Skip to contentSkip to conversation

nospec: Add a generic barrier_nospec()

PATCH New Pawan Gupta 1 participant 2 messages Oct 21, 2022 1 message not in the archive

Subsystems (2)
Stable branch mac80211
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Pawan Gupta

author
#1 lore raw

PATCH v2 1/2 nospec: Add a generic barrier_nospec()

barrier_nospec() is a speculation barrier with arch dependent implementation. To be able to use barrier_nospec() in non-architecture code add a generic version that does nothing. Architectures that don't have a use case for speculation barrier shouldn't need to define an arch specific version.

Architectures needing speculation barrier can override the generic version in their asm/barrier.h.

Cc <[email protected]>
Signed-off-by Pawan Gupta <[email protected]>
---
 include/linux/nospec.h | 4 ++++
 1 file changed, 4 insertions(+)
include/linux/nospec.h +4 -0
index c1e79f72cd89..60e040a5df27 100644
@@ -60,6 +60,10 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 	(typeof(_i)) (_i & _mask);					\
 })
 
+#ifndef barrier_nospec
+#define barrier_nospec()	do { } while (0)
+#endif
+
 /* Speculation control prctl */
 int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which);
 int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
Signature · 1 line
2.37.3
author
#2 lore raw

PATCH v2 2/2 minstrel_ht: Mitigate minstrel_ht_get_expected_throughput() for BTI

In reply to a message not in the archive

Static analysis tools indicate that indirect target minstrel_ht_get_expected_throughput() could be used as a disclosure gadget for Intra-mode Branch Target Injection (IMBTI) or Branch History Injection (BHI).

ASM generated by compilers indicate a construct of a typical disclosure gadget, where function arguments can be used to speculatively access and transmit the contents of an arbitrary memory location.

Mitigate it by adding a speculation barrier.

Reported-by Scott D. Constable <[email protected]>
Cc <[email protected]>
Signed-off-by Pawan Gupta <[email protected]>
---
 net/mac80211/rc80211_minstrel_ht.c | 9 +++++++++
 1 file changed, 9 insertions(+)
net/mac80211/rc80211_minstrel_ht.c +9 -0
index 788a82f9c74d..af66e5c8dcfa 100644
@@ -11,6 +11,7 @@
 #include <linux/moduleparam.h>
 #include <linux/ieee80211.h>
 #include <linux/minmax.h>
+#include <linux/nospec.h>
 #include <net/mac80211.h>
 #include "rate.h"
 #include "sta_info.h"

@@ -1998,6 +1999,14 @@ static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
 	struct minstrel_ht_sta *mi = priv_sta;
 	int i, j, prob, tp_avg;
 
+	/*
+	 * Protect against IMBTI/BHI.
+	 *
+	 * Transiently executing this function with an adversary controlled
+	 * argument may disclose secrets. Speculation barrier prevents that.
+	 */
+	barrier_nospec();
+
 	i = MI_RATE_GROUP(mi->max_tp_rate[0]);
 	j = MI_RATE_IDX(mi->max_tp_rate[0]);
 	prob = mi->groups[i].rates[j].prob_avg;
Signature · 1 line
2.37.3