arm64: kaslr: Set TCR_EL1.NFD1 when CONFIG_RANDOMIZE_BASE=y

TCR_EL1.NFD1 was allocated by SVE and ensures that fault-surpressing SVE
memory accesses (e.g. speculative accesses from a first-fault gather load)
which translate via TTBR1_EL1 result in a translation fault if they
miss in the TLB when executed from EL0. This mitigates some timing attacks
against KASLR, where the kernel address space could otherwise be probed
efficiently using the FFR in conjunction with suppressed faults on SVE
loads.

Cc: Dave Martin <Dave.Martin@arm.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>

diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index cdfe3e657a9e9ae70bb6c91267517678cb19dfcb..fd208eac9f2a92bc8a09bb66c2f2ae19226aedf4 100644 (file)
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -291,6 +291,7 @@
 #define TCR_TBI0               (UL(1) << 37)
 #define TCR_HA                 (UL(1) << 39)
 #define TCR_HD                 (UL(1) << 40)
+#define TCR_NFD1               (UL(1) << 54)
 
 /*
  * TTBR.

diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index c0af4761729986da832a8e844b256e64da8cb4c1..8f074d64b7603407778d5a6162ad0e8994a86664 100644 (file)
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -36,6 +36,12 @@
 #define TCR_TG_FLAGS   TCR_TG0_4K | TCR_TG1_4K
 #endif
 
+#ifdef CONFIG_RANDOMIZE_BASE
+#define TCR_KASLR_FLAGS        TCR_NFD1
+#else
+#define TCR_KASLR_FLAGS        0
+#endif
+
 #define TCR_SMP_FLAGS  TCR_SHARED
 
 /* PTWs cacheable, inner/outer WBWA */
@@ -432,7 +438,8 @@ ENTRY(__cpu_setup)
         * both user and kernel.
         */
        ldr     x10, =TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
-                       TCR_TG_FLAGS | TCR_ASID16 | TCR_TBI0 | TCR_A1
+                       TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
+                       TCR_TBI0 | TCR_A1
        tcr_set_idmap_t0sz      x10, x9
 
        /*