[RFC PATCH] arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y

[Dave Martin]

On Mon, Mar 05, 2018 at 10:08:48AM +0000, Will Deacon wrote:
> TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE

suppressing

> memory accesses (e.g. speculative accesses from a first-fault gather load)
> which translate via TTBR1_EL1 result in a translation fault if they
> miss in the TLB when executed from EL0. This mitigates some timing attacks
> against KASLR, where the kernel address space could otherwise be probed
> efficiently using the FFR in conjunction with suppressed faults on SVE
> loads.

To be clear, I might say

	result in a (suppressed) translation fault

(there is no new exception taken here; the effect is only to suppress
the table walk on TLB miss in these cases).

Cheers
---Dave

> 
> Cc: Ard Biesheuvel <ard.biesheuvel at linaro.org>
> Cc: Dave Martin <Dave.Martin at arm.com>
> Signed-off-by: Will Deacon <will.deacon at arm.com>
> ---
> 
> Sending as RFC because this doesn't make any difference if kpti is enabled,
> which is the default with KASLR. It helps if kpti=off is being passed and
> shouldn't have an impact on performance.
> 
>  arch/arm64/include/asm/pgtable-hwdef.h | 1 +
>  arch/arm64/mm/proc.S                   | 9 ++++++++-
>  2 files changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
> index cdfe3e657a9e..fd208eac9f2a 100644
> --- a/arch/arm64/include/asm/pgtable-hwdef.h
> +++ b/arch/arm64/include/asm/pgtable-hwdef.h
> @@ -291,6 +291,7 @@
>  #define TCR_TBI0		(UL(1) << 37)
>  #define TCR_HA			(UL(1) << 39)
>  #define TCR_HD			(UL(1) << 40)
> +#define TCR_NFD1		(UL(1) << 54)
>  
>  /*
>   * TTBR.
> diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
> index c0af47617299..8f074d64b760 100644
> --- a/arch/arm64/mm/proc.S
> +++ b/arch/arm64/mm/proc.S
> @@ -36,6 +36,12 @@
>  #define TCR_TG_FLAGS	TCR_TG0_4K | TCR_TG1_4K
>  #endif
>  
> +#ifdef CONFIG_RANDOMIZE_BASE
> +#define TCR_KASLR_FLAGS	TCR_NFD1
> +#else
> +#define TCR_KASLR_FLAGS	0
> +#endif
> +
>  #define TCR_SMP_FLAGS	TCR_SHARED
>  
>  /* PTWs cacheable, inner/outer WBWA */
> @@ -432,7 +438,8 @@ ENTRY(__cpu_setup)
>  	 * both user and kernel.
>  	 */
>  	ldr	x10, =TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
> -			TCR_TG_FLAGS | TCR_ASID16 | TCR_TBI0 | TCR_A1
> +			TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
> +			TCR_TBI0 | TCR_A1
>  	tcr_set_idmap_t0sz	x10, x9
>  
>  	/*
> -- 
> 2.1.4
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel