* [PATCH] arm64: kpti: ensure patched kernel text is fetched from PoU
@ 2019-08-27 17:12 Mark Rutland
2019-08-28 11:12 ` James Morse
0 siblings, 1 reply; 2+ messages in thread
From: Mark Rutland @ 2019-08-27 17:12 UTC (permalink / raw)
To: linux-arm-kernel; +Cc: Mark Rutland, Catalin Marinas, James Morse, Will Deacon
While the MMUs is disabled, I-cache speculation can result in
instructions being fetched from the PoC. During boot we may patch
instructions (e.g. for alternatives and jump labels), and these may be
dirty at the PoU (and stale at the PoC).
Thus, while the MMU is disabled in the KPTI pagetable fixup code we may
load stale instructions into the I-cache, potentially leading to
subsequent crashes when executing regions of code which have been
modified at runtime.
Similarly to commit:
8ec41987436d566f ("arm64: mm: ensure patched kernel text is fetched from PoU")
... we can invalidate the I-cache after enabling the MMU to prevent such
issues.
The KPTI pagetable fixup code itself should be clean to the PoC per the
boot protocol, so no maintenance is required for this code.
Signed-off-by: Mark Rutland <mark.rutland@arm•com>
Cc: Catalin Marinas <catalin.marinas@arm•com>
Cc: James Morse <james.morse@arm•com>
Cc: Will Deacon <will@kernel•org>
---
arch/arm64/mm/proc.S | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 7dbf2be470f6..28a8f7b87ff0 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -286,6 +286,15 @@ skip_pgd:
msr sctlr_el1, x18
isb
+ /*
+ * Invalidate the local I-cache so that any instructions fetched
+ * speculatively from the PoC are discarded, since they may have
+ * been dynamically patched at the PoU.
+ */
+ ic iallu
+ dsb nsh
+ isb
+
/* Set the flag to zero to indicate that we're all done */
str wzr, [flag_ptr]
ret
--
2.11.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists•infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] arm64: kpti: ensure patched kernel text is fetched from PoU
2019-08-27 17:12 [PATCH] arm64: kpti: ensure patched kernel text is fetched from PoU Mark Rutland
@ 2019-08-28 11:12 ` James Morse
0 siblings, 0 replies; 2+ messages in thread
From: James Morse @ 2019-08-28 11:12 UTC (permalink / raw)
To: Mark Rutland; +Cc: Catalin Marinas, Will Deacon, linux-arm-kernel
Hi Mark,
On 27/08/2019 18:12, Mark Rutland wrote:
> While the MMUs is disabled, I-cache speculation can result in
(Nit: MMU)
> instructions being fetched from the PoC. During boot we may patch
> instructions (e.g. for alternatives and jump labels), and these may be
> dirty at the PoU (and stale at the PoC).
>
> Thus, while the MMU is disabled in the KPTI pagetable fixup code we may
> load stale instructions into the I-cache, potentially leading to
> subsequent crashes when executing regions of code which have been
> modified at runtime.
>
> Similarly to commit:
>
> 8ec41987436d566f ("arm64: mm: ensure patched kernel text is fetched from PoU")
>
> ... we can invalidate the I-cache after enabling the MMU to prevent such
> issues.
> The KPTI pagetable fixup code itself should be clean to the PoC per the
> boot protocol, so no maintenance is required for this code.
Reviewed-by: James Morse <james.morse@arm•com>
Thanks,
James
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists•infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-28 11:13 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-27 17:12 [PATCH] arm64: kpti: ensure patched kernel text is fetched from PoU Mark Rutland
2019-08-28 11:12 ` James Morse
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox