| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20181122122638.GC10365@zn.tnic>
Date: Thu, 22 Nov 2018 13:26:38 +0100
From: Borislav Petkov <bp@...en8.de>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
Peter Zijlstra <peterz@...radead.org>,
Andy Lutomirski <luto@...nel.org>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Jiri Kosina <jkosina@...e.cz>,
Tom Lendacky <thomas.lendacky@....com>,
Josh Poimboeuf <jpoimboe@...hat.com>,
Andrea Arcangeli <aarcange@...hat.com>,
David Woodhouse <dwmw@...zon.co.uk>,
Andi Kleen <ak@...ux.intel.com>,
Dave Hansen <dave.hansen@...el.com>,
Casey Schaufler <casey.schaufler@...el.com>,
Asit Mallick <asit.k.mallick@...el.com>,
Arjan van de Ven <arjan@...ux.intel.com>,
Jon Masters <jcm@...hat.com>,
Waiman Long <longman9394@...il.com>,
Greg KH <gregkh@...uxfoundation.org>,
Dave Stewart <david.c.stewart@...el.com>,
Kees Cook <keescook@...omium.org>,
Tim Chen <tim.c.chen@...ux.intel.com>
Subject: Re: [patch 22/24] x86/speculation: Create PRCTL interface to
restrict indirect branch speculation
On Wed, Nov 21, 2018 at 09:14:52PM +0100, Thomas Gleixner wrote:
> From: Tim Chen <tim.c.chen@...ux.intel.com>
>
> Add the PR_SPEC_INDIR_BRANCH option for the PR_GET_SPECULATION_CTRL and
> PR_SET_SPECULATION_CTRL prctls to allow fine grained per task control of
> indirect branch speculation via STIBP.
>
> Invocations:
> Check indirect branch speculation status with
> - prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, 0, 0, 0);
>
> Enable indirect branch speculation with
> - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_ENABLE, 0, 0);
>
> Disable indirect branch speculation with
> - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_DISABLE, 0, 0);
>
> Force disable indirect branch speculation with
> - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
>
> See Documentation/userspace-api/spec_ctrl.rst.
>
> Signed-off-by: Tim Chen <tim.c.chen@...ux.intel.com>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
>
> ---
> Documentation/userspace-api/spec_ctrl.rst | 9 +++
> arch/x86/include/asm/nospec-branch.h | 1
> arch/x86/kernel/cpu/bugs.c | 71 ++++++++++++++++++++++++++++++
> include/linux/sched.h | 9 +++
> include/uapi/linux/prctl.h | 1
> tools/include/uapi/linux/prctl.h | 1
> 6 files changed, 92 insertions(+)
> @@ -753,12 +755,56 @@ static int ssb_prctl_set(struct task_str
> return 0;
> }
>
> +static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
> +{
> + switch (ctrl) {
> + case PR_SPEC_ENABLE:
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> + return 0;
> + /*
> + * Indirect branch speculation is always disabled in strict
> + * mode.
> + */
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> + return -EPERM;
> + task_clear_spec_indir_branch_disable(task);
> + task_update_spec_tif(task, TIF_SPEC_IB, false);
> + break;
> + case PR_SPEC_DISABLE:
> + /*
> + * Indirect branch speculation is always allowed when
> + * mitigation is force disabled.
> + */
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> + return -EPERM;
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> + return 0;
> + task_set_spec_indir_branch_disable(task);
> + task_update_spec_tif(task, TIF_SPEC_IB, true);
> + break;
> + case PR_SPEC_FORCE_DISABLE:
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> + return -EPERM;
> + if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> + return 0;
> + task_set_spec_indir_branch_disable(task);
> + task_set_spec_indir_branch_force_disable(task);
> + task_update_spec_tif(task, TIF_SPEC_IB, true);
> + break;
> + default:
> + return -ERANGE;
> + }
> + return 0;
> +}
Perhaps merge the two DISABLE branches to make it obvious what the
difference between them is:
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 6eac074e3935..28cece3a067b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -769,7 +769,9 @@ static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
task_clear_spec_indir_branch_disable(task);
task_update_spec_tif(task, TIF_SPEC_IB, false);
break;
+
case PR_SPEC_DISABLE:
+ case PR_SPEC_FORCE_DISABLE:
/*
* Indirect branch speculation is always allowed when
* mitigation is force disabled.
@@ -780,16 +782,11 @@ static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
return 0;
task_set_spec_indir_branch_disable(task);
task_update_spec_tif(task, TIF_SPEC_IB, true);
+
+ if (ctrl == PR_SPEC_FORCE_DISABLE)
+ task_set_spec_indir_branch_force_disable(task);
break;
- case PR_SPEC_FORCE_DISABLE:
- if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
- return -EPERM;
- if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
- return 0;
- task_set_spec_indir_branch_disable(task);
- task_set_spec_indir_branch_force_disable(task);
- task_update_spec_tif(task, TIF_SPEC_IB, true);
- break;
+
default:
return -ERANGE;
}
> @@ -1453,6 +1453,8 @@ static inline bool is_percpu_thread(void
> #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */
> #define PFA_SPEC_SSB_DISABLE 3 /* Speculative Store Bypass disabled */
> #define PFA_SPEC_SSB_FORCE_DISABLE 4 /* Speculative Store Bypass force disabled*/
> +#define PFA_SPEC_INDIR_BRANCH_DISABLE 5 /* Indirect branch speculation restricted */
> +#define PFA_SPEC_INDIR_BRANCH_FORCE_DISABLE 6 /* Indirect branch speculation permanentely restricted */
permanently
--
Regards/Gruss,
Boris.
Good mailing practices for 400: avoid top-posting and trim the reply.
Powered by blists - more mailing lists