Hi all, On Wed, Jan 10, 2018 at 07:47:33PM +0000, Will Deacon wrote: > On Tue, Jan 09, 2018 at 10:21:29AM +0000, Will Deacon wrote: > > On Mon, Jan 08, 2018 at 10:49:01AM -0800, Linus Torvalds wrote: > > > In this particular case, we should be very much aware of future CPU's > > > being more _constrained_, because CPU vendors had better start taking > > > this thing into account. > > > > > > So the masking approach is FUNDAMENTALLY SAFER than the "let's try to > > > limit control speculation". > > > > > > If somebody can point to a CPU that actually speculates across an > > > address masking operation, I will be very surprised. And unless you > > > can point to that, then stop trying to dismiss the masking approach. > > > > Whilst I agree with your comments about future CPUs, this stuff is further > > out of academia than you might think. We're definitely erring on the > > belt-and-braces side of things at the moment, so let me go check what's > > *actually* been built and I suspect we'll be able to make the masking work. > > > > Stay tuned... > > I can happily confirm that there aren't any (ARM architecture) CPUs where > the masking approach is not sufficient, so there's no need to worry about > value speculation breaking this.
Unfortunately, thanks to some internal miscommunication, my previous assertion that no implementations of the Armv8 architecture utilise data value prediction has turned out to be incorrect. I received confirmation last week that this has been deployed in production silicon and has shipped widely in various products, so the horse really has bolted and this isn't confined to academia as was suggested previously. We're still investigating whether this affects the mask-based mitigation used by eBPF, but we'll definitely be adding a CSDB-based sequence to our nospec helpers to ensure that array_index_nospec is robust for arm64: the CSDB instruction follows the generation of the mask (see patches at [1]). In the meantime, I wanted to correct my previous claim in case anybody else is using that as a basis to push ahead with the bare masking approach elsewhere for arm64. Sorry for the confusion, Will [1] http://lists.infradead.org/pipermail/linux-arm-kernel/2018-February/557825.html
