From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EF20C10F0E for ; Mon, 15 Apr 2019 11:08:43 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3E5CB2087C for ; Mon, 15 Apr 2019 11:08:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="ul6sRh3K" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3E5CB2087C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linutronix.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=quuBvkImma/QR5SYaNtVeYfPGNiAu/TlP7u8kles6Go=; b=ul6sRh3Kw8wvTz puIND7/QdAvj4UuLxnM/pMC44ib52vc8bhv4a8lUa2Yi91sAdOvixec9+urdP/TRniEKDlr1i9/4Y q49me9PP+AJM3HxcFIj7lIgBkCBTTFjs9h3MMRqCKVRD7DIX4lfkW6j+EhtBpnEXVejETrmNIKI4o k9+ahsWGP5x0G3e1YU0KU9AAd8/s+o1vgZvg86kcJgES0tevPDvJqfB+G5aBagP/OC2Z0NZGx8Po5 aZztmimX8rrUxMQgEFzcZLjdD5CYlMqxbMeobaSAiNr5T8tqjyXb/nMLQotvV/WYb6iBt7A7v8nft g+tXenUfvn6zdAWZ2fUA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hFzTc-0001Yg-Be; Mon, 15 Apr 2019 11:08:40 +0000 Received: from galois.linutronix.de ([2a01:7a0:2:106d:700::1]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1hFzTZ-0001XW-1X for linux-arm-kernel@lists.infradead.org; Mon, 15 Apr 2019 11:08:38 +0000 Received: from bigeasy by Galois.linutronix.de with local (Exim 4.80) (envelope-from ) id 1hFzTT-00065A-C2; Mon, 15 Apr 2019 13:08:31 +0200 Date: Mon, 15 Apr 2019 13:08:31 +0200 From: Sebastian Andrzej Siewior To: linux-arm-kernel@lists.infradead.org, Russell King , Arnd Bergmann Subject: Re: [PATCH] ARM: mm: harden branch predictor before opening interrupts during fault Message-ID: <20190415110831.rjxsryiqb5duq5wp@linutronix.de> References: <20190319203239.gl46fxnfz6gzeeic@linutronix.de> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190319203239.gl46fxnfz6gzeeic@linutronix.de> User-Agent: NeoMutt/20180716 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190415_040837_223530_A9591BBD X-CRM114-Status: GOOD ( 17.57 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Gleixner , Bernd Edlinger Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 2019-03-19 21:32:39 [+0100], To linux-arm-kernel@lists.infradead.org wrote: > On non-LPAE systems a write to 0xbffffff0 (modules area) from userland > results in: > | BUG: using smp_processor_id() in preemptible [00000000] code: mem-tc/521 > | caller is __do_user_fault.constprop.2+0x4c/0x74 > | CPU: 1 PID: 521 Comm: mem-tc Not tainted 5.1.0-rc1 #4 > | [] (debug_smp_processor_id) from [] (__do_user_fault.constprop.2+0x4c/0x74) > | [] (__do_user_fault.constprop.2) from [] (do_page_fault+0x278/0x37c) > | [] (do_page_fault) from [] (do_DataAbort+0x3c/0xa8) > | [] (do_DataAbort) from [] (__dabt_usr+0x3c/0x40) > > Move harden_branch_predictor() from __do_user_fault() to its both > callers (do_bad_area() and do_page_fault()). The invocation in > do_page_fault() is added before interrupst are enabled. The invocation > in do_bad_area() is added just before __do_user_fault() is invoked. In 20190216113338.irr5j4ukhpwngval@shell.armlinux.org.uk Russel complained that I am opening a window for branch predictor attacks that he tried to close. This is no longer the case because harden_branch_predictor() is now in do_page_fault() and do_bad_area(). So is this still obviously wrong and I don't see it? > Fixes: f5fe12b1eaee2 ("ARM: spectre-v2: harden user aborts in kernel space") > Reported-by: Bernd Edlinger > Signed-off-by: Sebastian Andrzej Siewior > --- > arch/arm/mm/fault.c | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > index 58f69fa07df95..7adff8eb8f3d2 100644 > --- a/arch/arm/mm/fault.c > +++ b/arch/arm/mm/fault.c > @@ -161,9 +161,6 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr, > unsigned int fsr, unsigned int sig, int code, > struct pt_regs *regs) > { > - if (addr > TASK_SIZE) > - harden_branch_predictor(); > - > #ifdef CONFIG_DEBUG_USER > if (((user_debug & UDBG_SEGV) && (sig == SIGSEGV)) || > ((user_debug & UDBG_BUS) && (sig == SIGBUS))) { > @@ -195,10 +192,13 @@ void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs) > * If we are in kernel mode at this point, we > * have no context to handle this fault with. > */ > - if (user_mode(regs)) > + if (user_mode(regs)) { > + if (addr > TASK_SIZE) > + harden_branch_predictor(); > __do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs); > - else > + } else { > __do_kernel_fault(mm, addr, fsr, regs); > + } > } > > #ifdef CONFIG_MMU > @@ -272,6 +272,8 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) > tsk = current; > mm = tsk->mm; > > + if (addr > TASK_SIZE && user_mode(regs)) > + harden_branch_predictor(); > /* Enable interrupts if they were enabled in the parent context. */ > if (interrupts_enabled(regs)) > local_irq_enable(); Sebastian _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel