1=================== 2Speculation Control 3=================== 4 5Quite some CPUs have speculation-related misfeatures which are in 6fact vulnerabilities causing data leaks in various forms even across 7privilege domains. 8 9The kernel provides mitigation for such vulnerabilities in various 10forms. Some of these mitigations are compile-time configurable and some 11can be supplied on the kernel command line. 12 13There is also a class of mitigations which are very expensive, but they can 14be restricted to a certain set of processes or tasks in controlled 15environments. The mechanism to control these mitigations is via 16:manpage:`prctl(2)`. 17 18There are two prctl options which are related to this: 19 20 * PR_GET_SPECULATION_CTRL 21 22 * PR_SET_SPECULATION_CTRL 23 24PR_GET_SPECULATION_CTRL 25----------------------- 26 27PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature 28which is selected with arg2 of prctl(2). The return value uses bits 0-3 with 29the following meaning: 30 31==== ===================== =================================================== 32Bit Define Description 33==== ===================== =================================================== 340 PR_SPEC_PRCTL Mitigation can be controlled per task by 35 PR_SET_SPECULATION_CTRL. 361 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is 37 disabled. 382 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is 39 enabled. 403 PR_SPEC_FORCE_DISABLE Same as PR_SPEC_DISABLE, but cannot be undone. A 41 subsequent prctl(..., PR_SPEC_ENABLE) will fail. 42==== ===================== =================================================== 43 44If all bits are 0 the CPU is not affected by the speculation misfeature. 45 46If PR_SPEC_PRCTL is set, then the per-task control of the mitigation is 47available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation 48misfeature will fail. 49 50PR_SET_SPECULATION_CTRL 51----------------------- 52 53PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, which 54is selected by arg2 of :manpage:`prctl(2)` per task. arg3 is used to hand 55in the control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE or 56PR_SPEC_FORCE_DISABLE. 57 58Common error codes 59------------------ 60======= ================================================================= 61Value Meaning 62======= ================================================================= 63EINVAL The prctl is not implemented by the architecture or unused 64 prctl(2) arguments are not 0. 65 66ENODEV arg2 is selecting a not supported speculation misfeature. 67======= ================================================================= 68 69PR_SET_SPECULATION_CTRL error codes 70----------------------------------- 71======= ================================================================= 72Value Meaning 73======= ================================================================= 740 Success 75 76ERANGE arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor 77 PR_SPEC_DISABLE nor PR_SPEC_FORCE_DISABLE. 78 79ENXIO Control of the selected speculation misfeature is not possible. 80 See PR_GET_SPECULATION_CTRL. 81 82EPERM Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller 83 tried to enable it again. 84======= ================================================================= 85 86Speculation misfeature controls 87------------------------------- 88- PR_SPEC_STORE_BYPASS: Speculative Store Bypass 89 90 Invocations: 91 * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, 0, 0, 0); 92 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0); 93 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); 94 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0); 95 96- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes 97 (Mitigate Spectre V2 style attacks against user processes) 98 99 Invocations: 100 * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); 101 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); 102 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); 103 * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0); 104