7390db8aea
Branch History Injection (BHI) attacks may allow a malicious application to influence indirect branch prediction in kernel by poisoning the branch history. eIBRS isolates indirect branch targets in ring0. The BHB can still influence the choice of indirect branch predictor entry, and although branch predictor entries are isolated between modes when eIBRS is enabled, the BHB itself is not isolated between modes. Alder Lake and new processors supports a hardware control BHI_DIS_S to mitigate BHI. For older processors Intel has released a software sequence to clear the branch history on parts that don't support BHI_DIS_S. Add support to execute the software sequence at syscall entry and VMexit to overwrite the branch history. For now, branch history is not cleared at interrupt entry, as malicious applications are not believed to have sufficient control over the registers, since previous register state is cleared at interrupt entry. Researchers continue to poke at this area and it may become necessary to clear at interrupt entry as well in the future. This mitigation is only defined here. It is enabled later. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Co-developed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com> Signed-off-by: Daniel Sneddon <daniel.sneddon@linux.intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com> Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
136 lines
3.4 KiB
C
136 lines
3.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Access to user system call parameters and results
|
|
*
|
|
* Copyright (C) 2008-2009 Red Hat, Inc. All rights reserved.
|
|
*
|
|
* See asm-generic/syscall.h for descriptions of what we must do here.
|
|
*/
|
|
|
|
#ifndef _ASM_X86_SYSCALL_H
|
|
#define _ASM_X86_SYSCALL_H
|
|
|
|
#include <uapi/linux/audit.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/err.h>
|
|
#include <asm/thread_info.h> /* for TS_COMPAT */
|
|
#include <asm/unistd.h>
|
|
|
|
/* This is used purely for kernel/trace/trace_syscalls.c */
|
|
typedef long (*sys_call_ptr_t)(const struct pt_regs *);
|
|
extern const sys_call_ptr_t sys_call_table[];
|
|
|
|
/*
|
|
* These may not exist, but still put the prototypes in so we
|
|
* can use IS_ENABLED().
|
|
*/
|
|
extern long ia32_sys_call(const struct pt_regs *, unsigned int nr);
|
|
extern long x32_sys_call(const struct pt_regs *, unsigned int nr);
|
|
extern long x64_sys_call(const struct pt_regs *, unsigned int nr);
|
|
|
|
/*
|
|
* Only the low 32 bits of orig_ax are meaningful, so we return int.
|
|
* This importantly ignores the high bits on 64-bit, so comparisons
|
|
* sign-extend the low 32 bits.
|
|
*/
|
|
static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
|
|
{
|
|
return regs->orig_ax;
|
|
}
|
|
|
|
static inline void syscall_rollback(struct task_struct *task,
|
|
struct pt_regs *regs)
|
|
{
|
|
regs->ax = regs->orig_ax;
|
|
}
|
|
|
|
static inline long syscall_get_error(struct task_struct *task,
|
|
struct pt_regs *regs)
|
|
{
|
|
unsigned long error = regs->ax;
|
|
#ifdef CONFIG_IA32_EMULATION
|
|
/*
|
|
* TS_COMPAT is set for 32-bit syscall entries and then
|
|
* remains set until we return to user mode.
|
|
*/
|
|
if (task->thread_info.status & (TS_COMPAT|TS_I386_REGS_POKED))
|
|
/*
|
|
* Sign-extend the value so (int)-EFOO becomes (long)-EFOO
|
|
* and will match correctly in comparisons.
|
|
*/
|
|
error = (long) (int) error;
|
|
#endif
|
|
return IS_ERR_VALUE(error) ? error : 0;
|
|
}
|
|
|
|
static inline long syscall_get_return_value(struct task_struct *task,
|
|
struct pt_regs *regs)
|
|
{
|
|
return regs->ax;
|
|
}
|
|
|
|
static inline void syscall_set_return_value(struct task_struct *task,
|
|
struct pt_regs *regs,
|
|
int error, long val)
|
|
{
|
|
regs->ax = (long) error ?: val;
|
|
}
|
|
|
|
#ifdef CONFIG_X86_32
|
|
|
|
static inline void syscall_get_arguments(struct task_struct *task,
|
|
struct pt_regs *regs,
|
|
unsigned long *args)
|
|
{
|
|
memcpy(args, ®s->bx, 6 * sizeof(args[0]));
|
|
}
|
|
|
|
static inline int syscall_get_arch(struct task_struct *task)
|
|
{
|
|
return AUDIT_ARCH_I386;
|
|
}
|
|
|
|
#else /* CONFIG_X86_64 */
|
|
|
|
static inline void syscall_get_arguments(struct task_struct *task,
|
|
struct pt_regs *regs,
|
|
unsigned long *args)
|
|
{
|
|
# ifdef CONFIG_IA32_EMULATION
|
|
if (task->thread_info.status & TS_COMPAT) {
|
|
*args++ = regs->bx;
|
|
*args++ = regs->cx;
|
|
*args++ = regs->dx;
|
|
*args++ = regs->si;
|
|
*args++ = regs->di;
|
|
*args = regs->bp;
|
|
} else
|
|
# endif
|
|
{
|
|
*args++ = regs->di;
|
|
*args++ = regs->si;
|
|
*args++ = regs->dx;
|
|
*args++ = regs->r10;
|
|
*args++ = regs->r8;
|
|
*args = regs->r9;
|
|
}
|
|
}
|
|
|
|
static inline int syscall_get_arch(struct task_struct *task)
|
|
{
|
|
/* x32 tasks should be considered AUDIT_ARCH_X86_64. */
|
|
return (IS_ENABLED(CONFIG_IA32_EMULATION) &&
|
|
task->thread_info.status & TS_COMPAT)
|
|
? AUDIT_ARCH_I386 : AUDIT_ARCH_X86_64;
|
|
}
|
|
|
|
bool do_syscall_64(struct pt_regs *regs, int nr);
|
|
void do_int80_emulation(struct pt_regs *regs);
|
|
|
|
#endif /* CONFIG_X86_32 */
|
|
|
|
void do_int80_syscall_32(struct pt_regs *regs);
|
|
bool do_fast_syscall_32(struct pt_regs *regs);
|
|
bool do_SYSENTER_32(struct pt_regs *regs);
|
|
|
|
#endif /* _ASM_X86_SYSCALL_H */
|