From: Alex Shi <alex.shi@linaro.org>
To: "Marc Zyngier" <marc.zyngier@arm.com>,
"Will Deacon" <will.deacon@arm.com>,
"Ard Biesheuvel" <ard.biesheuvel@linaro.org>,
"Catalin Marinas" <catalin.marinas@arm.com>,
stable@vger.kernel.org, "Paolo Bonzini" <pbonzini@redhat.com>,
"Radim Krčmář" <rkrcmar@redhat.com>,
"Christoffer Dall" <christoffer.dall@linaro.org>,
"Russell King" <linux@armlinux.org.uk>,
kvm@vger.kernel.org (open list:KERNEL VIRTUAL MACHINE (KVM)),
linux-arm-kernel@lists.infradead.org (moderated list:KERNEL
VIRTUAL MACHINE (KVM) FOR ARM),
kvmarm@lists.cs.columbia.edu (open list:KERNEL VIRTUAL MACHINE
(KVM) FOR ARM), linux-kernel@vger.kernel.org (open list)
Subject: [PATCH 48/52] arm: KVM: Invalidate BTB on guest exit for Cortex-A12/A17
Date: Mon, 26 Feb 2018 16:20:22 +0800 [thread overview]
Message-ID: <1519633227-29832-49-git-send-email-alex.shi@linaro.org> (raw)
In-Reply-To: <1519633227-29832-1-git-send-email-alex.shi@linaro.org>
From: Marc Zyngier <marc.zyngier@arm.com>
** Not yet queued for inclusion in mainline **
In order to avoid aliasing attacks against the branch predictor,
let's invalidate the BTB on guest exit. This is made complicated
by the fact that we cannot take a branch before invalidating the
BTB.
We only apply this to A12 and A17, which are the only two ARM
cores on which this useful.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Alex Shi <alex.shi@linaro.org>
Conflicts:
no hvc stub in hyp_hvc in arch/arm/kvm/hyp/hyp-entry.S
---
arch/arm/include/asm/kvm_asm.h | 2 --
arch/arm/include/asm/kvm_mmu.h | 18 ++++++++++-
arch/arm/kvm/hyp/hyp-entry.S | 71 ++++++++++++++++++++++++++++++++++++++++--
3 files changed, 86 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/kvm_asm.h b/arch/arm/include/asm/kvm_asm.h
index 8ef0538..24f3ec7 100644
--- a/arch/arm/include/asm/kvm_asm.h
+++ b/arch/arm/include/asm/kvm_asm.h
@@ -61,8 +61,6 @@ struct kvm_vcpu;
extern char __kvm_hyp_init[];
extern char __kvm_hyp_init_end[];
-extern char __kvm_hyp_vector[];
-
extern void __kvm_flush_vm_context(void);
extern void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
extern void __kvm_tlb_flush_vmid(struct kvm *kvm);
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index d10e362..2887129 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -37,6 +37,7 @@
#include <linux/highmem.h>
#include <asm/cacheflush.h>
+#include <asm/cputype.h>
#include <asm/pgalloc.h>
#include <asm/stage2_pgtable.h>
@@ -225,7 +226,22 @@ static inline unsigned int kvm_get_vmid_bits(void)
static inline void *kvm_get_hyp_vector(void)
{
- return kvm_ksym_ref(__kvm_hyp_vector);
+ switch(read_cpuid_part()) {
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ case ARM_CPU_PART_CORTEX_A12:
+ case ARM_CPU_PART_CORTEX_A17:
+ {
+ extern char __kvm_hyp_vector_bp_inv[];
+ return kvm_ksym_ref(__kvm_hyp_vector_bp_inv);
+ }
+
+#endif
+ default:
+ {
+ extern char __kvm_hyp_vector[];
+ return kvm_ksym_ref(__kvm_hyp_vector);
+ }
+ }
}
static inline int kvm_map_vectors(void)
diff --git a/arch/arm/kvm/hyp/hyp-entry.S b/arch/arm/kvm/hyp/hyp-entry.S
index 96beb53..b6b8cb1 100644
--- a/arch/arm/kvm/hyp/hyp-entry.S
+++ b/arch/arm/kvm/hyp/hyp-entry.S
@@ -71,6 +71,66 @@ __kvm_hyp_vector:
W(b) hyp_irq
W(b) hyp_fiq
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ .align 5
+__kvm_hyp_vector_bp_inv:
+ .global __kvm_hyp_vector_bp_inv
+
+ /*
+ * We encode the exception entry in the bottom 3 bits of
+ * SP, and we have to guarantee to be 8 bytes aligned.
+ */
+ W(add) sp, sp, #1 /* Reset 7 */
+ W(add) sp, sp, #1 /* Undef 6 */
+ W(add) sp, sp, #1 /* Syscall 5 */
+ W(add) sp, sp, #1 /* Prefetch abort 4 */
+ W(add) sp, sp, #1 /* Data abort 3 */
+ W(add) sp, sp, #1 /* HVC 2 */
+ W(add) sp, sp, #1 /* IRQ 1 */
+ W(nop) /* FIQ 0 */
+
+ mcr p15, 0, r0, c7, c5, 6 /* BPIALL */
+ isb
+
+#ifdef CONFIG_THUMB2_KERNEL
+ /*
+ * Yet another silly hack: Use VPIDR as a temp register.
+ * Thumb2 is really a pain, as SP cannot be used with most
+ * of the bitwise instructions. The vect_br macro ensures
+ * things gets cleaned-up.
+ */
+ mcr p15, 4, r0, c0, c0, 0 /* VPIDR */
+ mov r0, sp
+ and r0, r0, #7
+ sub sp, sp, r0
+ push {r1, r2}
+ mov r1, r0
+ mrc p15, 4, r0, c0, c0, 0 /* VPIDR */
+ mrc p15, 0, r2, c0, c0, 0 /* MIDR */
+ mcr p15, 4, r2, c0, c0, 0 /* VPIDR */
+#endif
+
+.macro vect_br val, targ
+ARM( eor sp, sp, #\val )
+ARM( tst sp, #7 )
+ARM( eorne sp, sp, #\val )
+
+THUMB( cmp r1, #\val )
+THUMB( popeq {r1, r2} )
+
+ beq \targ
+.endm
+
+ vect_br 0, hyp_fiq
+ vect_br 1, hyp_irq
+ vect_br 2, hyp_hvc
+ vect_br 3, hyp_dabt
+ vect_br 4, hyp_pabt
+ vect_br 5, hyp_svc
+ vect_br 6, hyp_undef
+ vect_br 7, hyp_reset
+#endif
+
.macro invalid_vector label, cause
.align
\label: mov r0, #\cause
@@ -131,7 +191,14 @@ hyp_hvc:
mrceq p15, 4, r0, c12, c0, 0 @ get HVBAR
beq 1f
- push {lr}
+ /*
+ * Pushing r2 here is just a way of keeping the stack aligned to
+ * 8 bytes on any path that can trigger a HYP exception. Here,
+ * we may well be about to jump into the guest, and the guest
+ * exit would otherwise be badly decoded by our fancy
+ * "decode-exception-without-a-branch" code...
+ */
+ push {r2, lr}
mov lr, r0
mov r0, r1
@@ -141,7 +208,7 @@ hyp_hvc:
THUMB( orr lr, #1)
blx lr @ Call the HYP function
- pop {lr}
+ pop {r2, lr}
1: eret
guest_trap:
--
2.7.4
next prev parent reply other threads:[~2018-02-26 8:27 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1519633227-29832-1-git-send-email-alex.shi@linaro.org>
2018-02-26 8:19 ` [PATCH 01/52] mm: Introduce lm_alias Alex Shi
2018-02-26 8:19 ` [PATCH 02/52] arm64: alternatives: apply boot time fixups via the linear mapping Alex Shi
2018-02-26 8:19 ` [PATCH 03/52] arm64: barrier: Add CSDB macros to control data-value prediction Alex Shi
2018-02-26 8:19 ` [PATCH 04/52] arm64: Implement array_index_mask_nospec() Alex Shi
2018-02-26 8:19 ` [PATCH 05/52] arm64: move TASK_* definitions to <asm/processor.h> Alex Shi
2018-02-26 8:19 ` [PATCH 06/52] arm64: Factor out PAN enabling/disabling into separate uaccess_* macros Alex Shi
2018-02-26 8:19 ` [PATCH 07/52] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Alex Shi
2018-02-26 8:19 ` [PATCH 08/52] arm64: uaccess: consistently check object sizes Alex Shi
2018-02-26 8:19 ` [PATCH 09/52] arm64: Make USER_DS an inclusive limit Alex Shi
2018-02-26 8:19 ` [PATCH 10/52] arm64: Use pointer masking to limit uaccess speculation Alex Shi
2018-02-26 8:19 ` [PATCH 11/52] arm64: syscallno is secretly an int, make it official Alex Shi
2018-02-26 8:19 ` [PATCH 12/52] arm64: entry: Ensure branch through syscall table is bounded under speculation Alex Shi
2018-02-26 8:19 ` [PATCH 13/52] arm64: uaccess: Prevent speculative use of the current addr_limit Alex Shi
2018-02-26 8:19 ` [PATCH 14/52] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user Alex Shi
2018-02-26 8:19 ` [PATCH 15/52] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Alex Shi
2018-02-26 8:19 ` [PATCH 16/52] arm64: futex: Mask __user pointers prior to dereference Alex Shi
2018-02-26 8:19 ` [PATCH 17/52] drivers/firmware: Expose psci_get_version through psci_ops structure Alex Shi
2018-02-26 8:19 ` [PATCH 18/52] arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early Alex Shi
2018-02-26 8:19 ` [PATCH 19/52] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core Alex Shi
2018-02-26 8:19 ` [PATCH 20/52] arm64: Run enable method for errata work arounds on late CPUs Alex Shi
2018-02-26 8:19 ` [PATCH 21/52] arm64: cpufeature: Pass capability structure to ->enable callback Alex Shi
2018-02-26 8:19 ` [PATCH 22/52] arm64: Move post_ttbr_update_workaround to C code Alex Shi
2018-02-26 8:19 ` [PATCH 23/52] arm64: Add skeleton to harden the branch predictor against aliasing attacks Alex Shi
2018-02-26 8:19 ` [PATCH 24/52] arm64: Move BP hardening to check_and_switch_context Alex Shi
2018-02-26 8:19 ` [PATCH 25/52] arm64: KVM: Use per-CPU vector when BP hardening is enabled Alex Shi
2018-02-26 8:20 ` [PATCH 26/52] arm64: entry: Apply BP hardening for high-priority synchronous exceptions Alex Shi
2018-02-26 8:20 ` [PATCH 27/52] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Alex Shi
2018-02-26 8:20 ` [PATCH 28/52] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 Alex Shi
2018-02-26 8:20 ` [PATCH 29/52] arm64: Implement branch predictor hardening for affected Cortex-A CPUs Alex Shi
2018-02-26 8:20 ` [PATCH 30/52] arm64: KVM: Increment PC after handling an SMC trap Alex Shi
2018-02-26 8:20 ` [PATCH 31/52] arm/arm64: KVM: Consolidate the PSCI include files Alex Shi
2018-02-26 8:20 ` [PATCH 32/52] arm/arm64: KVM: Add PSCI_VERSION helper Alex Shi
2018-02-26 8:20 ` [PATCH 33/52] arm/arm64: KVM: Add smccc accessors to PSCI code Alex Shi
2018-02-26 8:20 ` [PATCH 34/52] arm/arm64: KVM: Implement PSCI 1.0 support Alex Shi
2018-02-26 8:20 ` [PATCH 35/52] arm/arm64: KVM: Advertise SMCCC v1.1 Alex Shi
2018-02-26 8:20 ` [PATCH 36/52] arm64: KVM: Make PSCI_VERSION a fast path Alex Shi
2018-02-26 8:20 ` [PATCH 37/52] arm/arm64: KVM: Turn kvm_psci_version into a static inline Alex Shi
2018-02-26 8:20 ` [PATCH 38/52] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Alex Shi
2018-02-26 8:20 ` [PATCH 39/52] arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling Alex Shi
2018-02-26 8:20 ` [PATCH 40/52] firmware/psci: Expose PSCI conduit Alex Shi
2018-02-26 8:20 ` [PATCH 41/52] firmware/psci: Expose SMCCC version through psci_ops Alex Shi
2018-02-26 8:20 ` [PATCH 42/52] arm/arm64: smccc: Make function identifiers an unsigned quantity Alex Shi
2018-02-26 8:20 ` [PATCH 43/52] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Alex Shi
2018-02-26 8:20 ` [PATCH 44/52] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Alex Shi
2018-02-26 8:20 ` [PATCH 45/52] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround Alex Shi
2018-02-26 8:20 ` [PATCH 46/52] arm: Add BTB invalidation on switch_mm for Cortex-A9, A12 and A17 Alex Shi
2018-02-26 10:05 ` Greg KH
2018-02-26 10:40 ` Alex Shi
2018-02-26 10:45 ` Will Deacon
2018-02-28 4:10 ` Alex Shi
2018-02-26 8:20 ` [PATCH 47/52] arm: Invalidate BTB on prefetch abort outside of user mapping on Cortex A8, A9, " Alex Shi
2018-02-26 8:20 ` Alex Shi [this message]
2018-02-26 8:20 ` [PATCH 49/52] arm: Add icache invalidation on switch_mm for Cortex-A15 Alex Shi
2018-02-26 8:20 ` [PATCH 50/52] arm: Invalidate icache on prefetch abort outside of user mapping on Cortex-A15 Alex Shi
2018-02-26 8:20 ` [PATCH 51/52] arm: KVM: Invalidate icache on guest exit for Cortex-A15 Alex Shi
2018-02-26 8:20 ` [PATCH 52/52] arm64: Add README describing the branch Alex Shi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1519633227-29832-49-git-send-email-alex.shi@linaro.org \
--to=alex.shi@linaro.org \
--cc=ard.biesheuvel@linaro.org \
--cc=catalin.marinas@arm.com \
--cc=christoffer.dall@linaro.org \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=marc.zyngier@arm.com \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
--cc=stable@vger.kernel.org \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).