Commit 558c303c authored by James Morse's avatar James Morse
Browse files

arm64: Mitigate spectre style branch history side channels 



Speculation attacks against some high-performance processors can
make use of branch history to influence future speculation.
When taking an exception from user-space, a sequence of branches
or a firmware call overwrites or invalidates the branch history.

The sequence of branches is added to the vectors, and should appear
before the first indirect branch. For systems using KPTI the sequence
is added to the kpti trampoline where it has a free register as the exit
from the trampoline is via a 'ret'. For systems not using KPTI, the same
register tricks are used to free up a register in the vectors.

For the firmware call, arch-workaround-3 clobbers 4 registers, so
there is no choice but to save them to the EL1 stack. This only happens
for entry from EL0, so if we take an exception due to the stack access,
it will not become re-entrant.

For KVM, the existing branch-predictor-hardening vectors are used.
When a spectre version of these vectors is in use, the firmware call
is sufficient to mitigate against Spectre-BHB. For the non-spectre
versions, the sequence of branches is added to the indirect vector.

Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: default avatarJames Morse <james.morse@arm.com>
parent dee435be

arch/arm64/Kconfig

+9 −0
Original line number Diff line number Diff line
@@ -1382,6 +1382,15 @@ config UNMAP_KERNEL_AT_EL0 


	  If unsure, say Y.



config MITIGATE_SPECTRE_BRANCH_HISTORY

	bool "Mitigate Spectre style attacks against branch history" if EXPERT

	default y

	help

	  Speculation attacks against some high-performance processors can

	  make use of branch history to influence future speculation.

	  When taking an exception from user-space, a sequence of branches

	  or a firmware call overwrites the branch history.



config RODATA_FULL_DEFAULT_ENABLED

	bool "Apply r/o permissions of VM areas also to their linear aliases"

	default y

arch/arm64/include/asm/assembler.h

+13 −1
Original line number Diff line number Diff line
@@ -852,7 +852,9 @@ alternative_endif 


	.macro __mitigate_spectre_bhb_loop      tmp

#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY

	mov	\tmp, #32

alternative_cb  spectre_bhb_patch_loop_iter

	mov	\tmp, #32		// Patched to correct the immediate

alternative_cb_end

.Lspectre_bhb_loop\@:

	b	. + 4

	subs	\tmp, \tmp, #1
@@ -861,6 +863,16 @@ alternative_endif 
#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */

	.endm



	.macro mitigate_spectre_bhb_loop	tmp

#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY

alternative_cb	spectre_bhb_patch_loop_mitigation_enable

	b	.L_spectre_bhb_loop_done\@	// Patched to NOP

alternative_cb_end

	__mitigate_spectre_bhb_loop	\tmp

.L_spectre_bhb_loop_done\@:

#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */

	.endm



	/* Save/restores x0-x3 to the stack */

	.macro __mitigate_spectre_bhb_fw

#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY

arch/arm64/include/asm/cpufeature.h

+16 −0
Original line number Diff line number Diff line
@@ -637,6 +637,22 @@ static inline bool cpu_supports_mixed_endian_el0(void) 
	return id_aa64mmfr0_mixed_endian_el0(read_cpuid(ID_AA64MMFR0_EL1));

}





static inline bool supports_csv2p3(int scope)

{

	u64 pfr0;

	u8 csv2_val;



	if (scope == SCOPE_LOCAL_CPU)

		pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1);

	else

		pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);



	csv2_val = cpuid_feature_extract_unsigned_field(pfr0,

							ID_AA64PFR0_CSV2_SHIFT);

	return csv2_val == 3;

}



const struct cpumask *system_32bit_el0_cpumask(void);

DECLARE_STATIC_KEY_FALSE(arm64_mismatched_32bit_el0);

arch/arm64/include/asm/cputype.h

+8 −0
Original line number Diff line number Diff line
@@ -73,10 +73,14 @@ 
#define ARM_CPU_PART_CORTEX_A76		0xD0B

#define ARM_CPU_PART_NEOVERSE_N1	0xD0C

#define ARM_CPU_PART_CORTEX_A77		0xD0D

#define ARM_CPU_PART_NEOVERSE_V1	0xD40

#define ARM_CPU_PART_CORTEX_A78		0xD41

#define ARM_CPU_PART_CORTEX_X1		0xD44

#define ARM_CPU_PART_CORTEX_A510	0xD46

#define ARM_CPU_PART_CORTEX_A710	0xD47

#define ARM_CPU_PART_CORTEX_X2		0xD48

#define ARM_CPU_PART_NEOVERSE_N2	0xD49

#define ARM_CPU_PART_CORTEX_A78C	0xD4B



#define APM_CPU_PART_POTENZA		0x000
@@ -117,10 +121,14 @@ 
#define MIDR_CORTEX_A76	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76)

#define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1)

#define MIDR_CORTEX_A77	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77)

#define MIDR_NEOVERSE_V1	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1)

#define MIDR_CORTEX_A78	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78)

#define MIDR_CORTEX_X1	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)

#define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510)

#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)

#define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)

#define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)

#define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)

#define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)

#define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)

#define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)

arch/arm64/include/asm/spectre.h

+3 −1
Original line number Diff line number Diff line
@@ -94,6 +94,8 @@ void spectre_v4_enable_task_mitigation(struct task_struct *tsk); 
enum mitigation_state arm64_get_meltdown_state(void);



enum mitigation_state arm64_get_spectre_bhb_state(void);



bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);

u8 spectre_bhb_loop_affected(int scope);

void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);

#endif	/* __ASSEMBLY__ */

#endif	/* __ASM_SPECTRE_H */