From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F28DCC04EBB for ; Wed, 21 Nov 2018 00:34:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6003721479 for ; Wed, 21 Nov 2018 00:34:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6003721479 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727610AbeKULF7 (ORCPT ); Wed, 21 Nov 2018 06:05:59 -0500 Received: from mga14.intel.com ([192.55.52.115]:30250 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727171AbeKULFX (ORCPT ); Wed, 21 Nov 2018 06:05:23 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Nov 2018 16:33:27 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,259,1539673200"; d="scan'208";a="93650224" Received: from skl-02.jf.intel.com ([10.54.74.62]) by orsmga008.jf.intel.com with ESMTP; 20 Nov 2018 16:33:27 -0800 From: Tim Chen To: Jiri Kosina , Thomas Gleixner Cc: Tim Chen , Linus Torvalds , Tom Lendacky , Ingo Molnar , Peter Zijlstra , Josh Poimboeuf , Andrea Arcangeli , David Woodhouse , Andi Kleen , Dave Hansen , Casey Schaufler , Asit Mallick , Arjan van de Ven , Jon Masters , Waiman Long , Greg KH , Dave Stewart , linux-kernel@vger.kernel.org, x86@kernel.org, stable@vger.kernel.org Subject: [Patch v6 11/16] x86/speculation: Enable IBPB for tasks with TIF_SPEC_BRANCH_SPECULATION Date: Tue, 20 Nov 2018 16:00:03 -0800 Message-Id: <9f9cfed2830ebf5cce69190409b0716406aeaf22.1542757030.git.tim.c.chen@linux.intel.com> X-Mailer: git-send-email 2.9.4 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org IBPB currently is applied to all tasks. However, when spectre_v2_app2app_enabled is set to default value SPECTRE_V2_APP2APP_PRCTL, only tasks marked with TIF_SPEC_BRANCH_SPECULATION via prctl are protected against Spectre V2 sibling thread attack to minimize performance impact. Extend this option to IBPB to protect only tasks marked with TIF_SPEC_BRANCH_SPECULATION needing mitigation to minimize performance impact. Make IBPB usage follow the spectre_v2_app2app_enabled option: spectre_v2_app2app = SPECTRE_V2_APP2APP_PRCTL : Use IBPB only on tasks with TIF_SPEC_BRANCH_SPECULATION SPECTRE_V2_APP2APP_STRICT : Use IBPB on all tasks SPECTRE_V2_APP2APP_NONE : Don't use IBPB Signed-off-by: Tim Chen --- arch/x86/kernel/cpu/bugs.c | 29 ++++++++++++++++++----------- arch/x86/mm/tlb.c | 23 ++++++++++++++++++----- 2 files changed, 36 insertions(+), 16 deletions(-) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 26e1a87..44f7127 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -534,12 +534,6 @@ static void __init spectre_v2_select_mitigation(void) setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); - /* Initialize Indirect Branch Prediction Barrier if supported */ - if (boot_cpu_has(X86_FEATURE_IBPB)) { - setup_force_cpu_cap(X86_FEATURE_USE_IBPB); - pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n"); - } - /* * Retpoline means the kernel is safe because it has no indirect * branches. Enhanced IBRS protects firmware too, so, enable restricted @@ -558,8 +552,9 @@ static void __init spectre_v2_select_mitigation(void) app2app_mode = SPECTRE_V2_APP2APP_NONE; - /* No mitigation if mitigation feature is unavailable */ - if (!boot_cpu_has(X86_FEATURE_STIBP)) + /* No mitigation if all mitigation features are unavailable */ + if (!boot_cpu_has(X86_FEATURE_IBPB) && + !boot_cpu_has(X86_FEATURE_STIBP)) goto set_app2app_mode; app2app_cmd = spectre_v2_parse_app2app_cmdline(cmd); @@ -587,6 +582,16 @@ static void __init spectre_v2_select_mitigation(void) break; } + /* + * Initialize Indirect Branch Prediction Barrier if supported + * and not disabled explicitly + */ + if (boot_cpu_has(X86_FEATURE_IBPB) && + app2app_mode != SPECTRE_V2_APP2APP_NONE) { + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); + pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n"); + } + set_app2app_mode: spectre_v2_app2app_enabled = app2app_mode; pr_info("%s\n", spectre_v2_app2app_strings[app2app_mode]); @@ -1076,10 +1081,12 @@ static char *stibp_state(void) static char *ibpb_state(void) { - if (boot_cpu_has(X86_FEATURE_USE_IBPB)) - return ", IBPB"; - else + if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE) return ""; + else if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_PRCTL) + return ", IBPB-prctl"; + else + return ", IBPB-all"; } static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c index bddd6b3..616694c 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c @@ -184,14 +184,27 @@ static void sync_current_stack_to_mm(struct mm_struct *mm) static bool ibpb_needed(struct task_struct *tsk, u64 last_ctx_id) { /* - * Check if the current (previous) task has access to the memory - * of the @tsk (next) task. If access is denied, make sure to - * issue a IBPB to stop user->user Spectre-v2 attacks. + * Don't issue IBPB when switching to kernel threads or staying in the + * same mm context. + */ + if (!tsk || !tsk->mm || tsk->mm->context.ctx_id == last_ctx_id) + return false; + + /* + * If lite protection mode is enabled, check the STIBP thread flag. + * + * Otherwise check if the current (previous) task has access to the + * the memory of the @tsk (next) task for strict app to app protection. + * If access is denied, make sure to issue a IBPB to stop user->user + * Spectre-v2 attacks. * * Note: __ptrace_may_access() returns 0 or -ERRNO. */ - return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id && - ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB)); + + if (static_branch_unlikely(&spectre_v2_app_lite)) + return test_tsk_thread_flag(tsk, TIF_SPEC_INDIR_BRANCH); + else + return ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB); } void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, -- 2.9.4