Andi Kleen
7c5b42f82c
x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings ...
commit 42e4089c7890725fcd329999252dc489b72f2921 upstream
For L1TF PROT_NONE mappings are protected by inverting the PFN in the page
table entry. This sets the high bits in the CPU's address space, thus
making sure to point to not point an unmapped entry to valid cached memory.
Some server system BIOSes put the MMIO mappings high up in the physical
address space. If such an high mapping was mapped to unprivileged users
they could attack low memory by setting such a mapping to PROT_NONE. This
could happen through a special device driver which is not access
protected. Normal /dev/mem is of course access protected.
To avoid this forbid PROT_NONE mappings or mprotect for high MMIO mappings.
Valid page mappings are allowed because the system is then unsafe anyways.
It's not expected that users commonly use PROT_NONE on MMIO. But to
minimize any impact this is only enforced if the mapping actually refers to
a high MMIO address (defined as the MAX_PA-1 bit being set), and also skip
the check for root.
For mmaps this is straight forward and can be handled in vm_insert_pfn and
in remap_pfn_range().
For mprotect it's a bit trickier. At the point where the actual PTEs are
accessed a lot of state has been changed and it would be difficult to undo
on an error. Since this is a uncommon case use a separate early page talk
walk pass for MMIO PROT_NONE mappings that checks for this condition
early. For non MMIO and non PROT_NONE there are no changes.
[dwmw2: Backport to 4.9]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-15 18:14:45 +02:00
bitops: Do not default to __clear_bit() for __clear_bit_unlock()
2016-03-21 10:50:48 +01:00
mm, asm-generic: define PUD_SHIFT in <asm-generic/4level-fixup.h>
2015-02-11 17:06:03 -08:00
asm-generic: Add common asm-offsets.h
2015-06-23 13:35:49 +09:00
asm-prototypes: Clear any CPP defines before declaring the functions
2017-01-12 11:39:07 +01:00
locking/atomic: Introduce inc/dec variants for the atomic_fetch_$op() API
2016-07-07 09:16:20 +02:00
locking/atomic: Remove linux/atomic.h:atomic_fetch_or()
2016-06-16 10:48:32 +02:00
locking/atomic: Implement atomic{,64,_long}_fetch_{add,sub,and,andnot,or,xor}{,_relaxed,_acquire,_release}()
2016-06-16 10:48:32 +02:00
audit: Modify a set of system calls in audit class definitions
2014-01-17 17:01:46 -05:00
audit: support the "standard" <asm-generic/unistd.h>
2011-05-04 14:41:28 -04:00
audit: support the "standard" <asm-generic/unistd.h>
2011-05-04 14:41:28 -04:00
audit: Modify a set of system calls in audit class definitions
2014-01-17 17:01:46 -05:00
locking/spinlock, arch: Update and fix spin_unlock_wait() implementations
2016-06-14 11:55:15 +02:00
arch: Prepare for smp_mb__{before,after}_atomic()
2014-04-18 11:40:30 +02:00
UAPI: (Scripted) Disintegrate include/asm-generic
2012-10-04 18:20:15 +01:00
asm-generic changes for 4.6
2016-03-24 23:13:48 -07:00
asm-generic/cacheflush.h: flush icache when copying to user pages
2011-05-25 08:39:37 -07:00
ipv4: Update parameters for csum_tcpudp_magic to their original types
2016-03-13 23:55:13 -04:00
asm-generic: COMMON_CLK defines __clk_{get,put}
2014-09-25 18:00:45 -07:00
LLVMLinux: Remove warning about returning an uninitialized variable
2014-04-09 13:44:35 -07:00
asm-generic: cmpxchg: avoid warnings from macro-ized cmpxchg() implementations
2015-10-15 00:21:13 +02:00
cputime: Generic on-demand virtual cputime accounting
2013-01-27 19:23:27 +01:00
sched, time: Fix build error with 64 bit cputime_t on 32 bit systems
2014-10-03 05:46:55 +02:00
sched/cputime: Count actually elapsed irq & softirq time
2016-07-14 10:42:34 +02:00
asm-generic: delay.h fix udelay and ndelay for 8 bit args
2011-07-22 18:45:33 +02:00
__div64_32(): make it overridable at compile time
2015-11-16 14:42:12 -05:00
asm-generic: Add dma-contiguous.h
2014-09-22 13:35:51 +02:00
Merge branch 'akpm' (patches from Andrew)
2015-09-08 17:52:23 -07:00
Split arch_align_stack() out from asm-generic/system.h
2012-03-28 18:30:03 +01:00
Revert "default exported asm symbols to zero"
2016-12-07 08:39:00 -08:00
asm-generic: Fix local variable shadow in __set_fixmap_offset
2016-02-16 15:10:44 +00:00
futex: Remove duplicated code and fix undefined behaviour
2018-05-19 10:27:00 +02:00
bitops: Add missing parentheses to new get_order macro
2012-02-24 10:39:27 -08:00
gpio: allow setting ARCH_NR_GPIOS from Kconfig
2016-02-19 00:22:54 +01:00
mm: Fix generic hugetlb pte check return type.
2013-10-02 20:02:35 -04:00
UAPI: (Scripted) Disintegrate include/asm-generic
2012-10-04 18:20:15 +01:00
asm-generic/io.h: add io{read,write}64 accessors
2016-05-31 16:41:50 +08:00
include/asm-generic/ioctl.h: fix _IOC_TYPECHECK sparse error
2014-06-06 16:08:13 -07:00
asm-generic/io.h: add io{read,write}64 accessors
2016-05-31 16:41:50 +08:00
irq_work: Introduce arch_irq_work_has_interrupt()
2014-09-13 18:38:07 +02:00
UAPI: Set up uapi/asm/Kbuild.asm
2012-10-02 18:01:56 +01:00
asm-generic: remove km_type definitions
2012-07-24 15:27:30 +08:00
KVM: add kvm_para_available to asm-generic/kvm_para.h
2013-06-05 13:21:29 +03:00
atomic: use <linux/atomic.h>
2011-07-26 16:49:47 -07:00
atomic: use <linux/atomic.h>
2011-07-26 16:49:47 -07:00
locking/mcs: Allow architecture specific asm files to be used for contended case
2014-02-09 21:18:52 +01:00
mm: add PHYS_PFN, use it in __phys_to_pfn()
2016-01-14 16:00:49 -08:00
mm: clean up per architecture MM hook header files
2015-07-17 16:39:53 -07:00
mm/core, x86/mm/pkeys: Differentiate instruction fetches
2016-02-18 19:46:29 +01:00
asm-generic/mmu.h: Add support for FDPIC
2012-12-09 23:14:14 +01:00
asm-generic: Remove asm-generic arch_bprm_mm_init()
2014-11-22 21:52:08 +01:00
Make most arch asm/module.h files use asm-generic/module.h
2012-09-28 14:31:03 +09:30
asm-generic: Add msi.h
2014-11-23 13:01:47 +01:00
locking/mutex: Optimize mutex_trylock() fast-path
2016-06-08 15:17:01 +02:00
arch: Make __mutex_fastpath_lock_retval return whether fastpath succeeded or not
2013-06-26 12:10:55 +02:00
locking/mutex: Optimize mutex_trylock() fast-path
2016-06-08 15:17:01 +02:00
asm-generic: page.h: Remove useless get_user_page and free_user_page
2016-02-26 15:24:55 +01:00
UAPI: (Scripted) Disintegrate include/asm-generic
2012-10-04 18:20:15 +01:00
include: remove __dev* attributes.
2013-01-03 15:57:16 -08:00
PCI: Remove unused pcibios_select_root() (again)
2015-06-08 07:56:21 -05:00
PCI: Add pci_iomap_wc() variants
2015-08-25 09:59:45 +02:00
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
2017-10-12 11:51:23 +02:00
x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
2018-08-15 18:14:45 +02:00
sched/preempt: Fix preempt_count manipulations
2016-05-17 12:24:21 +02:00
asm-generic/ptrace.h: start a common low level ptrace helper
2011-05-26 17:12:36 -07:00
locking/qrwlock: Fix write unlock bug on big endian systems
2016-08-10 14:13:27 +02:00
locking/qrwlock: Rename ->lock to ->wait_lock
2015-09-18 09:27:29 +02:00
locking/qspinlock: Use atomic_sub_return_release() in queued_spin_unlock()
2016-06-08 15:17:01 +02:00
locking/qspinlock: Move __ARCH_SPIN_LOCK_UNLOCKED to qspinlock_types.h
2016-02-29 10:02:43 +01:00
asm-generic: remove _STK_LIM_MAX
2014-05-15 00:32:09 +01:00
locking/rwsem: Remove rwsem_atomic_add() and rwsem_atomic_update()
2016-06-08 15:16:59 +02:00
seccomp: Get compat syscalls from asm-generic header
2016-05-13 14:02:00 +02:00
mm: kmemleak: scan .data.ro_after_init
2016-11-11 08:12:37 -08:00
SIGNAL: Move generic copy_siginfo() to signal.h
2016-05-13 14:02:10 +02:00
unify default ptrace_signal_deliver
2012-11-29 00:01:23 -05:00
crypto: create generic version of ablk_helper
2013-09-24 06:02:24 +10:00
ARM: 7430/1: sizes.h: move from asm-generic to <linux/sizes.h>
2012-06-28 17:14:34 +01:00
UAPI: (Scripted) Disintegrate include/asm-generic
2012-10-04 18:20:15 +01:00
Split the switch_to() wrapper out of asm-generic/system.h
2012-03-28 18:30:03 +01:00
syscall.h: fix doc text for syscall_get_arch()
2014-09-23 16:20:00 -04:00
burying unused conditionals
2013-02-14 09:21:15 -05:00
UAPI: (Scripted) Disintegrate include/asm-generic
2012-10-04 18:20:15 +01:00
mm/mmu_gather: track page size with mmu gather and force flush if page size change
2016-07-26 16:19:19 -07:00
BUG: headers with BUG/BUG_ON etc. need linux/bug.h
2012-03-04 17:54:34 -05:00
cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
2017-09-07 08:35:40 +02:00
tracing,x86: Add a TSC trace_clock
2012-11-13 15:48:27 -05:00
exceptions: detritus removal
2016-09-27 21:15:14 -04:00
asm-generic: allow generic unaligned access if the arch supports it
2014-05-08 10:22:23 +02:00
We get rid of the general module prefix confusion with a binary config option,
2013-05-05 10:58:06 -07:00
earlycon: Use a pointer table to fix __earlycon_table stride
2018-05-01 15:13:09 -07:00
include/asm-generic/vtime.h: avoid zero-length file
2013-09-30 14:31:02 -07:00
Make asm/word-at-a-time.h available on all architectures
2015-07-08 16:41:55 -04:00
asm-generic: xor: mark static functions as __maybe_unused
2012-10-03 21:21:06 +02:00
7c5b42f82c