lkml.org 
[lkml]   [2018]   [Oct]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[Patch v4 16/18] x86/speculation: Enable STIBP to protect security sensitive tasks
Date
Enable STIBP defense on high security tasks.

For normal tasks, STIBP is unused so they are not impacted by overhead
from STIBP in lite protection mode.

Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
---
arch/x86/kernel/cpu/bugs.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 54f4675..b402b96 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -14,6 +14,8 @@
#include <linux/module.h>
#include <linux/nospec.h>
#include <linux/prctl.h>
+#include <linux/sched/coredump.h>
+#include <linux/security.h>

#include <asm/spec-ctrl.h>
#include <asm/cmdline.h>
@@ -770,6 +772,37 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
return 0;
}

+static void set_task_stibp(struct task_struct *tsk, bool stibp_on)
+{
+ bool update = false;
+
+ if (!static_branch_unlikely(&spectre_v2_app_lite))
+ return;
+
+ if (stibp_on)
+ update = !test_and_set_tsk_thread_flag(tsk, TIF_STIBP);
+ else
+ update = test_and_clear_tsk_thread_flag(tsk, TIF_STIBP);
+
+ if (!update)
+ return;
+
+ if (tsk == current)
+ speculation_ctrl_update_current();
+}
+
+void arch_set_security(struct task_struct *tsk, unsigned int value)
+{
+ if (value > SECURITY_HIGH)
+ return;
+
+ /* Update STIBP defenses */
+ if (value == SECURITY_HIGH)
+ set_task_stibp(tsk, true);
+ else
+ set_task_stibp(tsk, false);
+}
+
int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
unsigned long ctrl)
{
--
2.9.4
\
 
 \ /
  Last update: 2018-10-30 20:23    [W:0.792 / U:0.392 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site