Messages in this thread | | | Date | Wed, 12 Sep 2018 11:05:20 +0200 (CEST) | From | Jiri Kosina <> | Subject | [PATCH v6 0/3] Harden spectrev2 userspace-userspace protection |
| |
Currently, linux kernel is basically not preventing userspace-userspace spectrev2 attack, because:
- IBPB is basically unused (issued only for tasks that marked themselves explicitly non-dumpable, which is absolutely negligible minority of all software out there), therefore cross-process branch buffer posioning using spectrev2 is possible
- STIBP is completely unused, therefore cross-process branch buffer poisoning using spectrev2 between processess running on two HT siblings thread s is possible
This patchset changes IBPB semantics, so that it's now applied whenever context-switching between processess that can't use ptrace() to achieve the same. This admittedly comes with extra overhad on a context switch; systems that don't care about could disable the mitigation using nospectre_v2 boot option. The IBPB implementaion is heavily based on original patches by Tim Chen.
In addition to that, we unconditionally turn STIBP on so that HT siblings always have separate branch buffers.
We've been carrying IBPB implementation with the same semantics in our (SUSE) trees since january disclosure; STIBP was more or less ignored up to today.
v1->v2: include IBPB changes v2->v3: fix IBPB 'who can trace who' semantics wire up STIBP flipping to SMT hotplug v3->v4: dropped ___ptrace_may_access(), as it's not needed fixed deadlock with LSM/audit/selinux (Andrea Arcangeli) statically patch out the ptrace check if !IBPB
v4->v5: fix MSR writing logic (Thomas Gleixner, Josh Poimboeuf)
v5->v6: propagate X86_FEATURE_RSB_CTXSW setting to sysfs propagate STIBP setting to sysfs (Thomas Gleixner) simplify arch_smt_update() (Thomas Gleixner)
Jiri Kosina (3): x86/speculation: apply IBPB more strictly to avoid cross-process data leak x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation x86/speculation: Propagate information about RSB filling mitigation to sysfs
arch/x86/kernel/cpu/bugs.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++------ arch/x86/mm/tlb.c | 31 ++++++++++++++++++++----------- include/linux/ptrace.h | 4 ++++ kernel/cpu.c | 11 ++++++++++- kernel/ptrace.c | 12 ++++++++---- 5 files changed, 96 insertions(+), 22 deletions(-)
-- Jiri Kosina SUSE Labs
| |