From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227dnEnRVDaltlB+0nQG0wargNdSUbfLB3jDmPPQwhO15LpzNtxg+M1WHKDGhKEp6LNixwgL ARC-Seal: i=1; a=rsa-sha256; t=1517226922; cv=none; d=google.com; s=arc-20160816; b=CjWW7x5Z5T+ki1Im0XMGEoS/qe0WpTuy+pAxYPjFa6iT/BugR0W0dNBGUMcLwwQ+Pe MKAR4oHQWsIGwHdCE2i4V3uHNNkR9Wkx7FJ1kwtugzmcIUVft0i3N/8WrhTgWdjLW4rU zd2ch+pj0HpiXgF/MOHemYn2v00L79BgDP8JEkeNxy9FsGwZ8Fl2glwRPekorhIVuThc /lbA7/PCXS0QjNrERqRsVoEytKCxXQYKr3O6gTvTOsDqgg9nXiNgDvS/VNUnvJVEjZy2 7mRaks9m4ZTe6SBCPnC2psU0av8jA+QwcPsx8fbX8lTfaykUyPSYsZgmehkMRG2+IEHw 2D4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:dkim-signature:arc-authentication-results; bh=vSgcYKqyTkhZZ3am0y/k02HWTnVhOWKcsxbhy8O+ND0=; b=0+a3Kd9LIyXSUSwCz5BV4ug+wTufjeWmlIzE64RXgFE8hH0xf8mC6R9o3QTngVSjYR D4Bg0Tg4bHqg2dJpv08rbyXy6qgyVI6/BRgL8EiG9ZOmBQrgP/dLzAkr65L5xBFrP6ba 15tcoEQ1/c85Mbp6mEmsPVYIYuXCvDnRcJRzHzSCcqbn4ZxqHFalQ1p+icqp/+pYRloZ pJc6US5zzWLj+dWa4TPUCn6QDf1iedzMrgOy7LJVD8QUHrSpCxPm6Q4vkZeH8tcoEjy/ agfYMBeJpTWzbz5sE62TL5KpRSfkfRL0YgUCG3GuUcEYJfWL48O6npK4gZApuJFWtF5R lmVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amazon.co.uk header.s=amazon201209 header.b=Qqf0xNxf; spf=pass (google.com: domain of prvs=5600f5902=dwmw@amazon.com designates 207.171.184.29 as permitted sender) smtp.mailfrom=prvs=5600f5902=dwmw@amazon.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.co.uk Authentication-Results: mx.google.com; dkim=pass header.i=@amazon.co.uk header.s=amazon201209 header.b=Qqf0xNxf; spf=pass (google.com: domain of prvs=5600f5902=dwmw@amazon.com designates 207.171.184.29 as permitted sender) smtp.mailfrom=prvs=5600f5902=dwmw@amazon.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.co.uk X-IronPort-AV: E=Sophos;i="5.46,429,1511827200"; d="scan'208";a="590837759" From: David Woodhouse To: arjan@linux.intel.com, tglx@linutronix.de, karahmed@amazon.de, x86@kernel.org, linux-kernel@vger.kernel.org, tim.c.chen@linux.intel.com, bp@alien8.de, peterz@infradead.org, pbonzini@redhat.com, ak@linux.intel.com, torvalds@linux-foundation.org, gregkh@linux-foundation.org, mingo@kernel.org, luto@kernel.org Subject: [PATCH] x86/speculation: Use Indirect Branch Prediction Barrier in context switch Date: Mon, 29 Jan 2018 11:33:28 +0000 Message-Id: <1517225608-9153-1-git-send-email-dwmw@amazon.co.uk> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590927737453215025?= X-GMAIL-MSGID: =?utf-8?q?1590927737453215025?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Tim Chen Flush indirect branches when switching into a process that marked itself non dumpable. This protects high value processes like gpg better, without having too high performance overhead. If done naïvely, we could switch to a kernel idle thread and then back to the original process, such as: process A -> idle -> process A In such scenario, we do not have to do IBPB here even though the process is non-dumpable, as we are switching back to the same process after a hiatus. To avoid the redundant IBPB, which is expensive, we track the last mm user context ID. The cost is to have an extra u64 mm context id to track the last mm we were using before switching to the init_mm used by idle. Avoiding the extra IBPB is probably worth the extra memory for this common scenario. For those cases where tlb_defer_switch_to_init_mm() returns true (non PCID), lazy tlb will defer switch to init_mm, so we will not be changing the mm for the process A -> idle -> process A switch. So IBPB will be skipped for this case. Thanks to the reviewers and Andy Lutomirski for the suggestion of using ctx_id which got rid of the problem of mm pointer recycling. Signed-off-by: Tim Chen Signed-off-by: David Woodhouse --- How close are we to done with bikeshedding this one?... arch/x86/include/asm/tlbflush.h | 2 ++ arch/x86/mm/tlb.c | 31 ++++++++++++++++++++++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h index 3effd3c..4405c4b 100644 --- a/arch/x86/include/asm/tlbflush.h +++ b/arch/x86/include/asm/tlbflush.h @@ -174,6 +174,8 @@ struct tlb_state { struct mm_struct *loaded_mm; u16 loaded_mm_asid; u16 next_asid; + /* last user mm's ctx id */ + u64 last_ctx_id; /* * We can be in one of several states: diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c index a156195..870fb99 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c @@ -6,13 +6,14 @@ #include #include #include +#include #include #include +#include #include #include #include -#include /* * TLB flushing, formerly SMP-only @@ -219,6 +220,25 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, } else { u16 new_asid; bool need_flush; + u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id); + + /* + * Avoid user/user BTB poisoning by flushing the branch + * predictor when switching between processes. This stops + * one process from doing Spectre-v2 attacks on another. + * + * As an optimization, flush indirect branches only when + * switching into processes that disable dumping. + * + * This will not flush branches when switching into kernel + * threads. It will also not flush if we switch to idle + * thread and back to the same process. It will flush if we + * switch to a different non-dumpable process. + */ + if (tsk && tsk->mm && + tsk->mm->context.ctx_id != last_ctx_id && + get_dumpable(tsk->mm) != SUID_DUMP_USER) + indirect_branch_prediction_barrier(); if (IS_ENABLED(CONFIG_VMAP_STACK)) { /* @@ -268,6 +288,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0); } + /* + * Record last user mm's context id, so we can avoid + * flushing branch buffer with IBPB if we switch back + * to the same user. + */ + if (next != &init_mm) + this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id); + this_cpu_write(cpu_tlbstate.loaded_mm, next); this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid); } @@ -345,6 +373,7 @@ void initialize_tlbstate_and_flush(void) write_cr3(build_cr3(mm->pgd, 0)); /* Reinitialize tlbstate. */ + this_cpu_write(cpu_tlbstate.last_ctx_id, mm->context.ctx_id); this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0); this_cpu_write(cpu_tlbstate.next_asid, 1); this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id); -- 2.7.4