From: Thomas Gleixner <tglx@linutronix.de>
To: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Jiri Kosina <jikos@kernel.org>,
Tom Lendacky <thomas.lendacky@amd.com>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
David Woodhouse <dwmw@amazon.co.uk>,
Andi Kleen <ak@linux.intel.com>,
Dave Hansen <dave.hansen@intel.com>,
Casey Schaufler <casey.schaufler@intel.com>,
Asit Mallick <asit.k.mallick@intel.com>,
Arjan van de Ven <arjan@linux.intel.com>,
Jon Masters <jcm@redhat.com>,
linux-kernel@vger.kernel.org, x86@kernel.org
Subject: Re: [Patch v2 1/4] x86/speculation: Option to select app to app mitigation for spectre_v2
Date: Tue, 2 Oct 2018 22:04:05 +0200 (CEST) [thread overview]
Message-ID: <alpine.DEB.2.21.1810022145570.1435@nanos.tec.linutronix.de> (raw)
In-Reply-To: <cb7314d6deb8d1c58e2ead56fef8848b642e4e5a.1537920575.git.tim.c.chen@linux.intel.com>
On Tue, 25 Sep 2018, Tim Chen wrote:
> +enum spectre_v2_app2app_mitigation {
> + SPECTRE_V2_APP2APP_NONE,
> + SPECTRE_V2_APP2APP_LITE,
> + SPECTRE_V2_APP2APP_STRICT,
> +};
>
> static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
> SPECTRE_V2_NONE;
>
> +static enum spectre_v2_mitigation spectre_v2_app2app_enabled __ro_after_init =
Copy and paste. The enum type is wrong.
> + SPECTRE_V2_APP2APP_NONE;
> +
> +static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_app2app_cmdline(void)
Ditto
> +{
> + char arg[20];
> + int ret, i;
> + enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_APP2APP_CMD_AUTO;
Please use reverse fir tree ordering of the variables:
enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_APP2APP_CMD_AUTO;
char arg[20];
int ret, i;
> +
> + ret = cmdline_find_option(boot_command_line, "spectre_v2_app2app", arg, sizeof(arg));
Line break around 78 please
> @@ -325,6 +383,9 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
>
> static bool stibp_needed(void)
> {
> + if (static_branch_unlikely(&spectre_v2_app_lite))
> + return false;
> +
> if (spectre_v2_enabled == SPECTRE_V2_NONE)
> return false;
>
> @@ -366,7 +427,9 @@ void arch_smt_update(void)
> static void __init spectre_v2_select_mitigation(void)
> {
> enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
> + enum spectre_v2_app2app_mitigation_cmd app2app_cmd = spectre_v2_parse_app2app_cmdline();
Please avoid these overlong lines. Move the initialization to the code if
it does not fit into the declaration part.
> enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
> + enum spectre_v2_app2app_mitigation app2app_mode = SPECTRE_V2_APP2APP_NONE;
> /*
> * If the CPU is not affected and the command line mode is NONE or AUTO
> @@ -376,6 +439,17 @@ static void __init spectre_v2_select_mitigation(void)
> (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
> return;
>
> + switch (app2app_cmd) {
> + case SPECTRE_V2_APP2APP_CMD_LITE:
> + case SPECTRE_V2_APP2APP_CMD_AUTO:
> + app2app_mode = SPECTRE_V2_APP2APP_LITE;
> + break;
> +
> + case SPECTRE_V2_APP2APP_CMD_STRICT:
> + app2app_mode = SPECTRE_V2_APP2APP_STRICT;
> + break;
> + }
> +
> switch (cmd) {
> case SPECTRE_V2_CMD_NONE:
> return;
> @@ -427,6 +501,11 @@ static void __init spectre_v2_select_mitigation(void)
> }
>
> specv2_set_mode:
> + spectre_v2_app2app_enabled = app2app_mode;
> + pr_info("%s\n", spectre_v2_app2app_strings[app2app_mode]);
> + if (app2app_mode == SPECTRE_V2_APP2APP_LITE)
> + static_branch_enable(&spectre_v2_app_lite);
> +
> spectre_v2_enabled = mode;
> pr_info("%s\n", spectre_v2_strings[mode]);
>
> @@ -441,8 +520,8 @@ static void __init spectre_v2_select_mitigation(void)
> setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
> pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
>
> - /* Initialize Indirect Branch Prediction Barrier if supported */
> - if (boot_cpu_has(X86_FEATURE_IBPB)) {
> + /* Initialize Indirect Branch Prediction Barrier if supported and not disabled */
> + if (boot_cpu_has(X86_FEATURE_IBPB) && app2app_mode != SPECTRE_V2_APP2APP_NONE) {
Line breaks exist for a reason. Applies to comments and code.
> setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
> pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
> }
> @@ -875,8 +954,16 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
>
> case X86_BUG_SPECTRE_V2:
> mutex_lock(&spec_ctrl_mutex);
> - ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
> - boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
> + if (static_branch_unlikely(&spectre_v2_app_lite))
> + ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
> + boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB-lite" : "",
> + boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
> + (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
> + boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
> + spectre_v2_module_string());
> + else
> + ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
> + boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB-strict" : "",
> boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
> (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
> boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
Why do you need to copy the whole thing? What's wrong with using
spectre_v2_app2app_enabled for getting the proper string for the IBPB
mitigation?
> - * Check if the current (previous) task has access to the memory
> - * of the @tsk (next) task. If access is denied, make sure to
> + * For lite protection mode, we only protect the non-dumpable
> + * processes.
> + *
> + * Otherwise check if the current (previous) task has access to the memory
> + * of the @tsk (next) task for strict app to app protection.
> + * If access is denied, make sure to
> * issue a IBPB to stop user->user Spectre-v2 attacks.
> *
> * Note: __ptrace_may_access() returns 0 or -ERRNO.
> */
> - return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id &&
> - __ptrace_may_access(tsk, PTRACE_MODE_IBPB));
Needs to be updated to the latest code in tip x86/pti
> + /* skip IBPB if no context changes */
> + if (!tsk || !tsk->mm || tsk->mm->context.ctx_id == last_ctx_id)
> + return false;
> +
> + if (static_branch_unlikely(&spectre_v2_app_lite))
> + return (get_dumpable(tsk->mm) != SUID_DUMP_USER);
> + else
> + return (__ptrace_may_access(tsk, PTRACE_MODE_IBPB));
Neither of the branches needs braces for the return
Thanks,
tglx
next prev parent reply other threads:[~2018-10-02 20:04 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-26 0:43 [Patch v2 0/4] Provide options to enable spectre_v2 userspace-userspace protection Tim Chen
2018-09-26 0:43 ` [Patch v2 1/4] x86/speculation: Option to select app to app mitigation for spectre_v2 Tim Chen
2018-10-02 9:23 ` Ingo Molnar
2018-10-02 16:24 ` Tim Chen
2018-10-02 20:04 ` Thomas Gleixner [this message]
2018-09-26 0:43 ` [Patch v2 2/4] x86/speculation: Provide application property based STIBP protection Tim Chen
2018-10-02 19:10 ` Thomas Gleixner
2018-10-04 19:19 ` Tim Chen
2018-09-26 0:43 ` [Patch v2 3/4] x86/speculation: Extend per process STIBP to AMD cpus Tim Chen
2018-09-26 17:24 ` Tim Chen
2018-09-26 19:11 ` Lendacky, Thomas
2018-10-02 9:27 ` Ingo Molnar
2018-10-02 19:02 ` Thomas Gleixner
2018-09-26 0:43 ` [Patch v2 4/4] x86/speculation: Add prctl to control indirect branch speculation per process Tim Chen
2018-10-02 9:35 ` Ingo Molnar
2018-10-02 16:12 ` Tim Chen
2018-10-03 7:25 ` Ingo Molnar
2018-10-02 17:58 ` Thomas Gleixner
2018-10-05 18:12 ` Tim Chen
2018-10-05 18:46 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.21.1810022145570.1435@nanos.tec.linutronix.de \
--to=tglx@linutronix.de \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=arjan@linux.intel.com \
--cc=asit.k.mallick@intel.com \
--cc=casey.schaufler@intel.com \
--cc=dave.hansen@intel.com \
--cc=dwmw@amazon.co.uk \
--cc=jcm@redhat.com \
--cc=jikos@kernel.org \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=thomas.lendacky@amd.com \
--cc=tim.c.chen@linux.intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).