On Tue, Jul 16, 2019 at 11:31:27AM +0800, Guo Ren wrote: > I saw arm64 to prevent speculation by temporarily setting TTBR0.el1 to > a zero page table. Is that used to prevent speculative execution user > space code or just prevent ld/st in copy_use_* ? Only to prevent explicit ld/st from user. On ARMv8.1+, we don't normally use the TTBR0 trick but rather disable user space access using the PAN (privileged access never) feature. However, I don't think PAN disables speculative accesses, only explicit loads/stores. Also, with ARMv8.2 Linux uses the LDTR/STTR instructions in copy_*_user() which don't need to disable PAN explicitly. -- Catalin
