Subject: [RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y

From: [email-masked] (Will Deacon)
Date: Mon, 5 Mar 2018 10:26:56 +0000

On Mon, Mar 05, 2018 at 10:15:29AM +0000, Ard Biesheuvel wrote:
> On 5 March 2018 at 10:08, Will Deacon <[email-masked]> wrote:
> > TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
> > memory accesses (e.g. speculative accesses from a first-fault gather load)
> > which translate via TTBR1_EL1 result in a translation fault if they
> > miss in the TLB when executed from EL0. This mitigates some timing attacks
> > against KASLR, where the kernel address space could otherwise be probed
> > efficiently using the FFR in conjunction with suppressed faults on SVE
> > loads.
> >
> > Cc: Ard Biesheuvel <[email-masked]>
> > Cc: Dave Martin <[email-masked]>
> > Signed-off-by: Will Deacon <[email-masked]>
> > ---
> >
> > Sending as RFC because this doesn't make any difference if kpti is enabled,
> > which is the default with KASLR. It helps if kpti=off is being passed and
> > shouldn't have an impact on performance.
> >
> 
> This just makes it harder/slower to probe the kernel address space
> using SVE instructions, right?

Yeah, basically, but given that kpti should make any walks via ttbr1 from
EL0 timing invariant, it doesn't make a whole lot of difference in
conjunction with that.

Will