From: Jiri Kosina <[email protected]>
From: Jiri Kosina <[email protected]>
If 'prctl' mode of app2app protection from spectre_v2 is selected on
kernel command-line, we are currently applying STIBP protection to
tasks that restrict their indirect branch speculation via
prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIR_BRANCH, PR_SPEC_ENABLE, 0,
0);
Let's extend this to cover also SECCOMP tasks (analogically to how we
apply SSBD protection).
According to software guidance:
"Setting ... STIBP ... on a logical processor prevents the predicted
targets of indirect branches on any logical processor of that core
from being controlled by software that executes (or executed
previously) on another logical processor of the same core."
https://software.intel.com/security-software-guidance/insights/deep-dive-single-thread-indirect-branch-predictors
Hence setting STIBP on a sandboxed task will prevent the task
from attacking other sibling threads or getting attacked.
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Tim Chen <[email protected]>
---
Documentation/admin-guide/kernel-parameters.txt | 7 ++++++-
arch/x86/include/asm/nospec-branch.h | 1 +
arch/x86/kernel/cpu/bugs.c | 21 +++++++++++++++++++--
3 files changed, 26 insertions(+), 3 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt
b/Documentation/admin-guide/kernel-parameters.txt
index d2255f7..89b193c 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4227,12 +4227,17 @@
and STIBP mitigations against Spectre V2
attacks.
If the CPU is not vulnerable, "off" is
selected.
If the CPU is vulnerable, the default
mitigation
- is "prctl".
+ is architecture and Kconfig dependent. See
below.
prctl - Enable mitigations per thread by restricting
indirect branch speculation via prctl.
Mitigation for a thread is not enabled by
default to
avoid mitigation overhead. The state of
of the control is inherited on fork.
+ seccomp - Same as "prctl" above, but all seccomp threads
+ will disable SSB unless they explicitly opt
out.
+
+ Default mitigations:
+ If CONFIG_SECCOMP=y "seccomp", otherwise "prctl"
Not specifying this option is equivalent to
spectre_v2_app2app=auto.
diff --git a/arch/x86/include/asm/nospec-branch.h
b/arch/x86/include/asm/nospec-branch.h
index 69d2657..077ec54 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -231,6 +231,7 @@ enum spectre_v2_app2app_mitigation {
SPECTRE_V2_APP2APP_NONE,
SPECTRE_V2_APP2APP_STRICT,
SPECTRE_V2_APP2APP_PRCTL,
+ SPECTRE_V2_APP2APP_SECCOMP,
};
/* The Speculative Store Bypass disable variants */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 44f7127..f349b3f 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -138,6 +138,7 @@ enum spectre_v2_app2app_mitigation_cmd {
SPECTRE_V2_APP2APP_CMD_FORCE,
SPECTRE_V2_APP2APP_CMD_AUTO,
SPECTRE_V2_APP2APP_CMD_PRCTL,
+ SPECTRE_V2_APP2APP_CMD_SECCOMP,
};
static const char *spectre_v2_strings[] = {
@@ -153,6 +154,7 @@ static const char *spectre_v2_app2app_strings[] = {
[SPECTRE_V2_APP2APP_NONE] = "App-App Vulnerable",
[SPECTRE_V2_APP2APP_STRICT] = "App-App Mitigation: Full app to app
attack protection",
[SPECTRE_V2_APP2APP_PRCTL] = "App-App Mitigation: Protect branch
speculation restricted tasks",
+ [SPECTRE_V2_APP2APP_SECCOMP] = "App-App Mitigation: Protect branch
speculation restricted and seccomp tasks",
};
/* Lightweight mitigation: mitigate only tasks with TIF_SPEC_INDIR_BRANCH */
@@ -573,10 +575,17 @@ static void __init spectre_v2_select_mitigation(void)
break;
case SPECTRE_V2_APP2APP_CMD_PRCTL:
- case SPECTRE_V2_APP2APP_CMD_AUTO:
app2app_mode = SPECTRE_V2_APP2APP_PRCTL;
break;
+ case SPECTRE_V2_APP2APP_CMD_AUTO:
+ case SPECTRE_V2_APP2APP_CMD_SECCOMP:
+ if (IS_ENABLED(CONFIG_SECCOMP))
+ app2app_mode = SPECTRE_V2_APP2APP_SECCOMP;
+ else
+ app2app_mode = SPECTRE_V2_APP2APP_PRCTL;
+ break;
+
case SPECTRE_V2_APP2APP_CMD_FORCE:
app2app_mode = SPECTRE_V2_APP2APP_STRICT;
break;
@@ -595,7 +604,8 @@ static void __init spectre_v2_select_mitigation(void)
set_app2app_mode:
spectre_v2_app2app_enabled = app2app_mode;
pr_info("%s\n", spectre_v2_app2app_strings[app2app_mode]);
- if (app2app_mode == SPECTRE_V2_APP2APP_PRCTL)
+ if (app2app_mode == SPECTRE_V2_APP2APP_PRCTL ||
+ app2app_mode == SPECTRE_V2_APP2APP_SECCOMP)
static_branch_enable(&spectre_v2_app_lite);
/* Enable STIBP if appropriate */
@@ -849,6 +859,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
{
if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+ if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_SECCOMP)
+ set_task_restrict_indir_branch(task, true);
}
#endif
@@ -879,6 +891,7 @@ static int indir_branch_prctl_get(struct task_struct *task)
switch (spectre_v2_app2app_enabled) {
case SPECTRE_V2_APP2APP_NONE:
return PR_SPEC_ENABLE;
+ case SPECTRE_V2_APP2APP_SECCOMP:
case SPECTRE_V2_APP2APP_PRCTL:
if (task_spec_indir_branch_force_disable(task))
return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
@@ -1075,6 +1088,8 @@ static char *stibp_state(void)
return "";
else if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_PRCTL)
return ", STIBP-prctl";
+ else if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_SECCOMP)
+ return ", STIBP-seccomp";
else
return ", STIBP-all";
}
@@ -1085,6 +1100,8 @@ static char *ibpb_state(void)
return "";
else if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_PRCTL)
return ", IBPB-prctl";
+ else if (spectre_v2_app2app_enabled == SPECTRE_V2_APP2APP_SECCOMP)
+ return ", IBPB-seccomp";
else
return ", IBPB-all";
}
--
2.9.4
