From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DD9AC433C1 for ; Thu, 25 Mar 2021 14:03:50 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B295661962 for ; Thu, 25 Mar 2021 14:03:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B295661962 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=derH/JJTZ4uxZ8MnjHYgJinN4Bt646jR0451Gr72PvY=; b=Ud5zGCqwz4tKoHxagtGcUbpbc hcQDp+jwdijL/at7H+lsO3Hp13E2QCvyq5/l0rGrBjzg03+VGLoHi71B0aEcfamGFQrE5/Zj1IHsn hY8hF8VRxw5maiDrdqbwhs4x9Czt0K0Hubjcm5LXEo8jplBf1cIUXbK/51es9l3tg82Ml2VrR8JqJ FZrnHMc6ULzWjJ5T+gZGISUlEDJCsLUZgHd+Buo8VXALHxlOzeunXyPLQJDbebzRKVsp050Uj0Xmr nhv/bvac9l/NWSVDBjxO41gcmO7ZQ+RPOTXYraaBmGqs3eJKGS7pucwkPifG9h9kiuwrjWx3RYO10 b9ZX3ZXgA==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lPQYM-001ZYe-VO; Thu, 25 Mar 2021 14:01:39 +0000 Received: from mail-lf1-x12e.google.com ([2a00:1450:4864:20::12e]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lPQYG-001ZY0-V0 for linux-arm-kernel@lists.infradead.org; Thu, 25 Mar 2021 14:01:35 +0000 Received: by mail-lf1-x12e.google.com with SMTP id b4so2680649lfi.6 for ; Thu, 25 Mar 2021 07:01:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MmF8zMMhSJr2UbOoYiZqtv8YBPrRUBEDP7fTi81KAEk=; b=ySCJ54ICDE6200wEeFqVJv/p1kR197zEWndwv2ypByqKlhCXXhWFp8/SLHr5XEWYN8 97L3YlomdDH9+yIicnZJt0XCSWZ6LfsEGo/Uc10dXf8YhTttlLJfGwIJqy3mVtxTlp7B 1/Ct2gYKCrxR/T7G4+DrDJLfyfIGAgXqUpTEb3DE1U7OdVSRn2JS46gpwUF3/VektYED cviJesFIXSxfUFqjNV5JtVZZGXZPZZpUt4UAND002egeiXa+uOEXrcLommLqWcVX8vxx UzN20W0zHk8DABO2nVpledwJz2npmWit2ZxuobV51siQhqslP3p/LYZae6ZeZx3BUUf8 f5ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MmF8zMMhSJr2UbOoYiZqtv8YBPrRUBEDP7fTi81KAEk=; b=HNK+/oNouxhGMbUlpzGI+fFgkLIAxiXYtJeCcQxis3sdGyX5GUXfft7Ywo7nvGVKQV INmNVAgPQWsMsht2Vq6iq3GDBORx+ZRjXqr28lEVc9cLn9jHEcpMPxFzGqsdUZ2x++ik HHHAxauco+GH9tBOZjPrjeAa3Oz/b9PJsNwy4av9Ycb+pplIaqjhoLXmsmWNFOvxG6ij m9y313orIgeHA3viUqNTvlvfQsWSiPjp4u4vUQaEJxpD1VGAFni4SiygYKNHGSaqfy0b TIAcTlIbS85yR9NM/f9pKb3xCocqG75H9L80fQDO/CHwSQqvKgjH0SWmKCkgrsbD3mW0 6QVA== X-Gm-Message-State: AOAM531aKZ+OU7MlPnZyb9zszibL64lWcQIMZ4QjCnO955CSoUpHu9rM z4wRvpRGsv3dCJFe4V2DT/MxdlzUJMic09xqlAuSRg== X-Google-Smtp-Source: ABdhPJwN9qo9jK5N4Qbvi4l62f5Ye52sRZLOgrlXWLb5uvDKoV3liGbEnF0y5GhyhtVdQ0++fd/nRNIdObtNPuZNGvU= X-Received: by 2002:a19:4c08:: with SMTP id z8mr4917148lfa.157.1616680886895; Thu, 25 Mar 2021 07:01:26 -0700 (PDT) MIME-Version: 1.0 References: <3f61af0eee9b495e8e8c032902d033c5@AcuMS.aculab.com> <20210212195255.1321544-1-jiancai@google.com> <20210217094859.GA3706@willie-the-truck> In-Reply-To: <20210217094859.GA3706@willie-the-truck> From: Linus Walleij Date: Thu, 25 Mar 2021 15:01:15 +0100 Message-ID: Subject: Re: [PATCH v2] ARM: Implement Clang's SLS mitigation To: Will Deacon Cc: Jian Cai , Nick Desaulniers , Manoj Gupta , Luis Lozano , clang-built-linux , Nathan Chancellor , David Laight , Russell King , Catalin Marinas , James Morris , "Serge E. Hallyn" , Arnd Bergmann , Masahiro Yamada , Kees Cook , Krzysztof Kozlowski , Ard Biesheuvel , =?UTF-8?Q?Andreas_F=C3=A4rber?= , Linux ARM , "linux-kernel@vger.kernel.org" , linux-security-module@vger.kernel.org, Kristof Beyls X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210325_140133_249258_8D7656E3 X-CRM114-Status: GOOD ( 30.36 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Will, I went back and found this feedback which is kind of the heart of the issues regarding SLS. On Wed, Feb 17, 2021 at 10:51 AM Will Deacon wrote: > The big problem I have with this is that it's a compile-time decision. > For the other spectre crap we have a combination of the "mitigations=off" > command-line and CPU detection to avoid the cost of the mitigation where > it is not deemed necessary. For newcomers, the way this works today can be found in e.g.: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/kernel/proton-pack.c mitigations=off turns off Spectre v2 and v4 mitigations. AFAICT this is achived with misc parameterization to firmware and hypervisors and no runtime-patching of any code at all? (On ARM32 it has no effect whatsoever, we just turn on all spectre v2 mitigations by default. No runtime choice.) The way I understand it is that for SLS the compiler must at least put in some kind of placeholders, but that it *might* be possible to do runtime mitigations on top of that. We need feedback from the compiler people as to what is possible here. If it is *not* possible to mitigate at run-time, then I don't know what is the right thing to do. Certainly not to turn it on by default as is done today? > So I think that either we enable this unconditionally, or we don't enable it > at all (and people can hack their CFLAGS themselves if they want to). It > would be helpful for one of the Arm folks to chime in, as I'm yet to see any > evidence that this is actually exploitable. (...) > Is it any worse that Spectre-v1, > where we _don't_ have a compiler mitigation? There is such a compiler mitigation for Spectre v1, under the name "Speculative load hardening" the kernel is not (yet) enabling it. https://llvm.org/docs/SpeculativeLoadHardening.html it comes with the intuitive command line switch -mspeculative-load-hardening Certainly a separate patch can add speculative load hardening support on top of this, or before this patch, if there is desire and/or feels like a more coherent approach. As the article says "The performance overhead of this style of comprehensive mitigation is very high (...) most large applications seeing a 30% overhead or less." I suppose it can be enabled while compiling the kernel just like this patch enables -mharden-sls=all I don't know if your comment means that if we enable one of them we should just as well enable both or none as otherwise there is no real protection, as attackers can just use the other similar attack vector? > Finally, do we have to worry about our assembly code? AFAICT yes, and you seem to have hardened Aarch64's ERET:s which seemed especially vulnerable in commit 679db70801da9fda91d26caf13bf5b5ccc74e8e8 "arm64: entry: Place an SB sequence following an ERET instruction" Link for people without kernel source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=679db70801da9fda91d26caf13bf5b5ccc74e8e8 So it seems the most vulnerable spot was already fixed by you, thanks! But I bet there are some more spots. Yours, Linus Walleij _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel