linux-kernel - Re: [PATCH 6/6] arm64: trap userspace "dc cvau" cache operation on errata-affected core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5764326E.1080702@arm.com>
Date:	Fri, 17 Jun 2016 18:25:02 +0100
From:	Suzuki K Poulose <Suzuki.Poulose@....com>
To:	Andre Przywara <andre.przywara@....com>,
	Will Deacon <will.deacon@....com>,
	Catalin Marinas <catalin.marinas@....com>
Cc:	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6/6] arm64: trap userspace "dc cvau" cache operation on
 errata-affected core

On 17/06/16 18:20, Andre Przywara wrote:
> Hi Suzuki,
>
> thanks for having a look!
>
> On 14/06/16 17:16, Suzuki K Poulose wrote:
>> On 09/05/16 17:49, Andre Przywara wrote:
>>> The ARM errata 819472, 826319, 827319 and 824069 for affected
>>> Cortex-A53 cores demand to promote "dc cvau" instructions to
>>> "dc civac". Since we allow userspace to also emit those instructions,
>>> we should make sure that "dc cvau" gets promoted there too.
>>> So lets grasp the nettle here and actually trap every userland cache
>>> maintenance instruction once we detect at least one affected core in
>>> the system.
            __user_cache_maint("dc civac", address, ret);
>>> +            break;
>>> +        case 10:        /* DC CVAC, gets promoted */
>>> +            __user_cache_maint("dc civac", address, ret);
>>> +            break;
>>> +        case 14:        /* DC CIVAC */
>>> +            __user_cache_maint("dc civac", address, ret);
>>> +            break;
>>> +        case 5:            /* IC IVAU */
>>> +            __user_cache_maint("ic ivau", address, ret);
>>> +            break;
>>> +        default:
>>> +            force_signal_inject(SIGILL, ILL_ILLOPC, regs, 0);
>>> +            return;
>>> +        }
>>> +    } else {
>>> +        force_signal_inject(SIGILL, ILL_ILLOPC, regs, 0);
>>> +        return;
>>
>> Correct me if I am wrong, I think we should handle DC ZVA and emulate
>> the same ?
>> Thats the only EL0 accessible instruction we don't handle above.
>
> Mmmh, but why should we care?
> 1) DC ZVA is not trapped by setting SCTLR.UCI - instead it has its own
> bit (SCTLR.DZE).

You are right. I was thinking that UCI traps all DC operations. It only
traps  DC CVAU, DC CIVAC, DC CVAC, and IC IVAU.






Cheers
Suzuki