linux-kernel - Re: [RFC PATCH 2/2] arm64: kpti: Update arm64_use_ng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 26 Jan 2021 14:14:30 +0000
From:   Will Deacon <will@...nel.org>
To:     Jia He <justin.he@....com>
Cc:     Catalin Marinas <catalin.marinas@....com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Anshuman Khandual <anshuman.khandual@....com>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        Mark Rutland <mark.rutland@....com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Richard Henderson <richard.henderson@...aro.org>,
        Dave Martin <Dave.Martin@....com>,
        Steven Price <steven.price@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Mike Rapoport <rppt@...nel.org>,
        Ard Biesheuvel <ardb@...nel.org>,
        Gavin Shan <gshan@...hat.com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        Mark Brown <broonie@...nel.org>, Marc Zyngier <maz@...nel.org>,
        Cristian Marussi <cristian.marussi@....com>
Subject: Re: [RFC PATCH 2/2] arm64: kpti: Update arm64_use_ng_mappings before
 pagetable mapping

On Wed, Jan 13, 2021 at 09:40:47AM +0800, Jia He wrote:
> There is a 10s stall in idmap_kpti_install_ng_mappings when kernel boots
> on a Ampere EMAG server.
> 
> Commit f992b4dfd58b ("arm64: kpti: Add ->enable callback to remap
> swapper using nG mappings") updates the nG bit runtime if kpti is required.
> But things get worse if rodata=full in map_mem(). NO_BLOCK_MAPPINGS |
> NO_CONT_MAPPINGS is required when creating pagetable mapping. Hence all
> ptes are fully mapped in this case. On a Ampere EMAG server with 256G
> memory(pagesize=4k), it causes the 10s stall.
> 
> After previous commit moving init_cpu_features(), we can use
> cpu_have_const_cap earlier than before. Hence we can avoid this stall
> by updating arm64_use_ng_mappings.
> 
> Signed-off-by: Jia He <justin.he@....com>
> ---
>  arch/arm64/kernel/setup.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
> index e078ab068f3b..51098ceb7159 100644
> --- a/arch/arm64/kernel/setup.c
> +++ b/arch/arm64/kernel/setup.c
> @@ -306,6 +306,10 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p)
>  	/* Init the cpu feature codes for boot cpu */
>  	cpuinfo_store_boot_cpu();
>  
> +	/* ARM64_UNMAP_KERNEL_AT_EL0 cap can be updated in cpuinfo_store_boot_cpu() */
> +	if (!arm64_use_ng_mappings)
> +		arm64_use_ng_mappings = cpus_have_const_cap(ARM64_UNMAP_KERNEL_AT_EL0);

Are you sure it's safe to run the cpu feature initialisation code this
early? For example, we haven't even parsed the command-line yet, so I think
a fair amount of stuff will break.

Of course, you could also just pass "mitigations=off" if you want your
performance back.

Will