spec_ctrl.rst

  1===================
  2Speculation Control
  3===================
  4
  5Quite some CPUs have speculation-related misfeatures which are in
  6fact vulnerabilities causing data leaks in various forms even across
  7privilege domains.
  8
  9The kernel provides mitigation for such vulnerabilities in various
 10forms. Some of these mitigations are compile-time configurable and some
 11can be supplied on the kernel command line.
 12
 13There is also a class of mitigations which are very expensive, but they can
 14be restricted to a certain set of processes or tasks in controlled
 15environments. The mechanism to control these mitigations is via
 16:manpage:`prctl(2)`.
 17
 18There are two prctl options which are related to this:
 19
 20 * PR_GET_SPECULATION_CTRL
 21
 22 * PR_SET_SPECULATION_CTRL
 23
 24PR_GET_SPECULATION_CTRL
 25-----------------------
 26
 27PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature
 28which is selected with arg2 of prctl(2). The return value uses bits 0-3 with
 29the following meaning (with the caveat that PR_SPEC_L1D_FLUSH has less obvious
 30semantics, see documentation for that specific control below):
 31
 32==== ====================== ==================================================
 33Bit  Define                 Description
 34==== ====================== ==================================================
 350    PR_SPEC_PRCTL          Mitigation can be controlled per task by
 36                            PR_SET_SPECULATION_CTRL.
 371    PR_SPEC_ENABLE         The speculation feature is enabled, mitigation is
 38                            disabled.
 392    PR_SPEC_DISABLE        The speculation feature is disabled, mitigation is
 40                            enabled.
 413    PR_SPEC_FORCE_DISABLE  Same as PR_SPEC_DISABLE, but cannot be undone. A
 42                            subsequent prctl(..., PR_SPEC_ENABLE) will fail.
 434    PR_SPEC_DISABLE_NOEXEC Same as PR_SPEC_DISABLE, but the state will be
 44                            cleared on :manpage:`execve(2)`.
 45==== ====================== ==================================================
 46
 47If all bits are 0 the CPU is not affected by the speculation misfeature.
 48
 49If PR_SPEC_PRCTL is set, then the per-task control of the mitigation is
 50available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation
 51misfeature will fail.
 52
 53.. _set_spec_ctrl:
 54
 55PR_SET_SPECULATION_CTRL
 56-----------------------
 57
 58PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, which
 59is selected by arg2 of :manpage:`prctl(2)` per task. arg3 is used to hand
 60in the control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE or
 61PR_SPEC_FORCE_DISABLE.
 62
 63Common error codes
 64------------------
 65======= =================================================================
 66Value   Meaning
 67======= =================================================================
 68EINVAL  The prctl is not implemented by the architecture or unused
 69        prctl(2) arguments are not 0.
 70
 71ENODEV  arg2 is selecting a not supported speculation misfeature.
 72======= =================================================================
 73
 74PR_SET_SPECULATION_CTRL error codes
 75-----------------------------------
 76======= =================================================================
 77Value   Meaning
 78======= =================================================================
 790       Success
 80
 81ERANGE  arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor
 82        PR_SPEC_DISABLE nor PR_SPEC_FORCE_DISABLE.
 83
 84ENXIO   Control of the selected speculation misfeature is not possible.
 85        See PR_GET_SPECULATION_CTRL.
 86
 87EPERM   Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller
 88        tried to enable it again.
 89======= =================================================================
 90
 91Speculation misfeature controls
 92-------------------------------
 93- PR_SPEC_STORE_BYPASS: Speculative Store Bypass
 94
 95  Invocations:
 96   * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, 0, 0, 0);
 97   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
 98   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
 99   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0);
100   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE_NOEXEC, 0, 0);
101
102- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes
103                        (Mitigate Spectre V2 style attacks against user processes)
104
105  Invocations:
106   * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
107   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
108   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
109   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
110
111- PR_SPEC_L1D_FLUSH: Flush L1D Cache on context switch out of the task
112                        (works only when tasks run on non SMT cores)
113
114For this control, PR_SPEC_ENABLE means that the **mitigation** is enabled (L1D
115is flushed), PR_SPEC_DISABLE means it is disabled.
116
117  Invocations:
118   * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, 0, 0, 0);
119   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, PR_SPEC_ENABLE, 0, 0);
120   * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, PR_SPEC_DISABLE, 0, 0);