From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BC29BC433FE for ; Fri, 4 Nov 2022 08:10:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Pp3gmwuDCPCW0UuDLClyUKgeIIb5+r6hYJcum4u3TNU=; b=fFkVxXtWRWBk78 YXy8+JNceXxn5SkUza6UZJnTqPpvGKkuMepOEYGRpS2JCVTF7DRpK5UAXNFILB6UJxCh5sPNFZK/k MFAWCUqmvbMbv2HqmaU4XnwV7DHTs2T6IXXdSuD5OsSHLnXDY1UKU5Bz0JfEkrc95Nxr29tEK2yIu e3e0+/drW0J0mgxSwqVx9hoUKZSKdxc4vg+FolVVEKPBBugd3ElfDWq863XXDbBLiU4PXdavFjo1P KVQFVPwC2mpjrnW7IIQvB2zWrwya0LQycWYCpfeznmKA2eQ+luqBXSR3Z50TQtEikX4S/wfhVHz2E 5DJIoGSdUB22ScPdGA5g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oqrlV-002tWo-0v; Fri, 04 Nov 2022 08:09:25 +0000 Received: from ams.source.kernel.org ([2604:1380:4601:e00::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oqrlR-002tTr-8H for linux-arm-kernel@lists.infradead.org; Fri, 04 Nov 2022 08:09:23 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0548BB82BE5; Fri, 4 Nov 2022 08:09:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 639F5C433C1; Fri, 4 Nov 2022 08:09:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1667549355; bh=nz35tr+hBsbPN5fBvXlpKtAAHzHkRag6EGe1QLpmQp0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=I5wdORS31VqYzOQsOQSfOkydc78TFXctGPFb8etaKnRfNkTNvbXx8L7ModesGjizA megKYxIClIQtHB8qWxmjV1aCXcIlKeg/Ml9T3or7wdk9yO7mS+ccqjcAAXH7O46Jdu t9+DpKbODZRn1Z5zons1jch1Dd0ZHNbpMkKsHlDANixWL8LXEZDafH0CyW9kZH0NRq Awr88EA2j71GcHVw+sxnh7E43/Sm9JAjMkyDAlTv8aIQfjrMNNKExAchPy+B48/fG2 JplBmKjw2SXg92oY9OnQSkZjYHrMVruZUpZnapj/Bgp8VbvXT9yAZfq4BtrQLhjrTm 1Mqw6z5el+vCw== Date: Fri, 4 Nov 2022 01:09:13 -0700 From: Eric Biggers To: Ard Biesheuvel Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Catalin Marinas , Will Deacon , Mark Rutland , Marc Zyngier , "Jason A . Donenfeld" , Kees Cook , Suzuki K Poulose , Adam Langley Subject: Re: [RFC PATCH] arm64: Enable data independent timing (DIT) in the kernel Message-ID: References: <20221027112741.1678057-1-ardb@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20221027112741.1678057-1-ardb@kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221104_010921_638368_CE37A569 X-CRM114-Status: GOOD ( 22.80 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Ard, On Thu, Oct 27, 2022 at 01:27:41PM +0200, Ard Biesheuvel wrote: > Given that running privileged code with DIT disabled on a CPU that > implements support for it may result in a side channel that exposes > privileged data to unprivileged user space processes, let's enable DIT > while running in the kernel if supported by all CPUs. This patch looks good to me, though I'm not an expert in low-level arm64 stuff. It's a bit unfortunate that we have to manually create the .inst to enable DIT instead of just using the assembler. But it looks like there's a reason for it (it's done for PAN et al. too), and based on the manual it looks correct. Two nits below: > diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h > index 7d301700d1a9..18e065f5130c 100644 > --- a/arch/arm64/include/asm/sysreg.h > +++ b/arch/arm64/include/asm/sysreg.h > @@ -94,15 +94,18 @@ > #define PSTATE_PAN pstate_field(0, 4) > #define PSTATE_UAO pstate_field(0, 3) > #define PSTATE_SSBS pstate_field(3, 1) > +#define PSTATE_DIT pstate_field(3, 2) > #define PSTATE_TCO pstate_field(3, 4) > > #define SET_PSTATE_PAN(x) __emit_inst(0xd500401f | PSTATE_PAN | ((!!x) << PSTATE_Imm_shift)) > #define SET_PSTATE_UAO(x) __emit_inst(0xd500401f | PSTATE_UAO | ((!!x) << PSTATE_Imm_shift)) > #define SET_PSTATE_SSBS(x) __emit_inst(0xd500401f | PSTATE_SSBS | ((!!x) << PSTATE_Imm_shift)) > +#define SET_PSTATE_DIT(x) __emit_inst(0xd500401f | PSTATE_DIT | ((!!x) << PSTATE_Imm_shift)) > #define SET_PSTATE_TCO(x) __emit_inst(0xd500401f | PSTATE_TCO | ((!!x) << PSTATE_Imm_shift)) > > #define set_pstate_pan(x) asm volatile(SET_PSTATE_PAN(x)) > #define set_pstate_uao(x) asm volatile(SET_PSTATE_UAO(x)) > +#define set_pstate_dit(x) asm volatile(SET_PSTATE_DIT(x)) > #define set_pstate_ssbs(x) asm volatile(SET_PSTATE_SSBS(x)) To keep the order consistent, set_pstate_dit() should be defined after set_pstate_ssbs(), not before. > /* Internal helper functions to match cpu capability type */ > static bool > cpucap_late_cpu_optional(const struct arm64_cpu_capabilities *cap) > @@ -2640,6 +2645,17 @@ static const struct arm64_cpu_capabilities arm64_features[] = { > .matches = has_cpuid_feature, > .cpu_enable = cpu_trap_el0_impdef, > }, > + { > + .desc = "Data independent timing control (DIT)", > + .capability = ARM64_HAS_DIT, > + .type = ARM64_CPUCAP_SYSTEM_FEATURE, > + .matches = has_cpuid_feature, > + .sys_reg = SYS_ID_AA64PFR0_EL1, > + .field_pos = ID_AA64PFR0_EL1_DIT_SHIFT, > + .field_width = 4, > + .min_field_value = 1, > + .cpu_enable = cpu_enable_dit, > + }, The other entries in this array are explicit about '.sign = FTR_UNSIGNED' (even though FTR_UNSIGNED is defined to false, so it's the default value). - Eric _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel