SSB extra 0

BPF is a potential source of gadgets that can be used for memory diambiguation-based attacks. To help mitigate these, we enable the bit in SPEC_CTRL which enables the reduced (memory) speculation mode on the processor when runing BPF code.

This is far from optimal: it does not opt-out of the mitigations for BPF programs which are trusted or which are less likely to be exploited, like those which have been offloaded.

It also uses a fixed (and stupid) algoritm for keeping the MSR write traffic to a minimum. Each time a CPU uses BPF, it does the MSR write to enable the mitigation and then schedules some work in 10ms to disable the mitigation. It repeats this every 10ms if the CPU keeps seeing BPF activity. This can obviously be improved on, but it is simple at the moment and _works_.

Dave Hansen (5):
bpf: add enter/exit markers
bpf: track entry to and exit from BFP code
bpf: use reduced speculation mitigations x86, bugs: centralize SPEC_CTRL MSR mask generation
x86: implement reduced speculation when running BPF

 arch/x86/Kconfig                 |  4 ++
 arch/x86/include/asm/rmspec.h    | 24 ++++++++++++
 arch/x86/include/asm/spec-ctrl.h |  3 ++
 arch/x86/kernel/cpu/bugs.c       | 81 ++++++++++++++++++++++++++++++++--------
 include/linux/bpf.h              |  2 +
 include/linux/filter.h           | 34 ++++++++++++++++-
 include/linux/nospec.h           | 11 ++++++
 kernel/bpf/sockmap.c             |  6 +++
 net/core/filter.c                | 65 ++++++++++++++++++++++++++++++++
 net/kcm/kcmsock.c                |  7 +++-
 10 files changed, 220 insertions(+), 17 deletions(-)
 create mode 100644 arch/x86/include/asm/rmspec.h

2.9.5