| Message ID | 20231005084123.1338-1-laoar.shao@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bc5bc309db45a7ab218ce8259ba9bc7659be61ca |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] bpf: Inherit system settings for CPU security mitigations | expand |
On 10/05, Yafang Shao wrote: > Currently, there exists a system-wide setting related to CPU security > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > deactivates all optional CPU mitigations. Therefore, if we implement a > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > v1 and Spectre v4 in the BPF subsystem. > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > architectures, though it is not currently exported. For the time being, > let's disregard it. > > This idea emerged during our discussion about potential Spectre v1 attacks > with Luis[1]. > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ Based on the discussion from [1]: Acked-by: Stanislav Fomichev <sdf@google.com> > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > --- > include/linux/bpf.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index a82efd34b741..61bde4520f5c 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > static inline bool bpf_bypass_spec_v1(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); > } > > static inline bool bpf_bypass_spec_v4(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); > } > > int bpf_map_new_fd(struct bpf_map *map, int flags); > -- > 2.30.1 (Apple Git-130) >
On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > Currently, there exists a system-wide setting related to CPU security > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > deactivates all optional CPU mitigations. Therefore, if we implement a > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > v1 and Spectre v4 in the BPF subsystem. > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > architectures, though it is not currently exported. For the time being, > let's disregard it. > > This idea emerged during our discussion about potential Spectre v1 attacks > with Luis[1]. > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > Cc: Luis Gerhorst <gerhorst@cs.fau.de> Acked-by: Song Liu <song@kernel.org>
On Thu, Oct 5, 2023 at 8:02 PM Song Liu <song@kernel.org> wrote: > > On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > > > Currently, there exists a system-wide setting related to CPU security > > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > > deactivates all optional CPU mitigations. Therefore, if we implement a > > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > > v1 and Spectre v4 in the BPF subsystem. > > > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > > architectures, though it is not currently exported. For the time being, > > let's disregard it. > > > > This idea emerged during our discussion about potential Spectre v1 attacks > > with Luis[1]. > > > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > > Acked-by: Song Liu <song@kernel.org> > Acked-by: KP Singh <kpsingh@kernel.org>
On 10/6/23 1:30 AM, KP Singh wrote: > On Thu, Oct 5, 2023 at 8:02 PM Song Liu <song@kernel.org> wrote: >> On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: >>> >>> Currently, there exists a system-wide setting related to CPU security >>> mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it >>> deactivates all optional CPU mitigations. Therefore, if we implement a >>> system-wide 'mitigations=off' setting, it should inherently bypass Spectre >>> v1 and Spectre v4 in the BPF subsystem. >>> >>> Please note that there is also a 'nospectre_v1' setting on x86 and ppc >>> architectures, though it is not currently exported. For the time being, >>> let's disregard it. From reading, the cpu_mitigations_off() is a more generic toggle to turn these generally off, so going via cpu_mitigations_off() is fine in our case and does not leave some corner cases behind. I presume you mean above that in future the BPF side could respect some more fine-tuned settings, though it probably might need some more coordination wrt archs to abstract sth generic out of it. >>> This idea emerged during our discussion about potential Spectre v1 attacks >>> with Luis[1]. >>> >>> [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ >>> >>> Signed-off-by: Yafang Shao <laoar.shao@gmail.com> >>> Cc: Luis Gerhorst <gerhorst@cs.fau.de> >> >> Acked-by: Song Liu <song@kernel.org> >> > > Acked-by: KP Singh <kpsingh@kernel.org> Thanks, Daniel
Hello: This patch was applied to bpf/bpf-next.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Thu, 5 Oct 2023 08:41:23 +0000 you wrote: > Currently, there exists a system-wide setting related to CPU security > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > deactivates all optional CPU mitigations. Therefore, if we implement a > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > v1 and Spectre v4 in the BPF subsystem. > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > architectures, though it is not currently exported. For the time being, > let's disregard it. > > [...] Here is the summary with links: - [bpf-next] bpf: Inherit system settings for CPU security mitigations https://git.kernel.org/bpf/bpf-next/c/bc5bc309db45 You are awesome, thank you!
On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > Currently, there exists a system-wide setting related to CPU security > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > deactivates all optional CPU mitigations. Therefore, if we implement a > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > v1 and Spectre v4 in the BPF subsystem. > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > architectures, though it is not currently exported. For the time being, > let's disregard it. > > This idea emerged during our discussion about potential Spectre v1 attacks > with Luis[1]. > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > --- > include/linux/bpf.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index a82efd34b741..61bde4520f5c 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > static inline bool bpf_bypass_spec_v1(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); Should we check cpu_mitigations_off() first before perfmon_capable() to avoid unnecessary capability checks, which generate audit messages? > } > > static inline bool bpf_bypass_spec_v4(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); > } > > int bpf_map_new_fd(struct bpf_map *map, int flags); > -- > 2.30.1 (Apple Git-130) >
On Thu, Oct 12, 2023 at 6:53 AM Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote: > > On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > > > Currently, there exists a system-wide setting related to CPU security > > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > > deactivates all optional CPU mitigations. Therefore, if we implement a > > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > > v1 and Spectre v4 in the BPF subsystem. > > > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > > architectures, though it is not currently exported. For the time being, > > let's disregard it. > > > > This idea emerged during our discussion about potential Spectre v1 attacks > > with Luis[1]. > > > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > > --- > > include/linux/bpf.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > > index a82efd34b741..61bde4520f5c 100644 > > --- a/include/linux/bpf.h > > +++ b/include/linux/bpf.h > > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > > > static inline bool bpf_bypass_spec_v1(void) > > { > > - return perfmon_capable(); > > + return perfmon_capable() || cpu_mitigations_off(); > > Should we check cpu_mitigations_off() first before perfmon_capable() > to avoid unnecessary capability checks, which generate audit messages? makes sense. Should I send an additional patch, or you modify the original patch?
On Wed, Oct 11, 2023 at 7:29 PM Yafang Shao <laoar.shao@gmail.com> wrote: > > On Thu, Oct 12, 2023 at 6:53 AM Andrii Nakryiko > <andrii.nakryiko@gmail.com> wrote: > > > > On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > > > > > Currently, there exists a system-wide setting related to CPU security > > > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > > > deactivates all optional CPU mitigations. Therefore, if we implement a > > > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > > > v1 and Spectre v4 in the BPF subsystem. > > > > > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > > > architectures, though it is not currently exported. For the time being, > > > let's disregard it. > > > > > > This idea emerged during our discussion about potential Spectre v1 attacks > > > with Luis[1]. > > > > > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > > > > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > > > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > > > --- > > > include/linux/bpf.h | 4 ++-- > > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > > > index a82efd34b741..61bde4520f5c 100644 > > > --- a/include/linux/bpf.h > > > +++ b/include/linux/bpf.h > > > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > > > > > static inline bool bpf_bypass_spec_v1(void) > > > { > > > - return perfmon_capable(); > > > + return perfmon_capable() || cpu_mitigations_off(); > > > > Should we check cpu_mitigations_off() first before perfmon_capable() > > to avoid unnecessary capability checks, which generate audit messages? > > makes sense. > Should I send an additional patch, or you modify the original patch? please send a patch > > -- > Regards > Yafang
On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > Currently, there exists a system-wide setting related to CPU security > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > deactivates all optional CPU mitigations. Therefore, if we implement a > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > v1 and Spectre v4 in the BPF subsystem. > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > architectures, though it is not currently exported. For the time being, > let's disregard it. > > This idea emerged during our discussion about potential Spectre v1 attacks > with Luis[1]. > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > --- > include/linux/bpf.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index a82efd34b741..61bde4520f5c 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > static inline bool bpf_bypass_spec_v1(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); > } > > static inline bool bpf_bypass_spec_v4(void) > { > - return perfmon_capable(); > + return perfmon_capable() || cpu_mitigations_off(); > } Yafang, this patch breaks several test_progs -t verifier tests when system is booted with mitigations=off command line. Please follow up with a patch to fix this. As you noticed cpu_mitigations_off() is not quite right here. The system might have booted without that command line, but spec_v1 and spec_v4 mitigations are turned off. Unfortunately there is no good way to check that atm. Have you seen this patch set ? https://lore.kernel.org/all/20231019181158.1982205-1-leitao@debian.org/ Please take a look at it and comment if you think it will help. In the meantime please fix test_progs -t verifier Thanks
On Fri, Oct 20, 2023 at 8:42 AM Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > > On Thu, Oct 5, 2023 at 1:41 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > > > Currently, there exists a system-wide setting related to CPU security > > mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it > > deactivates all optional CPU mitigations. Therefore, if we implement a > > system-wide 'mitigations=off' setting, it should inherently bypass Spectre > > v1 and Spectre v4 in the BPF subsystem. > > > > Please note that there is also a 'nospectre_v1' setting on x86 and ppc > > architectures, though it is not currently exported. For the time being, > > let's disregard it. > > > > This idea emerged during our discussion about potential Spectre v1 attacks > > with Luis[1]. > > > > [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ > > > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > > Cc: Luis Gerhorst <gerhorst@cs.fau.de> > > --- > > include/linux/bpf.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > > index a82efd34b741..61bde4520f5c 100644 > > --- a/include/linux/bpf.h > > +++ b/include/linux/bpf.h > > @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) > > > > static inline bool bpf_bypass_spec_v1(void) > > { > > - return perfmon_capable(); > > + return perfmon_capable() || cpu_mitigations_off(); > > } > > > > static inline bool bpf_bypass_spec_v4(void) > > { > > - return perfmon_capable(); > > + return perfmon_capable() || cpu_mitigations_off(); > > } > > Yafang, > > this patch breaks several > test_progs -t verifier Sorry, I miss that. > > tests when system is booted with mitigations=off command line. > > Please follow up with a patch to fix this. will do it. > > As you noticed cpu_mitigations_off() is not quite right here. > The system might have booted without that command line, but > spec_v1 and spec_v4 mitigations are turned off. > Unfortunately there is no good way to check that atm. > Have you seen this patch set ? > https://lore.kernel.org/all/20231019181158.1982205-1-leitao@debian.org/ > Please take a look at it and comment if you think it will help. Thanks for your information. will take a look. > > In the meantime please fix test_progs -t verifier sure
diff --git a/include/linux/bpf.h b/include/linux/bpf.h index a82efd34b741..61bde4520f5c 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void) static inline bool bpf_bypass_spec_v1(void) { - return perfmon_capable(); + return perfmon_capable() || cpu_mitigations_off(); } static inline bool bpf_bypass_spec_v4(void) { - return perfmon_capable(); + return perfmon_capable() || cpu_mitigations_off(); } int bpf_map_new_fd(struct bpf_map *map, int flags);
Currently, there exists a system-wide setting related to CPU security mitigations, denoted as 'mitigations='. When set to 'mitigations=off', it deactivates all optional CPU mitigations. Therefore, if we implement a system-wide 'mitigations=off' setting, it should inherently bypass Spectre v1 and Spectre v4 in the BPF subsystem. Please note that there is also a 'nospectre_v1' setting on x86 and ppc architectures, though it is not currently exported. For the time being, let's disregard it. This idea emerged during our discussion about potential Spectre v1 attacks with Luis[1]. [1]. https://lore.kernel.org/bpf/b4fc15f7-b204-767e-ebb9-fdb4233961fb@iogearbox.net/ Signed-off-by: Yafang Shao <laoar.shao@gmail.com> Cc: Luis Gerhorst <gerhorst@cs.fau.de> --- include/linux/bpf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)