• Nicholas Piggin's avatar
    powerpc/64s: flush L1D on kernel entry · f7964378
    Nicholas Piggin authored
    IBM Power9 processors can speculatively operate on data in the L1 cache
    before it has been completely validated, via a way-prediction mechanism. It
    is not possible for an attacker to determine the contents of impermissible
    memory using this method, since these systems implement a combination of
    hardware and software security measures to prevent scenarios where
    protected data could be leaked.
    
    However these measures don't address the scenario where an attacker induces
    the operating system to speculatively execute instructions using data that
    the attacker controls. This can be used for example to speculatively bypass
    "kernel user access prevention" techniques, as discovered by Anthony
    Steinhauser of Google's Safeside Project. This is not an attack by itself,
    but there is a possibility it could be used in conjunction with
    side-channels or other weaknesses in the privileged code to construct an
    attack.
    
    This issue can be mitigated by flushing the L1 cache between privilege
    boundaries of concern. This patch flushes the L1 cache on kernel entry.
    
    This is part of the fix for CVE-2020-4788.
    Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
    Signed-off-by: default avatarDaniel Axtens <dja@axtens.net>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    f7964378
feature-fixups.c 25.5 KB