From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 332A33A8C6 for ; Mon, 22 Jan 2024 11:16:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705922180; cv=none; b=cCC3FzNc50KYJ4Ag+weql00ll0daK/zwFgvkIavLW26IaJq5R+CD7MDhKSuZzEgVyDTvfj44dCWag6nlVoVN9g0aJrnhGDnt2byFvseFNrXImn6bAeuIT+iXfrnwqWIBUXdQrOFDr1V3bfr40ZGqN1O6gzaVI5pxxgACVbUb6V8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705922180; c=relaxed/simple; bh=Z46VKqKZ0FPff1sCru/gK9s4P3X0W2Nu7ly7V5AunKM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=dsoXNahrOSqXhc3V2AsK2EiPsUAVA/g7LvW5pVxBNoCXpdSTuoo9s3LvHYRbcvkHdo4cWHuIwRuPSuDF5EizX1gZ8vRflpX6EHu2iuPz/NV7yGpH80GRIHFsIR5nRdSyZqf0DD9p+exVuAQD+FiW7zCEKeUl7Nc43ga6gU8GP3o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 1490E2F4; Mon, 22 Jan 2024 03:17:03 -0800 (PST) Received: from FVFF77S0Q05N (unknown [10.57.47.106]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 0A46F3F5A1; Mon, 22 Jan 2024 03:16:15 -0800 (PST) Date: Mon, 22 Jan 2024 11:16:10 +0000 From: Mark Rutland To: Rob Herring Cc: linux-arm-kernel@lists.infradead.org, catalin.marinas@arm.com, james.morse@arm.com, stable@vger.kernel.org, will@kernel.org Subject: Re: [PATCH 1/2] arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD Message-ID: References: <20240116110221.420467-1-mark.rutland@arm.com> <20240116110221.420467-2-mark.rutland@arm.com> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Hi Rob, Sorry for the confusion here; I should have synced up with you before sending this out. On Fri, Jan 19, 2024 at 09:11:33AM -0600, Rob Herring wrote: > On Tue, Jan 16, 2024 at 5:02 AM Mark Rutland wrote: > > > > Currently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't > > quite right, as it is supposed to be applied after the last explicit > > memory access, but is immediately followed by an LDR. > > This isn't necessary. The LDR in question is an unprivileged load from > the EL0 stack. The erratum write-up is not really clear in that > regard. I see from internal notes that the rationale is that the LDR in question only loads data that EL0 already has in its registers, and hence it doesn't matter if that data is leaked to EL0. That's reasonable, but we didn't note that anywhere (i.e. neither in the commit message nor in any comments). To avoid confusion, the LDR in question *is* a privileged load (whereas an LDTR at EL1 would be an unprivileged load); for memory accesses the architecture uses the terms privileged and unprivileged to distinguish the way those are handled by the MMU. I agree that given the rationale above this patch isn't strictly necessary, but I would prefer result of these two patches as it's less likely that we'll add loads of sensitive information in future as this code is changed. > It's the same as the KPTI case. After switching the page tables, there > are unprivileged loads from the EL0 stack. I'm not sure what you mean here; maybe I'm missing something? AFAICT we don't do any loads within the kernel after switching the translation tables. In tramp_exit we follow tramp_unmap_kernel with: MRS; ERET; SB ... and in __sdei_asm_exit_trampoline we follow tramp_unmap_kernel with CMP; B.NE; {HVC,SMC}; B . ... so there are no explicit loads at EL1 before the ERET to EL0. In the SDEI case any loads at a higher EL don't matter because they're in a different translation regime. Thanks, Mark. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 697B4C47DAF for ; Mon, 22 Jan 2024 11:17:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=5KOtLDVjTPDZ3WdxFqN2Sj5FUy4UzI7k3z61FnDKzDw=; b=LlTWzTMTw+09HD 460L+Nsu1aFOVAe652QTTyfzsVv7Lj1tjJJhYANbhFdDgsEu91OmSOD8tT8c0qYwyCtpKRNzFg8Ev sn/upNpp63yaATHoJdC0Ep31awXJoOpbKAmxL1qmGwIsMK+tpgHLFiJzkvtpC4FGf64vHdZQAsWuC q25RtGwBzIN7OPGRCAHFZv8Rl3SAEbPvEhDUlDFFwRpmveDHNOKXJcjtYDHh4cNjj0+oy61BANS24 ly24S5y7kwSql4gX7vxEW+SwHBbfpxMSYndu7XGRc/DAdx/VFfIXSF1rHP5PJoRwlb+8Xrb2WTAio ePzaPn9Ta+bcZskhqI7w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1rRsID-00BhhJ-25; Mon, 22 Jan 2024 11:16:41 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1rRsHs-00BhT7-1v for linux-arm-kernel@lists.infradead.org; Mon, 22 Jan 2024 11:16:31 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 1490E2F4; Mon, 22 Jan 2024 03:17:03 -0800 (PST) Received: from FVFF77S0Q05N (unknown [10.57.47.106]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 0A46F3F5A1; Mon, 22 Jan 2024 03:16:15 -0800 (PST) Date: Mon, 22 Jan 2024 11:16:10 +0000 From: Mark Rutland To: Rob Herring Cc: linux-arm-kernel@lists.infradead.org, catalin.marinas@arm.com, james.morse@arm.com, stable@vger.kernel.org, will@kernel.org Subject: Re: [PATCH 1/2] arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD Message-ID: References: <20240116110221.420467-1-mark.rutland@arm.com> <20240116110221.420467-2-mark.rutland@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240122_031625_361356_D5D8823A X-CRM114-Status: GOOD ( 20.47 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org SGkgUm9iLAoKU29ycnkgZm9yIHRoZSBjb25mdXNpb24gaGVyZTsgSSBzaG91bGQgaGF2ZSBzeW5j ZWQgdXAgd2l0aCB5b3UgYmVmb3JlIHNlbmRpbmcKdGhpcyBvdXQuCgpPbiBGcmksIEphbiAxOSwg MjAyNCBhdCAwOToxMTozM0FNIC0wNjAwLCBSb2IgSGVycmluZyB3cm90ZToKPiBPbiBUdWUsIEph biAxNiwgMjAyNCBhdCA1OjAy4oCvQU0gTWFyayBSdXRsYW5kIDxtYXJrLnJ1dGxhbmRAYXJtLmNv bT4gd3JvdGU6Cj4gPgo+ID4gQ3VycmVudGx5IHRoZSBBUk02NF9XT1JLQVJPVU5EX1NQRUNVTEFU SVZFX1VOUFJJVl9MT0FEIHdvcmthcm91bmQgaXNuJ3QKPiA+IHF1aXRlIHJpZ2h0LCBhcyBpdCBp cyBzdXBwb3NlZCB0byBiZSBhcHBsaWVkIGFmdGVyIHRoZSBsYXN0IGV4cGxpY2l0Cj4gPiBtZW1v cnkgYWNjZXNzLCBidXQgaXMgaW1tZWRpYXRlbHkgZm9sbG93ZWQgYnkgYW4gTERSLgo+IAo+IFRo aXMgaXNuJ3QgbmVjZXNzYXJ5LiBUaGUgTERSIGluIHF1ZXN0aW9uIGlzIGFuIHVucHJpdmlsZWdl ZCBsb2FkIGZyb20KPiB0aGUgRUwwIHN0YWNrLiBUaGUgZXJyYXR1bSB3cml0ZS11cCBpcyBub3Qg cmVhbGx5IGNsZWFyIGluIHRoYXQKPiByZWdhcmQuCgpJIHNlZSBmcm9tIGludGVybmFsIG5vdGVz IHRoYXQgdGhlIHJhdGlvbmFsZSBpcyB0aGF0IHRoZSBMRFIgaW4gcXVlc3Rpb24gb25seQpsb2Fk cyBkYXRhIHRoYXQgRUwwIGFscmVhZHkgaGFzIGluIGl0cyByZWdpc3RlcnMsIGFuZCBoZW5jZSBp dCBkb2Vzbid0IG1hdHRlcgppZiB0aGF0IGRhdGEgaXMgbGVha2VkIHRvIEVMMC4gVGhhdCdzIHJl YXNvbmFibGUsIGJ1dCB3ZSBkaWRuJ3Qgbm90ZSB0aGF0CmFueXdoZXJlIChpLmUuIG5laXRoZXIg aW4gdGhlIGNvbW1pdCBtZXNzYWdlIG5vciBpbiBhbnkgY29tbWVudHMpLgoKVG8gYXZvaWQgY29u ZnVzaW9uLCB0aGUgTERSIGluIHF1ZXN0aW9uICppcyogYSBwcml2aWxlZ2VkIGxvYWQgKHdoZXJl YXMgYW4gTERUUgphdCBFTDEgd291bGQgYmUgYW4gdW5wcml2aWxlZ2VkIGxvYWQpOyBmb3IgbWVt b3J5IGFjY2Vzc2VzIHRoZSBhcmNoaXRlY3R1cmUKdXNlcyB0aGUgdGVybXMgcHJpdmlsZWdlZCBh bmQgdW5wcml2aWxlZ2VkIHRvIGRpc3Rpbmd1aXNoIHRoZSB3YXkgdGhvc2UgYXJlCmhhbmRsZWQg YnkgdGhlIE1NVS4KCkkgYWdyZWUgdGhhdCBnaXZlbiB0aGUgcmF0aW9uYWxlIGFib3ZlIHRoaXMg cGF0Y2ggaXNuJ3Qgc3RyaWN0bHkgbmVjZXNzYXJ5LCBidXQKSSB3b3VsZCBwcmVmZXIgcmVzdWx0 IG9mIHRoZXNlIHR3byBwYXRjaGVzIGFzIGl0J3MgbGVzcyBsaWtlbHkgdGhhdCB3ZSdsbCBhZGQK bG9hZHMgb2Ygc2Vuc2l0aXZlIGluZm9ybWF0aW9uIGluIGZ1dHVyZSBhcyB0aGlzIGNvZGUgaXMg Y2hhbmdlZC4KCj4gSXQncyB0aGUgc2FtZSBhcyB0aGUgS1BUSSBjYXNlLiBBZnRlciBzd2l0Y2hp bmcgdGhlIHBhZ2UgdGFibGVzLCB0aGVyZQo+IGFyZSB1bnByaXZpbGVnZWQgbG9hZHMgZnJvbSB0 aGUgRUwwIHN0YWNrLgoKSSdtIG5vdCBzdXJlIHdoYXQgeW91IG1lYW4gaGVyZTsgbWF5YmUgSSdt IG1pc3Npbmcgc29tZXRoaW5nPwoKQUZBSUNUIHdlIGRvbid0IGRvIGFueSBsb2FkcyB3aXRoaW4g dGhlIGtlcm5lbCBhZnRlciBzd2l0Y2hpbmcgdGhlIHRyYW5zbGF0aW9uCnRhYmxlcy4gSW4gdHJh bXBfZXhpdCB3ZSBmb2xsb3cgdHJhbXBfdW5tYXBfa2VybmVsIHdpdGg6CgoJTVJTOyBFUkVUOyBT QgoKLi4uIGFuZCBpbiBfX3NkZWlfYXNtX2V4aXRfdHJhbXBvbGluZSB3ZSBmb2xsb3cgdHJhbXBf dW5tYXBfa2VybmVsIHdpdGgKCglDTVA7IEIuTkU7IHtIVkMsU01DfTsgQiAuCgouLi4gc28gdGhl cmUgYXJlIG5vIGV4cGxpY2l0IGxvYWRzIGF0IEVMMSBiZWZvcmUgdGhlIEVSRVQgdG8gRUwwLiBJ biB0aGUgU0RFSQpjYXNlIGFueSBsb2FkcyBhdCBhIGhpZ2hlciBFTCBkb24ndCBtYXR0ZXIgYmVj YXVzZSB0aGV5J3JlIGluIGEgZGlmZmVyZW50CnRyYW5zbGF0aW9uIHJlZ2ltZS4KClRoYW5rcywK TWFyay4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmxp bnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0CmxpbnV4LWFybS1rZXJuZWxAbGlzdHMuaW5mcmFk ZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4 LWFybS1rZXJuZWwK