Messages in this thread Patch in this message | | | From | Benjamin Gray <> | Subject | [RFC PATCH 08/13] powerpc/dexcr: Add enforced userspace ROP protection config | Date | Mon, 28 Nov 2022 13:44:53 +1100 |
| |
The DEXCR Non-Privileged Hash Instruction Enable (NPHIE) aspect controls whether the hashst and hashchk instructions are treated as no-ops by the CPU.
NPHIE behaviour per ISA 3.1B:
0: hashst and hashchk instructions are executed as no-ops (even when allowed by PCR)
1: hashst and hashchk instructions are executed normally (if allowed by PCR)
Currently this aspect may be set per-process by prctl() or enforced globally by the hypervisor.
Add a kernel config option PPC_USER_ROP_PROTECT to enforce DEXCR[NPHIE] globally regardless of prctl() or hypervisor. If set, don't report NPHIE as editable via prctl(), as the prctl() value can never take effect.
Signed-off-by: Benjamin Gray <bgray@linux.ibm.com> --- arch/powerpc/Kconfig | 5 +++++ arch/powerpc/kernel/dexcr.c | 15 +++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 699df27b0e2f..ba3458d07744 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -434,6 +434,11 @@ config PGTABLE_LEVELS default 2 if !PPC64 default 4 +config PPC_USER_ROP_PROTECT + bool + depends on PPC_BOOK3S_64 + default y + source "arch/powerpc/sysdev/Kconfig" source "arch/powerpc/platforms/Kconfig" diff --git a/arch/powerpc/kernel/dexcr.c b/arch/powerpc/kernel/dexcr.c index 8239bcc92026..394140fc23aa 100644 --- a/arch/powerpc/kernel/dexcr.c +++ b/arch/powerpc/kernel/dexcr.c @@ -2,6 +2,7 @@ #include <linux/capability.h> #include <linux/cpu.h> #include <linux/init.h> +#include <linux/kconfig.h> #include <linux/prctl.h> #include <linux/sched.h> #include <linux/spinlock.h> @@ -18,8 +19,8 @@ #define DEFAULT_DEXCR 0 /* Allow process configuration of these by default */ -#define DEXCR_PRCTL_EDITABLE (DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | \ - DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE) +static unsigned long dexcr_prctl_editable __ro_after_init = + DEXCR_PRO_SBHE | DEXCR_PRO_IBRTPD | DEXCR_PRO_SRAPD | DEXCR_PRO_NPHIE; /* * Lock to protect system DEXCR override from concurrent updates. @@ -83,6 +84,12 @@ static int __init dexcr_init(void) if (early_cpu_has_feature(CPU_FTR_DEXCR_SBHE)) update_userspace_system_dexcr(DEXCR_PRO_SBHE, spec_branch_hint_enable); + if (early_cpu_has_feature(CPU_FTR_DEXCR_NPHIE) && + IS_ENABLED(CONFIG_PPC_USER_ROP_PROTECT)) { + update_userspace_system_dexcr(DEXCR_PRO_NPHIE, 1); + dexcr_prctl_editable &= ~DEXCR_PRO_NPHIE; + } + return 0; } early_initcall(dexcr_init); @@ -131,7 +138,7 @@ static int dexcr_aspect_get(struct task_struct *task, unsigned int aspect) { int ret = 0; - if (aspect & DEXCR_PRCTL_EDITABLE) + if (aspect & dexcr_prctl_editable) ret |= PR_PPC_DEXCR_PRCTL; if (aspect & task->thread.dexcr_mask) { @@ -174,7 +181,7 @@ int dexcr_prctl_get(struct task_struct *task, unsigned long which) static int dexcr_aspect_set(struct task_struct *task, unsigned int aspect, unsigned long ctrl) { - if (!(aspect & DEXCR_PRCTL_EDITABLE)) + if (!(aspect & dexcr_prctl_editable)) return -ENXIO; /* Aspect is not allowed to be changed by prctl */ if (aspect & task->thread.dexcr_forced) -- 2.38.1
| |