Commit 9a32a7e7 authored by Nicholas Piggin's avatar Nicholas Piggin Committed by Michael Ellerman
Browse files

powerpc/64s: flush L1D after user accesses 



IBM Power9 processors can speculatively operate on data in the L1 cache
before it has been completely validated, via a way-prediction mechanism. It
is not possible for an attacker to determine the contents of impermissible
memory using this method, since these systems implement a combination of
hardware and software security measures to prevent scenarios where
protected data could be leaked.

However these measures don't address the scenario where an attacker induces
the operating system to speculatively execute instructions using data that
the attacker controls. This can be used for example to speculatively bypass
"kernel user access prevention" techniques, as discovered by Anthony
Steinhauser of Google's Safeside Project. This is not an attack by itself,
but there is a possibility it could be used in conjunction with
side-channels or other weaknesses in the privileged code to construct an
attack.

This issue can be mitigated by flushing the L1 cache between privilege
boundaries of concern. This patch flushes the L1 cache after user accesses.

This is part of the fix for CVE-2020-4788.

Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
Signed-off-by: default avatarDaniel Axtens <dja@axtens.net>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent f7964378

Documentation/admin-guide/kernel-parameters.txt

+4 −0
Original line number Diff line number Diff line
@@ -2859,6 +2859,7 @@ 
					       tsx_async_abort=off [X86]

					       kvm.nx_huge_pages=off [X86]

					       no_entry_flush [PPC]

					       no_uaccess_flush [PPC]



				Exceptions:

					       This does not have any effect on
@@ -3238,6 +3239,9 @@ 
	nospec_store_bypass_disable

			[HW] Disable all mitigations for the Speculative Store Bypass vulnerability



	no_uaccess_flush

	                [PPC] Don't flush the L1-D cache after accessing user data.



	noxsave		[BUGS=X86] Disables x86 extended register state save

			and restore using xsave. The kernel will fallback to

			enabling legacy floating-point and sse state.

arch/powerpc/include/asm/book3s/64/kup-radix.h

+42 −24
Original line number Diff line number Diff line
@@ -61,6 +61,8 @@ 


#else /* !__ASSEMBLY__ */



DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);



#ifdef CONFIG_PPC_KUAP



#include <asm/mmu.h>
@@ -103,8 +105,16 @@ static inline void kuap_check_amr(void) 


static inline unsigned long get_kuap(void)

{

	/*

	 * We return AMR_KUAP_BLOCKED when we don't support KUAP because

	 * prevent_user_access_return needs to return AMR_KUAP_BLOCKED to

	 * cause restore_user_access to do a flush.

	 *

	 * This has no effect in terms of actually blocking things on hash,

	 * so it doesn't break anything.

	 */

	if (!early_mmu_has_feature(MMU_FTR_RADIX_KUAP))

		return 0;

		return AMR_KUAP_BLOCKED;



	return mfspr(SPRN_AMR);

}
@@ -123,6 +133,31 @@ static inline void set_kuap(unsigned long value) 
	isync();

}



static inline bool

bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)

{

	return WARN(mmu_has_feature(MMU_FTR_RADIX_KUAP) &&

		    (regs->kuap & (is_write ? AMR_KUAP_BLOCK_WRITE : AMR_KUAP_BLOCK_READ)),

		    "Bug: %s fault blocked by AMR!", is_write ? "Write" : "Read");

}

#else /* CONFIG_PPC_KUAP */

static inline void kuap_restore_amr(struct pt_regs *regs, unsigned long amr) { }



static inline unsigned long kuap_get_and_check_amr(void)

{

	return 0UL;

}



static inline void kuap_check_amr(void) { }



static inline unsigned long get_kuap(void)

{

	return AMR_KUAP_BLOCKED;

}



static inline void set_kuap(unsigned long value) { }

#endif /* !CONFIG_PPC_KUAP */



static __always_inline void allow_user_access(void __user *to, const void __user *from,

					      unsigned long size, unsigned long dir)

{
@@ -142,6 +177,8 @@ static inline void prevent_user_access(void __user *to, const void __user *from, 
				       unsigned long size, unsigned long dir)

{

	set_kuap(AMR_KUAP_BLOCKED);

	if (static_branch_unlikely(&uaccess_flush_key))

		do_uaccess_flush();

}



static inline unsigned long prevent_user_access_return(void)
@@ -149,6 +186,8 @@ static inline unsigned long prevent_user_access_return(void) 
	unsigned long flags = get_kuap();



	set_kuap(AMR_KUAP_BLOCKED);

	if (static_branch_unlikely(&uaccess_flush_key))

		do_uaccess_flush();



	return flags;

}
@@ -156,30 +195,9 @@ static inline unsigned long prevent_user_access_return(void) 
static inline void restore_user_access(unsigned long flags)

{

	set_kuap(flags);

	if (static_branch_unlikely(&uaccess_flush_key) && flags == AMR_KUAP_BLOCKED)

		do_uaccess_flush();

}



static inline bool

bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)

{

	return WARN(mmu_has_feature(MMU_FTR_RADIX_KUAP) &&

		    (regs->kuap & (is_write ? AMR_KUAP_BLOCK_WRITE : AMR_KUAP_BLOCK_READ)),

		    "Bug: %s fault blocked by AMR!", is_write ? "Write" : "Read");

}

#else /* CONFIG_PPC_KUAP */

static inline void kuap_restore_amr(struct pt_regs *regs, unsigned long amr)

{

}



static inline void kuap_check_amr(void)

{

}



static inline unsigned long kuap_get_and_check_amr(void)

{

	return 0;

}

#endif /* CONFIG_PPC_KUAP */



#endif /* __ASSEMBLY__ */



#endif /* _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H */

arch/powerpc/include/asm/exception-64s.h

+3 −0
Original line number Diff line number Diff line
@@ -144,6 +144,9 @@ 
	RFSCV;								\

	b	rfscv_flush_fallback



#else /* __ASSEMBLY__ */

/* Prototype for function defined in exceptions-64s.S */

void do_uaccess_flush(void);

#endif /* __ASSEMBLY__ */



#endif	/* _ASM_POWERPC_EXCEPTION_H */

arch/powerpc/include/asm/feature-fixups.h

+9 −0
Original line number Diff line number Diff line
@@ -205,6 +205,14 @@ label##3: \ 
	FTR_ENTRY_OFFSET 955b-956b;			\

	.popsection;



#define UACCESS_FLUSH_FIXUP_SECTION			\

959:							\

	.pushsection __uaccess_flush_fixup,"a";		\

	.align 2;					\

960:							\

	FTR_ENTRY_OFFSET 959b-960b;			\

	.popsection;



#define ENTRY_FLUSH_FIXUP_SECTION			\

957:							\

	.pushsection __entry_flush_fixup,"a";		\
@@ -248,6 +256,7 @@ extern long stf_barrier_fallback; 
extern long entry_flush_fallback;

extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;

extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;

extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup;

extern long __start___entry_flush_fixup, __stop___entry_flush_fixup;

extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;

extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;

arch/powerpc/include/asm/kup.h

+14 −5
Original line number Diff line number Diff line
@@ -53,17 +53,26 @@ static inline void setup_kuep(bool disabled) { } 
void setup_kuap(bool disabled);

#else

static inline void setup_kuap(bool disabled) { }



static inline bool

bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)

{

	return false;

}



/*

 * book3s/64/kup-radix.h defines these functions for the !KUAP case to flush

 * the L1D cache after user accesses. Only include the empty stubs for other

 * platforms.

 */

#ifndef CONFIG_PPC64

static inline void allow_user_access(void __user *to, const void __user *from,

				     unsigned long size, unsigned long dir) { }

static inline void prevent_user_access(void __user *to, const void __user *from,

				       unsigned long size, unsigned long dir) { }

static inline unsigned long prevent_user_access_return(void) { return 0UL; }

static inline void restore_user_access(unsigned long flags) { }

static inline bool

bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)

{

	return false;

}

#endif /* CONFIG_PPC64 */

#endif /* CONFIG_PPC_KUAP */



static inline void allow_read_from_user(const void __user *from, unsigned long size)

CRA Git | Maintained and supported by SUSTech CRA and CCSE