[MODERATED] Re: [patch 07/11] [PATCH v2 07/10] Linux Patch #7

[Tim Chen <tim.c.chen@linux.intel.com>]

[-- Attachment #1.1: Type: text/plain, Size: 8983 bytes --]


> 
> As we discussed before:
> 
>  1) Yet another patch site in the entry/exit path which if patched to
>     functional contains yet another conditonal.
> 
>     The amount of NOOPs in entry/exit is horrendous already if this whole
>     nonsense is patched out.
> 
>  2) The prctl is a handwavy idea. The semantics are blury at best. Is it
>     opt-in or opt-out? Which processes should set it? What's the chance
>     that the applications get actually patched? This is the ideal target
>     for bitrot.
> 
> Anyway, if Intel thinks that this is desired, then they can send patches on
> top of the big hammer (MD on/off globally) and provide the answers to #2
> and proper numbers.
> 


Here's a crack from me on top of Conrad's patches to disable speculation only
for SECCOMP process.  I know that there is still some debate going forward
on refining the prctl but this is to illustrate an example of how it can be
done. We still need to switch the default to SECCOMP or some other prctl 
mechanism and the memory disambiguation disable and reduced data
speculation names need to be put in sync.

I've tested it with browser app that has seccomp turned on.

I still need to collect some performance numbers.

Thanks.

Tim

------>8-------

From e6aaa3123f9c42db4936d705341f799ef8a698f6 Mon Sep 17 00:00:00 2001
From: Tim Chen <tim.c.chen@linux.intel.com>
Date: Mon, 23 Apr 2018 05:57:53 -0700
Subject: [PATCH] x86/ssb: Enable option to mitigate SBB only for seccomp
 processes

For many usage cases, the administrator may not want to disable
speculative store bypass for the whole system for performance reason.
He may choose to enable speculative store bypass mitigation only
for seccomp processes, which have the highest risk for this kind of
vulnerability.

Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
---
 Documentation/admin-guide/kernel-parameters.txt |  2 ++
 arch/x86/include/asm/nospec-branch.h            | 21 ++++++++++++--
 arch/x86/kernel/cpu/bugs.c                      | 37 ++++++++++++++++++++++++-
 arch/x86/kernel/cpu/intel.c                     |  3 +-
 arch/x86/kernel/process_64.c                    | 11 ++++++++
 5 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 0574105..bd1baf9 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4053,6 +4053,8 @@
 			auto - kernel detects whether your CPU model contains a
 			       vulnerable implementation of Speculative Store
 			       Bypass and picks the most appropriate mitigation
+			seccomp - disable Speculative Store Bypass only for seccomp
+				  processes.
 
 			Not specifying this option is equivalent to
 			spec_store_bypass_disable=auto.
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index c4a99c9..c718929 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -3,10 +3,12 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/jump_label.h>
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
 #include <asm/msr-index.h>
+#include <asm/percpu.h>
 
 /*
  * Fill the CPU return stack buffer.
@@ -241,11 +243,15 @@ extern void x86_restore_host_spec_ctrl(u64);
 enum spec_store_bypass_mitigation {
 	SPEC_STORE_BYPASS_NONE,
 	SPEC_STORE_BYPASS_DISABLE,
+	SPEC_STORE_BYPASS_SECCOMP,
 };
 
 extern char __indirect_thunk_start[];
 extern char __indirect_thunk_end[];
 
+/* cpu's MSR_IA32_SPEC_CTRL state for speculation store bypass mitigation */
+DECLARE_PER_CPU(int, rds_msr_val);
+
 /*
  * On VMEXIT we must ensure that no RSB predictions learned in the guest
  * can be followed in the host, by overwriting the RSB completely. Both
@@ -300,12 +306,23 @@ do {									\
 
 #define firmware_restrict_branch_speculation_end()			\
 do {									\
-	alternative_msr_write(MSR_IA32_SPEC_CTRL,			\
-			      x86_spec_ctrl_base,			\
+	u64 val = x86_spec_ctrl_base | __this_cpu_read(rds_msr_val);	\
+	alternative_msr_write(MSR_IA32_SPEC_CTRL, val,			\
 			      X86_FEATURE_USE_IBRS_FW);			\
 	preempt_enable();						\
 } while (0)
 
+/*
+ * speculation store bypass vulnerabilities mitigation functions.
+ *
+ * Should be called only from pre-emption off paths.
+ *
+ */
+
+void enable_speculative_store_bypass_mitigation(void);
+void disable_speculative_store_bypass_mitigation(void);
+
+DECLARE_STATIC_KEY_FALSE(specctrl_rds);
 #endif /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 03f13a6..9e811cd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -361,16 +361,26 @@ static void __init spectre_v2_select_mitigation(void)
 
 static enum spec_store_bypass_mitigation spec_store_bypass_mode = SPEC_STORE_BYPASS_NONE;
 
+/* dynamic reduced data speculation in use */
+DEFINE_STATIC_KEY_FALSE(specctrl_rds);
+EXPORT_SYMBOL(specctrl_rds);
+
+/* current MSR_IA32_SPEC_CTRL state for ssb mitigation */
+DEFINE_PER_CPU(int, rds_msr_val);
+EXPORT_SYMBOL(rds_msr_val);
+
 /* The kernel command line selection */
 enum spec_store_bypass_mitigation_cmd {
 	SPEC_STORE_BYPASS_CMD_NONE,
 	SPEC_STORE_BYPASS_CMD_AUTO,
 	SPEC_STORE_BYPASS_CMD_ON,
+	SPEC_STORE_BYPASS_CMD_SECCOMP,
 };
 
 static const char *spec_store_bypass_strings[] = {
 	[SPEC_STORE_BYPASS_NONE]			= "Vulnerable",
-	[SPEC_STORE_BYPASS_DISABLE]			= "Mitigation: Speculative Store Bypass disabled"
+	[SPEC_STORE_BYPASS_DISABLE]			= "Mitigation: Speculative Store Bypass disabled",
+	[SPEC_STORE_BYPASS_SECCOMP]			= "Mitigation: Speculative Store Bypass disabled for seccomp processes"
 };
 
 static const struct {
@@ -380,8 +390,29 @@ static const struct {
 	{ "auto",				SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
 	{ "on",					SPEC_STORE_BYPASS_CMD_ON },   /* Disable Speculative Store Bypass */
 	{ "off",				SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
+	{ "seccomp",				SPEC_STORE_BYPASS_CMD_SECCOMP }, /* disable Speculative Store Bypass for seccomp processes*/
 };
 
+void enable_speculative_store_bypass_mitigation(void)
+{
+       if (static_branch_unlikely(&specctrl_rds) &&
+           /* need to toggle msr? */
+           __this_cpu_read(rds_msr_val) != SPEC_CTRL_MDD) {
+               wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_MDD | x86_spec_ctrl_base);
+               __this_cpu_write(rds_msr_val, SPEC_CTRL_MDD);
+       }
+}
+
+void disable_speculative_store_bypass_mitigation(void)
+{
+       if (static_branch_unlikely(&specctrl_rds) &&
+           /* need to toggle msr? */
+           __this_cpu_read(rds_msr_val) != 0) {
+               wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+               __this_cpu_write(rds_msr_val, 0);
+       }
+}
+
 static enum spec_store_bypass_mitigation_cmd __init spec_store_bypass_parse_cmdline(void)
 {
 	char arg[20];
@@ -440,6 +471,10 @@ static void __init spec_store_bypass_select_mitigation(void)
 	case SPEC_STORE_BYPASS_CMD_ON:
 		mode = SPEC_STORE_BYPASS_DISABLE;
 		break;
+	case SPEC_STORE_BYPASS_CMD_SECCOMP:
+		mode = SPEC_STORE_BYPASS_SECCOMP;
+		static_branch_enable(&specctrl_rds);
+		break;
 	case SPEC_STORE_BYPASS_CMD_NONE:
 		break;
 	}
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index c66a8e7..ca6e7f3 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -774,7 +774,8 @@ static void init_intel(struct cpuinfo_x86 *c)
 	init_intel_misc_features(c);
 
 	if (cpu_has(c, X86_FEATURE_STBUF_MITIGATE)) {
-		x86_spec_ctrl_base |= SPEC_CTRL_MDD;
+		if (!static_branch_unlikely(&specctrl_rds))
+			x86_spec_ctrl_base |= SPEC_CTRL_MDD;
 		wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
 	}
 }
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 4b100fe..9e1236d 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -54,6 +54,7 @@
 #include <asm/vdso.h>
 #include <asm/intel_rdt_sched.h>
 #include <asm/unistd.h>
+#include <asm/nospec-branch.h>
 #ifdef CONFIG_IA32_EMULATION
 /* Not included via unistd.h */
 #include <asm/unistd_32_ia32.h>
@@ -529,6 +530,16 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
 	/* Load the Intel cache allocation PQR MSR. */
 	intel_rdt_sched_in();
 
+	if (next_p->mm && test_tsk_thread_flag(next_p, TIF_SECCOMP))
+		/*
+		 * Reduce data speculation for sandboxed
+		 * seccomp process for protection against speculation
+		 * store bypass attack.
+		 */
+		enable_speculative_store_bypass_mitigation();
+	else
+		disable_speculative_store_bypass_mitigation();
+
 	return prev_p;
 }
 
-- 
2.9.4