Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
Something went wrong. Try again.
5.4 kB · 124 lines
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125===================Speculation Control===================
Quite some CPUs have speculation-related misfeatures which are infact vulnerabilities causing data leaks in various forms even acrossprivilege domains.
The kernel provides mitigation for such vulnerabilities in variousforms. Some of these mitigations are compile-time configurable and somecan be supplied on the kernel command line.
There is also a class of mitigations which are very expensive, but they canbe restricted to a certain set of processes or tasks in controlledenvironments. The mechanism to control these mitigations is via:manpage:`prctl(2)`.
There are two prctl options which are related to this:
* PR_GET_SPECULATION_CTRL
* PR_SET_SPECULATION_CTRL
PR_GET_SPECULATION_CTRL-----------------------
PR_GET_SPECULATION_CTRL returns the state of the speculation misfeaturewhich is selected with arg2 of prctl(2). The return value uses bits 0-3 withthe following meaning (with the caveat that PR_SPEC_L1D_FLUSH has less obvioussemantics, see documentation for that specific control below):
==== ====================== ==================================================Bit Define Description==== ====================== ==================================================0 PR_SPEC_PRCTL Mitigation can be controlled per task by PR_SET_SPECULATION_CTRL.1 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is disabled.2 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is enabled.3 PR_SPEC_FORCE_DISABLE Same as PR_SPEC_DISABLE, but cannot be undone. A subsequent prctl(..., PR_SPEC_ENABLE) will fail.4 PR_SPEC_DISABLE_NOEXEC Same as PR_SPEC_DISABLE, but the state will be cleared on :manpage:`execve(2)`.==== ====================== ==================================================
If all bits are 0 the CPU is not affected by the speculation misfeature.
If PR_SPEC_PRCTL is set, then the per-task control of the mitigation isavailable. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculationmisfeature will fail.
.. _set_spec_ctrl:
PR_SET_SPECULATION_CTRL-----------------------
PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, whichis selected by arg2 of :manpage:`prctl(2)` per task. arg3 is used to handin the control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE orPR_SPEC_FORCE_DISABLE.
Common error codes------------------======= =================================================================Value Meaning======= =================================================================EINVAL The prctl is not implemented by the architecture or unused prctl(2) arguments are not 0.
ENODEV arg2 is selecting a not supported speculation misfeature.======= =================================================================
PR_SET_SPECULATION_CTRL error codes-----------------------------------======= =================================================================Value Meaning======= =================================================================0 Success
ERANGE arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor PR_SPEC_DISABLE nor PR_SPEC_FORCE_DISABLE.
ENXIO For PR_SPEC_STORE_BYPASS: control of the selected speculation misfeature is not possible via prctl, because of the system's boot configuration.
EPERM Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller tried to enable it again.
EPERM For PR_SPEC_L1D_FLUSH and PR_SPEC_INDIRECT_BRANCH: control of the mitigation is not possible because of the system's boot configuration.
======= =================================================================
Speculation misfeature controls-------------------------------- PR_SPEC_STORE_BYPASS: Speculative Store Bypass
Invocations: * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, 0, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE_NOEXEC, 0, 0);
- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes (Mitigate Spectre V2 style attacks against user processes)
Invocations: * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
- PR_SPEC_L1D_FLUSH: Flush L1D Cache on context switch out of the task (works only when tasks run on non SMT cores)
For this control, PR_SPEC_ENABLE means that the **mitigation** is enabled (L1Dis flushed), PR_SPEC_DISABLE means it is disabled.
Invocations: * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, 0, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, PR_SPEC_ENABLE, 0, 0); * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, PR_SPEC_DISABLE, 0, 0);