From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Jiri Kosina" <jkosina@suse.cz>,
"Peter Zijlstra" <peterz@infradead.org>,
"David Woodhouse" <dwmw@amazon.co.uk>,
"Asit Mallick" <asit.k.mallick@intel.com>,
"Kees Cook" <keescook@chromium.org>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@kernel.org>,
"Andi Kleen" <ak@linux.intel.com>,
"Dave Hansen" <dave.hansen@intel.com>,
"Arjan van de Ven" <arjan@linux.intel.com>,
"Andrea Arcangeli" <aarcange@redhat.com>,
"Tim Chen" <tim.c.chen@linux.intel.com>,
"Andy Lutomirski" <luto@kernel.org>,
"Casey Schaufler" <casey.schaufler@intel.com>,
"Waiman Long" <longman9394@gmail.com>,
"Linus Torvalds" <torvalds@linux-foundation.org>,
"Jon Masters" <jcm@redhat.com>,
"Dave Stewart" <david.c.stewart@intel.com>,
"Josh Poimboeuf" <jpoimboe@redhat.com>,
"Greg KH" <gregkh@linuxfoundation.org>,
"Tom Lendacky" <thomas.lendacky@amd.com>
Subject: [PATCH 3.16 57/86] x86/speculation: Enable prctl mode for spectre_v2_user
Date: Thu, 16 May 2019 16:55:33 +0100 [thread overview]
Message-ID: <lsq.1558022133.26224445@decadent.org.uk> (raw)
In-Reply-To: <lsq.1558022132.52852998@decadent.org.uk>
3.16.68-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 7cc765a67d8e04ef7d772425ca5a2a1e2b894c15 upstream.
Now that all prerequisites are in place:
- Add the prctl command line option
- Default the 'auto' mode to 'prctl'
- When SMT state changes, update the static key which controls the
conditional STIBP evaluation on context switch.
- At init update the static key which controls the conditional IBPB
evaluation on context switch.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Casey Schaufler <casey.schaufler@intel.com>
Cc: Asit Mallick <asit.k.mallick@intel.com>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Jon Masters <jcm@redhat.com>
Cc: Waiman Long <longman9394@gmail.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Dave Stewart <david.c.stewart@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Link: https://lkml.kernel.org/r/20181125185005.958421388@linutronix.de
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
Docuemntation/kernel-parameters.txt | 7 +++-
arch/x86/kernel/cpu/bugs.c | 41 +++++++++++++++----
2 files changed, 38 insertions(+), 10 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3218,9 +3218,14 @@ bytes respectively. Such letter suffixes
off - Unconditionally disable mitigations. Is
enforced by spectre_v2=off
+ prctl - Indirect branch speculation is enabled,
+ but mitigation can be enabled via prctl
+ per thread. The mitigation control state
+ is inherited on fork.
+
auto - Kernel selects the mitigation depending on
the available CPU features and vulnerability.
- Default is off.
+ Default is prctl.
Not specifying this option is equivalent to
spectre_v2_user=auto.
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -307,11 +307,13 @@ enum spectre_v2_user_cmd {
SPECTRE_V2_USER_CMD_NONE,
SPECTRE_V2_USER_CMD_AUTO,
SPECTRE_V2_USER_CMD_FORCE,
+ SPECTRE_V2_USER_CMD_PRCTL,
};
static const char * const spectre_v2_user_strings[] = {
[SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
[SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
+ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
};
static const struct {
@@ -322,6 +324,7 @@ static const struct {
{ "auto", SPECTRE_V2_USER_CMD_AUTO, false },
{ "off", SPECTRE_V2_USER_CMD_NONE, false },
{ "on", SPECTRE_V2_USER_CMD_FORCE, true },
+ { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
};
static void __init spec_v2_user_print_cond(const char *reason, bool secure)
@@ -375,12 +378,15 @@ spectre_v2_user_select_mitigation(enum s
smt_possible = false;
switch (spectre_v2_parse_user_cmdline(v2_cmd)) {
- case SPECTRE_V2_USER_CMD_AUTO:
case SPECTRE_V2_USER_CMD_NONE:
goto set_mode;
case SPECTRE_V2_USER_CMD_FORCE:
mode = SPECTRE_V2_USER_STRICT;
break;
+ case SPECTRE_V2_USER_CMD_AUTO:
+ case SPECTRE_V2_USER_CMD_PRCTL:
+ mode = SPECTRE_V2_USER_PRCTL;
+ break;
}
/* Initialize Indirect Branch Prediction Barrier */
@@ -391,6 +397,9 @@ spectre_v2_user_select_mitigation(enum s
case SPECTRE_V2_USER_STRICT:
static_branch_enable(&switch_mm_always_ibpb);
break;
+ case SPECTRE_V2_USER_PRCTL:
+ static_branch_enable(&switch_mm_cond_ibpb);
+ break;
default:
break;
}
@@ -403,6 +412,12 @@ spectre_v2_user_select_mitigation(enum s
if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
return;
+ /*
+ * If SMT is not possible or STIBP is not available clear the STIPB
+ * mode.
+ */
+ if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
+ mode = SPECTRE_V2_USER_NONE;
set_mode:
spectre_v2_user = mode;
/* Only print the STIBP mode when SMT possible */
@@ -610,6 +625,15 @@ static void update_stibp_strict(void)
on_each_cpu(update_stibp_msr, NULL, 1);
}
+/* Update the static key controlling the evaluation of TIF_SPEC_IB */
+static void update_indir_branch_cond(void)
+{
+ if (sched_smt_active())
+ static_branch_enable(&switch_to_cond_stibp);
+ else
+ static_branch_disable(&switch_to_cond_stibp);
+}
+
void arch_smt_update(void)
{
/* Enhanced IBRS implies STIBP. No update required. */
@@ -625,6 +649,7 @@ void arch_smt_update(void)
update_stibp_strict();
break;
case SPECTRE_V2_USER_PRCTL:
+ update_indir_branch_cond();
break;
}
@@ -1012,7 +1037,8 @@ static char *stibp_state(void)
case SPECTRE_V2_USER_STRICT:
return ", STIBP: forced";
case SPECTRE_V2_USER_PRCTL:
- return "";
+ if (static_key_enabled(&switch_to_cond_stibp))
+ return ", STIBP: conditional";
}
return "";
}
@@ -1020,14 +1046,11 @@ static char *stibp_state(void)
static char *ibpb_state(void)
{
if (boot_cpu_has(X86_FEATURE_IBPB)) {
- switch (spectre_v2_user) {
- case SPECTRE_V2_USER_NONE:
- return ", IBPB: disabled";
- case SPECTRE_V2_USER_STRICT:
+ if (static_key_enabled(&switch_mm_always_ibpb))
return ", IBPB: always-on";
- case SPECTRE_V2_USER_PRCTL:
- return "";
- }
+ if (static_key_enabled(&switch_mm_cond_ibpb))
+ return ", IBPB: conditional";
+ return ", IBPB: disabled";
}
return "";
}
next prev parent reply other threads:[~2019-05-16 16:03 UTC|newest]
Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-16 15:55 [PATCH 3.16 00/86] 3.16.68-rc1 review Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 04/86] MIPS: jump_label.c: Correct the span of the J instruction Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 01/86] x86/cpufeature: Add bug flags to /proc/cpuinfo Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 08/86] jump_label: Allow asm/jump_label.h to be included in assembly Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 07/86] s390/jump label: use different nop instruction Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 10/86] module, jump_label: Fix module locking Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 02/86] module: add within_module() function Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 03/86] jump_label: Fix small typos in the documentation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 09/86] jump_label: Allow jump labels to be used in assembly Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 05/86] MIPS: jump_label.c: Handle the microMIPS J instruction encoding Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 06/86] s390/jump label: add sanity checks Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 75/86] x86/speculation: Move arch_smt_update() call to after mitigation decisions Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 43/86] x86/speculation: Rework SMT state change Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 78/86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 68/86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 32/86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 63/86] x86/speculation/mds: Add basic bug infrastructure for MDS Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 34/86] x86/speculation: Update the TIF_SSBD comment Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 64/86] x86/speculation/mds: Add BUG_MSBDS_ONLY Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 79/86] cpu/speculation: Add 'mitigations=' cmdline option Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 66/86] x86/speculation/mds: Add mds_clear_cpu_buffers() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 76/86] x86/speculation/mds: Add SMT warning message Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 21/86] x86/asm: Error out if asm/jump_label.h is included inappropriately Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 51/86] x86/speculation: Avoid __switch_to_xtra() calls Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 45/86] x86/speculation: Mark string arrays const correctly Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 41/86] x86/Kconfig: Select SCHED_SMT if SMP enabled Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 14/86] locking/static_keys: Rework update logic Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 77/86] x86/speculation/mds: Fix comment Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 27/86] x86/speculation: Support Enhanced IBRS on future CPUs Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 38/86] x86/speculation: Disable STIBP when enhanced IBRS is in use Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 31/86] x86/speculation: Apply IBPB more strictly to avoid cross-process data leak Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 33/86] x86/speculation: Propagate information about RSB filling mitigation to sysfs Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 70/86] x86/speculation/l1tf: Document l1tf in sysfs Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 16/86] jump label, locking/static_keys: Update docs Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 81/86] x86/speculation/mds: Add 'mitigations=' support for MDS Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 44/86] x86/speculation: Reorder the spec_v2 code Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 60/86] kvm: x86: Report STIBP on GET_SUPPORTED_CPUID Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 35/86] x86/speculation: Clean up spectre_v2_parse_cmdline() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 18/86] locking/static_keys: Fix a silly typo Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 80/86] x86/speculation: Support 'mitigations=' cmdline option Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 40/86] x86/speculation: Reorganize speculation control MSRs update Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 30/86] x86/cpu: Sanitize FAM6_ATOM naming Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 58/86] x86/speculation: Add seccomp Spectre v2 user space protection mode Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 39/86] x86/speculation: Rename SSBD update functions Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 50/86] x86/process: Consolidate and simplify switch_to_xtra() code Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 37/86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 82/86] x86/mds: Add MDSUM variant to the MDS documentation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 36/86] x86/speculation: Remove unnecessary ret variable in cpu_show_common() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 52/86] x86/speculation: Prepare for conditional IBPB in switch_mm() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 54/86] x86/speculation: Prepare arch_smt_update() for PRCTL mode Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 69/86] x86/speculation/mds: Add mitigation control for MDS Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 28/86] x86/speculation: Simplify the CPU bug detection logic Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 71/86] x86/speculation/mds: Add sysfs reporting for MDS Ben Hutchings
2019-05-16 15:55 ` Ben Hutchings [this message]
2019-05-16 15:55 ` [PATCH 3.16 86/86] x86/bugs: Change L1TF mitigation string to match upstream Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 59/86] x86/speculation: Provide IBPB always command line options Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 48/86] x86/speculation: Add command line control for indirect branch speculation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 83/86] Documentation: Correct the possible MDS sysfs values Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 23/86] x86/headers: Don't include asm/processor.h in asm/atomic.h Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 22/86] x86/asm: Add asm macros for static keys/jump labels Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 29/86] x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 74/86] Documentation: Add MDS vulnerability documentation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 24/86] x86/cpufeature: Carve out X86_FEATURE_* Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 62/86] x86/speculation: Consolidate CPU whitelists Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 73/86] Documentation: Move L1TF to separate directory Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 19/86] locking/static_keys: Fix up the static keys documentation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 15/86] locking/static_keys: Add a new static_key interface Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 49/86] x86/speculation: Prepare for per task indirect branch speculation control Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 46/86] x86/speculataion: Mark command line parser data __initdata Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 53/86] x86/speculation: Split out TIF update Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 11/86] jump_label: Rename JUMP_LABEL_{EN,DIS}ABLE to JUMP_LABEL_{JMP,NOP} Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 85/86] x86/cpu/bugs: Use __initconst for 'const' init data Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 13/86] jump_label: Add jump_entry_key() helper Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 61/86] x86/msr-index: Cleanup bit defines Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 55/86] x86/speculation: Prevent stale SPEC_CTRL msr content Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 84/86] x86/speculation/mds: Fix documentation typo Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 67/86] x86/speculation/mds: Clear CPU buffers on exit to user Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 65/86] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 56/86] x86/speculation: Add prctl() control for indirect branch speculation Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 12/86] jump_label, locking/static_keys: Rename JUMP_LABEL_TYPE_* and related helpers to the static_key* pattern Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 47/86] x86/speculation: Unify conditional spectre v2 print functions Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 26/86] locking/static_keys: Provide DECLARE and well as DEFINE macros Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 25/86] locking/static_key: Fix concurrent static_key_slow_inc() Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 17/86] jump_label/x86: Work around asm build bug on older/backported GCCs Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 20/86] jump_label: make static_key_enabled() work on static_key_true/false types too Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 72/86] x86/speculation/mds: Add mitigation mode VMWERV Ben Hutchings
2019-05-16 15:55 ` [PATCH 3.16 42/86] sched: Add sched_smt_active() Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1558022133.26224445@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=arjan@linux.intel.com \
--cc=asit.k.mallick@intel.com \
--cc=casey.schaufler@intel.com \
--cc=dave.hansen@intel.com \
--cc=david.c.stewart@intel.com \
--cc=dwmw@amazon.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=jcm@redhat.com \
--cc=jkosina@suse.cz \
--cc=jpoimboe@redhat.com \
--cc=kda@linux-powerpc.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=longman9394@gmail.com \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tim.c.chen@linux.intel.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).