From patchwork Mon Oct 24 22:57:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawan Gupta X-Patchwork-Id: 10424 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp725761wru; Mon, 24 Oct 2022 17:34:54 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7zrWVR+1ihMO900AMcfkiFhkvCqzIteB6l+xkeVWbaCaULCsVD8E8XNGJCutf4ciStlgME X-Received: by 2002:a65:5688:0:b0:3c2:1015:988e with SMTP id v8-20020a655688000000b003c21015988emr30226242pgs.280.1666658094143; Mon, 24 Oct 2022 17:34:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666658094; cv=none; d=google.com; s=arc-20160816; b=ONpYJt+uLleRvY72kIr1D1EQgg39uvVR7uftbtY7yBp9xEPH+2q6jTkZifdfdGlelD B+jXQM4gvl35OzhMH58MYwkiOeSvaygeBRiB8MAmbTI5ryvSYa9DLUdZhWhxneulN1xY pntolo4SwqwwCXJIpqxaOWOF748MhaG4IFx1eKrOdOSL4H53IaEz0JOjvKIKVaPi/Ec8 GXutjAdM+a1mBS7EAZ+JOp5jGhEJByrAiiLLR7FsT6ZLYCiGnOmxHhoPD9OoZAS9lHgl ug5Sj1cBY3foLIpDoKKK/QEJGnXiWpWbUx4L40eA24LrwqvAlzF74hEGRwfp6Ppvcdem KZKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=zd0UdwukHOVtwRwki6PrGgmZEnO5hdVYT3KEZp4+4q0=; b=reg0R6t75OcD2Hb+ZQ+MeYQbS8invY+ccWb8av6Fpm7xis0f8KaKiSrkverPRvlp44 oAKQwYu81rC2ifQVINbUvfleaDIlIa4n4eQ9vv+6oMuaFfVnDuING7XdUUZGil9W9ejF JF3Bn+qhPowAlVXIh7tZVUkgoFmRkZ1kch2pGAMghqv89sG8vqLaRLpNYynIxfQuvu5/ QGEXxD+q8pGVm+KJHLjYDDQV8NN2qm77itEg92OcK0lo9mAd3721nAbJLaGI832xqavY VWBjwVuBWQLkV86zkevkjJu8K79gozcd08vKeeUDdTCKqkz8EHlHLrAqp4Ttsi2hXNXr Nu4A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=aQxgHaZd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i11-20020a17090332cb00b0018538b93791si1341260plr.96.2022.10.24.17.34.41; Mon, 24 Oct 2022 17:34:54 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=aQxgHaZd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229981AbiJYAd4 (ORCPT + 99 others); Mon, 24 Oct 2022 20:33:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229945AbiJYAdS (ORCPT ); Mon, 24 Oct 2022 20:33:18 -0400 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B07D757BE4; Mon, 24 Oct 2022 15:58:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1666652294; x=1698188294; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=t3bv2MkjydtsyaQXVR2HQj9d69MKIx3tGIYCICf7vKY=; b=aQxgHaZdJNYAbonuzsqyEAE9Y4sl0jDSCJoSSfd5mL4a+CYBr/TDVdIE 4Az5nQ1kMpKjb4OUs+oJmIBzCckUDRbjHGOgOfaj2p1GoKictzIwzjFYG rtpRDL+oQ4OuEZMhwPGepkk70uma5xwUC4umyvF3gUrDKZ2PbPN5NzVl6 C9zbm8RZSDHBQTBny8HvbVb0JVFcrfgbINLvC7Skevtu0PApU62z3csDe jNSE0QgacAvr6Q70noiv6IB47K1Gd6pzeYaIRCif9mAU6jPZRREeouNGi sa2ujiCWAVOwBvKQLsZ9IXTrlSw2/UckrIa74+wXOaiCa3iz+NT6T9vTM g==; X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="308633274" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="308633274" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="609363403" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="609363403" Received: from pkearns-mobl1.amr.corp.intel.com (HELO guptapa-desk.intel.com) ([10.252.131.64]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 From: Pawan Gupta To: scott.d.constable@intel.com, daniel.sneddon@linux.intel.com, Jakub Kicinski , dave.hansen@intel.com, Johannes Berg , Paolo Abeni , antonio.gomez.iglesias@linux.intel.com, "David S. Miller" , Eric Dumazet Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, gregkh@linuxfoundation.org, netdev@vger.kernel.org Subject: [RFC PATCH 1/2] nospec: Add a generic barrier_nospec() Date: Mon, 24 Oct 2022 15:57:46 -0700 Message-Id: X-Mailer: git-send-email 2.37.3 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747617678183300812?= X-GMAIL-MSGID: =?utf-8?q?1747617678183300812?= barrier_nospec() is a speculation barrier with an arch dependent implementation. Architectures that don't need a speculation barrier shouldn't have to define an arch specific version. To be able to use barrier_nospec() in non-architecture code add a generic version that does nothing. Architectures needing speculation barrier can override the generic version in their asm/barrier.h. Signed-off-by: Pawan Gupta --- include/linux/nospec.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/nospec.h b/include/linux/nospec.h index c1e79f72cd89..60e040a5df27 100644 --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -60,6 +60,10 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, (typeof(_i)) (_i & _mask); \ }) +#ifndef barrier_nospec +#define barrier_nospec() do { } while (0) +#endif + /* Speculation control prctl */ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which); int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, From patchwork Mon Oct 24 22:57:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawan Gupta X-Patchwork-Id: 10423 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp725647wru; Mon, 24 Oct 2022 17:34:37 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7rn9Gw5FAEXr/pq2IRFub490BF50Y/Cax6f2d/JWESXzXp9Wj+9pKoIRMPsrZIECav0A3u X-Received: by 2002:a62:7bc5:0:b0:56b:47ed:22a7 with SMTP id w188-20020a627bc5000000b0056b47ed22a7mr18100002pfc.63.1666658076927; Mon, 24 Oct 2022 17:34:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666658076; cv=none; d=google.com; s=arc-20160816; b=xXaeBUUVmxCLAdct08alI6qruP4vysv0o8WZ39EdyBVYMg4yJpMDnEKYVohFSp9vG1 wjRPiZ296ojl/VonZ7pP/a+ryf54+XexTTXRd1kQwbfJySvmlBUCF0O+9VcHG7pcy6q/ D76QlbkmmrHXCx8sRHdXuqupbWuc2R39np86pg3qabEbSUPdiI5RKD42i0scnvW4Wg3E v21rkM/tN5ojKbAaaQjMv42Kvh+YrY7BZl/Pyy9p9jGc1pix+da1PTYPku3w9Nx6M34p zOHbEc6wp1Dv7hfPQIc0lkqU4SPD57s9O9MaRkUJGmuYA0q6EcUp0E1ssxcDcvzO8vA/ gEew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=ft/Jxb2rASN15ajy4VT1XwMRwikbCeKmQiD9qGfgmFY=; b=Xi9kgaxSx3alwh9Fr0Ml6ydQNAA351UxNKUx/Pc8CQGHcG4zRMunPA1l8GZlRTBosn GW+qY5xyTHqZXJ9TG//eTey76hp8iMUfN0WRXyWBj1KwrtMERrNqZ4B8qF61I7L7gdn4 CSSck5qckPgrM2E+0/ZfH1uzMx5Lh2PcGgXNkuKIlzc4kkPjycWqNYPbImShyfNgclY4 ExHfirQfU7xjv4I/P2bw5+aEa+x1+IGUxXF2QNrUcZVAyEu9U103zf5Howho0a9N4eLR Nfbr6T+8NIWBu/WITmuGUdH04LWvN63GF/6T+dTAFRdZYDYvOEj3huvGyE1CHXdF/1i3 V4Bg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=C22EG5Xc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 26-20020a63165a000000b0043895127033si1159398pgw.335.2022.10.24.17.34.23; Mon, 24 Oct 2022 17:34:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=C22EG5Xc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231273AbiJYAds (ORCPT + 99 others); Mon, 24 Oct 2022 20:33:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229682AbiJYAdO (ORCPT ); Mon, 24 Oct 2022 20:33:14 -0400 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF9082BB1E; Mon, 24 Oct 2022 15:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1666652294; x=1698188294; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Dg022xT9wrRgqUOEQj0+Hywo+Hdp+CKqSuOIoBjxANA=; b=C22EG5XcyJX2f9Ys6Grt+UBMZlGLH/lCGgd7tZ1gN1686+UC7ougWr99 aIrHkzfS74BbWWuz0Ch+Fdb+qBXcqD2O1oHy+0BMpHJl9ZaYRYZwz16Pt /IBNuH/SgBPSY7gxkAm+dO19oVm9ev8d+Mr0Texj/K9+28FugoE/Kf0mr JFXCkeOWuAlqGL0L87ToRM0OzVfrlqdHNIwYED8UGTK+tI3PwDgi3t+3g xSciMN9ruUD6oYTfGDUSXspM1IbIYMZ3GrZCpQ3BQynOshUa7SnLsxUG/ lPZFlnO4LglySCyrzjRs5lXame45ywF+xnPOe50wc30nNrQlui1ugoyp3 Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="308633276" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="308633276" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10510"; a="609363407" X-IronPort-AV: E=Sophos;i="5.95,210,1661842800"; d="scan'208";a="609363407" Received: from pkearns-mobl1.amr.corp.intel.com (HELO guptapa-desk.intel.com) ([10.252.131.64]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Oct 2022 15:57:56 -0700 From: Pawan Gupta To: scott.d.constable@intel.com, daniel.sneddon@linux.intel.com, Jakub Kicinski , dave.hansen@intel.com, Johannes Berg , Paolo Abeni , antonio.gomez.iglesias@linux.intel.com, "David S. Miller" , Eric Dumazet Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, gregkh@linuxfoundation.org, netdev@vger.kernel.org Subject: [RFC PATCH 2/2] minstrel_ht: Mitigate BTI gadget minstrel_ht_get_expected_throughput() Date: Mon, 24 Oct 2022 15:57:47 -0700 Message-Id: X-Mailer: git-send-email 2.37.3 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747617659935200504?= X-GMAIL-MSGID: =?utf-8?q?1747617659935200504?= Static analysis indicate that indirect target minstrel_ht_get_expected_throughput() could be used as a disclosure gadget for Intra-mode Branch Target Injection (IMBTI) and Branch History Injection (BHI). ASM generated by compilers indicate a construct of a typical disclosure gadget, where an adversary-controlled register contents can be used to transiently access an arbitrary memory location. Although there are no known ways to exploit this, but to be on safer side mitigate it by adding a speculation barrier. Reported-by: Scott D. Constable Signed-off-by: Pawan Gupta --- net/mac80211/rc80211_minstrel_ht.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index 3d91b98db099..7cf90666a865 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include "rate.h" #include "sta_info.h" @@ -1999,6 +2000,14 @@ static u32 minstrel_ht_get_expected_throughput(void *priv_sta) struct minstrel_ht_sta *mi = priv_sta; int i, j, prob, tp_avg; + /* + * Protect against IMBTI/BHI. + * + * Transiently executing this function with an adversary controlled + * argument may disclose secrets. Speculation barrier prevents that. + */ + barrier_nospec(); + i = MI_RATE_GROUP(mi->max_tp_rate[0]); j = MI_RATE_IDX(mi->max_tp_rate[0]); prob = mi->groups[i].rates[j].prob_avg;