Provide process property based options to enable Spectre v2 userspace-userspace protection

Remove unnecessary else statement in spectre_v2_parse_cmdline to save an indent.

Remove unecessary ret variable in cpu_show_common.

Break up long lines too to make the code more concise and easier to read and modify in later patches.

static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,

arch/x86/kernel/cpu/bugs.c +0 -9

 			       char *buf, unsigned int bug)
 {
-	int ret;
-
 	if (!boot_cpu_has_bug(bug))
 		return sprintf(buf, "Not affected\n");

@@ -873,13 +871,17 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 		return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 
 	case X86_BUG_SPECTRE_V2:
-		ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
-			       boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
-			       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
-			       (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
-			       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
-			       spectre_v2_module_string());
-		return ret;

Add static key to indicate whether we are using Enhanced IBRS to mitigate

Add static key to indicate whether we are using Enhanced IBRS to mitigate Spectre v2. This will be used in later patches to disengage STIBP code for Spectre v2 mitigation as STIBP is not needed when Enhanced IBRS is in use.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/include/asm/nospec-branch.h | 3 +++
 arch/x86/kernel/cpu/bugs.c           | 4 ++++
 2 files changed, 7 insertions(+)

arch/x86/include/asm/nospec-branch.h +3 -0

index fd2a8c1..d57e84e 100644
@@ -3,6 +3,7 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/static_key.h>
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>

@@ -228,6 +229,8 @@ enum ssb_mitigation {
 extern char __indirect_thunk_start[];
 extern char __indirect_thunk_end[];
 
+DECLARE_STATIC_KEY_FALSE(spectre_v2_enhanced_ibrs);
+
 /*
  * On VMEXIT we must ensure that no RSB predictions learned in the guest
  * can be followed in the host, by overwriting the RSB completely. Both

arch/x86/kernel/cpu/bugs.c +3 -0

index b2f6b8b..2fc7b4e 100644
@@ -142,6 +142,9 @@ static const char *spectre_v2_strings[] = {
 	[SPECTRE_V2_IBRS_ENHANCED]		= "Mitigation: Enhanced IBRS",
 };
 
+DEFINE_STATIC_KEY_FALSE(spectre_v2_enhanced_ibrs);
+EXPORT_SYMBOL(spectre_v2_enhanced_ibrs);
+
 #undef pr_fmt
 #define pr_fmt(fmt)     "Spectre V2 : " fmt
 

Quoted 46 lines · Tim Chen

Add static key to indicate whether we are using Enhanced IBRS to mitigate Spectre v2. This will be used in later patches to disengage STIBP code for Spectre v2 mitigation as STIBP is not needed when Enhanced IBRS is in use.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/include/asm/nospec-branch.h | 3 +++
 arch/x86/kernel/cpu/bugs.c           | 4 ++++
 2 files changed, 7 insertions(+)

arch/x86/include/asm/nospec-branch.h +3 -0

index fd2a8c1..d57e84e 100644
@@ -3,6 +3,7 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/static_key.h>
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>

@@ -228,6 +229,8 @@ enum ssb_mitigation {
 extern char __indirect_thunk_start[];
 extern char __indirect_thunk_end[];
 
+DECLARE_STATIC_KEY_FALSE(spectre_v2_enhanced_ibrs);
+
 /*
  * On VMEXIT we must ensure that no RSB predictions learned in the guest
  * can be followed in the host, by overwriting the RSB completely. Both

arch/x86/kernel/cpu/bugs.c +3 -0

index b2f6b8b..2fc7b4e 100644
@@ -142,6 +142,9 @@ static const char *spectre_v2_strings[] = {
 	[SPECTRE_V2_IBRS_ENHANCED]		= "Mitigation: Enhanced IBRS",
 };
 
+DEFINE_STATIC_KEY_FALSE(spectre_v2_enhanced_ibrs);
+EXPORT_SYMBOL(spectre_v2_enhanced_ibrs);
+
 #undef pr_fmt
 #define pr_fmt(fmt)     "Spectre V2 : " fmt
 

arch/x86/kernel/cpu/bugs.c static void __init spectre_v2_select_mitigation(void) · line 395

Quoted 8 lines

arch/x86/kernel/cpu/bugs.c +1 -0

@@ -386,6 +389,7 @@ static void __init spectre_v2_select_mitigation(void)
 			/* Force it so VMEXIT will restore correctly */
 			x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
 			wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+			static_branch_enable(&spectre_v2_enhanced_ibrs);
 			goto specv2_set_mode;
 		}
 		if (IS_ENABLED(CONFIG_RETPOLINE))

Why you need a static key for enhanced IBRS? It is supposed to be set at boot time and never get changed after that. It will be easier to use a feature bit for that instead. We usually use static key when the value can be changed at run time.

Quoted 5 lines · Waiman Long

Quoted 5 lines

arch/x86/kernel/cpu/bugs.c +1 -0

@@ -386,6 +389,7 @@ static void __init spectre_v2_select_mitigation(void)
 			/* Force it so VMEXIT will restore correctly */
 			x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
 			wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+			static_branch_enable(&spectre_v2_enhanced_ibrs);

Quoted 9 lines

arch/x86/kernel/cpu/bugs.c static void __init spectre_v2_select_mitigation(void) · line 395

Quoted 3 lines

arch/x86/kernel/cpu/bugs.c +0 -0

 			goto specv2_set_mode;
 		}
 		if (IS_ENABLED(CONFIG_RETPOLINE))

Why you need a static key for enhanced IBRS? It is supposed to be set at boot time and never get changed after that. It will be easier to use a feature bit for that instead. We usually use static key when the value can be changed at run time.

We're close to running out of the feature bits. So I'm trying not to use those.

With enhanced IBRS in use, the application running on sibling CPU will not

be able to launch Spectre v2 attack to the application on current CPU.

With enhanced IBRS in use, the application running on sibling CPU will not be able to launch Spectre v2 attack to the application on current CPU. There is no need to use STIBP for this case. Disable the STIBP code when enhanced IBRS is used.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

arch/x86/kernel/cpu/bugs.c +8 -0

index 2fc7b4e..6ed82ea 100644
@@ -327,6 +327,14 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 
 static bool stibp_needed(void)
 {
+	/*
+	 * Determine if we want to leave STIBP always on.
+	 * Using enhanced IBRS makes using STIBP unnecessary.
+	 */
+
+	if (static_branch_unlikely(&spectre_v2_enhanced_ibrs))
+		return false;
+
 	if (spectre_v2_enabled == SPECTRE_V2_NONE)
 		return false;
 

Quoted 29 lines · Tim Chen

With enhanced IBRS in use, the application running on sibling CPU will not be able to launch Spectre v2 attack to the application on current CPU. There is no need to use STIBP for this case. Disable the STIBP code when enhanced IBRS is used.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

arch/x86/kernel/cpu/bugs.c +8 -0

index 2fc7b4e..6ed82ea 100644
@@ -327,6 +327,14 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 
 static bool stibp_needed(void)
 {
+	/*
+	 * Determine if we want to leave STIBP always on.
+	 * Using enhanced IBRS makes using STIBP unnecessary.
+	 */
+
+	if (static_branch_unlikely(&spectre_v2_enhanced_ibrs))
+		return false;
+
 	if (spectre_v2_enabled == SPECTRE_V2_NONE)
 		return false;
 

arch/x86/kernel/cpu/bugs.c static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr · line 897

Quoted 11 lines

arch/x86/kernel/cpu/bugs.c +3 -1

@@ -881,7 +889,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 				   ", IBPB" : "",
 			boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ?
 				   ", IBRS_FW" : "",
-			(x86_spec_ctrl_base & SPEC_CTRL_STIBP) ?
+			spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED ?
+				   ", Enhanced IBRS" :
+			    (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ?
 				   ", STIBP" : "",
 			boot_cpu_has(X86_FEATURE_RSB_CTXSW) ?
 				   ", RSB filling" : "",

The "Enhanced IBRS" is one of the states of spectre_v2_enabled. So you don't need to print that out one more time.

Quoted 30 lines · Waiman Long

Quoted 29 lines · Tim Chen

With enhanced IBRS in use, the application running on sibling CPU will not be able to launch Spectre v2 attack to the application on current CPU. There is no need to use STIBP for this case. Disable the STIBP code when enhanced IBRS is used.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

arch/x86/kernel/cpu/bugs.c +8 -0

index 2fc7b4e..6ed82ea 100644
@@ -327,6 +327,14 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 
 static bool stibp_needed(void)
 {
+	/*
+	 * Determine if we want to leave STIBP always on.
+	 * Using enhanced IBRS makes using STIBP unnecessary.
+	 */
+
+	if (static_branch_unlikely(&spectre_v2_enhanced_ibrs))
+		return false;
+
 	if (spectre_v2_enabled == SPECTRE_V2_NONE)
 		return false;
 

Quoted 15 lines

arch/x86/kernel/cpu/bugs.c static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr · line 897

Quoted 11 lines

arch/x86/kernel/cpu/bugs.c +3 -1

@@ -881,7 +889,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 				   ", IBPB" : "",
 			boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ?
 				   ", IBRS_FW" : "",
-			(x86_spec_ctrl_base & SPEC_CTRL_STIBP) ?
+			spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED ?
+				   ", Enhanced IBRS" :
+			    (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ?
 				   ", STIBP" : "",
 			boot_cpu_has(X86_FEATURE_RSB_CTXSW) ?
 				   ", RSB filling" : "",

The "Enhanced IBRS" is one of the states of spectre_v2_enabled. So you don't need to print that out one more time.

This is for the query to to /sys/devices/system/cpu/vulnerabilities/spectre_v2

Currently Enhanced IBRS usage is not shown and should be listed.

Create the cpu_smt_enabled static key to indicate if we are using SMT. SMT specific code paths are executed only when SMT code paths are enabled by this key.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c |  2 +-
 arch/x86/kvm/vmx.c         |  2 +-
 include/linux/cpu.h        |  1 +
 kernel/cpu.c               | 12 ++++++++++--

Change the argument to set_dumpable from task->mm to task. This allows us to later add hooks to modify a task's property according to whether it is a non-dumpable task. Non dumpable tasks demand a higher level of security. Changes the dumpable value from in to unsigned int as negative number is not allowed.

Change the argument to set_dumpable from task->mm to task. This allows us to later add hooks to modify a task's property according to whether it is a non-dumpable task. Non dumpable tasks demand a higher level of security. Changes the dumpable value from in to unsigned int as negative number is not allowed.

Add arch_set_dumpable for setting architecture specific security modifications on processes according to its dumpable properties. Non dumpable processes are security sensitive and they can be modified to gain architecture specific security defenses via arch_set_dumpable.

Signed-off-by Tim Chen <[email protected]>

---
 fs/exec.c | 6 ++++++

 1 file changed, 6 insertions(+)

fs/exec.c +5 -0

index e204830..6f329fc 100644
@@ -1940,6 +1940,11 @@ void set_binfmt(struct linux_binfmt *new)
 }
 EXPORT_SYMBOL(set_binfmt);
 
+void __weak arch_set_dumpable(struct task_struct *tsk, unsigned int value)
+{
+	return;
+}
+
 /*
  * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
  */

So now the obvious question. set_dumpable() operates on tsk->mm. i.e. it's a process wide operation. But arch_set_dumpable() operates on the task itself. What about the other tasks of that process?

Thanks,

tglx

Quoted 4 lines · Thomas Gleixner

So now the obvious question. set_dumpable() operates on tsk->mm. i.e. it's a process wide operation. But arch_set_dumpable() operates on the task itself. What about the other tasks of that process?

I missed this part.

Fixing this is tricky as I don't see an easy way to reverse map mm back to all tasks that use the same mm to update their STIBP flags.

Quoted 11 lines · Tim Chen

Quoted 4 lines · Thomas Gleixner

So now the obvious question. set_dumpable() operates on tsk->mm. i.e. it's a process wide operation. But arch_set_dumpable() operates on the task itself. What about the other tasks of that process?

I missed this part.

Fixing this is tricky as I don't see an easy way to reverse map mm back to all tasks that use the same mm to update their STIBP flags.

task is known and handed in to the function. So why do you want to reverse map mm?

for_each_thread(task, ...) is what you want. The only thing to verify is whether you can lock the tasks sighand lock there. And then it's enough to set/clear the TIF bit and let it take effect at the next context switch.

Quoted 16 lines · Thomas Gleixner

Quoted 11 lines · Tim Chen

Quoted 4 lines · Thomas Gleixner

So now the obvious question. set_dumpable() operates on tsk->mm. i.e. it's a process wide operation. But arch_set_dumpable() operates on the task itself. What about the other tasks of that process?

I missed this part.

Fixing this is tricky as I don't see an easy way to reverse map mm back to all tasks that use the same mm to update their STIBP flags.

task is known and handed in to the function. So why do you want to reverse map mm?

Quoted 3 lines

for_each_thread(task, ...) is what you want. The only thing to verify is whether you can lock the tasks sighand lock there. And then it's enough to set/clear the TIF bit and let it take effect at the next context switch.

Though there is another issue with mm shared between processes, i.e. CLONE_VM without CLONE_THREAD where set_dumpabe() affects both processes, but for_each_thread() only seing the threads which belong to the thread group of 'task'.

I can understand your idea of clumping this on dumpable(), but at some point we really have to draw a line and just stop adding more and more expensive stuff to context switch.

Thanks,

tglx

This is a clean up patch that doesn't change any

functionality. We rename intel_set_ssb_state to spec_ctrl_update_msr, speculative_store_bypass_update to speculation_ctrl_update and speculative_store_bypass_update_current to speculation_ctrl_update_current.

This prepares us to update of other bits in the SPEC_CTRL MSR dynamically.

Reorganize the spculation control MSR update code. Currently it is limited to only dynamic update of the Speculative Store Bypass Disable bit. This patch consolidates the logic to check for AMD CPUs that may or may

not use this MSR to control SSBD. This prepares us to add logic to update other bits in the SPEC_CTRL MSR cleanly.

Originally-by Thomas Lendacky <[email protected]>

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/process.c | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

arch/x86/kernel/process.c +9 -2

index 8aa4960..789f1bada 100644
@@ -397,25 +397,45 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
 
 static __always_inline void spec_ctrl_update_msr(unsigned long tifn)
 {
-	u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+	u64 msr = x86_spec_ctrl_base;
+
+	/*
+	 * If X86_FEATURE_SSBD is not set, the SSBD
+	 * bit is not to be touched.
+	 */
+	if (static_cpu_has(X86_FEATURE_SSBD))
+		msr |= ssbd_tif_to_spec_ctrl(tifn);
 
 	wrmsrl(MSR_IA32_SPEC_CTRL, msr);
 }
 
-static __always_inline void __speculation_ctrl_update(unsigned long tifn)
+static __always_inline void __speculation_ctrl_update(unsigned long tifp,

arch/x86/kernel/process.c +9 -0

+	if ((tifp ^ tifn) & _TIF_SSBD) {
+		if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+			amd_set_ssb_virt_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+			amd_set_core_ssb_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_SSBD))
+			updmsr  = true;
+	}
+

Reorganize the spculation control MSR update code. Currently it is limited to only dynamic update of the Speculative Store Bypass Disable bit. This patch consolidates the logic to check for AMD CPUs that may or may not use this MSR to control SSBD. This prepares us to add logic to update other bits in the SPEC_CTRL MSR cleanly.

Originally-by Thomas Lendacky <[email protected]>

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/process.c | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

arch/x86/kernel/process.c +5 -1

index 8aa4960..789f1bada 100644
@@ -397,25 +397,45 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
 
 static __always_inline void spec_ctrl_update_msr(unsigned long tifn)
 {
-	u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+	u64 msr = x86_spec_ctrl_base;
+
+	/*
+	 * If X86_FEATURE_SSBD is not set, the SSBD
+	 * bit is not to be touched.

arch/x86/kernel/process.c +19 -8

 {
-	if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
-		amd_set_ssb_virt_state(tifn);
-	else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
-		amd_set_core_ssb_state(tifn);
-	else
+	bool updmsr = false;
+
+	/* Check for AMD cpu to see if it uses SPEC_CTRL MSR for SSBD */
+	if ((tifp ^ tifn) & _TIF_SSBD) {
+		if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+			amd_set_ssb_virt_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+			amd_set_core_ssb_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_SSBD))
+			updmsr  = true;
+	}
+
+	if (updmsr)
 		spec_ctrl_update_msr(tifn);
 }
 
 void speculation_ctrl_update(unsigned long tif)
 {
+	/*
+	 * On this path we're forcing the update, so use ~tif as the
+	 * previous flags.
+	 */
 	preempt_disable();
-	__speculation_ctrl_update(tif);
+	__speculation_ctrl_update(~tif, tif);
 	preempt_enable();
 }
 

@@ -451,8 +471,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
 	if ((tifp ^ tifn) & _TIF_NOCPUID)
 		set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
 
-	if ((tifp ^ tifn) & _TIF_SSBD)
-		__speculation_ctrl_update(tifn);
+	__speculation_ctrl_update(tifp, tifn);
 }
 
 /*

Quoted 33 lines · Tim Chen

Reorganize the spculation control MSR update code. Currently it is limited to only dynamic update of the Speculative Store Bypass Disable bit. This patch consolidates the logic to check for AMD CPUs that may or may not use this MSR to control SSBD. This prepares us to add logic to update other bits in the SPEC_CTRL MSR cleanly.

Originally-by Thomas Lendacky <[email protected]>

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/process.c | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

arch/x86/kernel/process.c +8 -1

index 8aa4960..789f1bada 100644
@@ -397,25 +397,45 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
 
 static __always_inline void spec_ctrl_update_msr(unsigned long tifn)
 {
-	u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+	u64 msr = x86_spec_ctrl_base;
+
+	/*
+	 * If X86_FEATURE_SSBD is not set, the SSBD
+	 * bit is not to be touched.
+	 */
+	if (static_cpu_has(X86_FEATURE_SSBD))
+		msr |= ssbd_tif_to_spec_ctrl(tifn);
 
 	wrmsrl(MSR_IA32_SPEC_CTRL, msr);
 }
 

arch/x86/kernel/process.c static __always_inline void amd_set_ssb_virt_state(unsigned long tifn) · line 413

Quoted 3 lines

arch/x86/kernel/process.c +2 -1

-static __always_inline void __speculation_ctrl_update(unsigned long tifn)
+static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+						      unsigned long tifn)

I think it will be more intuitive to pass in (tifp ^ tifn) as bitmask of changed TIF bits than tifp alone as you are only interested in the changed bits anyway.

hard to know what they are by reading the function alone.

Cheers,
Longman

Quoted 44 lines

arch/x86/kernel/process.c +19 -8

 {
-	if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
-		amd_set_ssb_virt_state(tifn);
-	else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
-		amd_set_core_ssb_state(tifn);
-	else
+	bool updmsr = false;
+
+	/* Check for AMD cpu to see if it uses SPEC_CTRL MSR for SSBD */
+	if ((tifp ^ tifn) & _TIF_SSBD) {
+		if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+			amd_set_ssb_virt_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+			amd_set_core_ssb_state(tifn);
+		else if (static_cpu_has(X86_FEATURE_SSBD))
+			updmsr  = true;
+	}
+
+	if (updmsr)
 		spec_ctrl_update_msr(tifn);
 }
 
 void speculation_ctrl_update(unsigned long tif)
 {
+	/*
+	 * On this path we're forcing the update, so use ~tif as the
+	 * previous flags.
+	 */
 	preempt_disable();
-	__speculation_ctrl_update(tif);
+	__speculation_ctrl_update(~tif, tif);
 	preempt_enable();
 }
 

@@ -451,8 +471,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
 	if ((tifp ^ tifn) & _TIF_NOCPUID)
 		set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
 
-	if ((tifp ^ tifn) & _TIF_SSBD)
-		__speculation_ctrl_update(tifn);
+	__speculation_ctrl_update(tifp, tifn);
 }
 
 /*

Add per thread STIBP flag. When context switching to a process thread that has the STIBP flag, the STIBP bit in the SPEC_CTRL MSR will be turned on to guard against application to application Spectre v2 attack. When switching to a non-security sensitive thread that doesn't have STIBP flag, the STIBP bit in the SPEC_CTRL MSR is turned off.

arch/x86/include/asm/thread_info.h +2 -0

@@ -83,6 +83,7 @@ struct thread_info {
 #define TIF_SYSCALL_EMU		6	/* syscall emulation active */
 #define TIF_SYSCALL_AUDIT	7	/* syscall auditing active */
 #define TIF_SECCOMP		8	/* secure computing */
+#define TIF_STIBP              9       /* Single threaded indirect branch predict */
 #define TIF_USER_RETURN_NOTIFY	11	/* notify kernel of userspace return */
 #define TIF_UPROBE		12	/* breakpointed or singlestepping */
 #define TIF_PATCH_PENDING	13	/* pending live patching update */

@@ -110,6 +111,7 @@ struct thread_info {
 #define _TIF_SYSCALL_EMU	(1 << TIF_SYSCALL_EMU)
 #define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP		(1 << TIF_SECCOMP)
+#define _TIF_STIBP		(1 << TIF_STIBP)
 #define _TIF_USER_RETURN_NOTIFY	(1 << TIF_USER_RETURN_NOTIFY)
 #define _TIF_UPROBE		(1 << TIF_UPROBE)
 #define _TIF_PATCH_PENDING	(1 << TIF_PATCH_PENDING)

Currently the STIBP is always turned on for CPUs vulnerable to Spectre V2. A new lite protection mode option is created. In this new mode, we protect security sensitive processes with STIBP and IBPB against application to application attack based on its process property or security level. This will allow non security sensitive processes not needing the protection avoid overhead associated with STIBP and IBPB.

Signed-off-by Tim Chen <[email protected]>

---
 Documentation/admin-guide/kernel-parameters.txt |  18 ++++
 arch/x86/include/asm/nospec-branch.h            |   7 ++
 arch/x86/kernel/cpu/bugs.c                      | 135 ++++++++++++++++++++++--
 arch/x86/mm/tlb.c                               |  19 +++-
 4 files changed, 166 insertions(+), 13 deletions(-)

Documentation/admin-guide/kernel-parameters.txt +0 -0

index 64a3bf5..2feb6b2 100644

Documentation/admin-guide/kernel-parameters.txt +7 -0

+enum spectre_v2_app2app_mitigation_cmd {
+	SPECTRE_V2_APP2APP_CMD_NONE,
+	SPECTRE_V2_APP2APP_CMD_AUTO,
+	SPECTRE_V2_APP2APP_CMD_LITE,
+	SPECTRE_V2_APP2APP_CMD_STRICT,
+};
+
 static const char *spectre_v2_strings[] = {
 	[SPECTRE_V2_NONE]			= "Vulnerable",
 	[SPECTRE_V2_RETPOLINE_MINIMAL]		= "Vulnerable: Minimal generic ASM retpoline",

Documentation/admin-guide/kernel-parameters.txt +13 -0

+	[SPECTRE_V2_APP2APP_STRICT] = "App-App Mitigation: Full app to app"
+				      " attack protection",
+};
+
+DEFINE_STATIC_KEY_FALSE(spectre_v2_app_lite);
+EXPORT_SYMBOL(spectre_v2_app_lite);
+
 DEFINE_STATIC_KEY_FALSE(spectre_v2_enhanced_ibrs);
 EXPORT_SYMBOL(spectre_v2_enhanced_ibrs);
 

@@ -151,6 +169,9 @@ EXPORT_SYMBOL(spectre_v2_enhanced_ibrs);
 static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
 	SPECTRE_V2_NONE;
 
+static enum spectre_v2_app2app_mitigation
+	spectre_v2_app2app_enabled __ro_after_init = SPECTRE_V2_APP2APP_NONE;
+
 void
 x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
 {

@@ -172,6 +193,9 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
 		    static_cpu_has(X86_FEATURE_AMD_SSBD))
 			hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
 
+		if (static_branch_unlikely(&spectre_v2_app_lite))
+			hostval |= stibp_tif_to_spec_ctrl(ti->flags);
+
 		if (hostval != guestval) {
 			msrval = setguest ? guestval : hostval;
 			wrmsrl(MSR_IA32_SPEC_CTRL, msrval);

@@ -278,6 +302,52 @@ static const struct {
 	{ "auto",              SPECTRE_V2_CMD_AUTO,              false },
 };

Documentation/admin-guide/kernel-parameters.txt +21 -0

+			continue;
+		cmd = app2app_mitigation_options[i].cmd;
+		break;
+	}
+
+	if (i >= ARRAY_SIZE(app2app_mitigation_options)) {
+		pr_err("unknown app to app protection option (%s). "
+		       "Switching to AUTO select\n", arg);
+		return SPECTRE_V2_APP2APP_CMD_AUTO;
+	}
+
+	if (app2app_mitigation_options[i].secure)
+		spec2_print_if_secure(app2app_mitigation_options[i].option);
+	else
+		spec2_print_if_insecure(app2app_mitigation_options[i].option);
+
+	return cmd;
+}
+
 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 {
 	char arg[20];

@@ -330,14 +400,22 @@ static bool stibp_needed(void)
 	/*
 	 * Determine if we want to leave STIBP always on.
 	 * Using enhanced IBRS makes using STIBP unnecessary.
+	 * For lite option, we enable STIBP based on a process's
+	 * flag during context switch.

Documentation/admin-guide/kernel-parameters.txt +3 -0

+	if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE)
+		return false;
+
 	if (!boot_cpu_has(X86_FEATURE_STIBP))
 		return false;
 

Documentation/admin-guide/kernel-parameters.txt +18 -1

 	/*
 	 * If the CPU is not affected and the command line mode is NONE or AUTO
 	 * then nothing to do.

@@ -398,7 +480,7 @@ static void __init spectre_v2_select_mitigation(void)
 			x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
 			wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
 			static_branch_enable(&spectre_v2_enhanced_ibrs);
-			goto specv2_set_mode;
+			goto specv2_app_set_mode;
 		}
 		if (IS_ENABLED(CONFIG_RETPOLINE))
 			goto retpoline_auto;

@@ -437,7 +519,31 @@ static void __init spectre_v2_select_mitigation(void)
 		setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 	}
 
+specv2_app_set_mode:
+	if (!boot_cpu_has(X86_FEATURE_IBPB) ||
+	    !boot_cpu_has(X86_FEATURE_STIBP))
+		goto specv2_set_mode;	
+
+	switch (app2app_cmd) {
+	case SPECTRE_V2_APP2APP_CMD_NONE:
+		break;	
+
+	case SPECTRE_V2_APP2APP_CMD_LITE:
+	case SPECTRE_V2_APP2APP_CMD_AUTO:
+		app2app_mode = SPECTRE_V2_APP2APP_LITE;
+		break;
+
+	case SPECTRE_V2_APP2APP_CMD_STRICT:
+		app2app_mode = SPECTRE_V2_APP2APP_STRICT;
+		break;

Documentation/admin-guide/kernel-parameters.txt +2 -3

 	case X86_BUG_SPECTRE_V2:
-		return sprintf(buf, "%s%s%s%s%s%s\n",
+		return sprintf(buf, "%s%s%s%s%s%s%s\n",
 			spectre_v2_strings[spectre_v2_enabled],
-			boot_cpu_has(X86_FEATURE_USE_IBPB) ?
-				   ", IBPB" : "",
+			spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE ||

Documentation/admin-guide/kernel-parameters.txt +1 -3

 			boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ?
 				   ", IBRS_FW" : "",
 			spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED ?
-				   ", Enhanced IBRS" :
-			    (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ?
-				   ", STIBP" : "",
+				   ", Enhanced IBRS" : "",
 			boot_cpu_has(X86_FEATURE_RSB_CTXSW) ?
 				   ", RSB filling" : "",
 			spectre_v2_module_string());

arch/x86/mm/tlb.c +0 -0

index 073b8df..1bd1597 100644

Mark the non-dumpable processes with TIF_STIBP flag so they will use STIBP and IBPB defenses against Spectre v2 attack from processes in user space.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

arch/x86/kernel/cpu/bugs.c +1 -0

index 1d317f2..cc77b9e 100644
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/nospec.h>
 #include <linux/prctl.h>
+#include <linux/sched/coredump.h>
 
 #include <asm/spec-ctrl.h>
 #include <asm/cmdline.h>

@@ -773,6 +774,26 @@ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
 	}
 }
 

arch/x86/kernel/cpu/bugs.c +10 -0

+
+	if (tsk->mm && value != SUID_DUMP_USER)
+		update = !test_and_set_tsk_thread_flag(tsk, TIF_STIBP);
+	else
+		update = test_and_clear_tsk_thread_flag(tsk, TIF_STIBP);
+
+	if (tsk == current && update)
+		speculation_ctrl_update_current();
+}
+
 #ifdef CONFIG_SECCOMP
 void arch_seccomp_spec_mitigate(struct task_struct *task)
 {

Quoted 25 lines · Tim Chen

Mark the non-dumpable processes with TIF_STIBP flag so they will use STIBP and IBPB defenses against Spectre v2 attack from processes in user space.

Signed-off-by Tim Chen <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

arch/x86/kernel/cpu/bugs.c +1 -0

index 1d317f2..cc77b9e 100644
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/nospec.h>
 #include <linux/prctl.h>
+#include <linux/sched/coredump.h>
 
 #include <asm/spec-ctrl.h>
 #include <asm/cmdline.h>

@@ -773,6 +774,26 @@ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
 	}
 }
 

arch/x86/kernel/cpu/bugs.c int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, · line 786

Quoted 10 lines

arch/x86/kernel/cpu/bugs.c +10 -0

+void arch_set_dumpable(struct task_struct *tsk, unsigned int value)
+{
+	bool update;
+
+	if (!static_branch_unlikely(&spectre_v2_app_lite))
+		return;
+	if (!static_cpu_has(X86_FEATURE_STIBP))
+		return;
+	if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE)
+		return;

The third if above seems to be a subset of the first one. Do you need to do the check one more time?

Signed-off-by Tim Chen <[email protected]>

---
 Documentation/admin-guide/kernel-parameters.txt |  5 +-
 Documentation/userspace-api/spec_ctrl.rst       | 10 +++
 arch/x86/kernel/cpu/bugs.c                      | 85 ++++++++++++++++++++++++-
 include/linux/sched.h                           | 11 ++++
 include/uapi/linux/prctl.h                      |  1 +
 tools/include/uapi/linux/prctl.h                |  1 +
 6 files changed, 111 insertions(+), 2 deletions(-)

Documentation/admin-guide/kernel-parameters.txt +0 -0

index 2feb6b2..9af11be 100644

Documentation/admin-guide/kernel-parameters.txt +3 -0

+				 branch speculation restricted via prctl's
+				 PR_SET_SPECULATION_CTRL option
+
 			strict - protect against attacks for all user processes
 			auto   - let kernel decide lite or strict mode
 

Documentation/admin-guide/kernel-parameters.txt +5 -0

+static int indir_branch_prctl_set(struct task_struct *task, unsigned long ctrl)
+{
+	bool update;
+
+	switch (ctrl) {

Documentation/admin-guide/kernel-parameters.txt +22 -0

+		task_clear_spec_indir_branch_disable(task);
+		update = test_and_clear_tsk_thread_flag(task, TIF_STIBP);
+		break;
+	case PR_SPEC_DISABLE:
+		/*
+		 * Indirect branch speculation is always enabled when
+		 * app to app mitigation is off.
+		 */
+		if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE)
+			return -ENXIO;
+		if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_STRICT)
+			return 0;
+		task_set_spec_indir_branch_disable(task);
+		update = !test_and_set_tsk_thread_flag(task, TIF_STIBP);
+		break;
+	case PR_SPEC_FORCE_DISABLE:
+		if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_NONE)
+			return -ENXIO;
+		if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_STRICT)
+			return 0;
+		task_set_spec_indir_branch_disable(task);
+		task_set_spec_indir_branch_force_disable(task);

Application to application exploit is in general difficult due to address space layout randomization in applications and the need to know an

Quoted 2 lines · Tim Chen

Application to application exploit is in general difficult due to address space layout randomization in applications and the need to know an

Does the BTB attack on KASLR not work for userspace?

Quoted 6 lines · Peter Zijlstra

Quoted 2 lines · Tim Chen

Application to application exploit is in general difficult due to address space layout randomization in applications and the need to know an

Does the BTB attack on KASLR not work for userspace?

With KASLR, you can probe the kernel mapped and unmapped addresses with side channels like TLB and infer the kernel mapping offsets much more easily, as kernel is in the same address space as the attack process. It is a lot harder to do such probing from another process that doesn't share the same page tables.