lkml.org 
[lkml]   [2022]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 41/58] arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting
    Date
    From: James Morse <james.morse@arm.com>

    commit 58c9a5060cb7cd529d49c93954cdafe81c1d642a upstream.

    The mitigations for Spectre-BHB are only applied when an exception is
    taken from user-space. The mitigation status is reported via the spectre_v2
    sysfs vulnerabilities file.

    When unprivileged eBPF is enabled the mitigation in the exception vectors
    can be avoided by an eBPF program.

    When unprivileged eBPF is enabled, print a warning and report vulnerable
    via the sysfs vulnerabilities file.

    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: James Morse <james.morse@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/arm64/kernel/proton-pack.c | 26 ++++++++++++++++++++++++++
    1 file changed, 26 insertions(+)

    --- a/arch/arm64/kernel/proton-pack.c
    +++ b/arch/arm64/kernel/proton-pack.c
    @@ -18,6 +18,7 @@
    */

    #include <linux/arm-smccc.h>
    +#include <linux/bpf.h>
    #include <linux/cpu.h>
    #include <linux/device.h>
    #include <linux/nospec.h>
    @@ -111,6 +112,15 @@ static const char *get_bhb_affected_stri
    }
    }

    +static bool _unprivileged_ebpf_enabled(void)
    +{
    +#ifdef CONFIG_BPF_SYSCALL
    + return !sysctl_unprivileged_bpf_disabled;
    +#else
    + return false;
    +#endif
    +}
    +
    ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr,
    char *buf)
    {
    @@ -130,6 +140,9 @@ ssize_t cpu_show_spectre_v2(struct devic
    v2_str = "CSV2";
    fallthrough;
    case SPECTRE_MITIGATED:
    + if (bhb_state == SPECTRE_MITIGATED && _unprivileged_ebpf_enabled())
    + return sprintf(buf, "Vulnerable: Unprivileged eBPF enabled\n");
    +
    return sprintf(buf, "Mitigation: %s%s\n", v2_str, bhb_str);
    case SPECTRE_VULNERABLE:
    fallthrough;
    @@ -1125,3 +1138,16 @@ void __init spectre_bhb_patch_clearbhb(s
    *updptr++ = cpu_to_le32(aarch64_insn_gen_nop());
    *updptr++ = cpu_to_le32(aarch64_insn_gen_nop());
    }
    +
    +#ifdef CONFIG_BPF_SYSCALL
    +#define EBPF_WARN "Unprivileged eBPF is enabled, data leaks possible via Spectre v2 BHB attacks!\n"
    +void unpriv_ebpf_notify(int new_state)
    +{
    + if (spectre_v2_state == SPECTRE_VULNERABLE ||
    + spectre_bhb_state != SPECTRE_MITIGATED)
    + return;
    +
    + if (!new_state)
    + pr_err("WARNING: %s", EBPF_WARN);
    +}
    +#endif

    \
     
     \ /
      Last update: 2022-03-10 15:54    [W:6.926 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site