Enable STIBP defense on high security tasks. For normal tasks, STIBP is unused so they are not impacted by overhead from STIBP in lite protection mode.
Signed-off-by: Tim Chen <[email protected]> --- arch/x86/kernel/cpu/bugs.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 54f4675..b402b96 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -14,6 +14,8 @@ #include <linux/module.h> #include <linux/nospec.h> #include <linux/prctl.h> +#include <linux/sched/coredump.h> +#include <linux/security.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -770,6 +772,37 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl) return 0; } +static void set_task_stibp(struct task_struct *tsk, bool stibp_on) +{ + bool update = false; + + if (!static_branch_unlikely(&spectre_v2_app_lite)) + return; + + if (stibp_on) + update = !test_and_set_tsk_thread_flag(tsk, TIF_STIBP); + else + update = test_and_clear_tsk_thread_flag(tsk, TIF_STIBP); + + if (!update) + return; + + if (tsk == current) + speculation_ctrl_update_current(); +} + +void arch_set_security(struct task_struct *tsk, unsigned int value) +{ + if (value > SECURITY_HIGH) + return; + + /* Update STIBP defenses */ + if (value == SECURITY_HIGH) + set_task_stibp(tsk, true); + else + set_task_stibp(tsk, false); +} + int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, unsigned long ctrl) { -- 2.9.4
