From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kees Cook <keescook@chromium.org>,
Thomas Gleixner <tglx@linutronix.de>,
David Woodhouse <dwmw@amazon.co.uk>
Subject: [PATCH 4.9 63/87] x86/speculation: Make "seccomp" the default mode for Speculative Store Bypass
Date: Mon, 21 May 2018 23:11:39 +0200 [thread overview]
Message-ID: <20180521210425.733930167@linuxfoundation.org> (raw)
In-Reply-To: <20180521210420.222671977@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit f21b53b20c754021935ea43364dbf53778eeba32 upstream
Unless explicitly opted out of, anything running under seccomp will have
SSB mitigations enabled. Choosing the "prctl" mode will disable this.
[ tglx: Adjusted it to the new arch_seccomp_spec_mitigate() mechanism ]
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 26 +++++++++++++++++---------
arch/x86/include/asm/nospec-branch.h | 1 +
arch/x86/kernel/cpu/bugs.c | 32 +++++++++++++++++++++++---------
3 files changed, 41 insertions(+), 18 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3997,19 +3997,27 @@ bytes respectively. Such letter suffixes
This parameter controls whether the Speculative Store
Bypass optimization is used.
- on - Unconditionally disable Speculative Store Bypass
- off - Unconditionally enable Speculative Store Bypass
- auto - Kernel detects whether the CPU model contains an
- implementation of Speculative Store Bypass and
- picks the most appropriate mitigation.
- prctl - Control Speculative Store Bypass per thread
- via prctl. Speculative Store Bypass is enabled
- for a process by default. The state of the control
- is inherited on fork.
+ on - Unconditionally disable Speculative Store Bypass
+ off - Unconditionally enable Speculative Store Bypass
+ auto - Kernel detects whether the CPU model contains an
+ implementation of Speculative Store Bypass and
+ picks the most appropriate mitigation. If the
+ CPU is not vulnerable, "off" is selected. If the
+ CPU is vulnerable the default mitigation is
+ architecture and Kconfig dependent. See below.
+ prctl - Control Speculative Store Bypass per thread
+ via prctl. Speculative Store Bypass is enabled
+ for a process by default. The state of the control
+ is inherited on fork.
+ seccomp - Same as "prctl" above, but all seccomp threads
+ will disable SSB unless they explicitly opt out.
Not specifying this option is equivalent to
spec_store_bypass_disable=auto.
+ Default mitigations:
+ X86: If CONFIG_SECCOMP=y "seccomp", otherwise "prctl"
+
spia_io_base= [HW,MTD]
spia_fio_base=
spia_pedr=
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -233,6 +233,7 @@ enum ssb_mitigation {
SPEC_STORE_BYPASS_NONE,
SPEC_STORE_BYPASS_DISABLE,
SPEC_STORE_BYPASS_PRCTL,
+ SPEC_STORE_BYPASS_SECCOMP,
};
extern char __indirect_thunk_start[];
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -415,22 +415,25 @@ enum ssb_mitigation_cmd {
SPEC_STORE_BYPASS_CMD_AUTO,
SPEC_STORE_BYPASS_CMD_ON,
SPEC_STORE_BYPASS_CMD_PRCTL,
+ SPEC_STORE_BYPASS_CMD_SECCOMP,
};
static const char *ssb_strings[] = {
[SPEC_STORE_BYPASS_NONE] = "Vulnerable",
[SPEC_STORE_BYPASS_DISABLE] = "Mitigation: Speculative Store Bypass disabled",
- [SPEC_STORE_BYPASS_PRCTL] = "Mitigation: Speculative Store Bypass disabled via prctl"
+ [SPEC_STORE_BYPASS_PRCTL] = "Mitigation: Speculative Store Bypass disabled via prctl",
+ [SPEC_STORE_BYPASS_SECCOMP] = "Mitigation: Speculative Store Bypass disabled via prctl and seccomp",
};
static const struct {
const char *option;
enum ssb_mitigation_cmd cmd;
} ssb_mitigation_options[] = {
- { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
- { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */
- { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
- { "prctl", SPEC_STORE_BYPASS_CMD_PRCTL }, /* Disable Speculative Store Bypass via prctl */
+ { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
+ { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */
+ { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
+ { "prctl", SPEC_STORE_BYPASS_CMD_PRCTL }, /* Disable Speculative Store Bypass via prctl */
+ { "seccomp", SPEC_STORE_BYPASS_CMD_SECCOMP }, /* Disable Speculative Store Bypass via prctl and seccomp */
};
static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)
@@ -480,8 +483,15 @@ static enum ssb_mitigation_cmd __init __
switch (cmd) {
case SPEC_STORE_BYPASS_CMD_AUTO:
- /* Choose prctl as the default mode */
- mode = SPEC_STORE_BYPASS_PRCTL;
+ case SPEC_STORE_BYPASS_CMD_SECCOMP:
+ /*
+ * Choose prctl+seccomp as the default mode if seccomp is
+ * enabled.
+ */
+ if (IS_ENABLED(CONFIG_SECCOMP))
+ mode = SPEC_STORE_BYPASS_SECCOMP;
+ else
+ mode = SPEC_STORE_BYPASS_PRCTL;
break;
case SPEC_STORE_BYPASS_CMD_ON:
mode = SPEC_STORE_BYPASS_DISABLE;
@@ -529,12 +539,14 @@ static void ssb_select_mitigation()
}
#undef pr_fmt
+#define pr_fmt(fmt) "Speculation prctl: " fmt
static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
{
bool update;
- if (ssb_mode != SPEC_STORE_BYPASS_PRCTL)
+ if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
+ ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
return -ENXIO;
switch (ctrl) {
@@ -582,7 +594,8 @@ int arch_prctl_spec_ctrl_set(struct task
#ifdef CONFIG_SECCOMP
void arch_seccomp_spec_mitigate(struct task_struct *task)
{
- ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+ if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
+ ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
}
#endif
@@ -591,6 +604,7 @@ static int ssb_prctl_get(struct task_str
switch (ssb_mode) {
case SPEC_STORE_BYPASS_DISABLE:
return PR_SPEC_DISABLE;
+ case SPEC_STORE_BYPASS_SECCOMP:
case SPEC_STORE_BYPASS_PRCTL:
if (task_spec_ssb_force_disable(task))
return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
next prev parent reply other threads:[~2018-05-21 21:11 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-21 21:10 [PATCH 4.9 00/87] 4.9.102-stable review Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 01/87] usbip: usbip_host: refine probe and disconnect debug msgs to be useful Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 02/87] usbip: usbip_host: delete device from busid_table after rebind Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 03/87] usbip: usbip_host: run rebind from exit when module is removed Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 04/87] usbip: usbip_host: fix NULL-ptr deref and use-after-free errors Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 05/87] usbip: usbip_host: fix bad unlock balance during stub_probe() Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 06/87] ALSA: usb: mixer: volume quirk for CM102-A+/102S+ Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 07/87] ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 08/87] ALSA: control: fix a redundant-copy issue Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 09/87] spi: pxa2xx: Allow 64-bit DMA Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 10/87] spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 11/87] spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 12/87] KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 13/87] powerpc: Dont preempt_disable() in show_cpuinfo() Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 14/87] signals: avoid unnecessary taking of sighand->siglock Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 15/87] tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 16/87] netfilter: nf_tables: cant fail after linking rule into active rule list Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 17/87] i2c: designware: fix poll-after-enable regression Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 18/87] powerpc/powernv: Fix NVRAM sleep in invalid context when crashing Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 19/87] mm: dont allow deferred pages with NEED_PER_CPU_KM Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 20/87] s390/qdio: fix access to uninitialized qdio_q fields Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 21/87] s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 22/87] s390/qdio: dont release memory in qdio_setup_irq() Greg Kroah-Hartman
2018-05-21 21:10 ` [PATCH 4.9 23/87] s390: remove indirect branch from do_softirq_own_stack Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 24/87] x86/pkeys: Override pkey when moving away from PROT_EXEC Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 25/87] x86/pkeys: Do not special case protection key 0 Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 26/87] efi: Avoid potential crashes, fix the struct efi_pci_io_protocol_32 definition for mixed mode Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 27/87] ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 28/87] tick/broadcast: Use for_each_cpu() specially on UP kernels Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 29/87] ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 30/87] ARM: 8770/1: kprobes: Prohibit probing on optimized_callback Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 31/87] ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 32/87] Btrfs: fix xattr loss after power failure Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 33/87] btrfs: fix crash when trying to resume balance without the resume flag Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 34/87] x86/amd: dont set X86_BUG_SYSRET_SS_ATTRS when running under Xen Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 35/87] btrfs: fix reading stale metadata blocks after degraded raid1 mounts Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 36/87] x86/nospec: Simplify alternative_msr_write() Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 37/87] x86/bugs: Concentrate bug detection into a separate function Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 38/87] x86/bugs: Concentrate bug reporting " Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 39/87] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 40/87] x86/bugs, KVM: Support the combination of guest and host IBRS Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 41/87] x86/bugs: Expose /sys/../spec_store_bypass Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 42/87] x86/cpufeatures: Add X86_FEATURE_RDS Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 43/87] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 44/87] x86/bugs/intel: Set proper CPU features and setup RDS Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 45/87] x86/bugs: Whitelist allowed SPEC_CTRL MSR values Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 46/87] x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 47/87] x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 48/87] x86/speculation: Create spec-ctrl.h to avoid include hell Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 49/87] prctl: Add speculation control prctls Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 50/87] x86/process: Optimize TIF checks in __switch_to_xtra() Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 51/87] x86/process: Correct and optimize TIF_BLOCKSTEP switch Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 52/87] x86/process: Optimize TIF_NOTSC switch Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 53/87] x86/process: Allow runtime control of Speculative Store Bypass Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 54/87] x86/speculation: Add prctl for Speculative Store Bypass mitigation Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 55/87] nospec: Allow getting/setting on non-current task Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 56/87] proc: Provide details on speculation flaw mitigations Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 57/87] seccomp: Enable " Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 58/87] x86/bugs: Make boot modes __ro_after_init Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 59/87] prctl: Add force disable speculation Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 60/87] seccomp: Use PR_SPEC_FORCE_DISABLE Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 61/87] seccomp: Add filter flag to opt-out of SSB mitigation Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 62/87] seccomp: Move speculation migitation control to arch code Greg Kroah-Hartman
2018-05-21 21:11 ` Greg Kroah-Hartman [this message]
2018-05-21 21:11 ` [PATCH 4.9 64/87] x86/bugs: Rename _RDS to _SSBD Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 65/87] proc: Use underscores for SSBD in status Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 66/87] Documentation/spec_ctrl: Do some minor cleanups Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 67/87] x86/bugs: Fix __ssb_select_mitigation() return type Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 68/87] x86/bugs: Make cpu_show_common() static Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 69/87] x86/bugs: Fix the parameters alignment and missing void Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 70/87] x86/cpu: Make alternative_msr_write work for 32-bit code Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 71/87] KVM: SVM: Move spec control call after restore of GS Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 72/87] x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 73/87] x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 74/87] x86/cpufeatures: Disentangle SSBD enumeration Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 75/87] x86/cpu/AMD: Fix erratum 1076 (CPB bit) Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 76/87] x86/cpufeatures: Add FEATURE_ZEN Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 77/87] x86/speculation: Handle HT correctly on AMD Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 78/87] x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 79/87] x86/speculation: Add virtualized speculative store bypass disable support Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 80/87] x86/speculation: Rework speculative_store_bypass_update() Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 81/87] x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host} Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 82/87] x86/bugs: Expose x86_spec_ctrl_base directly Greg Kroah-Hartman
2018-05-21 21:11 ` [PATCH 4.9 83/87] x86/bugs: Remove x86_spec_ctrl_set() Greg Kroah-Hartman
2018-05-21 21:12 ` [PATCH 4.9 84/87] x86/bugs: Rework spec_ctrl base and mask logic Greg Kroah-Hartman
2018-05-21 21:12 ` [PATCH 4.9 85/87] x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG Greg Kroah-Hartman
2018-05-21 21:12 ` [PATCH 4.9 86/87] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD Greg Kroah-Hartman
2018-05-21 21:12 ` [PATCH 4.9 87/87] x86/bugs: Rename SSBD_NO to SSB_NO Greg Kroah-Hartman
2018-05-22 4:46 ` [PATCH 4.9 00/87] 4.9.102-stable review kernelci.org bot
2018-05-22 11:08 ` Naresh Kamboju
2018-05-22 13:28 ` Guenter Roeck
2018-05-22 20:41 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180521210425.733930167@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dwmw@amazon.co.uk \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).