b617cfc858
Add two new prctls to control aspects of speculation related vulnerabilites
and their mitigations to provide finer grained control over performance
impacting mitigations.
PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature
which is selected with arg2 of prctl(2). The return value uses bit 0-2 with
the following meaning:
Bit Define Description
0 PR_SPEC_PRCTL Mitigation can be controlled per task by
PR_SET_SPECULATION_CTRL
1 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is
disabled
2 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is
enabled
If all bits are 0 the CPU is not affected by the speculation misfeature.
If PR_SPEC_PRCTL is set, then the per task control of the mitigation is
available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation
misfeature will fail.
PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, which
is selected by arg2 of prctl(2) per task. arg3 is used to hand in the
control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE.
The common return values are:
EINVAL prctl is not implemented by the architecture or the unused prctl()
arguments are not 0
ENODEV arg2 is selecting a not supported speculation misfeature
PR_SET_SPECULATION_CTRL has these additional return values:
ERANGE arg3 is incorrect, i.e. it's not either PR_SPEC_ENABLE or PR_SPEC_DISABLE
ENXIO prctl control of the selected speculation misfeature is disabled
The first supported controlable speculation misfeature is
PR_SPEC_STORE_BYPASS. Add the define so this can be shared between
architectures.
Based on an initial patch from Tim Chen and mostly rewritten.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
87 lines
3.3 KiB
ReStructuredText
87 lines
3.3 KiB
ReStructuredText
===================
|
|
Speculation Control
|
|
===================
|
|
|
|
Quite some CPUs have speculation related misfeatures which are in fact
|
|
vulnerabilites causing data leaks in various forms even accross privilege
|
|
domains.
|
|
|
|
The kernel provides mitigation for such vulnerabilities in various
|
|
forms. Some of these mitigations are compile time configurable and some on
|
|
the kernel command line.
|
|
|
|
There is also a class of mitigations which are very expensive, but they can
|
|
be restricted to a certain set of processes or tasks in controlled
|
|
environments. The mechanism to control these mitigations is via
|
|
:manpage:`prctl(2)`.
|
|
|
|
There are two prctl options which are related to this:
|
|
|
|
* PR_GET_SPECULATION_CTRL
|
|
|
|
* PR_SET_SPECULATION_CTRL
|
|
|
|
PR_GET_SPECULATION_CTRL
|
|
-----------------------
|
|
|
|
PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature
|
|
which is selected with arg2 of prctl(2). The return value uses bits 0-2 with
|
|
the following meaning:
|
|
|
|
==== ================ ===================================================
|
|
Bit Define Description
|
|
==== ================ ===================================================
|
|
0 PR_SPEC_PRCTL Mitigation can be controlled per task by
|
|
PR_SET_SPECULATION_CTRL
|
|
1 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is
|
|
disabled
|
|
2 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is
|
|
enabled
|
|
==== ================ ===================================================
|
|
|
|
If all bits are 0 the CPU is not affected by the speculation misfeature.
|
|
|
|
If PR_SPEC_PRCTL is set, then the per task control of the mitigation is
|
|
available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation
|
|
misfeature will fail.
|
|
|
|
PR_SET_SPECULATION_CTRL
|
|
-----------------------
|
|
PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, which
|
|
is selected by arg2 of :manpage:`prctl(2)` per task. arg3 is used to hand
|
|
in the control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE.
|
|
|
|
Common error codes
|
|
------------------
|
|
======= =================================================================
|
|
Value Meaning
|
|
======= =================================================================
|
|
EINVAL The prctl is not implemented by the architecture or unused
|
|
prctl(2) arguments are not 0
|
|
|
|
ENODEV arg2 is selecting a not supported speculation misfeature
|
|
======= =================================================================
|
|
|
|
PR_SET_SPECULATION_CTRL error codes
|
|
-----------------------------------
|
|
======= =================================================================
|
|
Value Meaning
|
|
======= =================================================================
|
|
0 Success
|
|
|
|
ERANGE arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor
|
|
PR_SPEC_DISABLE
|
|
|
|
ENXIO Control of the selected speculation misfeature is not possible.
|
|
See PR_GET_SPECULATION_CTRL.
|
|
======= =================================================================
|
|
|
|
Speculation misfeature controls
|
|
-------------------------------
|
|
- PR_SPEC_STORE_BYPASS: Speculative Store Bypass
|
|
|
|
Invocations:
|
|
* prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, 0, 0, 0);
|
|
* prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
|
|
* prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
|