From patchwork Mon Oct 24 22:57:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawan Gupta X-Patchwork-Id: 13018324 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF74CC67871 for ; Tue, 25 Oct 2022 00:33:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230457AbiJYAds (ORCPT ); Mon, 24 Oct 2022 20:33:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229945AbiJYAdS (ORCPT ); Mon, 24 Oct 2022 20:33:18 -0400 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B07D757BE4; Mon, 24 Oct 2022 15:58:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1666652294; x=1698188294; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=t3bv2MkjydtsyaQXVR2HQj9d69MKIx3tGIYCICf7vKY=; b=aQxgHaZdJNYAbonuzsqyEAE9Y4sl0jDSCJoSSfd5mL4a+CYBr/TDVdIE 4Az5nQ1kMpKjb4OUs+oJmIBzCckUDRbjHGOgOfaj2p1GoKictzIwzjFYG rtpRDL+oQ4OuEZMhwPGepkk70uma5xwUC4umyvF3gUrDKZ2PbPN5NzVl6 C9zbm8RZSDHBQTBny8HvbVb0JVFcrfgbINLvC7Skevtu0PApU62z3csDe jNSE0QgacAvr6Q70noiv6IB47K1Gd6pzeYaIRCif9mAU6jPZRREeouNGi sa2ujiCWAVOwBvKQLsZ9IXTrlSw2/UckrIa74+wXOaiCa3iz+NT6T9vTM g==; X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="308633274" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="308633274" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="609363403" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="609363403" Received: from pkearns-mobl1.amr.corp.intel.com (HELO guptapa-desk.intel.com) ([10.252.131.64]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 From: Pawan Gupta To: scott.d.constable@intel.com, daniel.sneddon@linux.intel.com, Jakub Kicinski , dave.hansen@intel.com, Johannes Berg , Paolo Abeni , antonio.gomez.iglesias@linux.intel.com, "David S. Miller" , Eric Dumazet Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, gregkh@linuxfoundation.org, netdev@vger.kernel.org Subject: [RFC PATCH 1/2] nospec: Add a generic barrier_nospec() Date: Mon, 24 Oct 2022 15:57:46 -0700 Message-Id: X-Mailer: git-send-email 2.37.3 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-State: RFC barrier_nospec() is a speculation barrier with an arch dependent implementation. Architectures that don't need a speculation barrier shouldn't have to define an arch specific version. To be able to use barrier_nospec() in non-architecture code add a generic version that does nothing. Architectures needing speculation barrier can override the generic version in their asm/barrier.h. Signed-off-by: Pawan Gupta --- include/linux/nospec.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/nospec.h b/include/linux/nospec.h index c1e79f72cd89..60e040a5df27 100644 --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -60,6 +60,10 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, (typeof(_i)) (_i & _mask); \ }) +#ifndef barrier_nospec +#define barrier_nospec() do { } while (0) +#endif + /* Speculation control prctl */ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which); int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, From patchwork Mon Oct 24 22:57:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawan Gupta X-Patchwork-Id: 13018323 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1330C38A2D for ; Tue, 25 Oct 2022 00:33:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229776AbiJYAdr (ORCPT ); Mon, 24 Oct 2022 20:33:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229682AbiJYAdO (ORCPT ); Mon, 24 Oct 2022 20:33:14 -0400 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF9082BB1E; Mon, 24 Oct 2022 15:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1666652294; x=1698188294; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Dg022xT9wrRgqUOEQj0+Hywo+Hdp+CKqSuOIoBjxANA=; b=C22EG5XcyJX2f9Ys6Grt+UBMZlGLH/lCGgd7tZ1gN1686+UC7ougWr99 aIrHkzfS74BbWWuz0Ch+Fdb+qBXcqD2O1oHy+0BMpHJl9ZaYRYZwz16Pt /IBNuH/SgBPSY7gxkAm+dO19oVm9ev8d+Mr0Texj/K9+28FugoE/Kf0mr JFXCkeOWuAlqGL0L87ToRM0OzVfrlqdHNIwYED8UGTK+tI3PwDgi3t+3g xSciMN9ruUD6oYTfGDUSXspM1IbIYMZ3GrZCpQ3BQynOshUa7SnLsxUG/ lPZFlnO4LglySCyrzjRs5lXame45ywF+xnPOe50wc30nNrQlui1ugoyp3 Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="308633276" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="308633276" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="609363407" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="609363407" Received: from pkearns-mobl1.amr.corp.intel.com (HELO guptapa-desk.intel.com) ([10.252.131.64]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 From: Pawan Gupta To: scott.d.constable@intel.com, daniel.sneddon@linux.intel.com, Jakub Kicinski , dave.hansen@intel.com, Johannes Berg , Paolo Abeni , antonio.gomez.iglesias@linux.intel.com, "David S. Miller" , Eric Dumazet Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, gregkh@linuxfoundation.org, netdev@vger.kernel.org Subject: [RFC PATCH 2/2] minstrel_ht: Mitigate BTI gadget minstrel_ht_get_expected_throughput() Date: Mon, 24 Oct 2022 15:57:47 -0700 Message-Id: X-Mailer: git-send-email 2.37.3 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org X-Patchwork-State: RFC Static analysis indicate that indirect target minstrel_ht_get_expected_throughput() could be used as a disclosure gadget for Intra-mode Branch Target Injection (IMBTI) and Branch History Injection (BHI). ASM generated by compilers indicate a construct of a typical disclosure gadget, where an adversary-controlled register contents can be used to transiently access an arbitrary memory location. Although there are no known ways to exploit this, but to be on safer side mitigate it by adding a speculation barrier. Reported-by: Scott D. Constable Signed-off-by: Pawan Gupta --- net/mac80211/rc80211_minstrel_ht.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index 3d91b98db099..7cf90666a865 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include "rate.h" #include "sta_info.h" @@ -1999,6 +2000,14 @@ static u32 minstrel_ht_get_expected_throughput(void *priv_sta) struct minstrel_ht_sta *mi = priv_sta; int i, j, prob, tp_avg; + /* + * Protect against IMBTI/BHI. + * + * Transiently executing this function with an adversary controlled + * argument may disclose secrets. Speculation barrier prevents that. + */ + barrier_nospec(); + i = MI_RATE_GROUP(mi->max_tp_rate[0]); j = MI_RATE_IDX(mi->max_tp_rate[0]); prob = mi->groups[i].rates[j].prob_avg;