Re: [RFC PATCH 06/13] powerpc/dexcr: Add prctl implementation
From: "Nicholas Piggin" <npiggin@gmail.com>
Date: 2023-03-07 05:27:37
Also in:
linux-hardening, lkml
On Mon Nov 28, 2022 at 12:44 PM AEST, Benjamin Gray wrote:
Adds an initial prctl interface implementation. Unprivileged processes can query the current prctl setting, including whether an aspect is implemented by the hardware or is permitted to be modified by a setter prctl. Editable aspects can be changed by a CAP_SYS_ADMIN privileged process. The prctl setting represents what the process itself has requested, and does not account for any overrides. Either the kernel or a hypervisor may enforce a different setting for an aspect. Userspace can access a readonly view of the current DEXCR via SPR 812, and a readonly view of the aspects enforced by the hypervisor via SPR 455. A bitwise OR of these two SPRs will give the effective DEXCR aspect state of the process.
You said (offline) that you were looking at the PR_SPEC_* speculation control APIs but that this was different enough that you needed a different one. It would be good to know what some of those issues were in the changelog, would be nice to have some docs (could we add something to spec_ctrl.rst maybe?). I assume at least one difference is that some of our bits are not speculative but architectural (e.g., the stack hash check). I also wonder if we could implement some of the PR_SPEC controls APIs by mapping relevant DEXCR aspects to them instead of (or as well as) the DEXCR controls? Or would the PR_SPEC users be amenable to extensions that make our usage fit a bit better? I'm just thinking if we can reduce reliance on arch specific APIs a bit would be nice.
quoted hunk ↗ jump to hunk
Signed-off-by: Benjamin Gray <redacted> --- arch/powerpc/include/asm/processor.h | 13 +++ arch/powerpc/kernel/dexcr.c | 133 ++++++++++++++++++++++++++- arch/powerpc/kernel/process.c | 6 ++ 3 files changed, 151 insertions(+), 1 deletion(-)diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h index 2381217c95dc..4c995258f668 100644 --- a/arch/powerpc/include/asm/processor.h +++ b/arch/powerpc/include/asm/processor.h@@ -265,6 +265,9 @@ struct thread_struct { unsigned long sier2; unsigned long sier3; unsigned long hashkeyr; + unsigned int dexcr_override; + unsigned int dexcr_mask;
Hmm, what's the mask doing here? It only gets bits set and never cleared AFAIKS. What is different between an initial state and a SET then CLEAR state? Thanks, Nick