From: will.deacon@arm•com (Will Deacon)
To: linux-arm-kernel@lists•infradead.org
Subject: [kernel-hardening] [PATCH 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching
Date: Mon, 15 Aug 2016 12:00:49 +0100 [thread overview]
Message-ID: <20160815110049.GG13262@arm.com> (raw)
In-Reply-To: <CAKv+Gu-5Ckd0_ot-Le=7dL2Wn8E6198vEHPk0-E4VtRUw8c0BQ@mail.gmail.com>
On Mon, Aug 15, 2016 at 12:43:31PM +0200, Ard Biesheuvel wrote:
> On 15 August 2016 at 12:37, Will Deacon <will.deacon@arm•com> wrote:
> > On Mon, Aug 15, 2016 at 12:31:29PM +0200, Ard Biesheuvel wrote:
> >> On 15 August 2016 at 12:30, Will Deacon <will.deacon@arm•com> wrote:
> >> > On Mon, Aug 15, 2016 at 12:21:00PM +0200, Ard Biesheuvel wrote:
> >> >> As to Will's point, I suppose there is a window where a speculative
> >> >> TLB fill could occur, so I suppose that means updating TTBR0_EL1.ASID
> >> >> first, then TCR_EL1.EPD0, and finally perform the TLBI ASIDE1 on the
> >> >> reserved ASID.
> >> >
> >> > But then what do you gain from the reserved ASID?
> >> >
> >>
> >> To prevent TLB hits against the ASID of the current (disabled)
> >> userland translation
> >
> > Right, but if the sequence you described ensures that, then why not just
> > set TCR_EL1.EPD0 and do TLBI ASIDE1 on the current ASID?
> >
>
> ... because then you wipe all the cached translations for current
> userland, which I suppose is best avoided. Wiping the reserved ASID
> only discards TLB entries that should not exist in the first place.
True, I guess we'd need to measure that vs. the extra cost of switching
to/from the reserved ASID.
> > I don't see the difference between a TLB entry formed from a speculative
> > fill using the reserved ASID and one formed using a non-reserved ASID --
> > the page table is the same.
> >
>
> No, but EPD0 does not disable translations, it disable translation
> table walks on TLB misses, so we need to switch ASIDs to prevent user
> space accesses via TLB hits.
Right, only if you don't do the invalidation for the current ASID.
> But, how about we store the reserved ASID in TTBR1_EL1 instead, and
> switch TCR_EL1.A1 and TCR_EL1.EPD0 in a single write? That way, we can
> switch ASIDs and disable table walks atomically (I hope), and we
> wouldn't need to change TTBR0_EL1 at all.
I doubt that would work, unfortunately. Whilst the writes are atomic
from the point-of-view of the TCR, if the fields can be cached in the
TLB logic, then we can't guarantee the atomicity of changes to the
cached state. Nice idea, though!
Will
next prev parent reply other threads:[~2016-08-15 11:00 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-12 15:27 [PATCH 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching Catalin Marinas
2016-08-12 15:27 ` [PATCH 1/7] arm64: Factor out PAN enabling/disabling into separate uaccess_* macros Catalin Marinas
2016-08-12 15:27 ` [PATCH 2/7] arm64: Factor out TTBR0_EL1 setting into a specific asm macro Catalin Marinas
2016-08-12 15:27 ` [PATCH 3/7] arm64: Introduce uaccess_{disable, enable} functionality based on TTBR0_EL1 Catalin Marinas
2016-08-12 15:27 ` [PATCH 4/7] arm64: Disable TTBR0_EL1 during normal kernel execution Catalin Marinas
2016-08-15 11:18 ` Mark Rutland
2016-08-15 16:39 ` Catalin Marinas
2016-08-12 15:27 ` [PATCH 5/7] arm64: Handle faults caused by inadvertent user access with PAN enabled Catalin Marinas
2016-08-12 15:27 ` [PATCH 6/7] arm64: xen: Enable user access before a privcmd hvc call Catalin Marinas
2016-08-15 9:58 ` Julien Grall
2016-08-15 18:00 ` Stefano Stabellini
2016-08-12 15:27 ` [PATCH 7/7] arm64: Enable CONFIG_ARM64_TTBR0_PAN Catalin Marinas
2016-08-12 18:04 ` [PATCH 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching Kees Cook
2016-08-12 18:22 ` Catalin Marinas
2016-08-13 9:13 ` [kernel-hardening] " Ard Biesheuvel
2016-08-15 9:48 ` Catalin Marinas
2016-08-15 9:58 ` Mark Rutland
2016-08-15 10:02 ` Ard Biesheuvel
2016-08-15 10:06 ` Mark Rutland
2016-08-15 10:10 ` Will Deacon
2016-08-15 10:15 ` Mark Rutland
2016-08-15 10:21 ` Will Deacon
2016-08-15 10:21 ` Ard Biesheuvel
2016-08-15 10:30 ` Will Deacon
2016-08-15 10:31 ` Ard Biesheuvel
2016-08-15 10:37 ` Will Deacon
2016-08-15 10:43 ` Ard Biesheuvel
2016-08-15 10:52 ` Catalin Marinas
2016-08-15 10:56 ` Ard Biesheuvel
2016-08-15 11:02 ` Will Deacon
2016-08-15 16:13 ` Catalin Marinas
2016-08-15 19:04 ` Ard Biesheuvel
2016-08-15 11:00 ` Will Deacon [this message]
2016-08-15 10:30 ` Mark Rutland
2016-08-15 10:08 ` Will Deacon
2016-08-26 15:39 ` David Brown
2016-08-26 17:24 ` Catalin Marinas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160815110049.GG13262@arm.com \
--to=will.deacon@arm$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox