* [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y
@ 2018-03-05 10:08 Will Deacon
2018-03-05 10:15 ` Ard Biesheuvel
2018-03-08 11:59 ` Dave Martin
0 siblings, 2 replies; 5+ messages in thread
From: Will Deacon @ 2018-03-05 10:08 UTC (permalink / raw)
To: linux-arm-kernel
TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
memory accesses (e.g. speculative accesses from a first-fault gather load)
which translate via TTBR1_EL1 result in a translation fault if they
miss in the TLB when executed from EL0. This mitigates some timing attacks
against KASLR, where the kernel address space could otherwise be probed
efficiently using the FFR in conjunction with suppressed faults on SVE
loads.
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
---
Sending as RFC because this doesn't make any difference if kpti is enabled,
which is the default with KASLR. It helps if kpti=off is being passed and
shouldn't have an impact on performance.
arch/arm64/include/asm/pgtable-hwdef.h | 1 +
arch/arm64/mm/proc.S | 9 ++++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index cdfe3e657a9e..fd208eac9f2a 100644
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -291,6 +291,7 @@
#define TCR_TBI0 (UL(1) << 37)
#define TCR_HA (UL(1) << 39)
#define TCR_HD (UL(1) << 40)
+#define TCR_NFD1 (UL(1) << 54)
/*
* TTBR.
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index c0af47617299..8f074d64b760 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -36,6 +36,12 @@
#define TCR_TG_FLAGS TCR_TG0_4K | TCR_TG1_4K
#endif
+#ifdef CONFIG_RANDOMIZE_BASE
+#define TCR_KASLR_FLAGS TCR_NFD1
+#else
+#define TCR_KASLR_FLAGS 0
+#endif
+
#define TCR_SMP_FLAGS TCR_SHARED
/* PTWs cacheable, inner/outer WBWA */
@@ -432,7 +438,8 @@ ENTRY(__cpu_setup)
* both user and kernel.
*/
ldr x10, =TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
- TCR_TG_FLAGS | TCR_ASID16 | TCR_TBI0 | TCR_A1
+ TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
+ TCR_TBI0 | TCR_A1
tcr_set_idmap_t0sz x10, x9
/*
--
2.1.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y
2018-03-05 10:08 [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y Will Deacon
@ 2018-03-05 10:15 ` Ard Biesheuvel
2018-03-05 10:26 ` Will Deacon
2018-03-08 11:59 ` Dave Martin
1 sibling, 1 reply; 5+ messages in thread
From: Ard Biesheuvel @ 2018-03-05 10:15 UTC (permalink / raw)
To: linux-arm-kernel
On 5 March 2018 at 10:08, Will Deacon <will.deacon@arm.com> wrote:
> TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
> memory accesses (e.g. speculative accesses from a first-fault gather load)
> which translate via TTBR1_EL1 result in a translation fault if they
> miss in the TLB when executed from EL0. This mitigates some timing attacks
> against KASLR, where the kernel address space could otherwise be probed
> efficiently using the FFR in conjunction with suppressed faults on SVE
> loads.
>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Dave Martin <Dave.Martin@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> ---
>
> Sending as RFC because this doesn't make any difference if kpti is enabled,
> which is the default with KASLR. It helps if kpti=off is being passed and
> shouldn't have an impact on performance.
>
This just makes it harder/slower to probe the kernel address space
using SVE instructions, right?
> arch/arm64/include/asm/pgtable-hwdef.h | 1 +
> arch/arm64/mm/proc.S | 9 ++++++++-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
> index cdfe3e657a9e..fd208eac9f2a 100644
> --- a/arch/arm64/include/asm/pgtable-hwdef.h
> +++ b/arch/arm64/include/asm/pgtable-hwdef.h
> @@ -291,6 +291,7 @@
> #define TCR_TBI0 (UL(1) << 37)
> #define TCR_HA (UL(1) << 39)
> #define TCR_HD (UL(1) << 40)
> +#define TCR_NFD1 (UL(1) << 54)
>
> /*
> * TTBR.
> diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
> index c0af47617299..8f074d64b760 100644
> --- a/arch/arm64/mm/proc.S
> +++ b/arch/arm64/mm/proc.S
> @@ -36,6 +36,12 @@
> #define TCR_TG_FLAGS TCR_TG0_4K | TCR_TG1_4K
> #endif
>
> +#ifdef CONFIG_RANDOMIZE_BASE
> +#define TCR_KASLR_FLAGS TCR_NFD1
> +#else
> +#define TCR_KASLR_FLAGS 0
> +#endif
> +
> #define TCR_SMP_FLAGS TCR_SHARED
>
> /* PTWs cacheable, inner/outer WBWA */
> @@ -432,7 +438,8 @@ ENTRY(__cpu_setup)
> * both user and kernel.
> */
> ldr x10, =TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
> - TCR_TG_FLAGS | TCR_ASID16 | TCR_TBI0 | TCR_A1
> + TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
> + TCR_TBI0 | TCR_A1
> tcr_set_idmap_t0sz x10, x9
>
> /*
> --
> 2.1.4
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y
2018-03-05 10:15 ` Ard Biesheuvel
@ 2018-03-05 10:26 ` Will Deacon
2018-03-05 17:08 ` Ard Biesheuvel
0 siblings, 1 reply; 5+ messages in thread
From: Will Deacon @ 2018-03-05 10:26 UTC (permalink / raw)
To: linux-arm-kernel
On Mon, Mar 05, 2018 at 10:15:29AM +0000, Ard Biesheuvel wrote:
> On 5 March 2018 at 10:08, Will Deacon <will.deacon@arm.com> wrote:
> > TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
> > memory accesses (e.g. speculative accesses from a first-fault gather load)
> > which translate via TTBR1_EL1 result in a translation fault if they
> > miss in the TLB when executed from EL0. This mitigates some timing attacks
> > against KASLR, where the kernel address space could otherwise be probed
> > efficiently using the FFR in conjunction with suppressed faults on SVE
> > loads.
> >
> > Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> > Cc: Dave Martin <Dave.Martin@arm.com>
> > Signed-off-by: Will Deacon <will.deacon@arm.com>
> > ---
> >
> > Sending as RFC because this doesn't make any difference if kpti is enabled,
> > which is the default with KASLR. It helps if kpti=off is being passed and
> > shouldn't have an impact on performance.
> >
>
> This just makes it harder/slower to probe the kernel address space
> using SVE instructions, right?
Yeah, basically, but given that kpti should make any walks via ttbr1 from
EL0 timing invariant, it doesn't make a whole lot of difference in
conjunction with that.
Will
^ permalink raw reply [flat|nested] 5+ messages in thread
* [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y
2018-03-05 10:26 ` Will Deacon
@ 2018-03-05 17:08 ` Ard Biesheuvel
0 siblings, 0 replies; 5+ messages in thread
From: Ard Biesheuvel @ 2018-03-05 17:08 UTC (permalink / raw)
To: linux-arm-kernel
On 5 March 2018 at 10:26, Will Deacon <will.deacon@arm.com> wrote:
> On Mon, Mar 05, 2018 at 10:15:29AM +0000, Ard Biesheuvel wrote:
>> On 5 March 2018 at 10:08, Will Deacon <will.deacon@arm.com> wrote:
>> > TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
>> > memory accesses (e.g. speculative accesses from a first-fault gather load)
>> > which translate via TTBR1_EL1 result in a translation fault if they
>> > miss in the TLB when executed from EL0. This mitigates some timing attacks
>> > against KASLR, where the kernel address space could otherwise be probed
>> > efficiently using the FFR in conjunction with suppressed faults on SVE
>> > loads.
>> >
>> > Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> > Cc: Dave Martin <Dave.Martin@arm.com>
>> > Signed-off-by: Will Deacon <will.deacon@arm.com>
>> > ---
>> >
>> > Sending as RFC because this doesn't make any difference if kpti is enabled,
>> > which is the default with KASLR. It helps if kpti=off is being passed and
>> > shouldn't have an impact on performance.
>> >
>>
>> This just makes it harder/slower to probe the kernel address space
>> using SVE instructions, right?
>
> Yeah, basically, but given that kpti should make any walks via ttbr1 from
> EL0 timing invariant, it doesn't make a whole lot of difference in
> conjunction with that.
>
Seems sane in any case
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y
2018-03-05 10:08 [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y Will Deacon
2018-03-05 10:15 ` Ard Biesheuvel
@ 2018-03-08 11:59 ` Dave Martin
1 sibling, 0 replies; 5+ messages in thread
From: Dave Martin @ 2018-03-08 11:59 UTC (permalink / raw)
To: linux-arm-kernel
On Mon, Mar 05, 2018 at 10:08:48AM +0000, Will Deacon wrote:
> TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
suppressing
> memory accesses (e.g. speculative accesses from a first-fault gather load)
> which translate via TTBR1_EL1 result in a translation fault if they
> miss in the TLB when executed from EL0. This mitigates some timing attacks
> against KASLR, where the kernel address space could otherwise be probed
> efficiently using the FFR in conjunction with suppressed faults on SVE
> loads.
To be clear, I might say
result in a (suppressed) translation fault
(there is no new exception taken here; the effect is only to suppress
the table walk on TLB miss in these cases).
Cheers
---Dave
>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Dave Martin <Dave.Martin@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> ---
>
> Sending as RFC because this doesn't make any difference if kpti is enabled,
> which is the default with KASLR. It helps if kpti=off is being passed and
> shouldn't have an impact on performance.
>
> arch/arm64/include/asm/pgtable-hwdef.h | 1 +
> arch/arm64/mm/proc.S | 9 ++++++++-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
> index cdfe3e657a9e..fd208eac9f2a 100644
> --- a/arch/arm64/include/asm/pgtable-hwdef.h
> +++ b/arch/arm64/include/asm/pgtable-hwdef.h
> @@ -291,6 +291,7 @@
> #define TCR_TBI0 (UL(1) << 37)
> #define TCR_HA (UL(1) << 39)
> #define TCR_HD (UL(1) << 40)
> +#define TCR_NFD1 (UL(1) << 54)
>
> /*
> * TTBR.
> diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
> index c0af47617299..8f074d64b760 100644
> --- a/arch/arm64/mm/proc.S
> +++ b/arch/arm64/mm/proc.S
> @@ -36,6 +36,12 @@
> #define TCR_TG_FLAGS TCR_TG0_4K | TCR_TG1_4K
> #endif
>
> +#ifdef CONFIG_RANDOMIZE_BASE
> +#define TCR_KASLR_FLAGS TCR_NFD1
> +#else
> +#define TCR_KASLR_FLAGS 0
> +#endif
> +
> #define TCR_SMP_FLAGS TCR_SHARED
>
> /* PTWs cacheable, inner/outer WBWA */
> @@ -432,7 +438,8 @@ ENTRY(__cpu_setup)
> * both user and kernel.
> */
> ldr x10, =TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
> - TCR_TG_FLAGS | TCR_ASID16 | TCR_TBI0 | TCR_A1
> + TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
> + TCR_TBI0 | TCR_A1
> tcr_set_idmap_t0sz x10, x9
>
> /*
> --
> 2.1.4
>
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-03-08 11:59 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-05 10:08 [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y Will Deacon
2018-03-05 10:15 ` Ard Biesheuvel
2018-03-05 10:26 ` Will Deacon
2018-03-05 17:08 ` Ard Biesheuvel
2018-03-08 11:59 ` Dave Martin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.