linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Vegard Nossum <vegard.nossum@oracle.com>
To: Sasha Levin <sashal@kernel.org>,
	linux-kernel@vger.kernel.org, tglx@linutronix.de,
	luto@kernel.org
Cc: tony.luck@intel.com, ak@linux.intel.com, chang.seok.bae@intel.com
Subject: Re: [PATCH v10 00/18] Enable FSGSBASE instructions
Date: Sun, 10 May 2020 10:09:14 +0200	[thread overview]
Message-ID: <5a6a0ef5-4dfc-d0b1-9181-5df4211cfcd9@oracle.com> (raw)
In-Reply-To: <20200423232207.5797-1-sashal@kernel.org>


On 4/24/20 1:21 AM, Sasha Levin wrote:
> Benefits:
> Currently a user process that wishes to read or write the FS/GS base must
> make a system call. But recent X86 processors have added new instructions
> for use in 64-bit mode that allow direct access to the FS and GS segment
> base addresses.  The operating system controls whether applications can
> use these instructions with a %cr4 control bit.
> 
> In addition to benefits to applications, performance improvements to the
> OS context switch code are possible by making use of these instructions. A
> third party reported out promising performance numbers out of their
> initial benchmarking of the previous version of this patch series [9].
> 
> Enablement check:
> The kernel provides information about the enabled state of FSGSBASE to
> applications using the ELF_AUX vector. If the HWCAP2_FSGSBASE bit is set in
> the AUX vector, the kernel has FSGSBASE instructions enabled and
> applications can use them.
> 
> Kernel changes:
> Major changes made in the kernel are in context switch, paranoid path, and
> ptrace. In a context switch, a task's FS/GS base will be secured regardless
> of its selector. In the paranoid path, GS base is unconditionally
> overwritten to the kernel GS base on entry and the original GS base is
> restored on exit. Ptrace includes divergence of FS/GS index and base
> values.
> 
> Security:
> For mitigating the Spectre v1 SWAPGS issue, LFENCE instructions were added
> on most kernel entries. Those patches are dependent on previous behaviors
> that users couldn't load a kernel address into the GS base. These patches
> change that assumption since the user can load any address into GS base.
> The changes to the kernel entry path in this patch series take account of
> the SWAPGS issue.
> 
> Changes from v9:
> 
>   - Rebase on top of v5.7-rc1 and re-test.
>   - Work around changes in 2fff071d28b5 ("x86/process: Unify
>     copy_thread_tls()").
>   - Work around changes in c7ca0b614513 ("Revert "x86/ptrace: Prevent
>     ptrace from clearing the FS/GS selector" and fix the test").
> 
>   
> 
> Andi Kleen (2):
>    x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions
>    x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2
> 
> Andy Lutomirski (4):
>    x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE
>    x86/entry/64: Clean up paranoid exit
>    x86/fsgsbase/64: Use FSGSBASE in switch_to() if available
>    x86/fsgsbase/64: Enable FSGSBASE on 64bit by default and add a chicken
>      bit
> 
> Chang S. Bae (9):
>    x86/ptrace: Prevent ptrace from clearing the FS/GS selector
>    selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base
>      write
>    x86/entry/64: Switch CR3 before SWAPGS in paranoid entry
>    x86/entry/64: Introduce the FIND_PERCPU_BASE macro
>    x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit
>    x86/entry/64: Document GSBASE handling in the paranoid path
>    x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions
>    x86/fsgsbase/64: Use FSGSBASE instructions on thread copy and ptrace
>    selftests/x86/fsgsbase: Test ptracer-induced GS base write with
>      FSGSBASE
> 
> Sasha Levin (1):
>    x86/fsgsbase/64: move save_fsgs to header file
> 
> Thomas Gleixner (1):
>    Documentation/x86/64: Add documentation for GS/FS addressing mode
> 
> Tony Luck (1):
>    x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation
> 
>   .../admin-guide/kernel-parameters.txt         |   2 +
>   Documentation/x86/entry_64.rst                |   9 +
>   Documentation/x86/x86_64/fsgs.rst             | 199 ++++++++++++++++++
>   Documentation/x86/x86_64/index.rst            |   1 +
>   arch/x86/entry/calling.h                      |  40 ++++
>   arch/x86/entry/entry_64.S                     | 131 +++++++++---
>   arch/x86/include/asm/fsgsbase.h               |  45 +++-
>   arch/x86/include/asm/inst.h                   |  15 ++
>   arch/x86/include/uapi/asm/hwcap2.h            |   3 +
>   arch/x86/kernel/cpu/bugs.c                    |   6 +-
>   arch/x86/kernel/cpu/common.c                  |  22 ++
>   arch/x86/kernel/process.c                     |  10 +-
>   arch/x86/kernel/process.h                     |  69 ++++++
>   arch/x86/kernel/process_64.c                  | 142 +++++++------
>   arch/x86/kernel/ptrace.c                      |  17 +-
>   tools/testing/selftests/x86/fsgsbase.c        |  24 ++-
>   16 files changed, 606 insertions(+), 129 deletions(-)
>   create mode 100644 Documentation/x86/x86_64/fsgs.rst

So FWIW I've done some overnight fuzz testing of this patch set and
haven't seen any problems. Will try a couple of other kernel configs too.


Vegard

  parent reply	other threads:[~2020-05-10  8:12 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-23 23:21 Sasha Levin
2020-04-23 23:21 ` [PATCH v10 01/18] x86/ptrace: Prevent ptrace from clearing the FS/GS selector Sasha Levin
2020-04-25 22:46   ` Andy Lutomirski
2020-04-23 23:21 ` [PATCH v10 02/18] selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base write Sasha Levin
2020-04-23 23:21 ` [PATCH v10 03/18] x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE Sasha Levin
2020-04-23 23:21 ` [PATCH v10 04/18] x86/entry/64: Clean up paranoid exit Sasha Levin
2020-04-23 23:21 ` [PATCH v10 05/18] x86/entry/64: Switch CR3 before SWAPGS in paranoid entry Sasha Levin
2020-04-23 23:21 ` [PATCH v10 06/18] x86/entry/64: Introduce the FIND_PERCPU_BASE macro Sasha Levin
2020-04-23 23:21 ` [PATCH v10 07/18] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit Sasha Levin
2020-04-23 23:21 ` [PATCH v10 08/18] x86/entry/64: Document GSBASE handling in the paranoid path Sasha Levin
2020-04-23 23:21 ` [PATCH v10 09/18] x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions Sasha Levin
2020-04-23 23:21 ` [PATCH v10 10/18] x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions Sasha Levin
2020-04-23 23:22 ` [PATCH v10 11/18] x86/fsgsbase/64: Use FSGSBASE in switch_to() if available Sasha Levin
2020-04-23 23:22 ` [PATCH v10 12/18] x86/fsgsbase/64: move save_fsgs to header file Sasha Levin
2020-04-23 23:22 ` [PATCH v10 13/18] x86/fsgsbase/64: Use FSGSBASE instructions on thread copy and ptrace Sasha Levin
2020-04-23 23:22 ` [PATCH v10 14/18] x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation Sasha Levin
2020-04-23 23:22 ` [PATCH v10 15/18] selftests/x86/fsgsbase: Test ptracer-induced GS base write with FSGSBASE Sasha Levin
2020-04-23 23:22 ` [PATCH v10 16/18] x86/fsgsbase/64: Enable FSGSBASE on 64bit by default and add a chicken bit Sasha Levin
2020-04-23 23:22 ` [PATCH v10 17/18] x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 Sasha Levin
2020-04-23 23:22 ` [PATCH v10 18/18] Documentation/x86/64: Add documentation for GS/FS addressing mode Sasha Levin
2020-05-10  8:09 ` Vegard Nossum [this message]
2020-05-10  8:29   ` [PATCH v10 00/18] Enable FSGSBASE instructions Vegard Nossum
2020-05-10 10:15     ` Thomas Gleixner
2020-05-10 14:17       ` Sasha Levin
2020-05-11  0:48     ` Andi Kleen
2020-05-11  0:50       ` Andi Kleen
2020-05-11  5:03         ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5a6a0ef5-4dfc-d0b1-9181-5df4211cfcd9@oracle.com \
    --to=vegard.nossum@oracle.com \
    --cc=ak@linux.intel.com \
    --cc=chang.seok.bae@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=sashal@kernel.org \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    --subject='Re: [PATCH v10 00/18] Enable FSGSBASE instructions' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox