[lkml]   [2018]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[RFCv2 0/4] API for inhibiting speculative arbitrary read primitives
Recently, Google Project Zero discovered several classes of attack
against speculative execution. One of these, known as variant-1, allows
explicit bounds checks to be bypassed under speculation, providing an
arbitrary read gadget. Further details can be found on the GPZ blog [1]
and the Documentation patch in this series.

There are a number of potential gadgets in the Linux codebase, and
mitigations for these are architecture-specific.

This RFC attempts to provide a cross-architecture API for inhibiting
these primitives. Hopefully, architecture-specific mitigations can be
unified behind this. An arm64 implementation is provided following the
architecturally recommended sequence laid out in the Arm whitepaper [2].
The API is based on a proposed compiler intrinsic [3].

I've provided a patch to BPF as an example use of the API. I know that
this is incomplete and less than optimal. I'd appreciate feedback from
other affected architectures as to whether this API is suitable for
their required mitigation.

I've pushed the series to my repo [4].

Since v1 [5]:
* Remove the nospec_*load helpers
* Added nospec_array_ptr()
* Rework asm-generic implementation to fit other architectures
* Improve documentation

[4] git:// core/nospec


Mark Rutland (4):
asm-generic/barrier: add generic nospec helpers
Documentation: document nospec helpers
arm64: implement nospec_{load,ptr}()
bpf: inhibit speculated out-of-bounds pointers

Documentation/speculation.txt | 166 +++++++++++++++++++++++++++++++++++++++
arch/arm64/include/asm/barrier.h | 55 +++++++++++++
include/asm-generic/barrier.h | 68 ++++++++++++++++
kernel/bpf/arraymap.c | 20 +++--
kernel/bpf/cpumap.c | 5 +-
kernel/bpf/devmap.c | 3 +-
kernel/bpf/sockmap.c | 3 +-
7 files changed, 308 insertions(+), 12 deletions(-)
create mode 100644 Documentation/speculation.txt


 \ /
  Last update: 2018-01-05 16:00    [W:0.141 / U:2.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site