On Thu, 17 Oct 2019 at 05:42, Richard Henderson
<[email protected]> wrote:
>
> The first patch has been seen before.
>
> https://patchwork.ozlabs.org/patch/1115039/
>
> It had a bug and I didn't fix it right away and then forgot.
> Fixed now; I had mixed up the operand ordering for aarch32.
Since Alex had a nit on patch 1 I'm going to assume you'll
respin this series once we're reopen for 5.0 development.
> The comment in patch 2 about ARMv8.4-DIT is perhaps a stretch,
> but re-reading the pmull instruction description in the current
> ARM ARM brought it to mind.
>
> Since TCG is officially not in the security domain, it's
> probably not a bug to just claim to support DIT without
> actually doing anything to ensure the algorithms used are in
> fact timing independent of the data.
>
> On the other hand, I expect the bit distribution of stuff
> going through these sort of hashing algorithms to approach
> 50% 1's and 0's, so I also don't think we gain anything on
> average to terminate the loop early.
>
> Thoughts on DIT specifically?
I think we have two plausible choices for DIT:
(1) don't implement it, since we can't make the timing
guarantees it suggests
(2) implement it but not actually change our behaviour:
this is technically a lie to the guest, but it means
that guest OS handling of the PSTATE.DIT bit etc can
be tested
At the moment we by default do (1). I think we should
probably postpone doing (2) until somebody actually
asks us for it.
thanks
-- PMM
