From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225Gq0EikqvotdnOY4qntEgmIMT8MBpwx+rSTo9cyDn0Ju3kRE/sTXLX2+1vB/cN6GHDDKeu ARC-Seal: i=1; a=rsa-sha256; t=1516712834; cv=none; d=google.com; s=arc-20160816; b=A9+1VD9nBcTy+bWaU8Jez0D46+exIZOjrq5wljDr8G0dPSsEgpyCwxmageb302bt7z p4L29zWD+uVOK1H+S0qwf3TEdm5UBcvzWprw+wXPHdlbU0X+jY3E1AWgkUq6xN15ftLS YvBwpl7uiUpznN2FY5/9raOZY5EKcBIqwQ1g9L8VOMRsCajNe4lTu1rYPMI/IcWZkBu1 Cjdw3o9HOpiabAAshJ4uz/gv9wVLvPGoA7Ajb0m1U/DbuEYWYXpJop8GH7+hZooTwWPJ Brz7pHTlfuYRNKykTrRoFDQgAxxWnau2k7pnGOH4zpWWmpqtT34VmWolyBG7Y7yc5P67 nPEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:references:in-reply-to:date:subject:cc:to:from :arc-authentication-results; bh=XZQJIq29sykpN3A4vFreKAbkbGWZvu5KQC+KkXM1yEY=; b=WylY65xb12Ib4QGERKMOdHb+y+8nEt1Ni6gEgFMLITcfaREqkI15QaYU629K3mFDuK MJU+X+4aFwz0dKTyE6+qytlMuZaWDkQ+6TUXurf6e7+Q8CaGWJsYmoY8RG5jl5ATRliw oEJh1f/9Y4lUo2vEnekX0nzgOXbIz0gykDsjK5ZkXD3fNI4ycS9NQrADXW/v5qOj88yO fTjbBVN7mhAsLavrsrTtYIQFy3CK2R+sl1BZwwJt9plj9k0svJCBMNq+rKm9/TUdGW4c JM15tko/H5FciHu4Rxf1QUjhTn/8SbhVOCe7TE5HfvBQWFAineWFv4vOJ0baXsU+IspT 7DMA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of schwidefsky@de.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=schwidefsky@de.ibm.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of schwidefsky@de.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=schwidefsky@de.ibm.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com From: Martin Schwidefsky To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: Heiko Carstens , Christian Borntraeger , Paolo Bonzini , Cornelia Huck , David Hildenbrand , Greg Kroah-Hartman , Jon Masters , Marcus Meissner , Jiri Kosina Subject: [PATCH 1/5] prctl: add PR_ISOLATE_BP process control Date: Tue, 23 Jan 2018 14:07:01 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1516712825-2917-1-git-send-email-schwidefsky@de.ibm.com> References: <1516712825-2917-1-git-send-email-schwidefsky@de.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 18012313-0012-0000-0000-000005A6DA9D X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18012313-0013-0000-0000-000019226217 Message-Id: <1516712825-2917-2-git-send-email-schwidefsky@de.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-01-23_03:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1801230179 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590388677068788062?= X-GMAIL-MSGID: =?utf-8?q?1590388677068788062?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: Add the PR_ISOLATE_BP operation to prctl. The effect of the process control is to make all branch prediction entries created by the execution of the user space code of this task not applicable to kernel code or the code of any other task. This can be achieved by the architecture specific implementation in different ways, e.g. by limiting the branch predicion for the task, or by clearing the branch prediction tables on each context switch, or by tagging the branch prediction entries in a suitable way. The architecture code needs to define the ISOLATE_BP macro to implement the hardware specific details of the branch prediction isolation. The control can not be removed from a task once it is activated and it is inherited by all children of the task. The user space wrapper to start a program with the isolated branch prediction: int main(int argc, char *argv[], char *envp[]) { int rc; if (argc < 2) { fprintf(stderr, "Usage: %s \n", argv[0]); exit(EXIT_FAILURE); } rc = prctl(PR_ISOLATE_BP); if (rc) { perror("PR_ISOLATE_BP"); exit(EXIT_FAILURE); } execve(argv[1], argv + 1, envp); perror("execve"); exit(EXIT_FAILURE); } Signed-off-by: Martin Schwidefsky --- include/uapi/linux/prctl.h | 8 ++++++++ kernel/sys.c | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h index af5f8c2..e7b84c9 100644 --- a/include/uapi/linux/prctl.h +++ b/include/uapi/linux/prctl.h @@ -207,4 +207,12 @@ struct prctl_mm_map { # define PR_SVE_VL_LEN_MASK 0xffff # define PR_SVE_VL_INHERIT (1 << 17) /* inherit across exec */ +/* + * Prevent branch prediction entries created by the execution of + * user space code of this task to be used in any other context. + * This makes it impossible for malicious user space code to train + * a branch in the kernel code or in another task to be mispredicted. + */ +#define PR_ISOLATE_BP 52 + #endif /* _LINUX_PRCTL_H */ diff --git a/kernel/sys.c b/kernel/sys.c index 83ffd7d..e41cb2f 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -117,6 +117,9 @@ #ifndef SVE_GET_VL # define SVE_GET_VL() (-EINVAL) #endif +#ifndef ISOLATE_BP +# define ISOLATE_BP() (-EINVAL) +#endif /* * this is where the system-wide overflow UID and GID are defined, for @@ -2398,6 +2401,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, case PR_SVE_GET_VL: error = SVE_GET_VL(); break; + case PR_ISOLATE_BP: + error = ISOLATE_BP(); + break; default: error = -EINVAL; break; -- 2.7.4