Re: [patch 22/24] x86/speculation: Create PRCTL interface to restrict indirect branch speculation

[Borislav Petkov]

On Wed, Nov 21, 2018 at 09:14:52PM +0100, Thomas Gleixner wrote:
> From: Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx>
> 
> Add the PR_SPEC_INDIR_BRANCH option for the PR_GET_SPECULATION_CTRL and
> PR_SET_SPECULATION_CTRL prctls to allow fine grained per task control of
> indirect branch speculation via STIBP.
> 
> Invocations:
>  Check indirect branch speculation status with
>  - prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, 0, 0, 0);
> 
>  Enable indirect branch speculation with
>  - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_ENABLE, 0, 0);
> 
>  Disable indirect branch speculation with
>  - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_DISABLE, 0, 0);
> 
>  Force disable indirect branch speculation with
>  - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
> 
> See Documentation/userspace-api/spec_ctrl.rst.
> 
> Signed-off-by: Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx>
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> 
> ---
>  Documentation/userspace-api/spec_ctrl.rst |    9 +++
>  arch/x86/include/asm/nospec-branch.h      |    1 
>  arch/x86/kernel/cpu/bugs.c                |   71 ++++++++++++++++++++++++++++++
>  include/linux/sched.h                     |    9 +++
>  include/uapi/linux/prctl.h                |    1 
>  tools/include/uapi/linux/prctl.h          |    1 
>  6 files changed, 92 insertions(+)

> @@ -753,12 +755,56 @@ static int ssb_prctl_set(struct task_str
>  	return 0;
>  }
>  
> +static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
> +{
> +	switch (ctrl) {
> +	case PR_SPEC_ENABLE:
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> +			return 0;
> +		/*
> +		 * Indirect branch speculation is always disabled in strict
> +		 * mode.
> +		 */
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> +			return -EPERM;
> +		task_clear_spec_indir_branch_disable(task);
> +		task_update_spec_tif(task, TIF_SPEC_IB, false);
> +		break;
> +	case PR_SPEC_DISABLE:
> +		/*
> +		 * Indirect branch speculation is always allowed when
> +		 * mitigation is force disabled.
> +		 */
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> +			return -EPERM;
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> +			return 0;
> +		task_set_spec_indir_branch_disable(task);
> +		task_update_spec_tif(task, TIF_SPEC_IB, true);
> +		break;
> +	case PR_SPEC_FORCE_DISABLE:
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
> +			return -EPERM;
> +		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
> +			return 0;
> +		task_set_spec_indir_branch_disable(task);
> +		task_set_spec_indir_branch_force_disable(task);
> +		task_update_spec_tif(task, TIF_SPEC_IB, true);
> +		break;
> +	default:
> +		return -ERANGE;
> +	}
> +	return 0;
> +}

Perhaps merge the two DISABLE branches to make it obvious what the
difference between them is:

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 6eac074e3935..28cece3a067b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -769,7 +769,9 @@ static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
 		task_clear_spec_indir_branch_disable(task);
 		task_update_spec_tif(task, TIF_SPEC_IB, false);
 		break;
+
 	case PR_SPEC_DISABLE:
+	case PR_SPEC_FORCE_DISABLE:
 		/*
 		 * Indirect branch speculation is always allowed when
 		 * mitigation is force disabled.
@@ -780,16 +782,11 @@ static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
 			return 0;
 		task_set_spec_indir_branch_disable(task);
 		task_update_spec_tif(task, TIF_SPEC_IB, true);
+
+		if (ctrl == PR_SPEC_FORCE_DISABLE)
+			task_set_spec_indir_branch_force_disable(task);
 		break;
-	case PR_SPEC_FORCE_DISABLE:
-		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_NONE)
-			return -EPERM;
-		if (spectre_v2_app2app == SPECTRE_V2_APP2APP_STRICT)
-			return 0;
-		task_set_spec_indir_branch_disable(task);
-		task_set_spec_indir_branch_force_disable(task);
-		task_update_spec_tif(task, TIF_SPEC_IB, true);
-		break;
+
 	default:
 		return -ERANGE;
 	}

> @@ -1453,6 +1453,8 @@ static inline bool is_percpu_thread(void
>  #define PFA_SPREAD_SLAB			2	/* Spread some slab caches over cpuset */
>  #define PFA_SPEC_SSB_DISABLE		3	/* Speculative Store Bypass disabled */
>  #define PFA_SPEC_SSB_FORCE_DISABLE	4	/* Speculative Store Bypass force disabled*/
> +#define PFA_SPEC_INDIR_BRANCH_DISABLE	5	/* Indirect branch speculation restricted */
> +#define PFA_SPEC_INDIR_BRANCH_FORCE_DISABLE 6	/* Indirect branch speculation permanentely restricted */

permanently

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.