From: Benjamin Gray <bgray@linux.ibm.com>
To: linuxppc-dev@lists.ozlabs.org
Cc: ajd@linux.ibm.com, linux-kernel@vger.kernel.org,
linux-hardening@vger.kernel.org, cmr@bluescreens.de,
Benjamin Gray <bgray@linux.ibm.com>
Subject: [RFC PATCH 08/13] powerpc/dexcr: Add enforced userspace ROP protection config
Date: Mon, 28 Nov 2022 13:44:53 +1100 [thread overview]
Message-ID: <20221128024458.46121-9-bgray@linux.ibm.com> (raw)
In-Reply-To: <20221128024458.46121-1-bgray@linux.ibm.com>
The DEXCR Non-Privileged Hash Instruction Enable (NPHIE) aspect controls
whether the hashst and hashchk instructions are treated as no-ops by the
CPU.
NPHIE behaviour per ISA 3.1B:
0: hashst and hashchk instructions are executed as no-ops
(even when allowed by PCR)
1: hashst and hashchk instructions are executed normally
(if allowed by PCR)
Currently this aspect may be set per-process by prctl() or enforced
globally by the hypervisor.
Add a kernel config option PPC_USER_ROP_PROTECT to enforce DEXCR[NPHIE]
globally regardless of prctl() or hypervisor. If set, don't report
NPHIE as editable via prctl(), as the prctl() value can never take
effect.
Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
---
arch/powerpc/Kconfig | 5 +++++
arch/powerpc/kernel/dexcr.c | 15 +++++++++++----
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 699df27b0e2f..ba3458d07744 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -434,6 +434,11 @@ config PGTABLE_LEVELS
default 2 if !PPC64
default 4
+config PPC_USER_ROP_PROTECT
+ bool
+ depends on PPC_BOOK3S_64
+ default y
+
source "arch/powerpc/sysdev/Kconfig"
source "arch/powerpc/platforms/Kconfig"
diff --git a/arch/powerpc/kernel/dexcr.c b/arch/powerpc/kernel/dexcr.c
index 8239bcc92026..394140fc23aa 100644
--- a/arch/powerpc/kernel/dexcr.c
+++ b/arch/powerpc/kernel/dexcr.c
@@ -2,6 +2,7 @@
#include <linux/capability.h>
#include <linux/cpu.h>
#include <linux/init.h>
+#include <linux/kconfig.h>
#include <linux/prctl.h>
#include <linux/sched.h>
#include <linux/spinlock.h>
@@ -18,8 +19,8 @@
#define DEFAULT_DEXCR 0
/* Allow process configuration of these by default */
-#define DEXCR_PRCTL_EDITABLE (DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | \
- DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE)
+static unsigned long dexcr_prctl_editable __ro_after_init =
+ DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE;
/*
* Lock to protect system DEXCR override from concurrent updates.
@@ -83,6 +84,12 @@ static int __init dexcr_init(void)
if (early_cpu_has_feature(CPU_FTR_DEXCR_SBHE))
update_userspace_system_dexcr(DEXCR_PRO_SBHE, spec_branch_hint_enable);
+ if (early_cpu_has_feature(CPU_FTR_DEXCR_NPHIE) &&
+ IS_ENABLED(CONFIG_PPC_USER_ROP_PROTECT)) {
+ update_userspace_system_dexcr(DEXCR_PRO_NPHIE, 1);
+ dexcr_prctl_editable &= ~DEXCR_PRO_NPHIE;
+ }
+
return 0;
}
early_initcall(dexcr_init);
@@ -131,7 +138,7 @@ static int dexcr_aspect_get(struct task_struct *task, unsigned int aspect)
{
int ret = 0;
- if (aspect & DEXCR_PRCTL_EDITABLE)
+ if (aspect & dexcr_prctl_editable)
ret |= PR_PPC_DEXCR_PRCTL;
if (aspect & task->thread.dexcr_mask) {
@@ -174,7 +181,7 @@ int dexcr_prctl_get(struct task_struct *task, unsigned long which)
static int dexcr_aspect_set(struct task_struct *task, unsigned int aspect, unsigned long ctrl)
{
- if (!(aspect & DEXCR_PRCTL_EDITABLE))
+ if (!(aspect & dexcr_prctl_editable))
return -ENXIO; /* Aspect is not allowed to be changed by prctl */
if (aspect & task->thread.dexcr_forced)
--
2.38.1
next prev parent reply other threads:[~2022-11-28 2:46 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-28 2:44 [RFC PATCH 00/13] Add DEXCR support Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 01/13] powerpc/book3s: Add missing <linux/sched.h> include Benjamin Gray
2023-03-07 4:28 ` Nicholas Piggin
2022-11-28 2:44 ` [RFC PATCH 02/13] powerpc: Add initial Dynamic Execution Control Register (DEXCR) support Benjamin Gray
2023-03-07 4:45 ` Nicholas Piggin
2023-03-09 23:46 ` Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 03/13] powerpc/dexcr: Handle hashchk exception Benjamin Gray
2022-11-29 10:39 ` Nicholas Piggin
2022-11-29 22:04 ` Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 04/13] powerpc/dexcr: Support userspace ROP protection Benjamin Gray
2023-03-07 5:05 ` Nicholas Piggin
2023-03-07 5:37 ` Benjamin Gray
2023-03-21 4:51 ` Nicholas Piggin
2022-11-28 2:44 ` [RFC PATCH 05/13] prctl: Define PowerPC DEXCR interface Benjamin Gray
2023-03-07 5:07 ` Nicholas Piggin
2022-11-28 2:44 ` [RFC PATCH 06/13] powerpc/dexcr: Add prctl implementation Benjamin Gray
2023-03-07 5:12 ` Nicholas Piggin
2022-11-28 2:44 ` [RFC PATCH 07/13] powerpc/dexcr: Add sysctl entry for SBHE system override Benjamin Gray
2023-03-07 5:30 ` Nicholas Piggin
2023-03-07 5:58 ` Benjamin Gray
2022-11-28 2:44 ` Benjamin Gray [this message]
2022-11-28 2:44 ` [RFC PATCH 09/13] selftests/powerpc: Add more utility macros Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 10/13] selftests/powerpc: Add hashst/hashchk test Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 11/13] selftests/powerpc: Add DEXCR prctl, sysctl interface test Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 12/13] selftests/powerpc: Add DEXCR status utility lsdexcr Benjamin Gray
2022-11-28 2:44 ` [RFC PATCH 13/13] Documentation: Document PowerPC kernel DEXCR interface Benjamin Gray
2023-03-07 5:40 ` Nicholas Piggin
2023-03-07 5:52 ` Benjamin Gray
2022-11-28 4:05 ` [RFC PATCH 00/13] Add DEXCR support Russell Currey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221128024458.46121-9-bgray@linux.ibm.com \
--to=bgray@linux.ibm.com \
--cc=ajd@linux.ibm.com \
--cc=cmr@bluescreens.de \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).