239-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ak@linux.intel.com \
    --cc=bp@alien8.de \
    --cc=chang.seok.bae@intel.com \
    --cc=corbet@lwn.net \
    --cc=dave.hansen@linux.intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=shuah@kernel.org \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git