* [PATCH ARM64 v4.4 V3 01/44] arm64: barrier: Add CSDB macros to control data-value prediction
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:39 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 02/44] arm64: Implement array_index_mask_nospec() Viresh Kumar
` (43 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 669474e772b952b14f4de4845a1558fd4c0414a4 upstream.
For CPUs capable of data value prediction, CSDB waits for any outstanding
predictions to architecturally resolve before allowing speculative execution
to continue. Provide macros to expose it to the arch code.
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/assembler.h | 7 +++++++
arch/arm64/include/asm/barrier.h | 2 ++
2 files changed, 9 insertions(+)
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index f68abb17aa4b..683c2875278f 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -95,6 +95,13 @@
dmb \opt
.endm
+/*
+ * Value prediction barrier
+ */
+ .macro csdb
+ hint #20
+ .endm
+
#define USER(l, x...) \
9999: x; \
.section __ex_table,"a"; \
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index f2d2c0bbe21b..574486634c62 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -28,6 +28,8 @@
#define dmb(opt) asm volatile("dmb " #opt : : : "memory")
#define dsb(opt) asm volatile("dsb " #opt : : : "memory")
+#define csdb() asm volatile("hint #20" : : : "memory")
+
#define mb() dsb(sy)
#define rmb() dsb(ld)
#define wmb() dsb(st)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 01/44] arm64: barrier: Add CSDB macros to control data-value prediction
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 01/44] arm64: barrier: Add CSDB macros to control data-value prediction Viresh Kumar
@ 2019-08-30 9:39 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:39 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:46PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit 669474e772b952b14f4de4845a1558fd4c0414a4 upstream.
>
> For CPUs capable of data value prediction, CSDB waits for any outstanding
> predictions to architecturally resolve before allowing speculative execution
> to continue. Provide macros to expose it to the arch code.
>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/assembler.h | 7 +++++++
> arch/arm64/include/asm/barrier.h | 2 ++
> 2 files changed, 9 insertions(+)
>
> diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
> index f68abb17aa4b..683c2875278f 100644
> --- a/arch/arm64/include/asm/assembler.h
> +++ b/arch/arm64/include/asm/assembler.h
> @@ -95,6 +95,13 @@
> dmb \opt
> .endm
>
> +/*
> + * Value prediction barrier
> + */
> + .macro csdb
> + hint #20
> + .endm
> +
> #define USER(l, x...) \
> 9999: x; \
> .section __ex_table,"a"; \
> diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
> index f2d2c0bbe21b..574486634c62 100644
> --- a/arch/arm64/include/asm/barrier.h
> +++ b/arch/arm64/include/asm/barrier.h
> @@ -28,6 +28,8 @@
> #define dmb(opt) asm volatile("dmb " #opt : : : "memory")
> #define dsb(opt) asm volatile("dsb " #opt : : : "memory")
>
> +#define csdb() asm volatile("hint #20" : : : "memory")
> +
> #define mb() dsb(sy)
> #define rmb() dsb(ld)
> #define wmb() dsb(st)
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 02/44] arm64: Implement array_index_mask_nospec()
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 01/44] arm64: barrier: Add CSDB macros to control data-value prediction Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 03/44] arm64: move TASK_* definitions to <asm/processor.h> Viresh Kumar
` (42 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Robin Murphy <robin.murphy@arm.com>
commit 022620eed3d0bc4bf2027326f599f5ad71c2ea3f upstream.
Provide an optimised, assembly implementation of array_index_mask_nospec()
for arm64 so that the compiler is not in a position to transform the code
in ways which affect its ability to inhibit speculation (e.g. by introducing
conditional branches).
This is similar to the sequence used by x86, modulo architectural differences
in the carry/borrow flags.
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/barrier.h | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index 574486634c62..7c25e3e11b6d 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -37,6 +37,27 @@
#define dma_rmb() dmb(oshld)
#define dma_wmb() dmb(oshst)
+/*
+ * Generate a mask for array_index__nospec() that is ~0UL when 0 <= idx < sz
+ * and 0 otherwise.
+ */
+#define array_index_mask_nospec array_index_mask_nospec
+static inline unsigned long array_index_mask_nospec(unsigned long idx,
+ unsigned long sz)
+{
+ unsigned long mask;
+
+ asm volatile(
+ " cmp %1, %2\n"
+ " sbc %0, xzr, xzr\n"
+ : "=r" (mask)
+ : "r" (idx), "Ir" (sz)
+ : "cc");
+
+ csdb();
+ return mask;
+}
+
#define smp_mb() dmb(ish)
#define smp_rmb() dmb(ishld)
#define smp_wmb() dmb(ishst)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 02/44] arm64: Implement array_index_mask_nospec()
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 02/44] arm64: Implement array_index_mask_nospec() Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:47PM +0530, Viresh Kumar wrote:
> From: Robin Murphy <robin.murphy@arm.com>
>
> commit 022620eed3d0bc4bf2027326f599f5ad71c2ea3f upstream.
>
> Provide an optimised, assembly implementation of array_index_mask_nospec()
> for arm64 so that the compiler is not in a position to transform the code
> in ways which affect its ability to inhibit speculation (e.g. by introducing
> conditional branches).
>
> This is similar to the sequence used by x86, modulo architectural differences
> in the carry/borrow flags.
>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/barrier.h | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
> index 574486634c62..7c25e3e11b6d 100644
> --- a/arch/arm64/include/asm/barrier.h
> +++ b/arch/arm64/include/asm/barrier.h
> @@ -37,6 +37,27 @@
> #define dma_rmb() dmb(oshld)
> #define dma_wmb() dmb(oshst)
>
> +/*
> + * Generate a mask for array_index__nospec() that is ~0UL when 0 <= idx < sz
> + * and 0 otherwise.
> + */
> +#define array_index_mask_nospec array_index_mask_nospec
> +static inline unsigned long array_index_mask_nospec(unsigned long idx,
> + unsigned long sz)
> +{
> + unsigned long mask;
> +
> + asm volatile(
> + " cmp %1, %2\n"
> + " sbc %0, xzr, xzr\n"
> + : "=r" (mask)
> + : "r" (idx), "Ir" (sz)
> + : "cc");
> +
> + csdb();
> + return mask;
> +}
> +
> #define smp_mb() dmb(ish)
> #define smp_rmb() dmb(ishld)
> #define smp_wmb() dmb(ishst)
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 03/44] arm64: move TASK_* definitions to <asm/processor.h>
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 01/44] arm64: barrier: Add CSDB macros to control data-value prediction Viresh Kumar
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 02/44] arm64: Implement array_index_mask_nospec() Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 04/44] arm64: Make USER_DS an inclusive limit Viresh Kumar
` (41 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Yury Norov <ynorov@caviumnetworks.com>
commit eef94a3d09aab437c8c254de942d8b1aa76455e2 upstream.
ILP32 series [1] introduces the dependency on <asm/is_compat.h> for
TASK_SIZE macro. Which in turn requires <asm/thread_info.h>, and
<asm/thread_info.h> include <asm/memory.h>, giving a circular dependency,
because TASK_SIZE is currently located in <asm/memory.h>.
In other architectures, TASK_SIZE is defined in <asm/processor.h>, and
moving TASK_SIZE there fixes the problem.
Discussion: https://patchwork.kernel.org/patch/9929107/
[1] https://github.com/norov/linux/tree/ilp32-next
CC: Will Deacon <will.deacon@arm.com>
CC: Laura Abbott <labbott@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/memory.h | 15 ---------------
arch/arm64/include/asm/processor.h | 21 +++++++++++++++++++++
arch/arm64/kernel/entry.S | 2 +-
3 files changed, 22 insertions(+), 16 deletions(-)
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index b42b930cc19a..959a1e9188fe 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -43,8 +43,6 @@
* (VA_BITS - 1))
* VA_BITS - the maximum number of bits for virtual addresses.
* VA_START - the first kernel virtual address.
- * TASK_SIZE - the maximum size of a user space task.
- * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
* The module space lives between the addresses given by TASK_SIZE
* and PAGE_OFFSET - it must be within 128MB of the kernel text.
*/
@@ -58,19 +56,6 @@
#define PCI_IO_END (MODULES_VADDR - SZ_2M)
#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE)
#define FIXADDR_TOP (PCI_IO_START - SZ_2M)
-#define TASK_SIZE_64 (UL(1) << VA_BITS)
-
-#ifdef CONFIG_COMPAT
-#define TASK_SIZE_32 UL(0x100000000)
-#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
- TASK_SIZE_32 : TASK_SIZE_64)
-#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
- TASK_SIZE_32 : TASK_SIZE_64)
-#else
-#define TASK_SIZE TASK_SIZE_64
-#endif /* CONFIG_COMPAT */
-
-#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 4))
/*
* Physical vs virtual RAM address space conversion. These are
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index d08559528927..75d9ef6c457c 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -19,6 +19,10 @@
#ifndef __ASM_PROCESSOR_H
#define __ASM_PROCESSOR_H
+#define TASK_SIZE_64 (UL(1) << VA_BITS)
+
+#ifndef __ASSEMBLY__
+
/*
* Default implementation of macro that returns current
* instruction pointer ("program counter").
@@ -36,6 +40,22 @@
#include <asm/types.h>
#ifdef __KERNEL__
+/*
+ * TASK_SIZE - the maximum size of a user space task.
+ * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
+ */
+#ifdef CONFIG_COMPAT
+#define TASK_SIZE_32 UL(0x100000000)
+#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
+ TASK_SIZE_32 : TASK_SIZE_64)
+#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
+ TASK_SIZE_32 : TASK_SIZE_64)
+#else
+#define TASK_SIZE TASK_SIZE_64
+#endif /* CONFIG_COMPAT */
+
+#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 4))
+
#define STACK_TOP_MAX TASK_SIZE_64
#ifdef CONFIG_COMPAT
#define AARCH32_VECTORS_BASE 0xffff0000
@@ -188,4 +208,5 @@ static inline void spin_lock_prefetch(const void *x)
int cpu_enable_pan(void *__unused);
+#endif /* __ASSEMBLY__ */
#endif /* __ASM_PROCESSOR_H */
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 586326981769..c849be9231bb 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -27,7 +27,7 @@
#include <asm/cpufeature.h>
#include <asm/errno.h>
#include <asm/esr.h>
-#include <asm/memory.h>
+#include <asm/processor.h>
#include <asm/thread_info.h>
#include <asm/asm-uaccess.h>
#include <asm/unistd.h>
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 03/44] arm64: move TASK_* definitions to <asm/processor.h>
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 03/44] arm64: move TASK_* definitions to <asm/processor.h> Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:48PM +0530, Viresh Kumar wrote:
> From: Yury Norov <ynorov@caviumnetworks.com>
>
> commit eef94a3d09aab437c8c254de942d8b1aa76455e2 upstream.
>
> ILP32 series [1] introduces the dependency on <asm/is_compat.h> for
> TASK_SIZE macro. Which in turn requires <asm/thread_info.h>, and
> <asm/thread_info.h> include <asm/memory.h>, giving a circular dependency,
> because TASK_SIZE is currently located in <asm/memory.h>.
>
> In other architectures, TASK_SIZE is defined in <asm/processor.h>, and
> moving TASK_SIZE there fixes the problem.
>
> Discussion: https://patchwork.kernel.org/patch/9929107/
>
> [1] https://github.com/norov/linux/tree/ilp32-next
>
> CC: Will Deacon <will.deacon@arm.com>
> CC: Laura Abbott <labbott@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: James Morse <james.morse@arm.com>
> Suggested-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/memory.h | 15 ---------------
> arch/arm64/include/asm/processor.h | 21 +++++++++++++++++++++
> arch/arm64/kernel/entry.S | 2 +-
> 3 files changed, 22 insertions(+), 16 deletions(-)
>
> diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
> index b42b930cc19a..959a1e9188fe 100644
> --- a/arch/arm64/include/asm/memory.h
> +++ b/arch/arm64/include/asm/memory.h
> @@ -43,8 +43,6 @@
> * (VA_BITS - 1))
> * VA_BITS - the maximum number of bits for virtual addresses.
> * VA_START - the first kernel virtual address.
> - * TASK_SIZE - the maximum size of a user space task.
> - * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
> * The module space lives between the addresses given by TASK_SIZE
> * and PAGE_OFFSET - it must be within 128MB of the kernel text.
> */
> @@ -58,19 +56,6 @@
> #define PCI_IO_END (MODULES_VADDR - SZ_2M)
> #define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE)
> #define FIXADDR_TOP (PCI_IO_START - SZ_2M)
> -#define TASK_SIZE_64 (UL(1) << VA_BITS)
> -
> -#ifdef CONFIG_COMPAT
> -#define TASK_SIZE_32 UL(0x100000000)
> -#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
> - TASK_SIZE_32 : TASK_SIZE_64)
> -#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
> - TASK_SIZE_32 : TASK_SIZE_64)
> -#else
> -#define TASK_SIZE TASK_SIZE_64
> -#endif /* CONFIG_COMPAT */
> -
> -#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 4))
>
> /*
> * Physical vs virtual RAM address space conversion. These are
> diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
> index d08559528927..75d9ef6c457c 100644
> --- a/arch/arm64/include/asm/processor.h
> +++ b/arch/arm64/include/asm/processor.h
> @@ -19,6 +19,10 @@
> #ifndef __ASM_PROCESSOR_H
> #define __ASM_PROCESSOR_H
>
> +#define TASK_SIZE_64 (UL(1) << VA_BITS)
> +
> +#ifndef __ASSEMBLY__
> +
> /*
> * Default implementation of macro that returns current
> * instruction pointer ("program counter").
> @@ -36,6 +40,22 @@
> #include <asm/types.h>
>
> #ifdef __KERNEL__
> +/*
> + * TASK_SIZE - the maximum size of a user space task.
> + * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
> + */
> +#ifdef CONFIG_COMPAT
> +#define TASK_SIZE_32 UL(0x100000000)
> +#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
> + TASK_SIZE_32 : TASK_SIZE_64)
> +#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
> + TASK_SIZE_32 : TASK_SIZE_64)
> +#else
> +#define TASK_SIZE TASK_SIZE_64
> +#endif /* CONFIG_COMPAT */
> +
> +#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 4))
> +
> #define STACK_TOP_MAX TASK_SIZE_64
> #ifdef CONFIG_COMPAT
> #define AARCH32_VECTORS_BASE 0xffff0000
> @@ -188,4 +208,5 @@ static inline void spin_lock_prefetch(const void *x)
>
> int cpu_enable_pan(void *__unused);
>
> +#endif /* __ASSEMBLY__ */
> #endif /* __ASM_PROCESSOR_H */
> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
> index 586326981769..c849be9231bb 100644
> --- a/arch/arm64/kernel/entry.S
> +++ b/arch/arm64/kernel/entry.S
> @@ -27,7 +27,7 @@
> #include <asm/cpufeature.h>
> #include <asm/errno.h>
> #include <asm/esr.h>
> -#include <asm/memory.h>
> +#include <asm/processor.h>
> #include <asm/thread_info.h>
> #include <asm/asm-uaccess.h>
> #include <asm/unistd.h>
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 04/44] arm64: Make USER_DS an inclusive limit
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (2 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 03/44] arm64: move TASK_* definitions to <asm/processor.h> Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 05/44] arm64: Use pointer masking to limit uaccess speculation Viresh Kumar
` (40 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Robin Murphy <robin.murphy@arm.com>
commit 51369e398d0d33e8f524314e672b07e8cf870e79 upstream.
Currently, USER_DS represents an exclusive limit while KERNEL_DS is
inclusive. In order to do some clever trickery for speculation-safe
masking, we need them both to behave equivalently - there aren't enough
bits to make KERNEL_DS exclusive, so we have precisely one option. This
also happens to correct a longstanding false negative for a range
ending on the very top byte of kernel memory.
Mark Rutland points out that we've actually got the semantics of
addresses vs. segments muddled up in most of the places we need to
amend, so shuffle the {USER,KERNEL}_DS definitions around such that we
can correct those properly instead of just pasting "-1"s everywhere.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ 4.4: Dropped changes from fault.c and fixed minor rebase conflict ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/processor.h | 3 ++
arch/arm64/include/asm/uaccess.h | 45 +++++++++++++++++-------------
arch/arm64/kernel/entry.S | 4 +--
3 files changed, 31 insertions(+), 21 deletions(-)
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 75d9ef6c457c..ff1449c25bf4 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -21,6 +21,9 @@
#define TASK_SIZE_64 (UL(1) << VA_BITS)
+#define KERNEL_DS UL(-1)
+#define USER_DS (TASK_SIZE_64 - 1)
+
#ifndef __ASSEMBLY__
/*
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 829fa6d3e561..c625cc5531fc 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -56,10 +56,7 @@ struct exception_table_entry
extern int fixup_exception(struct pt_regs *regs);
-#define KERNEL_DS (-1UL)
#define get_ds() (KERNEL_DS)
-
-#define USER_DS TASK_SIZE_64
#define get_fs() (current_thread_info()->addr_limit)
static inline void set_fs(mm_segment_t fs)
@@ -87,22 +84,32 @@ static inline void set_fs(mm_segment_t fs)
* Returns 1 if the range is valid, 0 otherwise.
*
* This is equivalent to the following test:
- * (u65)addr + (u65)size <= current->addr_limit
- *
- * This needs 65-bit arithmetic.
+ * (u65)addr + (u65)size <= (u65)current->addr_limit + 1
*/
-#define __range_ok(addr, size) \
-({ \
- unsigned long __addr = (unsigned long __force)(addr); \
- unsigned long flag, roksum; \
- __chk_user_ptr(addr); \
- asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \
- : "=&r" (flag), "=&r" (roksum) \
- : "1" (__addr), "Ir" (size), \
- "r" (current_thread_info()->addr_limit) \
- : "cc"); \
- flag; \
-})
+static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
+{
+ unsigned long limit = current_thread_info()->addr_limit;
+
+ __chk_user_ptr(addr);
+ asm volatile(
+ // A + B <= C + 1 for all A,B,C, in four easy steps:
+ // 1: X = A + B; X' = X % 2^64
+ " adds %0, %0, %2\n"
+ // 2: Set C = 0 if X > 2^64, to guarantee X' > C in step 4
+ " csel %1, xzr, %1, hi\n"
+ // 3: Set X' = ~0 if X >= 2^64. For X == 2^64, this decrements X'
+ // to compensate for the carry flag being set in step 4. For
+ // X > 2^64, X' merely has to remain nonzero, which it does.
+ " csinv %0, %0, xzr, cc\n"
+ // 4: For X < 2^64, this gives us X' - C - 1 <= 0, where the -1
+ // comes from the carry in being clear. Otherwise, we are
+ // testing X' - C == 0, subject to the previous adjustments.
+ " sbcs xzr, %0, %1\n"
+ " cset %0, ls\n"
+ : "+r" (addr), "+r" (limit) : "Ir" (size) : "cc");
+
+ return addr;
+}
/*
* When dealing with data aborts, watchpoints, or instruction traps we may end
@@ -111,7 +118,7 @@ static inline void set_fs(mm_segment_t fs)
*/
#define untagged_addr(addr) sign_extend64(addr, 55)
-#define access_ok(type, addr, size) __range_ok(addr, size)
+#define access_ok(type, addr, size) __range_ok((unsigned long)(addr), size)
#define user_addr_max get_fs
/*
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index c849be9231bb..4c5013b09dcb 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -96,10 +96,10 @@
.else
add x21, sp, #S_FRAME_SIZE
get_thread_info tsk
- /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */
+ /* Save the task's original addr_limit and set USER_DS */
ldr x20, [tsk, #TI_ADDR_LIMIT]
str x20, [sp, #S_ORIG_ADDR_LIMIT]
- mov x20, #TASK_SIZE_64
+ mov x20, #USER_DS
str x20, [tsk, #TI_ADDR_LIMIT]
.endif /* \el == 0 */
mrs x22, elr_el1
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 04/44] arm64: Make USER_DS an inclusive limit
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 04/44] arm64: Make USER_DS an inclusive limit Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:49PM +0530, Viresh Kumar wrote:
> From: Robin Murphy <robin.murphy@arm.com>
>
> commit 51369e398d0d33e8f524314e672b07e8cf870e79 upstream.
>
> Currently, USER_DS represents an exclusive limit while KERNEL_DS is
> inclusive. In order to do some clever trickery for speculation-safe
> masking, we need them both to behave equivalently - there aren't enough
> bits to make KERNEL_DS exclusive, so we have precisely one option. This
> also happens to correct a longstanding false negative for a range
> ending on the very top byte of kernel memory.
>
> Mark Rutland points out that we've actually got the semantics of
> addresses vs. segments muddled up in most of the places we need to
> amend, so shuffle the {USER,KERNEL}_DS definitions around such that we
> can correct those properly instead of just pasting "-1"s everywhere.
>
> Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> [ 4.4: Dropped changes from fault.c and fixed minor rebase conflict ]
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/processor.h | 3 ++
> arch/arm64/include/asm/uaccess.h | 45 +++++++++++++++++-------------
> arch/arm64/kernel/entry.S | 4 +--
> 3 files changed, 31 insertions(+), 21 deletions(-)
>
> diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
> index 75d9ef6c457c..ff1449c25bf4 100644
> --- a/arch/arm64/include/asm/processor.h
> +++ b/arch/arm64/include/asm/processor.h
> @@ -21,6 +21,9 @@
>
> #define TASK_SIZE_64 (UL(1) << VA_BITS)
>
> +#define KERNEL_DS UL(-1)
> +#define USER_DS (TASK_SIZE_64 - 1)
> +
> #ifndef __ASSEMBLY__
>
> /*
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index 829fa6d3e561..c625cc5531fc 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -56,10 +56,7 @@ struct exception_table_entry
>
> extern int fixup_exception(struct pt_regs *regs);
>
> -#define KERNEL_DS (-1UL)
> #define get_ds() (KERNEL_DS)
> -
> -#define USER_DS TASK_SIZE_64
> #define get_fs() (current_thread_info()->addr_limit)
>
> static inline void set_fs(mm_segment_t fs)
> @@ -87,22 +84,32 @@ static inline void set_fs(mm_segment_t fs)
> * Returns 1 if the range is valid, 0 otherwise.
> *
> * This is equivalent to the following test:
> - * (u65)addr + (u65)size <= current->addr_limit
> - *
> - * This needs 65-bit arithmetic.
> + * (u65)addr + (u65)size <= (u65)current->addr_limit + 1
> */
> -#define __range_ok(addr, size) \
> -({ \
> - unsigned long __addr = (unsigned long __force)(addr); \
> - unsigned long flag, roksum; \
> - __chk_user_ptr(addr); \
> - asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \
> - : "=&r" (flag), "=&r" (roksum) \
> - : "1" (__addr), "Ir" (size), \
> - "r" (current_thread_info()->addr_limit) \
> - : "cc"); \
> - flag; \
> -})
> +static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
> +{
> + unsigned long limit = current_thread_info()->addr_limit;
> +
> + __chk_user_ptr(addr);
> + asm volatile(
> + // A + B <= C + 1 for all A,B,C, in four easy steps:
> + // 1: X = A + B; X' = X % 2^64
> + " adds %0, %0, %2\n"
> + // 2: Set C = 0 if X > 2^64, to guarantee X' > C in step 4
> + " csel %1, xzr, %1, hi\n"
> + // 3: Set X' = ~0 if X >= 2^64. For X == 2^64, this decrements X'
> + // to compensate for the carry flag being set in step 4. For
> + // X > 2^64, X' merely has to remain nonzero, which it does.
> + " csinv %0, %0, xzr, cc\n"
> + // 4: For X < 2^64, this gives us X' - C - 1 <= 0, where the -1
> + // comes from the carry in being clear. Otherwise, we are
> + // testing X' - C == 0, subject to the previous adjustments.
> + " sbcs xzr, %0, %1\n"
> + " cset %0, ls\n"
> + : "+r" (addr), "+r" (limit) : "Ir" (size) : "cc");
> +
> + return addr;
> +}
>
> /*
> * When dealing with data aborts, watchpoints, or instruction traps we may end
> @@ -111,7 +118,7 @@ static inline void set_fs(mm_segment_t fs)
> */
> #define untagged_addr(addr) sign_extend64(addr, 55)
>
> -#define access_ok(type, addr, size) __range_ok(addr, size)
> +#define access_ok(type, addr, size) __range_ok((unsigned long)(addr), size)
> #define user_addr_max get_fs
>
> /*
> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
> index c849be9231bb..4c5013b09dcb 100644
> --- a/arch/arm64/kernel/entry.S
> +++ b/arch/arm64/kernel/entry.S
> @@ -96,10 +96,10 @@
> .else
> add x21, sp, #S_FRAME_SIZE
> get_thread_info tsk
> - /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */
> + /* Save the task's original addr_limit and set USER_DS */
> ldr x20, [tsk, #TI_ADDR_LIMIT]
> str x20, [sp, #S_ORIG_ADDR_LIMIT]
> - mov x20, #TASK_SIZE_64
> + mov x20, #USER_DS
> str x20, [tsk, #TI_ADDR_LIMIT]
> .endif /* \el == 0 */
> mrs x22, elr_el1
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 05/44] arm64: Use pointer masking to limit uaccess speculation
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (3 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 04/44] arm64: Make USER_DS an inclusive limit Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 06/44] arm64: entry: Ensure branch through syscall table is bounded under speculation Viresh Kumar
` (39 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Robin Murphy <robin.murphy@arm.com>
commit 4d8efc2d5ee4c9ccfeb29ee8afd47a8660d0c0ce upstream.
Similarly to x86, mitigate speculation past an access_ok() check by
masking the pointer against the address limit before use.
Even if we don't expect speculative writes per se, it is plausible that
a CPU may still speculate at least as far as fetching a cache line for
writing, hence we also harden put_user() and clear_user() for peace of
mind.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/uaccess.h | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index c625cc5531fc..75363d723262 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -121,6 +121,26 @@ static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
#define access_ok(type, addr, size) __range_ok((unsigned long)(addr), size)
#define user_addr_max get_fs
+/*
+ * Sanitise a uaccess pointer such that it becomes NULL if above the
+ * current addr_limit.
+ */
+#define uaccess_mask_ptr(ptr) (__typeof__(ptr))__uaccess_mask_ptr(ptr)
+static inline void __user *__uaccess_mask_ptr(const void __user *ptr)
+{
+ void __user *safe_ptr;
+
+ asm volatile(
+ " bics xzr, %1, %2\n"
+ " csel %0, %1, xzr, eq\n"
+ : "=&r" (safe_ptr)
+ : "r" (ptr), "r" (current_thread_info()->addr_limit)
+ : "cc");
+
+ csdb();
+ return safe_ptr;
+}
+
/*
* The "__xxx" versions of the user access functions do not verify the address
* space - it must have been done previously with a separate "access_ok()"
@@ -193,7 +213,7 @@ do { \
__typeof__(*(ptr)) __user *__p = (ptr); \
might_fault(); \
access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \
- __get_user((x), __p) : \
+ __p = uaccess_mask_ptr(__p), __get_user((x), __p) : \
((x) = 0, -EFAULT); \
})
@@ -259,7 +279,7 @@ do { \
__typeof__(*(ptr)) __user *__p = (ptr); \
might_fault(); \
access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ? \
- __put_user((x), __p) : \
+ __p = uaccess_mask_ptr(__p), __put_user((x), __p) : \
-EFAULT; \
})
@@ -297,7 +317,7 @@ static inline unsigned long __must_check copy_in_user(void __user *to, const voi
static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
{
if (access_ok(VERIFY_WRITE, to, n))
- n = __clear_user(to, n);
+ n = __clear_user(__uaccess_mask_ptr(to), n);
return n;
}
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 05/44] arm64: Use pointer masking to limit uaccess speculation
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 05/44] arm64: Use pointer masking to limit uaccess speculation Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:50PM +0530, Viresh Kumar wrote:
> From: Robin Murphy <robin.murphy@arm.com>
>
> commit 4d8efc2d5ee4c9ccfeb29ee8afd47a8660d0c0ce upstream.
>
> Similarly to x86, mitigate speculation past an access_ok() check by
> masking the pointer against the address limit before use.
>
> Even if we don't expect speculative writes per se, it is plausible that
> a CPU may still speculate at least as far as fetching a cache line for
> writing, hence we also harden put_user() and clear_user() for peace of
> mind.
>
> Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/uaccess.h | 26 +++++++++++++++++++++++---
> 1 file changed, 23 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index c625cc5531fc..75363d723262 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -121,6 +121,26 @@ static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
> #define access_ok(type, addr, size) __range_ok((unsigned long)(addr), size)
> #define user_addr_max get_fs
>
> +/*
> + * Sanitise a uaccess pointer such that it becomes NULL if above the
> + * current addr_limit.
> + */
> +#define uaccess_mask_ptr(ptr) (__typeof__(ptr))__uaccess_mask_ptr(ptr)
> +static inline void __user *__uaccess_mask_ptr(const void __user *ptr)
> +{
> + void __user *safe_ptr;
> +
> + asm volatile(
> + " bics xzr, %1, %2\n"
> + " csel %0, %1, xzr, eq\n"
> + : "=&r" (safe_ptr)
> + : "r" (ptr), "r" (current_thread_info()->addr_limit)
> + : "cc");
> +
> + csdb();
> + return safe_ptr;
> +}
> +
> /*
> * The "__xxx" versions of the user access functions do not verify the address
> * space - it must have been done previously with a separate "access_ok()"
> @@ -193,7 +213,7 @@ do { \
> __typeof__(*(ptr)) __user *__p = (ptr); \
> might_fault(); \
> access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \
> - __get_user((x), __p) : \
> + __p = uaccess_mask_ptr(__p), __get_user((x), __p) : \
> ((x) = 0, -EFAULT); \
> })
>
> @@ -259,7 +279,7 @@ do { \
> __typeof__(*(ptr)) __user *__p = (ptr); \
> might_fault(); \
> access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ? \
> - __put_user((x), __p) : \
> + __p = uaccess_mask_ptr(__p), __put_user((x), __p) : \
> -EFAULT; \
> })
>
> @@ -297,7 +317,7 @@ static inline unsigned long __must_check copy_in_user(void __user *to, const voi
> static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
> {
> if (access_ok(VERIFY_WRITE, to, n))
> - n = __clear_user(to, n);
> + n = __clear_user(__uaccess_mask_ptr(to), n);
> return n;
> }
>
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 06/44] arm64: entry: Ensure branch through syscall table is bounded under speculation
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (4 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 05/44] arm64: Use pointer masking to limit uaccess speculation Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 07/44] arm64: uaccess: Prevent speculative use of the current addr_limit Viresh Kumar
` (38 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 6314d90e64936c584f300a52ef173603fb2461b5 upstream.
In a similar manner to array_index_mask_nospec, this patch introduces an
assembly macro (mask_nospec64) which can be used to bound a value under
speculation. This macro is then used to ensure that the indirect branch
through the syscall table is bounded under speculation, with out-of-range
addresses speculating as calls to sys_io_setup (0).
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: use existing scno & sc_nr definitions ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/assembler.h | 11 +++++++++++
arch/arm64/kernel/entry.S | 1 +
2 files changed, 12 insertions(+)
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 683c2875278f..2b30363a3a89 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -102,6 +102,17 @@
hint #20
.endm
+/*
+ * Sanitise a 64-bit bounded index wrt speculation, returning zero if out
+ * of bounds.
+ */
+ .macro mask_nospec64, idx, limit, tmp
+ sub \tmp, \idx, \limit
+ bic \tmp, \tmp, \idx
+ and \idx, \idx, \tmp, asr #63
+ csdb
+ .endm
+
#define USER(l, x...) \
9999: x; \
.section __ex_table,"a"; \
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 4c5013b09dcb..e6aec982dea9 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -697,6 +697,7 @@ el0_svc_naked: // compat entry point
b.ne __sys_trace
cmp scno, sc_nr // check upper syscall limit
b.hs ni_sys
+ mask_nospec64 scno, sc_nr, x19 // enforce bounds for syscall number
ldr x16, [stbl, scno, lsl #3] // address in the syscall table
blr x16 // call sys_* routine
b ret_fast_syscall
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 06/44] arm64: entry: Ensure branch through syscall table is bounded under speculation
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 06/44] arm64: entry: Ensure branch through syscall table is bounded under speculation Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:51PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit 6314d90e64936c584f300a52ef173603fb2461b5 upstream.
>
> In a similar manner to array_index_mask_nospec, this patch introduces an
> assembly macro (mask_nospec64) which can be used to bound a value under
> speculation. This macro is then used to ensure that the indirect branch
> through the syscall table is bounded under speculation, with out-of-range
> addresses speculating as calls to sys_io_setup (0).
>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> [ v4.4: use existing scno & sc_nr definitions ]
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/assembler.h | 11 +++++++++++
> arch/arm64/kernel/entry.S | 1 +
> 2 files changed, 12 insertions(+)
>
> diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
> index 683c2875278f..2b30363a3a89 100644
> --- a/arch/arm64/include/asm/assembler.h
> +++ b/arch/arm64/include/asm/assembler.h
> @@ -102,6 +102,17 @@
> hint #20
> .endm
>
> +/*
> + * Sanitise a 64-bit bounded index wrt speculation, returning zero if out
> + * of bounds.
> + */
> + .macro mask_nospec64, idx, limit, tmp
> + sub \tmp, \idx, \limit
> + bic \tmp, \tmp, \idx
> + and \idx, \idx, \tmp, asr #63
> + csdb
> + .endm
> +
> #define USER(l, x...) \
> 9999: x; \
> .section __ex_table,"a"; \
> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
> index 4c5013b09dcb..e6aec982dea9 100644
> --- a/arch/arm64/kernel/entry.S
> +++ b/arch/arm64/kernel/entry.S
> @@ -697,6 +697,7 @@ el0_svc_naked: // compat entry point
> b.ne __sys_trace
> cmp scno, sc_nr // check upper syscall limit
> b.hs ni_sys
> + mask_nospec64 scno, sc_nr, x19 // enforce bounds for syscall number
> ldr x16, [stbl, scno, lsl #3] // address in the syscall table
> blr x16 // call sys_* routine
> b ret_fast_syscall
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 07/44] arm64: uaccess: Prevent speculative use of the current addr_limit
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (5 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 06/44] arm64: entry: Ensure branch through syscall table is bounded under speculation Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:40 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 08/44] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user Viresh Kumar
` (37 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit c2f0ad4fc089cff81cef6a13d04b399980ecbfcc upstream.
A mispredicted conditional call to set_fs could result in the wrong
addr_limit being forwarded under speculation to a subsequent access_ok
check, potentially forming part of a spectre-v1 attack using uaccess
routines.
This patch prevents this forwarding from taking place, but putting heavy
barriers in set_fs after writing the addr_limit.
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/uaccess.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 75363d723262..fc11c50af558 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -62,6 +62,13 @@ extern int fixup_exception(struct pt_regs *regs);
static inline void set_fs(mm_segment_t fs)
{
current_thread_info()->addr_limit = fs;
+
+ /*
+ * Prevent a mispredicted conditional call to set_fs from forwarding
+ * the wrong address limit to access_ok under speculation.
+ */
+ dsb(nsh);
+ isb();
}
#define segment_eq(a, b) ((a) == (b))
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 07/44] arm64: uaccess: Prevent speculative use of the current addr_limit
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 07/44] arm64: uaccess: Prevent speculative use of the current addr_limit Viresh Kumar
@ 2019-08-30 9:40 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:40 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:52PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit c2f0ad4fc089cff81cef6a13d04b399980ecbfcc upstream.
>
> A mispredicted conditional call to set_fs could result in the wrong
> addr_limit being forwarded under speculation to a subsequent access_ok
> check, potentially forming part of a spectre-v1 attack using uaccess
> routines.
>
> This patch prevents this forwarding from taking place, but putting heavy
> barriers in set_fs after writing the addr_limit.
>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/uaccess.h | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index 75363d723262..fc11c50af558 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -62,6 +62,13 @@ extern int fixup_exception(struct pt_regs *regs);
> static inline void set_fs(mm_segment_t fs)
> {
> current_thread_info()->addr_limit = fs;
> +
> + /*
> + * Prevent a mispredicted conditional call to set_fs from forwarding
> + * the wrong address limit to access_ok under speculation.
> + */
> + dsb(nsh);
> + isb();
> }
>
> #define segment_eq(a, b) ((a) == (b))
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 08/44] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (6 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 07/44] arm64: uaccess: Prevent speculative use of the current addr_limit Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:41 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 09/44] mm/kasan: add API to check memory regions Viresh Kumar
` (36 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 84624087dd7e3b482b7b11c170ebc1f329b3a218 upstream.
access_ok isn't an expensive operation once the addr_limit for the current
thread has been loaded into the cache. Given that the initial access_ok
check preceding a sequence of __{get,put}_user operations will take
the brunt of the miss, we can make the __* variants identical to the
full-fat versions, which brings with it the benefits of address masking.
The likely cost in these sequences will be from toggling PAN/UAO, which
we can address later by implementing the *_unsafe versions.
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Fixed conflicts around {__get_user|__put_user}_unaligned macros ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/uaccess.h | 62 ++++++++++++++++++--------------
1 file changed, 36 insertions(+), 26 deletions(-)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index fc11c50af558..a34324436ce1 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -200,30 +200,35 @@ do { \
CONFIG_ARM64_PAN)); \
} while (0)
-#define __get_user(x, ptr) \
+#define __get_user_check(x, ptr, err) \
({ \
- int __gu_err = 0; \
- __get_user_err((x), (ptr), __gu_err); \
- __gu_err; \
+ __typeof__(*(ptr)) __user *__p = (ptr); \
+ might_fault(); \
+ if (access_ok(VERIFY_READ, __p, sizeof(*__p))) { \
+ __p = uaccess_mask_ptr(__p); \
+ __get_user_err((x), __p, (err)); \
+ } else { \
+ (x) = 0; (err) = -EFAULT; \
+ } \
})
#define __get_user_error(x, ptr, err) \
({ \
- __get_user_err((x), (ptr), (err)); \
+ __get_user_check((x), (ptr), (err)); \
(void)0; \
})
-#define __get_user_unaligned __get_user
-
-#define get_user(x, ptr) \
+#define __get_user(x, ptr) \
({ \
- __typeof__(*(ptr)) __user *__p = (ptr); \
- might_fault(); \
- access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \
- __p = uaccess_mask_ptr(__p), __get_user((x), __p) : \
- ((x) = 0, -EFAULT); \
+ int __gu_err = 0; \
+ __get_user_check((x), (ptr), __gu_err); \
+ __gu_err; \
})
+#define __get_user_unaligned __get_user
+
+#define get_user __get_user
+
#define __put_user_asm(instr, reg, x, addr, err) \
asm volatile( \
"1: " instr " " reg "1, [%2]\n" \
@@ -266,30 +271,35 @@ do { \
CONFIG_ARM64_PAN)); \
} while (0)
-#define __put_user(x, ptr) \
+#define __put_user_check(x, ptr, err) \
({ \
- int __pu_err = 0; \
- __put_user_err((x), (ptr), __pu_err); \
- __pu_err; \
+ __typeof__(*(ptr)) __user *__p = (ptr); \
+ might_fault(); \
+ if (access_ok(VERIFY_WRITE, __p, sizeof(*__p))) { \
+ __p = uaccess_mask_ptr(__p); \
+ __put_user_err((x), __p, (err)); \
+ } else { \
+ (err) = -EFAULT; \
+ } \
})
#define __put_user_error(x, ptr, err) \
({ \
- __put_user_err((x), (ptr), (err)); \
+ __put_user_check((x), (ptr), (err)); \
(void)0; \
})
-#define __put_user_unaligned __put_user
-
-#define put_user(x, ptr) \
+#define __put_user(x, ptr) \
({ \
- __typeof__(*(ptr)) __user *__p = (ptr); \
- might_fault(); \
- access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ? \
- __p = uaccess_mask_ptr(__p), __put_user((x), __p) : \
- -EFAULT; \
+ int __pu_err = 0; \
+ __put_user_check((x), (ptr), __pu_err); \
+ __pu_err; \
})
+#define __put_user_unaligned __put_user
+
+#define put_user __put_user
+
extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 08/44] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 08/44] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user Viresh Kumar
@ 2019-08-30 9:41 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:41 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:53PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit 84624087dd7e3b482b7b11c170ebc1f329b3a218 upstream.
>
> access_ok isn't an expensive operation once the addr_limit for the current
> thread has been loaded into the cache. Given that the initial access_ok
> check preceding a sequence of __{get,put}_user operations will take
> the brunt of the miss, we can make the __* variants identical to the
> full-fat versions, which brings with it the benefits of address masking.
>
> The likely cost in these sequences will be from toggling PAN/UAO, which
> we can address later by implementing the *_unsafe versions.
>
> Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> [ v4.4: Fixed conflicts around {__get_user|__put_user}_unaligned macros ]
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
> ---
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> arch/arm64/include/asm/uaccess.h | 62 ++++++++++++++++++--------------
> 1 file changed, 36 insertions(+), 26 deletions(-)
>
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index fc11c50af558..a34324436ce1 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -200,30 +200,35 @@ do { \
> CONFIG_ARM64_PAN)); \
> } while (0)
>
> -#define __get_user(x, ptr) \
> +#define __get_user_check(x, ptr, err) \
> ({ \
> - int __gu_err = 0; \
> - __get_user_err((x), (ptr), __gu_err); \
> - __gu_err; \
> + __typeof__(*(ptr)) __user *__p = (ptr); \
> + might_fault(); \
> + if (access_ok(VERIFY_READ, __p, sizeof(*__p))) { \
> + __p = uaccess_mask_ptr(__p); \
> + __get_user_err((x), __p, (err)); \
> + } else { \
> + (x) = 0; (err) = -EFAULT; \
> + } \
> })
>
> #define __get_user_error(x, ptr, err) \
> ({ \
> - __get_user_err((x), (ptr), (err)); \
> + __get_user_check((x), (ptr), (err)); \
> (void)0; \
> })
>
> -#define __get_user_unaligned __get_user
> -
> -#define get_user(x, ptr) \
> +#define __get_user(x, ptr) \
> ({ \
> - __typeof__(*(ptr)) __user *__p = (ptr); \
> - might_fault(); \
> - access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \
> - __p = uaccess_mask_ptr(__p), __get_user((x), __p) : \
> - ((x) = 0, -EFAULT); \
> + int __gu_err = 0; \
> + __get_user_check((x), (ptr), __gu_err); \
> + __gu_err; \
> })
>
> +#define __get_user_unaligned __get_user
> +
> +#define get_user __get_user
> +
> #define __put_user_asm(instr, reg, x, addr, err) \
> asm volatile( \
> "1: " instr " " reg "1, [%2]\n" \
> @@ -266,30 +271,35 @@ do { \
> CONFIG_ARM64_PAN)); \
> } while (0)
>
> -#define __put_user(x, ptr) \
> +#define __put_user_check(x, ptr, err) \
> ({ \
> - int __pu_err = 0; \
> - __put_user_err((x), (ptr), __pu_err); \
> - __pu_err; \
> + __typeof__(*(ptr)) __user *__p = (ptr); \
> + might_fault(); \
> + if (access_ok(VERIFY_WRITE, __p, sizeof(*__p))) { \
> + __p = uaccess_mask_ptr(__p); \
> + __put_user_err((x), __p, (err)); \
> + } else { \
> + (err) = -EFAULT; \
> + } \
> })
>
> #define __put_user_error(x, ptr, err) \
> ({ \
> - __put_user_err((x), (ptr), (err)); \
> + __put_user_check((x), (ptr), (err)); \
> (void)0; \
> })
>
> -#define __put_user_unaligned __put_user
> -
> -#define put_user(x, ptr) \
> +#define __put_user(x, ptr) \
> ({ \
> - __typeof__(*(ptr)) __user *__p = (ptr); \
> - might_fault(); \
> - access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ? \
> - __p = uaccess_mask_ptr(__p), __put_user((x), __p) : \
> - -EFAULT; \
> + int __pu_err = 0; \
> + __put_user_check((x), (ptr), __pu_err); \
> + __pu_err; \
> })
>
> +#define __put_user_unaligned __put_user
> +
> +#define put_user __put_user
> +
> extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
> extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
> extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 09/44] mm/kasan: add API to check memory regions
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (7 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 08/44] arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:41 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 10/44] arm64: kasan: instrument user memory access API Viresh Kumar
` (35 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit 64f8ebaf115bcddc4aaa902f981c57ba6506bc42 upstream.
Memory access coded in an assembly won't be seen by KASAN as a compiler
can instrument only C code. Add kasan_check_[read,write]() API which is
going to be used to check a certain memory range.
Link: http://lkml.kernel.org/r/1462538722-1574-3-git-send-email-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ v4.4: Fixed MAINTAINERS conflict and added whole kasan entry. Drop 4th
argument to check_memory_region(). ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
MAINTAINERS | 14 ++++++++++++++
include/linux/kasan-checks.h | 12 ++++++++++++
mm/kasan/kasan.c | 12 ++++++++++++
3 files changed, 38 insertions(+)
create mode 100644 include/linux/kasan-checks.h
diff --git a/MAINTAINERS b/MAINTAINERS
index f4d4a5544dc1..2a8826732967 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5982,6 +5982,20 @@ S: Maintained
F: Documentation/hwmon/k8temp
F: drivers/hwmon/k8temp.c
+KASAN
+M: Andrey Ryabinin <aryabinin@virtuozzo.com>
+R: Alexander Potapenko <glider@google.com>
+R: Dmitry Vyukov <dvyukov@google.com>
+L: kasan-dev@googlegroups.com
+S: Maintained
+F: arch/*/include/asm/kasan.h
+F: arch/*/mm/kasan_init*
+F: Documentation/kasan.txt
+F: include/linux/kasan*.h
+F: lib/test_kasan.c
+F: mm/kasan/
+F: scripts/Makefile.kasan
+
KCONFIG
M: "Yann E. MORIN" <yann.morin.1998@free.fr>
L: linux-kbuild@vger.kernel.org
diff --git a/include/linux/kasan-checks.h b/include/linux/kasan-checks.h
new file mode 100644
index 000000000000..b7f8aced7870
--- /dev/null
+++ b/include/linux/kasan-checks.h
@@ -0,0 +1,12 @@
+#ifndef _LINUX_KASAN_CHECKS_H
+#define _LINUX_KASAN_CHECKS_H
+
+#ifdef CONFIG_KASAN
+void kasan_check_read(const void *p, unsigned int size);
+void kasan_check_write(const void *p, unsigned int size);
+#else
+static inline void kasan_check_read(const void *p, unsigned int size) { }
+static inline void kasan_check_write(const void *p, unsigned int size) { }
+#endif
+
+#endif
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index b7397b459960..1cdcab0c976a 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -274,6 +274,18 @@ static __always_inline void check_memory_region(unsigned long addr,
void __asan_loadN(unsigned long addr, size_t size);
void __asan_storeN(unsigned long addr, size_t size);
+void kasan_check_read(const void *p, unsigned int size)
+{
+ check_memory_region((unsigned long)p, size, false);
+}
+EXPORT_SYMBOL(kasan_check_read);
+
+void kasan_check_write(const void *p, unsigned int size)
+{
+ check_memory_region((unsigned long)p, size, true);
+}
+EXPORT_SYMBOL(kasan_check_write);
+
#undef memset
void *memset(void *addr, int c, size_t len)
{
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 09/44] mm/kasan: add API to check memory regions
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 09/44] mm/kasan: add API to check memory regions Viresh Kumar
@ 2019-08-30 9:41 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:41 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:54PM +0530, Viresh Kumar wrote:
> From: Andrey Ryabinin <aryabinin@virtuozzo.com>
>
> commit 64f8ebaf115bcddc4aaa902f981c57ba6506bc42 upstream.
>
> Memory access coded in an assembly won't be seen by KASAN as a compiler
> can instrument only C code. Add kasan_check_[read,write]() API which is
> going to be used to check a certain memory range.
>
> Link: http://lkml.kernel.org/r/1462538722-1574-3-git-send-email-aryabinin@virtuozzo.com
> Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Acked-by: Alexander Potapenko <glider@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> [ v4.4: Fixed MAINTAINERS conflict and added whole kasan entry. Drop 4th
> argument to check_memory_region(). ]
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> MAINTAINERS | 14 ++++++++++++++
> include/linux/kasan-checks.h | 12 ++++++++++++
> mm/kasan/kasan.c | 12 ++++++++++++
> 3 files changed, 38 insertions(+)
> create mode 100644 include/linux/kasan-checks.h
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index f4d4a5544dc1..2a8826732967 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -5982,6 +5982,20 @@ S: Maintained
> F: Documentation/hwmon/k8temp
> F: drivers/hwmon/k8temp.c
>
> +KASAN
> +M: Andrey Ryabinin <aryabinin@virtuozzo.com>
> +R: Alexander Potapenko <glider@google.com>
> +R: Dmitry Vyukov <dvyukov@google.com>
> +L: kasan-dev@googlegroups.com
> +S: Maintained
> +F: arch/*/include/asm/kasan.h
> +F: arch/*/mm/kasan_init*
> +F: Documentation/kasan.txt
> +F: include/linux/kasan*.h
> +F: lib/test_kasan.c
> +F: mm/kasan/
> +F: scripts/Makefile.kasan
> +
> KCONFIG
> M: "Yann E. MORIN" <yann.morin.1998@free.fr>
> L: linux-kbuild@vger.kernel.org
> diff --git a/include/linux/kasan-checks.h b/include/linux/kasan-checks.h
> new file mode 100644
> index 000000000000..b7f8aced7870
> --- /dev/null
> +++ b/include/linux/kasan-checks.h
> @@ -0,0 +1,12 @@
> +#ifndef _LINUX_KASAN_CHECKS_H
> +#define _LINUX_KASAN_CHECKS_H
> +
> +#ifdef CONFIG_KASAN
> +void kasan_check_read(const void *p, unsigned int size);
> +void kasan_check_write(const void *p, unsigned int size);
> +#else
> +static inline void kasan_check_read(const void *p, unsigned int size) { }
> +static inline void kasan_check_write(const void *p, unsigned int size) { }
> +#endif
> +
> +#endif
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index b7397b459960..1cdcab0c976a 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -274,6 +274,18 @@ static __always_inline void check_memory_region(unsigned long addr,
> void __asan_loadN(unsigned long addr, size_t size);
> void __asan_storeN(unsigned long addr, size_t size);
>
> +void kasan_check_read(const void *p, unsigned int size)
> +{
> + check_memory_region((unsigned long)p, size, false);
> +}
> +EXPORT_SYMBOL(kasan_check_read);
> +
> +void kasan_check_write(const void *p, unsigned int size)
> +{
> + check_memory_region((unsigned long)p, size, true);
> +}
> +EXPORT_SYMBOL(kasan_check_write);
> +
> #undef memset
> void *memset(void *addr, int c, size_t len)
> {
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 10/44] arm64: kasan: instrument user memory access API
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (8 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 09/44] mm/kasan: add API to check memory regions Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:41 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 11/44] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Viresh Kumar
` (34 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Yang Shi <yang.shi@linaro.org>
commit bffe1baff5d57521b0c41b6997c41ff1993e9818 upstream.
The upstream commit 1771c6e1a567ea0ba2cccc0a4ffe68a1419fd8ef
("x86/kasan: instrument user memory access API") added KASAN instrument to
x86 user memory access API, so added such instrument to ARM64 too.
Define __copy_to/from_user in C in order to add kasan_check_read/write call,
rename assembly implementation to __arch_copy_to/from_user.
Tested by test_kasan module.
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Yang Shi <yang.shi@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/uaccess.h | 25 +++++++++++++++++++++----
arch/arm64/kernel/arm64ksyms.c | 4 ++--
arch/arm64/lib/copy_from_user.S | 4 ++--
arch/arm64/lib/copy_to_user.S | 4 ++--
4 files changed, 27 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index a34324436ce1..693a0d784534 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -22,6 +22,7 @@
* User space memory access functions
*/
#include <linux/bitops.h>
+#include <linux/kasan-checks.h>
#include <linux/string.h>
#include <linux/thread_info.h>
@@ -300,15 +301,29 @@ do { \
#define put_user __put_user
-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
+extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n);
+extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n);
extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+ kasan_check_write(to, n);
+ return __arch_copy_from_user(to, from, n);
+}
+
+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
+{
+ kasan_check_read(from, n);
+ return __arch_copy_to_user(to, from, n);
+}
+
static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
{
+ kasan_check_write(to, n);
+
if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
+ n = __arch_copy_from_user(to, from, n);
else /* security hole - plug it */
memset(to, 0, n);
return n;
@@ -316,8 +331,10 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
{
+ kasan_check_read(from, n);
+
if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
+ n = __arch_copy_to_user(to, from, n);
return n;
}
diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
index 3b6d8cc9dfe0..c654df05b7d7 100644
--- a/arch/arm64/kernel/arm64ksyms.c
+++ b/arch/arm64/kernel/arm64ksyms.c
@@ -33,8 +33,8 @@ EXPORT_SYMBOL(copy_page);
EXPORT_SYMBOL(clear_page);
/* user mem (segment) */
-EXPORT_SYMBOL(__copy_from_user);
-EXPORT_SYMBOL(__copy_to_user);
+EXPORT_SYMBOL(__arch_copy_from_user);
+EXPORT_SYMBOL(__arch_copy_to_user);
EXPORT_SYMBOL(__clear_user);
EXPORT_SYMBOL(__copy_in_user);
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 4699cd74f87e..281e75db899a 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -66,7 +66,7 @@
.endm
end .req x5
-ENTRY(__copy_from_user)
+ENTRY(__arch_copy_from_user)
ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
add end, x0, x2
@@ -75,7 +75,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
mov x0, #0 // Nothing to copy
ret
-ENDPROC(__copy_from_user)
+ENDPROC(__arch_copy_from_user)
.section .fixup,"ax"
.align 2
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 7512bbbc07ac..db4d187de61f 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -65,7 +65,7 @@
.endm
end .req x5
-ENTRY(__copy_to_user)
+ENTRY(__arch_copy_to_user)
ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
add end, x0, x2
@@ -74,7 +74,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
mov x0, #0
ret
-ENDPROC(__copy_to_user)
+ENDPROC(__arch_copy_to_user)
.section .fixup,"ax"
.align 2
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 10/44] arm64: kasan: instrument user memory access API
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 10/44] arm64: kasan: instrument user memory access API Viresh Kumar
@ 2019-08-30 9:41 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:41 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:55PM +0530, Viresh Kumar wrote:
> From: Yang Shi <yang.shi@linaro.org>
>
> commit bffe1baff5d57521b0c41b6997c41ff1993e9818 upstream.
>
> The upstream commit 1771c6e1a567ea0ba2cccc0a4ffe68a1419fd8ef
> ("x86/kasan: instrument user memory access API") added KASAN instrument to
> x86 user memory access API, so added such instrument to ARM64 too.
>
> Define __copy_to/from_user in C in order to add kasan_check_read/write call,
> rename assembly implementation to __arch_copy_to/from_user.
>
> Tested by test_kasan module.
>
> Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>
> Tested-by: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Yang Shi <yang.shi@linaro.org>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/uaccess.h | 25 +++++++++++++++++++++----
> arch/arm64/kernel/arm64ksyms.c | 4 ++--
> arch/arm64/lib/copy_from_user.S | 4 ++--
> arch/arm64/lib/copy_to_user.S | 4 ++--
> 4 files changed, 27 insertions(+), 10 deletions(-)
>
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index a34324436ce1..693a0d784534 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -22,6 +22,7 @@
> * User space memory access functions
> */
> #include <linux/bitops.h>
> +#include <linux/kasan-checks.h>
> #include <linux/string.h>
> #include <linux/thread_info.h>
>
> @@ -300,15 +301,29 @@ do { \
>
> #define put_user __put_user
>
> -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
> -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
> +extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n);
> +extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n);
> extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
> extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
>
> +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
> +{
> + kasan_check_write(to, n);
> + return __arch_copy_from_user(to, from, n);
> +}
> +
> +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
> +{
> + kasan_check_read(from, n);
> + return __arch_copy_to_user(to, from, n);
> +}
> +
> static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
> {
> + kasan_check_write(to, n);
> +
> if (access_ok(VERIFY_READ, from, n))
> - n = __copy_from_user(to, from, n);
> + n = __arch_copy_from_user(to, from, n);
> else /* security hole - plug it */
> memset(to, 0, n);
> return n;
> @@ -316,8 +331,10 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
>
> static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
> {
> + kasan_check_read(from, n);
> +
> if (access_ok(VERIFY_WRITE, to, n))
> - n = __copy_to_user(to, from, n);
> + n = __arch_copy_to_user(to, from, n);
> return n;
> }
>
> diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
> index 3b6d8cc9dfe0..c654df05b7d7 100644
> --- a/arch/arm64/kernel/arm64ksyms.c
> +++ b/arch/arm64/kernel/arm64ksyms.c
> @@ -33,8 +33,8 @@ EXPORT_SYMBOL(copy_page);
> EXPORT_SYMBOL(clear_page);
>
> /* user mem (segment) */
> -EXPORT_SYMBOL(__copy_from_user);
> -EXPORT_SYMBOL(__copy_to_user);
> +EXPORT_SYMBOL(__arch_copy_from_user);
> +EXPORT_SYMBOL(__arch_copy_to_user);
> EXPORT_SYMBOL(__clear_user);
> EXPORT_SYMBOL(__copy_in_user);
>
> diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
> index 4699cd74f87e..281e75db899a 100644
> --- a/arch/arm64/lib/copy_from_user.S
> +++ b/arch/arm64/lib/copy_from_user.S
> @@ -66,7 +66,7 @@
> .endm
>
> end .req x5
> -ENTRY(__copy_from_user)
> +ENTRY(__arch_copy_from_user)
> ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> add end, x0, x2
> @@ -75,7 +75,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> mov x0, #0 // Nothing to copy
> ret
> -ENDPROC(__copy_from_user)
> +ENDPROC(__arch_copy_from_user)
>
> .section .fixup,"ax"
> .align 2
> diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
> index 7512bbbc07ac..db4d187de61f 100644
> --- a/arch/arm64/lib/copy_to_user.S
> +++ b/arch/arm64/lib/copy_to_user.S
> @@ -65,7 +65,7 @@
> .endm
>
> end .req x5
> -ENTRY(__copy_to_user)
> +ENTRY(__arch_copy_to_user)
> ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> add end, x0, x2
> @@ -74,7 +74,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> mov x0, #0
> ret
> -ENDPROC(__copy_to_user)
> +ENDPROC(__arch_copy_to_user)
>
> .section .fixup,"ax"
> .align 2
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 11/44] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (9 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 10/44] arm64: kasan: instrument user memory access API Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-30 9:41 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list Viresh Kumar
` (33 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit f71c2ffcb20dd8626880747557014bb9a61eb90e upstream.
Like we've done for get_user and put_user, ensure that user pointers
are masked before invoking the underlying __arch_{clear,copy_*}_user
operations.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: fixup for v4.4 style uaccess primitives ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/uaccess.h | 18 ++++++++++--------
arch/arm64/kernel/arm64ksyms.c | 4 ++--
arch/arm64/lib/clear_user.S | 6 +++---
arch/arm64/lib/copy_in_user.S | 4 ++--
4 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 693a0d784534..f2f5a152f372 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -303,19 +303,18 @@ do { \
extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n);
extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n);
-extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
-extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
+extern unsigned long __must_check __arch_copy_in_user(void __user *to, const void __user *from, unsigned long n);
static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
{
kasan_check_write(to, n);
- return __arch_copy_from_user(to, from, n);
+ return __arch_copy_from_user(to, __uaccess_mask_ptr(from), n);
}
static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
{
kasan_check_read(from, n);
- return __arch_copy_to_user(to, from, n);
+ return __arch_copy_to_user(__uaccess_mask_ptr(to), from, n);
}
static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
@@ -338,22 +337,25 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const voi
return n;
}
-static inline unsigned long __must_check copy_in_user(void __user *to, const void __user *from, unsigned long n)
+static inline unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n)
{
if (access_ok(VERIFY_READ, from, n) && access_ok(VERIFY_WRITE, to, n))
- n = __copy_in_user(to, from, n);
+ n = __arch_copy_in_user(__uaccess_mask_ptr(to), __uaccess_mask_ptr(from), n);
return n;
}
+#define copy_in_user __copy_in_user
#define __copy_to_user_inatomic __copy_to_user
#define __copy_from_user_inatomic __copy_from_user
-static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
+extern unsigned long __must_check __arch_clear_user(void __user *to, unsigned long n);
+static inline unsigned long __must_check __clear_user(void __user *to, unsigned long n)
{
if (access_ok(VERIFY_WRITE, to, n))
- n = __clear_user(__uaccess_mask_ptr(to), n);
+ n = __arch_clear_user(__uaccess_mask_ptr(to), n);
return n;
}
+#define clear_user __clear_user
extern long strncpy_from_user(char *dest, const char __user *src, long count);
diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
index c654df05b7d7..abe4e0984dbb 100644
--- a/arch/arm64/kernel/arm64ksyms.c
+++ b/arch/arm64/kernel/arm64ksyms.c
@@ -35,8 +35,8 @@ EXPORT_SYMBOL(clear_page);
/* user mem (segment) */
EXPORT_SYMBOL(__arch_copy_from_user);
EXPORT_SYMBOL(__arch_copy_to_user);
-EXPORT_SYMBOL(__clear_user);
-EXPORT_SYMBOL(__copy_in_user);
+EXPORT_SYMBOL(__arch_clear_user);
+EXPORT_SYMBOL(__arch_copy_in_user);
/* physical memory */
EXPORT_SYMBOL(memstart_addr);
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
index a9723c71c52b..fc6bb0f83511 100644
--- a/arch/arm64/lib/clear_user.S
+++ b/arch/arm64/lib/clear_user.S
@@ -24,7 +24,7 @@
.text
-/* Prototype: int __clear_user(void *addr, size_t sz)
+/* Prototype: int __arch_clear_user(void *addr, size_t sz)
* Purpose : clear some user memory
* Params : addr - user memory address to clear
* : sz - number of bytes to clear
@@ -32,7 +32,7 @@
*
* Alignment fixed up by hardware.
*/
-ENTRY(__clear_user)
+ENTRY(__arch_clear_user)
ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
mov x2, x1 // save the size for fixup return
@@ -57,7 +57,7 @@ USER(9f, strb wzr, [x0] )
ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
ret
-ENDPROC(__clear_user)
+ENDPROC(__arch_clear_user)
.section .fixup,"ax"
.align 2
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 81c8fc93c100..0219aa85b3cc 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -67,7 +67,7 @@
.endm
end .req x5
-ENTRY(__copy_in_user)
+ENTRY(__arch_copy_in_user)
ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
add end, x0, x2
@@ -76,7 +76,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
CONFIG_ARM64_PAN)
mov x0, #0
ret
-ENDPROC(__copy_in_user)
+ENDPROC(__arch_copy_in_user)
.section .fixup,"ax"
.align 2
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 11/44] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 11/44] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Viresh Kumar
@ 2019-08-30 9:41 ` Mark Rutland
0 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:41 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:56PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit f71c2ffcb20dd8626880747557014bb9a61eb90e upstream.
>
> Like we've done for get_user and put_user, ensure that user pointers
> are masked before invoking the underlying __arch_{clear,copy_*}_user
> operations.
>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> [ v4.4: fixup for v4.4 style uaccess primitives ]
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/uaccess.h | 18 ++++++++++--------
> arch/arm64/kernel/arm64ksyms.c | 4 ++--
> arch/arm64/lib/clear_user.S | 6 +++---
> arch/arm64/lib/copy_in_user.S | 4 ++--
> 4 files changed, 17 insertions(+), 15 deletions(-)
>
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index 693a0d784534..f2f5a152f372 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -303,19 +303,18 @@ do { \
>
> extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n);
> extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n);
> -extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
> -extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
> +extern unsigned long __must_check __arch_copy_in_user(void __user *to, const void __user *from, unsigned long n);
>
> static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
> {
> kasan_check_write(to, n);
> - return __arch_copy_from_user(to, from, n);
> + return __arch_copy_from_user(to, __uaccess_mask_ptr(from), n);
> }
>
> static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
> {
> kasan_check_read(from, n);
> - return __arch_copy_to_user(to, from, n);
> + return __arch_copy_to_user(__uaccess_mask_ptr(to), from, n);
> }
>
> static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
> @@ -338,22 +337,25 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const voi
> return n;
> }
>
> -static inline unsigned long __must_check copy_in_user(void __user *to, const void __user *from, unsigned long n)
> +static inline unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n)
> {
> if (access_ok(VERIFY_READ, from, n) && access_ok(VERIFY_WRITE, to, n))
> - n = __copy_in_user(to, from, n);
> + n = __arch_copy_in_user(__uaccess_mask_ptr(to), __uaccess_mask_ptr(from), n);
> return n;
> }
> +#define copy_in_user __copy_in_user
>
> #define __copy_to_user_inatomic __copy_to_user
> #define __copy_from_user_inatomic __copy_from_user
>
> -static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
> +extern unsigned long __must_check __arch_clear_user(void __user *to, unsigned long n);
> +static inline unsigned long __must_check __clear_user(void __user *to, unsigned long n)
> {
> if (access_ok(VERIFY_WRITE, to, n))
> - n = __clear_user(__uaccess_mask_ptr(to), n);
> + n = __arch_clear_user(__uaccess_mask_ptr(to), n);
> return n;
> }
> +#define clear_user __clear_user
>
> extern long strncpy_from_user(char *dest, const char __user *src, long count);
>
> diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
> index c654df05b7d7..abe4e0984dbb 100644
> --- a/arch/arm64/kernel/arm64ksyms.c
> +++ b/arch/arm64/kernel/arm64ksyms.c
> @@ -35,8 +35,8 @@ EXPORT_SYMBOL(clear_page);
> /* user mem (segment) */
> EXPORT_SYMBOL(__arch_copy_from_user);
> EXPORT_SYMBOL(__arch_copy_to_user);
> -EXPORT_SYMBOL(__clear_user);
> -EXPORT_SYMBOL(__copy_in_user);
> +EXPORT_SYMBOL(__arch_clear_user);
> +EXPORT_SYMBOL(__arch_copy_in_user);
>
> /* physical memory */
> EXPORT_SYMBOL(memstart_addr);
> diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
> index a9723c71c52b..fc6bb0f83511 100644
> --- a/arch/arm64/lib/clear_user.S
> +++ b/arch/arm64/lib/clear_user.S
> @@ -24,7 +24,7 @@
>
> .text
>
> -/* Prototype: int __clear_user(void *addr, size_t sz)
> +/* Prototype: int __arch_clear_user(void *addr, size_t sz)
> * Purpose : clear some user memory
> * Params : addr - user memory address to clear
> * : sz - number of bytes to clear
> @@ -32,7 +32,7 @@
> *
> * Alignment fixed up by hardware.
> */
> -ENTRY(__clear_user)
> +ENTRY(__arch_clear_user)
> ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> mov x2, x1 // save the size for fixup return
> @@ -57,7 +57,7 @@ USER(9f, strb wzr, [x0] )
> ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> ret
> -ENDPROC(__clear_user)
> +ENDPROC(__arch_clear_user)
>
> .section .fixup,"ax"
> .align 2
> diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
> index 81c8fc93c100..0219aa85b3cc 100644
> --- a/arch/arm64/lib/copy_in_user.S
> +++ b/arch/arm64/lib/copy_in_user.S
> @@ -67,7 +67,7 @@
> .endm
>
> end .req x5
> -ENTRY(__copy_in_user)
> +ENTRY(__arch_copy_in_user)
> ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(0)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> add end, x0, x2
> @@ -76,7 +76,7 @@ ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \
> CONFIG_ARM64_PAN)
> mov x0, #0
> ret
> -ENDPROC(__copy_in_user)
> +ENDPROC(__arch_copy_in_user)
>
> .section .fixup,"ax"
> .align 2
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (10 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 11/44] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-09-02 14:27 ` Mark Rutland
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 13/44] arm64: cpufeature: Add scope for capability check Viresh Kumar
` (32 subsequent siblings)
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: James Morse <james.morse@arm.com>
commit 644c2ae198412c956700e55a2acf80b2541f6aa5 upstream.
CPU feature code uses the desc field as a test to find the end of the list,
this means every entry must have a description. This generates noise for
entries in the list that aren't really features, but combinations of them.
e.g.
> CPU features: detected feature: Privileged Access Never
> CPU features: detected feature: PAN and not UAO
These combination features are needed for corner cases with alternatives,
where cpu features interact.
Change all walkers of the arm64_features[] and arm64_hwcaps[] lists to test
'matches' not 'desc', and only print 'desc' if it is non-NULL.
Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by : Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpufeature.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index c1eddc07d996..bdb4cd9ffccf 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -744,7 +744,7 @@ static void setup_cpu_hwcaps(void)
int i;
const struct arm64_cpu_capabilities *hwcaps = arm64_hwcaps;
- for (i = 0; hwcaps[i].desc; i++)
+ for (i = 0; hwcaps[i].matches; i++)
if (hwcaps[i].matches(&hwcaps[i]))
cap_set_hwcap(&hwcaps[i]);
}
@@ -754,11 +754,11 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
{
int i;
- for (i = 0; caps[i].desc; i++) {
+ for (i = 0; caps[i].matches; i++) {
if (!caps[i].matches(&caps[i]))
continue;
- if (!cpus_have_cap(caps[i].capability))
+ if (!cpus_have_cap(caps[i].capability) && caps[i].desc)
pr_info("%s %s\n", info, caps[i].desc);
cpus_set_cap(caps[i].capability);
}
@@ -772,7 +772,7 @@ static void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
{
int i;
- for (i = 0; caps[i].desc; i++)
+ for (i = 0; caps[i].matches; i++)
if (caps[i].enable && cpus_have_cap(caps[i].capability))
/*
* Use stop_machine() as it schedules the work allowing
@@ -884,7 +884,7 @@ void verify_local_cpu_capabilities(void)
return;
caps = arm64_features;
- for (i = 0; caps[i].desc; i++) {
+ for (i = 0; caps[i].matches; i++) {
if (!cpus_have_cap(caps[i].capability) || !caps[i].sys_reg)
continue;
/*
@@ -897,7 +897,7 @@ void verify_local_cpu_capabilities(void)
caps[i].enable(NULL);
}
- for (i = 0, caps = arm64_hwcaps; caps[i].desc; i++) {
+ for (i = 0, caps = arm64_hwcaps; caps[i].matches; i++) {
if (!cpus_have_hwcap(&caps[i]))
continue;
if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list Viresh Kumar
@ 2019-09-02 14:27 ` Mark Rutland
2019-09-05 7:45 ` Viresh Kumar
0 siblings, 1 reply; 64+ messages in thread
From: Mark Rutland @ 2019-09-02 14:27 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:57PM +0530, Viresh Kumar wrote:
> From: James Morse <james.morse@arm.com>
>
> commit 644c2ae198412c956700e55a2acf80b2541f6aa5 upstream.
>
> CPU feature code uses the desc field as a test to find the end of the list,
> this means every entry must have a description. This generates noise for
> entries in the list that aren't really features, but combinations of them.
> e.g.
> > CPU features: detected feature: Privileged Access Never
> > CPU features: detected feature: PAN and not UAO
>
> These combination features are needed for corner cases with alternatives,
> where cpu features interact.
>
> Change all walkers of the arm64_features[] and arm64_hwcaps[] lists to test
> 'matches' not 'desc', and only print 'desc' if it is non-NULL.
>
> Signed-off-by: James Morse <james.morse@arm.com>
> Reviewed-by : Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
> ---
> arch/arm64/kernel/cpufeature.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
From looking at my 4.9.y/{meltdown,spectre} banches on kernel.org [1,2],
and chasing the history v4.4..v4.9, there are a number of patches I'd
expect to have alongside this that I don't spot in this series:
* e3661b128e53ee281e1e7c589a5b647890bd6d7c ("arm64: Allow a capability to be checked on a single CPU")
* 8f4137588261d7504f4aa022dc9d1a1fd1940e8e ("arm64: Allow checking of a CPU-local erratum")
* 67948af41f2e6818edeeba5182811c704d484949 ("arm64: capabilities: Handle duplicate entries for a capability")
* edf298cfce47ab7279d03b5203ae2ef3a58e49db ("arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early")
... which IIUC are necessary for big.LITTLE to work correctly.
Have you verified this for big.LITTLE?
Thanks,
Mark.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/log/?h=stable/4.9.y/meltdown
[2] https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/log/?h=stable/4.9.y/spectre
>
> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
> index c1eddc07d996..bdb4cd9ffccf 100644
> --- a/arch/arm64/kernel/cpufeature.c
> +++ b/arch/arm64/kernel/cpufeature.c
> @@ -744,7 +744,7 @@ static void setup_cpu_hwcaps(void)
> int i;
> const struct arm64_cpu_capabilities *hwcaps = arm64_hwcaps;
>
> - for (i = 0; hwcaps[i].desc; i++)
> + for (i = 0; hwcaps[i].matches; i++)
> if (hwcaps[i].matches(&hwcaps[i]))
> cap_set_hwcap(&hwcaps[i]);
> }
> @@ -754,11 +754,11 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
> {
> int i;
>
> - for (i = 0; caps[i].desc; i++) {
> + for (i = 0; caps[i].matches; i++) {
> if (!caps[i].matches(&caps[i]))
> continue;
>
> - if (!cpus_have_cap(caps[i].capability))
> + if (!cpus_have_cap(caps[i].capability) && caps[i].desc)
> pr_info("%s %s\n", info, caps[i].desc);
> cpus_set_cap(caps[i].capability);
> }
> @@ -772,7 +772,7 @@ static void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
> {
> int i;
>
> - for (i = 0; caps[i].desc; i++)
> + for (i = 0; caps[i].matches; i++)
> if (caps[i].enable && cpus_have_cap(caps[i].capability))
> /*
> * Use stop_machine() as it schedules the work allowing
> @@ -884,7 +884,7 @@ void verify_local_cpu_capabilities(void)
> return;
>
> caps = arm64_features;
> - for (i = 0; caps[i].desc; i++) {
> + for (i = 0; caps[i].matches; i++) {
> if (!cpus_have_cap(caps[i].capability) || !caps[i].sys_reg)
> continue;
> /*
> @@ -897,7 +897,7 @@ void verify_local_cpu_capabilities(void)
> caps[i].enable(NULL);
> }
>
> - for (i = 0, caps = arm64_hwcaps; caps[i].desc; i++) {
> + for (i = 0, caps = arm64_hwcaps; caps[i].matches; i++) {
> if (!cpus_have_hwcap(&caps[i]))
> continue;
> if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-09-02 14:27 ` Mark Rutland
@ 2019-09-05 7:45 ` Viresh Kumar
2019-09-06 13:49 ` Mark Rutland
0 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-09-05 7:45 UTC (permalink / raw)
To: Mark Rutland
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On 02-09-19, 15:27, Mark Rutland wrote:
> On Thu, Aug 29, 2019 at 05:03:57PM +0530, Viresh Kumar wrote:
> > From: James Morse <james.morse@arm.com>
> >
> > commit 644c2ae198412c956700e55a2acf80b2541f6aa5 upstream.
> >
> > CPU feature code uses the desc field as a test to find the end of the list,
> > this means every entry must have a description. This generates noise for
> > entries in the list that aren't really features, but combinations of them.
> > e.g.
> > > CPU features: detected feature: Privileged Access Never
> > > CPU features: detected feature: PAN and not UAO
> >
> > These combination features are needed for corner cases with alternatives,
> > where cpu features interact.
> >
> > Change all walkers of the arm64_features[] and arm64_hwcaps[] lists to test
> > 'matches' not 'desc', and only print 'desc' if it is non-NULL.
> >
> > Signed-off-by: James Morse <james.morse@arm.com>
> > Reviewed-by : Suzuki K Poulose <suzuki.poulose@arm.com>
> > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
> > ---
> > arch/arm64/kernel/cpufeature.c | 12 ++++++------
> > 1 file changed, 6 insertions(+), 6 deletions(-)
>
> >From looking at my 4.9.y/{meltdown,spectre} banches on kernel.org [1,2],
> and chasing the history v4.4..v4.9, there are a number of patches I'd
> expect to have alongside this that I don't spot in this series:
>
> * e3661b128e53ee281e1e7c589a5b647890bd6d7c ("arm64: Allow a capability to be checked on a single CPU")
> * 8f4137588261d7504f4aa022dc9d1a1fd1940e8e ("arm64: Allow checking of a CPU-local erratum")
> * 67948af41f2e6818edeeba5182811c704d484949 ("arm64: capabilities: Handle duplicate entries for a capability")
> * edf298cfce47ab7279d03b5203ae2ef3a58e49db ("arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early")
I also had to pick this one for cleaner rebase:
752835019c15 arm64: HWCAP: Split COMPAT HWCAP table entries
>
> ... which IIUC are necessary for big.LITTLE to work correctly.
I have pushed the changes to my branch again with above 5 patches and
some more reordering to match 4.9 log.
> Have you verified this for big.LITTLE?
Not sure if we ever talked about this earlier, but here is the
situation which I explained to Julien earlier.
I don't have access to the test-suite to verify that these patches
indeed fix the spectre mitigations and I was asked to backport these
and then ask for help from ARM to get these tested through the
test-suite. I was expecting Julien to do that earlier.
Julien did ask me to verify few things earlier, which can be done
without the test suite and was about checking that the new code paths
are getting hit now or not, which I did.
I haven't tested these on big LITTLE, though I can get the branch
through LAVA to get it tested on big LITTLE but I have no clue on what
I should be looking for in results :)
If there is some testing that can be done on my side for this, I sure
can do it. But I would need help from you on that to know what exactly
I need to check.
Thanks for the reviews Mark.
--
viresh
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-09-05 7:45 ` Viresh Kumar
@ 2019-09-06 13:49 ` Mark Rutland
2019-09-10 9:35 ` Viresh Kumar
2019-10-11 6:36 ` Viresh Kumar
0 siblings, 2 replies; 64+ messages in thread
From: Mark Rutland @ 2019-09-06 13:49 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Sep 05, 2019 at 01:15:06PM +0530, Viresh Kumar wrote:
> On 02-09-19, 15:27, Mark Rutland wrote:
> > On Thu, Aug 29, 2019 at 05:03:57PM +0530, Viresh Kumar wrote:
> > > From: James Morse <james.morse@arm.com>
> > >
> > > commit 644c2ae198412c956700e55a2acf80b2541f6aa5 upstream.
> > >
> > > CPU feature code uses the desc field as a test to find the end of the list,
> > > this means every entry must have a description. This generates noise for
> > > entries in the list that aren't really features, but combinations of them.
> > > e.g.
> > > > CPU features: detected feature: Privileged Access Never
> > > > CPU features: detected feature: PAN and not UAO
> > >
> > > These combination features are needed for corner cases with alternatives,
> > > where cpu features interact.
> > >
> > > Change all walkers of the arm64_features[] and arm64_hwcaps[] lists to test
> > > 'matches' not 'desc', and only print 'desc' if it is non-NULL.
> > >
> > > Signed-off-by: James Morse <james.morse@arm.com>
> > > Reviewed-by : Suzuki K Poulose <suzuki.poulose@arm.com>
> > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > > Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
> > > ---
> > > arch/arm64/kernel/cpufeature.c | 12 ++++++------
> > > 1 file changed, 6 insertions(+), 6 deletions(-)
> >
> > >From looking at my 4.9.y/{meltdown,spectre} banches on kernel.org [1,2],
> > and chasing the history v4.4..v4.9, there are a number of patches I'd
> > expect to have alongside this that I don't spot in this series:
> >
> > * e3661b128e53ee281e1e7c589a5b647890bd6d7c ("arm64: Allow a capability to be checked on a single CPU")
> > * 8f4137588261d7504f4aa022dc9d1a1fd1940e8e ("arm64: Allow checking of a CPU-local erratum")
> > * 67948af41f2e6818edeeba5182811c704d484949 ("arm64: capabilities: Handle duplicate entries for a capability")
> > * edf298cfce47ab7279d03b5203ae2ef3a58e49db ("arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early")
>
> I also had to pick this one for cleaner rebase:
>
> 752835019c15 arm64: HWCAP: Split COMPAT HWCAP table entries
>
> >
> > ... which IIUC are necessary for big.LITTLE to work correctly.
>
> I have pushed the changes to my branch again with above 5 patches and
> some more reordering to match 4.9 log.
Thanks for this!
> > Have you verified this for big.LITTLE?
>
> Not sure if we ever talked about this earlier, but here is the
> situation which I explained to Julien earlier.
>
> I don't have access to the test-suite to verify that these patches
> indeed fix the spectre mitigations and I was asked to backport these
> and then ask for help from ARM to get these tested through the
> test-suite. I was expecting Julien to do that earlier.
Ok, thanks for providing this context.
As a heads-up, I'll be at LPC next week. While I'm there I won't be able
to test things, and I'm unlikely to find time to review, but I'll try to
do so ASAP once I return.
> Julien did ask me to verify few things earlier, which can be done
> without the test suite and was about checking that the new code paths
> are getting hit now or not, which I did.
>
> I haven't tested these on big LITTLE, though I can get the branch
> through LAVA to get it tested on big LITTLE but I have no clue on what
> I should be looking for in results :)
I think it would be worthwhile to do that ASAP to make sure there are no
boot-time or run-time regressions. We can look at the logs later (or
re-run with some additional logging) to verify things are working as
expected.
> If there is some testing that can be done on my side for this, I sure
> can do it. But I would need help from you on that to know what exactly
> I need to check.
Sure. I'll have to take another look over the series to figure that out,
and as above I might not be able to do so until after LPC -- sorry!
Thanks,
Mark.
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-09-06 13:49 ` Mark Rutland
@ 2019-09-10 9:35 ` Viresh Kumar
2019-10-11 6:36 ` Viresh Kumar
1 sibling, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-09-10 9:35 UTC (permalink / raw)
To: Mark Rutland
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On 06-09-19, 14:49, Mark Rutland wrote:
> I think it would be worthwhile to do that ASAP to make sure there are no
> boot-time or run-time regressions. We can look at the logs later (or
> re-run with some additional logging) to verify things are working as
> expected.
Sure, so my branch already goes through some LAVA testing from Linaro and
kernel-ci as well. It also gets build tested by 0-day testing bot.
I will make sure it runs on some big.LITTLE stuff on LAVA. Thanks.
--
viresh
^ permalink raw reply [flat|nested] 64+ messages in thread
* Re: [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list
2019-09-06 13:49 ` Mark Rutland
2019-09-10 9:35 ` Viresh Kumar
@ 2019-10-11 6:36 ` Viresh Kumar
1 sibling, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-10-11 6:36 UTC (permalink / raw)
To: Mark Rutland
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On 06-09-19, 14:49, Mark Rutland wrote:
> Sure. I'll have to take another look over the series to figure that out,
> and as above I might not be able to do so until after LPC -- sorry!
Just wanted to check if someone was able to come back to this series
to give further reviews :)
--
viresh
^ permalink raw reply [flat|nested] 64+ messages in thread
* [PATCH ARM64 v4.4 V3 13/44] arm64: cpufeature: Add scope for capability check
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (11 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 12/44] arm64: cpufeature: Test 'matches' pointer to find the end of the list Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 14/44] arm64: Introduce cpu_die_early Viresh Kumar
` (31 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 92406f0cc9e3d5cc77bf3de6d68c9c2373dcd701 upstream.
Add scope parameter to the arm64_cpu_capabilities::matches(), so that
this can be reused for checking the capability on a given CPU vs the
system wide. The system uses the default scope associated with the
capability for initialising the CPU_HWCAPs and ELF_HWCAPs.
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
[ v4.4: Changes made according to 4.4 codebase ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cpufeature.h | 9 ++-
arch/arm64/kernel/cpu_errata.c | 5 +-
arch/arm64/kernel/cpufeature.c | 105 +++++++++++++++-------------
3 files changed, 70 insertions(+), 49 deletions(-)
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index ad83c245781c..4c31e14c0f0e 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -74,10 +74,17 @@ struct arm64_ftr_reg {
struct arm64_ftr_bits *ftr_bits;
};
+/* scope of capability check */
+enum {
+ SCOPE_SYSTEM,
+ SCOPE_LOCAL_CPU,
+};
+
struct arm64_cpu_capabilities {
const char *desc;
u16 capability;
- bool (*matches)(const struct arm64_cpu_capabilities *);
+ int def_scope; /* default scope */
+ bool (*matches)(const struct arm64_cpu_capabilities *caps, int scope);
int (*enable)(void *); /* Called on all active CPUs */
union {
struct { /* To be used for erratum handling only */
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index a3e846a28b05..0971d80d3623 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -29,10 +29,12 @@
MIDR_ARCHITECTURE_MASK)
static bool __maybe_unused
-is_affected_midr_range(const struct arm64_cpu_capabilities *entry)
+is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
{
u32 midr = read_cpuid_id();
+ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
+
if ((midr & CPU_MODEL_MASK) != entry->midr_model)
return false;
@@ -42,6 +44,7 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry)
}
#define MIDR_RANGE(model, min, max) \
+ .def_scope = SCOPE_LOCAL_CPU, \
.matches = is_affected_midr_range, \
.midr_model = model, \
.midr_range_min = min, \
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index bdb4cd9ffccf..d0c82bc02de4 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -589,6 +589,48 @@ u64 read_system_reg(u32 id)
return regp->sys_val;
}
+/*
+ * __raw_read_system_reg() - Used by a STARTING cpu before cpuinfo is populated.
+ * Read the system register on the current CPU
+ */
+static u64 __raw_read_system_reg(u32 sys_id)
+{
+ switch (sys_id) {
+ case SYS_ID_PFR0_EL1: return (u64)read_cpuid(ID_PFR0_EL1);
+ case SYS_ID_PFR1_EL1: return (u64)read_cpuid(ID_PFR1_EL1);
+ case SYS_ID_DFR0_EL1: return (u64)read_cpuid(ID_DFR0_EL1);
+ case SYS_ID_MMFR0_EL1: return (u64)read_cpuid(ID_MMFR0_EL1);
+ case SYS_ID_MMFR1_EL1: return (u64)read_cpuid(ID_MMFR1_EL1);
+ case SYS_ID_MMFR2_EL1: return (u64)read_cpuid(ID_MMFR2_EL1);
+ case SYS_ID_MMFR3_EL1: return (u64)read_cpuid(ID_MMFR3_EL1);
+ case SYS_ID_ISAR0_EL1: return (u64)read_cpuid(ID_ISAR0_EL1);
+ case SYS_ID_ISAR1_EL1: return (u64)read_cpuid(ID_ISAR1_EL1);
+ case SYS_ID_ISAR2_EL1: return (u64)read_cpuid(ID_ISAR2_EL1);
+ case SYS_ID_ISAR3_EL1: return (u64)read_cpuid(ID_ISAR3_EL1);
+ case SYS_ID_ISAR4_EL1: return (u64)read_cpuid(ID_ISAR4_EL1);
+ case SYS_ID_ISAR5_EL1: return (u64)read_cpuid(ID_ISAR4_EL1);
+ case SYS_MVFR0_EL1: return (u64)read_cpuid(MVFR0_EL1);
+ case SYS_MVFR1_EL1: return (u64)read_cpuid(MVFR1_EL1);
+ case SYS_MVFR2_EL1: return (u64)read_cpuid(MVFR2_EL1);
+
+ case SYS_ID_AA64PFR0_EL1: return (u64)read_cpuid(ID_AA64PFR0_EL1);
+ case SYS_ID_AA64PFR1_EL1: return (u64)read_cpuid(ID_AA64PFR0_EL1);
+ case SYS_ID_AA64DFR0_EL1: return (u64)read_cpuid(ID_AA64DFR0_EL1);
+ case SYS_ID_AA64DFR1_EL1: return (u64)read_cpuid(ID_AA64DFR0_EL1);
+ case SYS_ID_AA64MMFR0_EL1: return (u64)read_cpuid(ID_AA64MMFR0_EL1);
+ case SYS_ID_AA64MMFR1_EL1: return (u64)read_cpuid(ID_AA64MMFR1_EL1);
+ case SYS_ID_AA64ISAR0_EL1: return (u64)read_cpuid(ID_AA64ISAR0_EL1);
+ case SYS_ID_AA64ISAR1_EL1: return (u64)read_cpuid(ID_AA64ISAR1_EL1);
+
+ case SYS_CNTFRQ_EL0: return (u64)read_cpuid(CNTFRQ_EL0);
+ case SYS_CTR_EL0: return (u64)read_cpuid(CTR_EL0);
+ case SYS_DCZID_EL0: return (u64)read_cpuid(DCZID_EL0);
+ default:
+ BUG();
+ return 0;
+ }
+}
+
#include <linux/irqchip/arm-gic-v3.h>
static bool
@@ -600,19 +642,24 @@ feature_matches(u64 reg, const struct arm64_cpu_capabilities *entry)
}
static bool
-has_cpuid_feature(const struct arm64_cpu_capabilities *entry)
+has_cpuid_feature(const struct arm64_cpu_capabilities *entry, int scope)
{
u64 val;
- val = read_system_reg(entry->sys_reg);
+ WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
+ if (scope == SCOPE_SYSTEM)
+ val = read_system_reg(entry->sys_reg);
+ else
+ val = __raw_read_system_reg(entry->sys_reg);
+
return feature_matches(val, entry);
}
-static bool has_useable_gicv3_cpuif(const struct arm64_cpu_capabilities *entry)
+static bool has_useable_gicv3_cpuif(const struct arm64_cpu_capabilities *entry, int scope)
{
bool has_sre;
- if (!has_cpuid_feature(entry))
+ if (!has_cpuid_feature(entry, scope))
return false;
has_sre = gic_enable_sre();
@@ -627,6 +674,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
{
.desc = "GIC system register CPU interface",
.capability = ARM64_HAS_SYSREG_GIC_CPUIF,
+ .def_scope = SCOPE_SYSTEM,
.matches = has_useable_gicv3_cpuif,
.sys_reg = SYS_ID_AA64PFR0_EL1,
.field_pos = ID_AA64PFR0_GIC_SHIFT,
@@ -636,6 +684,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
{
.desc = "Privileged Access Never",
.capability = ARM64_HAS_PAN,
+ .def_scope = SCOPE_SYSTEM,
.matches = has_cpuid_feature,
.sys_reg = SYS_ID_AA64MMFR1_EL1,
.field_pos = ID_AA64MMFR1_PAN_SHIFT,
@@ -647,6 +696,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
{
.desc = "LSE atomic instructions",
.capability = ARM64_HAS_LSE_ATOMICS,
+ .def_scope = SCOPE_SYSTEM,
.matches = has_cpuid_feature,
.sys_reg = SYS_ID_AA64ISAR0_EL1,
.field_pos = ID_AA64ISAR0_ATOMICS_SHIFT,
@@ -656,6 +706,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
{
.desc = "32-bit EL0 Support",
.capability = ARM64_HAS_32BIT_EL0,
+ .def_scope = SCOPE_SYSTEM,
.matches = has_cpuid_feature,
.sys_reg = SYS_ID_AA64PFR0_EL1,
.field_pos = ID_AA64PFR0_EL0_SHIFT,
@@ -667,6 +718,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
#define HWCAP_CAP(reg, field, min_value, type, cap) \
{ \
.desc = #cap, \
+ .def_scope = SCOPE_SYSTEM, \
.matches = has_cpuid_feature, \
.sys_reg = reg, \
.field_pos = field, \
@@ -745,7 +797,7 @@ static void setup_cpu_hwcaps(void)
const struct arm64_cpu_capabilities *hwcaps = arm64_hwcaps;
for (i = 0; hwcaps[i].matches; i++)
- if (hwcaps[i].matches(&hwcaps[i]))
+ if (hwcaps[i].matches(&hwcaps[i], hwcaps[i].def_scope))
cap_set_hwcap(&hwcaps[i]);
}
@@ -755,7 +807,7 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
int i;
for (i = 0; caps[i].matches; i++) {
- if (!caps[i].matches(&caps[i]))
+ if (!caps[i].matches(&caps[i], caps[i].def_scope))
continue;
if (!cpus_have_cap(caps[i].capability) && caps[i].desc)
@@ -800,47 +852,6 @@ static inline void set_sys_caps_initialised(void)
sys_caps_initialised = true;
}
-/*
- * __raw_read_system_reg() - Used by a STARTING cpu before cpuinfo is populated.
- */
-static u64 __raw_read_system_reg(u32 sys_id)
-{
- switch (sys_id) {
- case SYS_ID_PFR0_EL1: return (u64)read_cpuid(ID_PFR0_EL1);
- case SYS_ID_PFR1_EL1: return (u64)read_cpuid(ID_PFR1_EL1);
- case SYS_ID_DFR0_EL1: return (u64)read_cpuid(ID_DFR0_EL1);
- case SYS_ID_MMFR0_EL1: return (u64)read_cpuid(ID_MMFR0_EL1);
- case SYS_ID_MMFR1_EL1: return (u64)read_cpuid(ID_MMFR1_EL1);
- case SYS_ID_MMFR2_EL1: return (u64)read_cpuid(ID_MMFR2_EL1);
- case SYS_ID_MMFR3_EL1: return (u64)read_cpuid(ID_MMFR3_EL1);
- case SYS_ID_ISAR0_EL1: return (u64)read_cpuid(ID_ISAR0_EL1);
- case SYS_ID_ISAR1_EL1: return (u64)read_cpuid(ID_ISAR1_EL1);
- case SYS_ID_ISAR2_EL1: return (u64)read_cpuid(ID_ISAR2_EL1);
- case SYS_ID_ISAR3_EL1: return (u64)read_cpuid(ID_ISAR3_EL1);
- case SYS_ID_ISAR4_EL1: return (u64)read_cpuid(ID_ISAR4_EL1);
- case SYS_ID_ISAR5_EL1: return (u64)read_cpuid(ID_ISAR4_EL1);
- case SYS_MVFR0_EL1: return (u64)read_cpuid(MVFR0_EL1);
- case SYS_MVFR1_EL1: return (u64)read_cpuid(MVFR1_EL1);
- case SYS_MVFR2_EL1: return (u64)read_cpuid(MVFR2_EL1);
-
- case SYS_ID_AA64PFR0_EL1: return (u64)read_cpuid(ID_AA64PFR0_EL1);
- case SYS_ID_AA64PFR1_EL1: return (u64)read_cpuid(ID_AA64PFR0_EL1);
- case SYS_ID_AA64DFR0_EL1: return (u64)read_cpuid(ID_AA64DFR0_EL1);
- case SYS_ID_AA64DFR1_EL1: return (u64)read_cpuid(ID_AA64DFR0_EL1);
- case SYS_ID_AA64MMFR0_EL1: return (u64)read_cpuid(ID_AA64MMFR0_EL1);
- case SYS_ID_AA64MMFR1_EL1: return (u64)read_cpuid(ID_AA64MMFR1_EL1);
- case SYS_ID_AA64ISAR0_EL1: return (u64)read_cpuid(ID_AA64ISAR0_EL1);
- case SYS_ID_AA64ISAR1_EL1: return (u64)read_cpuid(ID_AA64ISAR1_EL1);
-
- case SYS_CNTFRQ_EL0: return (u64)read_cpuid(CNTFRQ_EL0);
- case SYS_CTR_EL0: return (u64)read_cpuid(CTR_EL0);
- case SYS_DCZID_EL0: return (u64)read_cpuid(DCZID_EL0);
- default:
- BUG();
- return 0;
- }
-}
-
/*
* Park the CPU which doesn't have the capability as advertised
* by the system.
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 14/44] arm64: Introduce cpu_die_early
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (12 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 13/44] arm64: cpufeature: Add scope for capability check Viresh Kumar
@ 2019-08-29 11:33 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 15/44] arm64: Add a helper for parking CPUs in a loop Viresh Kumar
` (30 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:33 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit ee02a15919cf86c004142edaa05b43f7ff10edf0 upstream.
Or in other words, make fail_incapable_cpu() reusable.
We use fail_incapable_cpu() to kill a secondary CPU early during the
bringup, which doesn't have the system advertised capabilities.
This patch makes the routine more generic, to kill a secondary
booting CPU, getting rid of the dependency on capability struct.
This can be used by checks which are not necessarily attached to
a capability struct (e.g, cpu ASIDBits).
In that process, renames the function to cpu_die_early() to better
match its functionality. This will be moved to arch/arm64/kernel/smp.c
later.
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpufeature.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index d0c82bc02de4..b7f01bf47988 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -853,15 +853,15 @@ static inline void set_sys_caps_initialised(void)
}
/*
- * Park the CPU which doesn't have the capability as advertised
- * by the system.
+ * Kill the calling secondary CPU, early in bringup before it is turned
+ * online.
*/
-static void fail_incapable_cpu(char *cap_type,
- const struct arm64_cpu_capabilities *cap)
+void cpu_die_early(void)
{
int cpu = smp_processor_id();
- pr_crit("CPU%d: missing %s : %s\n", cpu, cap_type, cap->desc);
+ pr_crit("CPU%d: will not boot\n", cpu);
+
/* Mark this CPU absent */
set_cpu_present(cpu, 0);
@@ -902,8 +902,11 @@ void verify_local_cpu_capabilities(void)
* If the new CPU misses an advertised feature, we cannot proceed
* further, park the cpu.
*/
- if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
- fail_incapable_cpu("arm64_features", &caps[i]);
+ if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i])) {
+ pr_crit("CPU%d: missing feature: %s\n",
+ smp_processor_id(), caps[i].desc);
+ cpu_die_early();
+ }
if (caps[i].enable)
caps[i].enable(NULL);
}
@@ -911,8 +914,11 @@ void verify_local_cpu_capabilities(void)
for (i = 0, caps = arm64_hwcaps; caps[i].matches; i++) {
if (!cpus_have_hwcap(&caps[i]))
continue;
- if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
- fail_incapable_cpu("arm64_hwcaps", &caps[i]);
+ if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i])) {
+ pr_crit("CPU%d: missing HWCAP: %s\n",
+ smp_processor_id(), caps[i].desc);
+ cpu_die_early();
+ }
}
}
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 15/44] arm64: Add a helper for parking CPUs in a loop
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (13 preceding siblings ...)
2019-08-29 11:33 ` [PATCH ARM64 v4.4 V3 14/44] arm64: Introduce cpu_die_early Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 16/44] arm64: Move cpu_die_early to smp.c Viresh Kumar
` (29 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
Commit c4bc34d20273db698c51951a1951dba0a722e162 upstream.
Adds a routine which can be used to park CPUs (spinning in kernel)
when they can't be killed.
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/smp.h | 8 ++++++++
arch/arm64/kernel/cpufeature.c | 5 +----
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h
index d9c3d6a6100a..53b53a9b3e5a 100644
--- a/arch/arm64/include/asm/smp.h
+++ b/arch/arm64/include/asm/smp.h
@@ -69,4 +69,12 @@ extern int __cpu_disable(void);
extern void __cpu_die(unsigned int cpu);
extern void cpu_die(void);
+static inline void cpu_park_loop(void)
+{
+ for (;;) {
+ wfe();
+ wfi();
+ }
+}
+
#endif /* ifndef __ASM_SMP_H */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index b7f01bf47988..4adf18307568 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -868,10 +868,7 @@ void cpu_die_early(void)
/* Check if we can park ourselves */
if (cpu_ops[cpu] && cpu_ops[cpu]->cpu_die)
cpu_ops[cpu]->cpu_die(cpu);
- asm(
- "1: wfe\n"
- " wfi\n"
- " b 1b");
+ cpu_park_loop();
}
/*
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 16/44] arm64: Move cpu_die_early to smp.c
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (14 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 15/44] arm64: Add a helper for parking CPUs in a loop Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 17/44] arm64: Verify CPU errata work arounds on hotplugged CPU Viresh Kumar
` (28 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
Commit fce6361fe9b0caeba0c05b7d72ceda406f8780df upstream.
This patch moves cpu_die_early to smp.c, where it fits better.
No functional changes, except for adding the necessary checks
for CONFIG_HOTPLUG_CPU.
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/smp.h | 1 +
arch/arm64/kernel/cpufeature.c | 19 -------------------
arch/arm64/kernel/smp.c | 22 ++++++++++++++++++++++
3 files changed, 23 insertions(+), 19 deletions(-)
diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h
index 53b53a9b3e5a..32e75ee21d5e 100644
--- a/arch/arm64/include/asm/smp.h
+++ b/arch/arm64/include/asm/smp.h
@@ -68,6 +68,7 @@ extern int __cpu_disable(void);
extern void __cpu_die(unsigned int cpu);
extern void cpu_die(void);
+extern void cpu_die_early(void);
static inline void cpu_park_loop(void)
{
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 4adf18307568..a0273cd8be51 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -852,25 +852,6 @@ static inline void set_sys_caps_initialised(void)
sys_caps_initialised = true;
}
-/*
- * Kill the calling secondary CPU, early in bringup before it is turned
- * online.
- */
-void cpu_die_early(void)
-{
- int cpu = smp_processor_id();
-
- pr_crit("CPU%d: will not boot\n", cpu);
-
- /* Mark this CPU absent */
- set_cpu_present(cpu, 0);
-
- /* Check if we can park ourselves */
- if (cpu_ops[cpu] && cpu_ops[cpu]->cpu_die)
- cpu_ops[cpu]->cpu_die(cpu);
- cpu_park_loop();
-}
-
/*
* Run through the enabled system capabilities and enable() it on this CPU.
* The capabilities were decided based on the available CPUs at the boot time.
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 03c0946b79d2..23e8ae0c6305 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -312,6 +312,28 @@ void cpu_die(void)
}
#endif
+/*
+ * Kill the calling secondary CPU, early in bringup before it is turned
+ * online.
+ */
+void cpu_die_early(void)
+{
+ int cpu = smp_processor_id();
+
+ pr_crit("CPU%d: will not boot\n", cpu);
+
+ /* Mark this CPU absent */
+ set_cpu_present(cpu, 0);
+
+#ifdef CONFIG_HOTPLUG_CPU
+ /* Check if we can park ourselves */
+ if (cpu_ops[cpu] && cpu_ops[cpu]->cpu_die)
+ cpu_ops[cpu]->cpu_die(cpu);
+#endif
+
+ cpu_park_loop();
+}
+
static void __init hyp_mode_check(void)
{
if (is_hyp_mode_available())
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 17/44] arm64: Verify CPU errata work arounds on hotplugged CPU
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (15 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 16/44] arm64: Move cpu_die_early to smp.c Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 18/44] arm64: errata: Calling enable functions for CPU errata too Viresh Kumar
` (27 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 6a6efbb45b7d95c84840010095367eb06a64f342 upstream.
CPU Errata work arounds are detected and applied to the
kernel code at boot time and the data is then freed up.
If a new hotplugged CPU requires a work around which
was not applied at boot time, there is nothing we can
do but simply fail the booting.
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
[ Viresh: Resolved rebase conflict ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cpufeature.h | 2 ++
arch/arm64/kernel/cpu_errata.c | 20 ++++++++++++++++++++
arch/arm64/kernel/cpufeature.c | 2 ++
3 files changed, 24 insertions(+)
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 4c31e14c0f0e..dd1aab8e52aa 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -173,6 +173,8 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
const char *info);
void check_local_cpu_errata(void);
+void verify_local_cpu_errata(void);
+
#ifdef CONFIG_HOTPLUG_CPU
void verify_local_cpu_capabilities(void);
#else
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 0971d80d3623..a3567881c01b 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -116,6 +116,26 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
}
};
+/*
+ * The CPU Errata work arounds are detected and applied at boot time
+ * and the related information is freed soon after. If the new CPU requires
+ * an errata not detected at boot, fail this CPU.
+ */
+void verify_local_cpu_errata(void)
+{
+ const struct arm64_cpu_capabilities *caps = arm64_errata;
+
+ for (; caps->matches; caps++)
+ if (!cpus_have_cap(caps->capability) &&
+ caps->matches(caps, SCOPE_LOCAL_CPU)) {
+ pr_crit("CPU%d: Requires work around for %s, not detected"
+ " at boot time\n",
+ smp_processor_id(),
+ caps->desc ? : "an erratum");
+ cpu_die_early();
+ }
+}
+
void check_local_cpu_errata(void)
{
update_cpu_capabilities(arm64_errata, "enabling workaround for");
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index a0273cd8be51..9a4b638b1c18 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -872,6 +872,8 @@ void verify_local_cpu_capabilities(void)
if (!sys_caps_initialised)
return;
+ verify_local_cpu_errata();
+
caps = arm64_features;
for (i = 0; caps[i].matches; i++) {
if (!cpus_have_cap(caps[i].capability) || !caps[i].sys_reg)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 18/44] arm64: errata: Calling enable functions for CPU errata too
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (16 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 17/44] arm64: Verify CPU errata work arounds on hotplugged CPU Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 19/44] arm64: Rearrange CPU errata workaround checks Viresh Kumar
` (26 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Andre Przywara <andre.przywara@arm.com>
commit 8e2318521bf5837dae093413f81292b59d49d030 upstream.
Currently we call the (optional) enable function for CPU _features_
only. As CPU _errata_ descriptions share the same data structure and
having an enable function is useful for errata as well (for instance
to set bits in SCTLR), lets call it when enumerating erratas too.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cpufeature.h | 2 ++
arch/arm64/kernel/cpu_errata.c | 5 +++++
arch/arm64/kernel/cpufeature.c | 3 ++-
3 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index dd1aab8e52aa..0267bab6ac18 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -171,7 +171,9 @@ void __init setup_cpu_features(void);
void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
const char *info);
+void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps);
void check_local_cpu_errata(void);
+void __init enable_errata_workarounds(void);
void verify_local_cpu_errata(void);
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index a3567881c01b..d9f095439011 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -140,3 +140,8 @@ void check_local_cpu_errata(void)
{
update_cpu_capabilities(arm64_errata, "enabling workaround for");
}
+
+void __init enable_errata_workarounds(void)
+{
+ enable_cpu_capabilities(arm64_errata);
+}
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 9a4b638b1c18..7773bea6927e 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -820,7 +820,7 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
* Run through the enabled capabilities and enable() it on all active
* CPUs
*/
-static void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
+void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
{
int i;
@@ -923,6 +923,7 @@ void __init setup_cpu_features(void)
/* Set the CPU feature capabilies */
setup_feature_capabilities();
+ enable_errata_workarounds();
setup_cpu_hwcaps();
/* Advertise that we have computed the system capabilities */
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 19/44] arm64: Rearrange CPU errata workaround checks
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (17 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 18/44] arm64: errata: Calling enable functions for CPU errata too Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 20/44] arm64: Run enable method for errata work arounds on late CPUs Viresh Kumar
` (25 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit c47a1900ad710fd2c97127e2ba19da1df79cf733 upstream.
Right now we run through the work around checks on a CPU
from __cpuinfo_store_cpu. There are some problems with that:
1) We initialise the system wide CPU feature registers only after the
Boot CPU updates its cpuinfo. Now, if a work around depends on the
variance of a CPU ID feature (e.g, check for Cache Line size mismatch),
we have no way of performing it cleanly for the boot CPU.
2) It is out of place, invoked from __cpuinfo_store_cpu() in cpuinfo.c. It
is not an obvious place for that.
This patch rearranges the CPU specific capability(aka work around) checks.
1) At the moment we use verify_local_cpu_capabilities() to check if a new
CPU has all the system advertised features. Use this for the secondary CPUs
to perform the work around check. For that we rename
verify_local_cpu_capabilities() => check_local_cpu_capabilities()
which:
If the system wide capabilities haven't been initialised (i.e, the CPU
is activated at the boot), update the system wide detected work arounds.
Otherwise (i.e a CPU hotplugged in later) verify that this CPU conforms to the
system wide capabilities.
2) Boot CPU updates the work arounds from smp_prepare_boot_cpu() after we have
initialised the system wide CPU feature values.
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cpufeature.h | 8 +-------
arch/arm64/kernel/cpufeature.c | 23 +++++++++++++++--------
arch/arm64/kernel/cpuinfo.c | 2 --
arch/arm64/kernel/smp.c | 8 +++++++-
4 files changed, 23 insertions(+), 18 deletions(-)
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 0267bab6ac18..1bc51f8835e5 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -177,13 +177,7 @@ void __init enable_errata_workarounds(void);
void verify_local_cpu_errata(void);
-#ifdef CONFIG_HOTPLUG_CPU
-void verify_local_cpu_capabilities(void);
-#else
-static inline void verify_local_cpu_capabilities(void)
-{
-}
-#endif
+void check_local_cpu_capabilities(void);
u64 read_system_reg(u32 id);
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 7773bea6927e..c74df3ca000e 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -860,18 +860,11 @@ static inline void set_sys_caps_initialised(void)
* cannot do anything to fix it up and could cause unexpected failures. So
* we park the CPU.
*/
-void verify_local_cpu_capabilities(void)
+static void verify_local_cpu_capabilities(void)
{
int i;
const struct arm64_cpu_capabilities *caps;
- /*
- * If we haven't computed the system capabilities, there is nothing
- * to verify.
- */
- if (!sys_caps_initialised)
- return;
-
verify_local_cpu_errata();
caps = arm64_features;
@@ -902,6 +895,20 @@ void verify_local_cpu_capabilities(void)
}
}
+void check_local_cpu_capabilities(void)
+{
+ /*
+ * If we haven't finalised the system capabilities, this CPU gets
+ * a chance to update the errata work arounds.
+ * Otherwise, this CPU should verify that it has all the system
+ * advertised capabilities.
+ */
+ if (!sys_caps_initialised)
+ check_local_cpu_errata();
+ else
+ verify_local_cpu_capabilities();
+}
+
#else /* !CONFIG_HOTPLUG_CPU */
static inline void set_sys_caps_initialised(void)
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 0166cfbc866c..13e659fda04a 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -239,8 +239,6 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
info->reg_mvfr2 = read_cpuid(MVFR2_EL1);
cpuinfo_detect_icache_policy(info);
-
- check_local_cpu_errata();
}
void cpuinfo_store_cpu(void)
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 23e8ae0c6305..02b76bb78d59 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -161,7 +161,7 @@ asmlinkage notrace void secondary_start_kernel(void)
* this CPU ticks all of those. If it doesn't, the CPU will
* fail to come online.
*/
- verify_local_cpu_capabilities();
+ check_local_cpu_capabilities();
if (cpu_ops[cpu]->cpu_postboot)
cpu_ops[cpu]->cpu_postboot();
@@ -357,6 +357,12 @@ void __init smp_prepare_boot_cpu(void)
{
set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
cpuinfo_store_boot_cpu();
+ /*
+ * Run the errata work around checks on the boot CPU, once we have
+ * initialised the cpu feature infrastructure from
+ * cpuinfo_store_boot_cpu() above.
+ */
+ check_local_cpu_errata();
}
static u64 __init of_get_cpu_mpidr(struct device_node *dn)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 20/44] arm64: Run enable method for errata work arounds on late CPUs
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (18 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 19/44] arm64: Rearrange CPU errata workaround checks Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 21/44] arm64: cpufeature: Pass capability structure to ->enable callback Viresh Kumar
` (24 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 55b35d070c2534dfb714b883f3c3ae05d02032da upstream.
When a CPU is brought up after we have finalised the system
wide capabilities (i.e, features and errata), we make sure the
new CPU doesn't need a new errata work around which has not been
detected already. However we don't run enable() method on the new
CPU for the errata work arounds already detected. This could
cause the new CPU running without potential work arounds.
It is upto the "enable()" method to decide if this CPU should
do something about the errata.
Fixes: commit 6a6efbb45b7d95c84 ("arm64: Verify CPU errata work arounds on hotplugged CPU")
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Dave Martin <dave.martin@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpu_errata.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index d9f095439011..047f1da59cb1 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -125,15 +125,18 @@ void verify_local_cpu_errata(void)
{
const struct arm64_cpu_capabilities *caps = arm64_errata;
- for (; caps->matches; caps++)
- if (!cpus_have_cap(caps->capability) &&
- caps->matches(caps, SCOPE_LOCAL_CPU)) {
+ for (; caps->matches; caps++) {
+ if (cpus_have_cap(caps->capability)) {
+ if (caps->enable)
+ caps->enable((void *)caps);
+ } else if (caps->matches(caps, SCOPE_LOCAL_CPU)) {
pr_crit("CPU%d: Requires work around for %s, not detected"
" at boot time\n",
smp_processor_id(),
caps->desc ? : "an erratum");
cpu_die_early();
}
+ }
}
void check_local_cpu_errata(void)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 21/44] arm64: cpufeature: Pass capability structure to ->enable callback
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (19 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 20/44] arm64: Run enable method for errata work arounds on late CPUs Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 22/44] drivers/firmware: Expose psci_get_version through psci_ops structure Viresh Kumar
` (23 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 0a0d111d40fd1dc588cc590fab6b55d86ddc71d3 upstream.
In order to invoke the CPU capability ->matches callback from the ->enable
callback for applying local-CPU workarounds, we need a handle on the
capability structure.
This patch passes a pointer to the capability structure to the ->enable
callback.
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Use &caps[i] instead as caps isn't incremented ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpufeature.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index c74df3ca000e..474b34243521 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -832,7 +832,7 @@ void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
* uses an IPI, giving us a PSTATE that disappears when
* we return.
*/
- stop_machine(caps[i].enable, NULL, cpu_online_mask);
+ stop_machine(caps[i].enable, (void *)&caps[i], cpu_online_mask);
}
#ifdef CONFIG_HOTPLUG_CPU
@@ -881,7 +881,7 @@ static void verify_local_cpu_capabilities(void)
cpu_die_early();
}
if (caps[i].enable)
- caps[i].enable(NULL);
+ caps[i].enable((void *)&caps[i]);
}
for (i = 0, caps = arm64_hwcaps; caps[i].matches; i++) {
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 22/44] drivers/firmware: Expose psci_get_version through psci_ops structure
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (20 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 21/44] arm64: cpufeature: Pass capability structure to ->enable callback Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 23/44] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Viresh Kumar
` (22 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit d68e3ba5303f7e1099f51fdcd155f5263da8569b upstream.
Entry into recent versions of ARM Trusted Firmware will invalidate the CPU
branch predictor state in order to protect against aliasing attacks.
This patch exposes the PSCI "VERSION" function via psci_ops, so that it
can be invoked outside of the PSCI driver where necessary.
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
drivers/firmware/psci.c | 2 ++
include/linux/psci.h | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c
index ae70d2485ca1..290f8982e7b3 100644
--- a/drivers/firmware/psci.c
+++ b/drivers/firmware/psci.c
@@ -305,6 +305,8 @@ static void __init psci_init_migrate(void)
static void __init psci_0_2_set_functions(void)
{
pr_info("Using standard PSCI v0.2 function IDs\n");
+ psci_ops.get_version = psci_get_version;
+
psci_function_id[PSCI_FN_CPU_SUSPEND] =
PSCI_FN_NATIVE(0_2, CPU_SUSPEND);
psci_ops.cpu_suspend = psci_cpu_suspend;
diff --git a/include/linux/psci.h b/include/linux/psci.h
index 12c4865457ad..04b4d92c7791 100644
--- a/include/linux/psci.h
+++ b/include/linux/psci.h
@@ -25,6 +25,7 @@ bool psci_power_state_loses_context(u32 state);
bool psci_power_state_is_valid(u32 state);
struct psci_operations {
+ u32 (*get_version)(void);
int (*cpu_suspend)(u32 state, unsigned long entry_point);
int (*cpu_off)(u32 state);
int (*cpu_on)(unsigned long cpuid, unsigned long entry_point);
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 23/44] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (21 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 22/44] drivers/firmware: Expose psci_get_version through psci_ops structure Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 24/44] arm64: Move post_ttbr_update_workaround to C code Viresh Kumar
` (21 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Catalin Marinas <catalin.marinas@arm.com>
commit f33bcf03e6079668da6bf4eec4a7dcf9289131d0 upstream.
This patch takes the errata workaround code out of cpu_do_switch_mm into
a dedicated post_ttbr0_update_workaround macro which will be reused in a
subsequent patch.
Cc: Will Deacon <will.deacon@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Kees Cook <keescook@chromium.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Included cpufeature.h and adapted to use alternative_if_not ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/assembler.h | 18 ++++++++++++++++++
arch/arm64/mm/proc.S | 11 +----------
2 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 2b30363a3a89..8ab46508e836 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -23,6 +23,7 @@
#ifndef __ASM_ASSEMBLER_H
#define __ASM_ASSEMBLER_H
+#include <asm/cpufeature.h>
#include <asm/cputype.h>
#include <asm/ptrace.h>
#include <asm/thread_info.h>
@@ -282,4 +283,21 @@ lr .req x30 // link register
.Ldone\@:
.endm
+/*
+ * Errata workaround post TTBR0_EL1 update.
+ */
+ .macro post_ttbr0_update_workaround
+#ifdef CONFIG_CAVIUM_ERRATUM_27456
+alternative_if_not ARM64_WORKAROUND_CAVIUM_27456
+ ret
+ nop
+ nop
+ nop
+alternative_else
+ ic iallu
+ dsb nsh
+ isb
+#endif
+ .endm
+
#endif /* __ASM_ASSEMBLER_H */
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index f09636738007..4eb1084e203a 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -139,17 +139,8 @@ ENTRY(cpu_do_switch_mm)
bfi x0, x1, #48, #16 // set the ASID
msr ttbr0_el1, x0 // set TTBR0
isb
-alternative_if_not ARM64_WORKAROUND_CAVIUM_27456
+ post_ttbr0_update_workaround
ret
- nop
- nop
- nop
-alternative_else
- ic iallu
- dsb nsh
- isb
- ret
-alternative_endif
ENDPROC(cpu_do_switch_mm)
.section ".text.init", #alloc, #execinstr
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 24/44] arm64: Move post_ttbr_update_workaround to C code
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (22 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 23/44] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 25/44] arm64: Add skeleton to harden the branch predictor against aliasing attacks Viresh Kumar
` (20 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 95e3de3590e3f2358bb13f013911bc1bfa5d3f53 upstream.
We will soon need to invoke a CPU-specific function pointer after changing
page tables, so move post_ttbr_update_workaround out into C code to make
this possible.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Removed cpufeature.h, included alternative.h, dropped entry.S
changes and adapted to drop alternative_if_not ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/assembler.h | 18 ------------------
arch/arm64/mm/context.c | 10 ++++++++++
arch/arm64/mm/proc.S | 3 +--
3 files changed, 11 insertions(+), 20 deletions(-)
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 8ab46508e836..2b30363a3a89 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -23,7 +23,6 @@
#ifndef __ASM_ASSEMBLER_H
#define __ASM_ASSEMBLER_H
-#include <asm/cpufeature.h>
#include <asm/cputype.h>
#include <asm/ptrace.h>
#include <asm/thread_info.h>
@@ -283,21 +282,4 @@ lr .req x30 // link register
.Ldone\@:
.endm
-/*
- * Errata workaround post TTBR0_EL1 update.
- */
- .macro post_ttbr0_update_workaround
-#ifdef CONFIG_CAVIUM_ERRATUM_27456
-alternative_if_not ARM64_WORKAROUND_CAVIUM_27456
- ret
- nop
- nop
- nop
-alternative_else
- ic iallu
- dsb nsh
- isb
-#endif
- .endm
-
#endif /* __ASM_ASSEMBLER_H */
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index e87f53ff5f58..492d2968fa8f 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -22,6 +22,7 @@
#include <linux/slab.h>
#include <linux/mm.h>
+#include <asm/alternative.h>
#include <asm/cpufeature.h>
#include <asm/mmu_context.h>
#include <asm/tlbflush.h>
@@ -185,6 +186,15 @@ void check_and_switch_context(struct mm_struct *mm, unsigned int cpu)
cpu_switch_mm(mm->pgd, mm);
}
+/* Errata workaround post TTBRx_EL1 update. */
+asmlinkage void post_ttbr_update_workaround(void)
+{
+ asm(ALTERNATIVE("nop; nop; nop",
+ "ic iallu; dsb nsh; isb",
+ ARM64_WORKAROUND_CAVIUM_27456,
+ CONFIG_CAVIUM_ERRATUM_27456));
+}
+
static int asids_init(void)
{
int fld = cpuid_feature_extract_field(read_cpuid(ID_AA64MMFR0_EL1), 4);
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 4eb1084e203a..a70b712ca94a 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -139,8 +139,7 @@ ENTRY(cpu_do_switch_mm)
bfi x0, x1, #48, #16 // set the ASID
msr ttbr0_el1, x0 // set TTBR0
isb
- post_ttbr0_update_workaround
- ret
+ b post_ttbr_update_workaround // Back to C code...
ENDPROC(cpu_do_switch_mm)
.section ".text.init", #alloc, #execinstr
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 25/44] arm64: Add skeleton to harden the branch predictor against aliasing attacks
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (23 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 24/44] arm64: Move post_ttbr_update_workaround to C code Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 26/44] arm64: Move BP hardening to check_and_switch_context Viresh Kumar
` (19 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 0f15adbb2861ce6f75ccfc5a92b19eae0ef327d0 upstream.
Aliasing attacks against CPU branch predictors can allow an attacker to
redirect speculative control flow on some CPUs and potentially divulge
information from one context to another.
This patch adds initial skeleton code behind a new Kconfig option to
enable implementation-specific mitigations against these attacks for
CPUs that are affected.
Co-developed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Changes made according to 4.4 codebase ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/Kconfig | 17 +++++++
arch/arm64/include/asm/cpufeature.h | 3 +-
arch/arm64/include/asm/mmu.h | 39 +++++++++++++++
arch/arm64/include/asm/sysreg.h | 2 +
arch/arm64/kernel/Makefile | 5 ++
arch/arm64/kernel/bpi.S | 55 +++++++++++++++++++++
arch/arm64/kernel/cpu_errata.c | 74 +++++++++++++++++++++++++++++
arch/arm64/kernel/cpufeature.c | 3 +-
arch/arm64/kernel/entry.S | 8 ++--
arch/arm64/mm/context.c | 2 +
arch/arm64/mm/fault.c | 16 +++++++
11 files changed, 219 insertions(+), 5 deletions(-)
create mode 100644 arch/arm64/kernel/bpi.S
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index f18b8c26a959..5fa01073566b 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -624,6 +624,23 @@ config FORCE_MAX_ZONEORDER
However for 4K, we choose a higher default value, 11 as opposed to 10, giving us
4M allocations matching the default size used by generic code.
+config HARDEN_BRANCH_PREDICTOR
+ bool "Harden the branch predictor against aliasing attacks" if EXPERT
+ default y
+ help
+ Speculation attacks against some high-performance processors rely on
+ being able to manipulate the branch predictor for a victim context by
+ executing aliasing branches in the attacker context. Such attacks
+ can be partially mitigated against by clearing internal branch
+ predictor state and limiting the prediction logic in some situations.
+
+ This config option will take CPU-specific actions to harden the
+ branch predictor against aliasing attacks and may rely on specific
+ instruction sequences or control bits being set by the system
+ firmware.
+
+ If unsure, say Y.
+
menuconfig ARMV8_DEPRECATED
bool "Emulate deprecated/obsolete ARMv8 instructions"
depends on COMPAT
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 1bc51f8835e5..93fb24d14d95 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -32,8 +32,9 @@
#define ARM64_WORKAROUND_834220 7
#define ARM64_WORKAROUND_CAVIUM_27456 8
#define ARM64_HAS_32BIT_EL0 9
+#define ARM64_HARDEN_BRANCH_PREDICTOR 10
-#define ARM64_NCAPS 10
+#define ARM64_NCAPS 11
#ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index 990124a67eeb..8d0129210416 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -16,6 +16,8 @@
#ifndef __ASM_MMU_H
#define __ASM_MMU_H
+#include <linux/percpu.h>
+
typedef struct {
atomic64_t id;
void *vdso;
@@ -28,6 +30,43 @@ typedef struct {
*/
#define ASID(mm) ((mm)->context.id.counter & 0xffff)
+typedef void (*bp_hardening_cb_t)(void);
+
+struct bp_hardening_data {
+ int hyp_vectors_slot;
+ bp_hardening_cb_t fn;
+};
+
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+extern char __bp_harden_hyp_vecs_start[], __bp_harden_hyp_vecs_end[];
+
+DECLARE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
+
+static inline struct bp_hardening_data *arm64_get_bp_hardening_data(void)
+{
+ return this_cpu_ptr(&bp_hardening_data);
+}
+
+static inline void arm64_apply_bp_hardening(void)
+{
+ struct bp_hardening_data *d;
+
+ if (!cpus_have_cap(ARM64_HARDEN_BRANCH_PREDICTOR))
+ return;
+
+ d = arm64_get_bp_hardening_data();
+ if (d->fn)
+ d->fn();
+}
+#else
+static inline struct bp_hardening_data *arm64_get_bp_hardening_data(void)
+{
+ return NULL;
+}
+
+static inline void arm64_apply_bp_hardening(void) { }
+#endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
+
extern void paging_init(void);
extern void __iomem *early_io_map(phys_addr_t phys, unsigned long virt);
extern void init_mem_pgprot(void);
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 50150320f80d..523b089fb408 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -95,6 +95,8 @@
#define ID_AA64ISAR0_AES_SHIFT 4
/* id_aa64pfr0 */
+#define ID_AA64PFR0_CSV2_SHIFT 56
+#define ID_AA64PFR0_SVE_SHIFT 32
#define ID_AA64PFR0_GIC_SHIFT 24
#define ID_AA64PFR0_ASIMD_SHIFT 20
#define ID_AA64PFR0_FP_SHIFT 16
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index 474691f8b13a..aa8f28210219 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -42,7 +42,12 @@ arm64-obj-$(CONFIG_PCI) += pci.o
arm64-obj-$(CONFIG_ARMV8_DEPRECATED) += armv8_deprecated.o
arm64-obj-$(CONFIG_ACPI) += acpi.o
+ifeq ($(CONFIG_KVM),y)
+arm64-obj-$(CONFIG_HARDEN_BRANCH_PREDICTOR) += bpi.o
+endif
+
obj-y += $(arm64-obj-y) vdso/
+
obj-m += $(arm64-obj-m)
head-y := head.o
extra-y += $(head-y) vmlinux.lds
diff --git a/arch/arm64/kernel/bpi.S b/arch/arm64/kernel/bpi.S
new file mode 100644
index 000000000000..06a931eb2673
--- /dev/null
+++ b/arch/arm64/kernel/bpi.S
@@ -0,0 +1,55 @@
+/*
+ * Contains CPU specific branch predictor invalidation sequences
+ *
+ * Copyright (C) 2018 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/linkage.h>
+
+.macro ventry target
+ .rept 31
+ nop
+ .endr
+ b \target
+.endm
+
+.macro vectors target
+ ventry \target + 0x000
+ ventry \target + 0x080
+ ventry \target + 0x100
+ ventry \target + 0x180
+
+ ventry \target + 0x200
+ ventry \target + 0x280
+ ventry \target + 0x300
+ ventry \target + 0x380
+
+ ventry \target + 0x400
+ ventry \target + 0x480
+ ventry \target + 0x500
+ ventry \target + 0x580
+
+ ventry \target + 0x600
+ ventry \target + 0x680
+ ventry \target + 0x700
+ ventry \target + 0x780
+.endm
+
+ .align 11
+ENTRY(__bp_harden_hyp_vecs_start)
+ .rept 4
+ vectors __kvm_hyp_vector
+ .endr
+ENTRY(__bp_harden_hyp_vecs_end)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 047f1da59cb1..19c51d1cd302 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -43,6 +43,80 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
return (midr >= entry->midr_range_min && midr <= entry->midr_range_max);
}
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+#include <asm/mmu_context.h>
+#include <asm/cacheflush.h>
+
+DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
+
+#ifdef CONFIG_KVM
+static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+{
+ void *dst = __bp_harden_hyp_vecs_start + slot * SZ_2K;
+ int i;
+
+ for (i = 0; i < SZ_2K; i += 0x80)
+ memcpy(dst + i, hyp_vecs_start, hyp_vecs_end - hyp_vecs_start);
+
+ flush_icache_range((uintptr_t)dst, (uintptr_t)dst + SZ_2K);
+}
+
+static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
+ const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+{
+ static int last_slot = -1;
+ static DEFINE_SPINLOCK(bp_lock);
+ int cpu, slot = -1;
+
+ spin_lock(&bp_lock);
+ for_each_possible_cpu(cpu) {
+ if (per_cpu(bp_hardening_data.fn, cpu) == fn) {
+ slot = per_cpu(bp_hardening_data.hyp_vectors_slot, cpu);
+ break;
+ }
+ }
+
+ if (slot == -1) {
+ last_slot++;
+ BUG_ON(((__bp_harden_hyp_vecs_end - __bp_harden_hyp_vecs_start)
+ / SZ_2K) <= last_slot);
+ slot = last_slot;
+ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
+ }
+
+ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+ __this_cpu_write(bp_hardening_data.fn, fn);
+ spin_unlock(&bp_lock);
+}
+#else
+static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
+ const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+{
+ __this_cpu_write(bp_hardening_data.fn, fn);
+}
+#endif /* CONFIG_KVM */
+
+static void install_bp_hardening_cb(const struct arm64_cpu_capabilities *entry,
+ bp_hardening_cb_t fn,
+ const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+{
+ u64 pfr0;
+
+ if (!entry->matches(entry, SCOPE_LOCAL_CPU))
+ return;
+
+ pfr0 = read_cpuid(ID_AA64PFR0_EL1);
+ if (cpuid_feature_extract_unsigned_field(pfr0, ID_AA64PFR0_CSV2_SHIFT))
+ return;
+
+ __install_bp_hardening_cb(fn, hyp_vecs_start, hyp_vecs_end);
+}
+#endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
+
#define MIDR_RANGE(model, min, max) \
.def_scope = SCOPE_LOCAL_CPU, \
.matches = is_affected_midr_range, \
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 474b34243521..07c39d1f4479 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -83,7 +83,8 @@ static struct arm64_ftr_bits ftr_id_aa64isar0[] = {
};
static struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
- ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 32, 32, 0),
+ ARM64_FTR_BITS(FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV2_SHIFT, 4, 0),
+ ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 32, 24, 0),
ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 28, 4, 0),
ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64PFR0_GIC_SHIFT, 4, 0),
ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index e6aec982dea9..05bfc71639fc 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -495,13 +495,15 @@ ENDPROC(el1_irq)
* Instruction abort handling
*/
mrs x26, far_el1
- // enable interrupts before calling the main handler
- enable_dbg_and_irq
+ msr daifclr, #(8 | 4 | 1)
+#ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off
+#endif
ct_user_exit
mov x0, x26
orr x1, x25, #1 << 24 // use reserved ISS bit for instruction aborts
mov x2, sp
- bl do_mem_abort
+ bl do_el0_ia_bp_hardening
b ret_to_user
el0_fpsimd_acc:
/*
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index 492d2968fa8f..be42bd3dca5c 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -193,6 +193,8 @@ asmlinkage void post_ttbr_update_workaround(void)
"ic iallu; dsb nsh; isb",
ARM64_WORKAROUND_CAVIUM_27456,
CONFIG_CAVIUM_ERRATUM_27456));
+
+ arm64_apply_bp_hardening();
}
static int asids_init(void)
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 89abdf9af4e6..1878c881a247 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -535,6 +535,22 @@ asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
arm64_notify_die("", regs, &info, esr);
}
+asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
+ unsigned int esr,
+ struct pt_regs *regs)
+{
+ /*
+ * We've taken an instruction abort from userspace and not yet
+ * re-enabled IRQs. If the address is a kernel address, apply
+ * BP hardening prior to enabling IRQs and pre-emption.
+ */
+ if (addr > TASK_SIZE)
+ arm64_apply_bp_hardening();
+
+ local_irq_enable();
+ do_mem_abort(addr, esr, regs);
+}
+
/*
* Handle stack alignment exceptions.
*/
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 26/44] arm64: Move BP hardening to check_and_switch_context
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (24 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 25/44] arm64: Add skeleton to harden the branch predictor against aliasing attacks Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 27/44] arm64: entry: Apply BP hardening for high-priority synchronous exceptions Viresh Kumar
` (18 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit a8e4c0a919ae310944ed2c9ace11cf3ccd8a609b upstream.
We call arm64_apply_bp_hardening() from post_ttbr_update_workaround,
which has the unexpected consequence of being triggered on every
exception return to userspace when ARM64_SW_TTBR0_PAN is selected,
even if no context switch actually occured.
This is a bit suboptimal, and it would be more logical to only
invalidate the branch predictor when we actually switch to
a different mm.
In order to solve this, move the call to arm64_apply_bp_hardening()
into check_and_switch_context(), where we're guaranteed to pick
a different mm context.
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/mm/context.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index be42bd3dca5c..de5afc27b4e6 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -183,6 +183,8 @@ void check_and_switch_context(struct mm_struct *mm, unsigned int cpu)
raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
switch_mm_fastpath:
+ arm64_apply_bp_hardening();
+
cpu_switch_mm(mm->pgd, mm);
}
@@ -193,8 +195,6 @@ asmlinkage void post_ttbr_update_workaround(void)
"ic iallu; dsb nsh; isb",
ARM64_WORKAROUND_CAVIUM_27456,
CONFIG_CAVIUM_ERRATUM_27456));
-
- arm64_apply_bp_hardening();
}
static int asids_init(void)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 27/44] arm64: entry: Apply BP hardening for high-priority synchronous exceptions
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (25 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 26/44] arm64: Move BP hardening to check_and_switch_context Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 28/44] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Viresh Kumar
` (17 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 5dfc6ed27710c42cbc15db5c0d4475699991da0a upstream.
Software-step and PC alignment fault exceptions have higher priority than
instruction abort exceptions, so apply the BP hardening hooks there too
if the user PC appears to reside in kernel space.
Reported-by: Dan Hettena <dhettena@nvidia.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Resolved rebase conflicts ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/entry.S | 6 ++++--
arch/arm64/mm/fault.c | 9 +++++++++
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 05bfc71639fc..42a141f01f3b 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -530,8 +530,10 @@ ENDPROC(el1_irq)
* Stack or PC alignment exception handling
*/
mrs x26, far_el1
- // enable interrupts before calling the main handler
- enable_dbg_and_irq
+ enable_dbg
+#ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off
+#endif
ct_user_exit
mov x0, x26
mov x1, x25
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 1878c881a247..082f385b6592 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -561,6 +561,12 @@ asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
struct siginfo info;
struct task_struct *tsk = current;
+ if (user_mode(regs)) {
+ if (instruction_pointer(regs) > TASK_SIZE)
+ arm64_apply_bp_hardening();
+ local_irq_enable();
+ }
+
if (show_unhandled_signals && unhandled_signal(tsk, SIGBUS))
pr_info_ratelimited("%s[%d]: %s exception: pc=%p sp=%p\n",
tsk->comm, task_pid_nr(tsk),
@@ -621,6 +627,9 @@ asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
if (interrupts_enabled(regs))
trace_hardirqs_off();
+ if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
+ arm64_apply_bp_hardening();
+
if (!inf->fn(addr_if_watchpoint, esr, regs)) {
rv = 1;
} else {
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 28/44] arm64: entry: Apply BP hardening for suspicious interrupts from EL0
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (26 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 27/44] arm64: entry: Apply BP hardening for high-priority synchronous exceptions Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 29/44] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 Viresh Kumar
` (16 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 30d88c0e3ace625a92eead9ca0ad94093a8f59fe upstream.
It is possible to take an IRQ from EL0 following a branch to a kernel
address in such a way that the IRQ is prioritised over the instruction
abort. Whilst an attacker would need to get the stars to align here,
it might be sufficient with enough calibration so perform BP hardening
in the rare case that we see a kernel address in the ELR when handling
an IRQ from EL0.
Reported-by: Dan Hettena <dhettena@nvidia.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/entry.S | 5 +++++
arch/arm64/mm/fault.c | 6 ++++++
2 files changed, 11 insertions(+)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 42a141f01f3b..1548be9732ce 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -582,6 +582,11 @@ ENDPROC(el0_sync)
#endif
ct_user_exit
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ tbz x22, #55, 1f
+ bl do_el0_irq_bp_hardening
+1:
+#endif
irq_handler
#ifdef CONFIG_TRACE_IRQFLAGS
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 082f385b6592..9ff48d083c4c 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -535,6 +535,12 @@ asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
arm64_notify_die("", regs, &info, esr);
}
+asmlinkage void __exception do_el0_irq_bp_hardening(void)
+{
+ /* PC has already been checked in entry.S */
+ arm64_apply_bp_hardening();
+}
+
asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
unsigned int esr,
struct pt_regs *regs)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 29/44] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (27 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 28/44] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 30/44] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core Viresh Kumar
` (15 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit a65d219fe5dc7887fd5ca04c2ac3e9a34feb8dfc upstream.
Hook up MIDR values for the Cortex-A72 and Cortex-A75 CPUs, since they
will soon need MIDR matches for hardening the branch predictor.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Add A73 values as well ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cputype.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index f43e10cfeda2..2a1f44646048 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -77,14 +77,20 @@
#define ARM_CPU_PART_AEM_V8 0xD0F
#define ARM_CPU_PART_FOUNDATION 0xD00
#define ARM_CPU_PART_CORTEX_A57 0xD07
+#define ARM_CPU_PART_CORTEX_A72 0xD08
#define ARM_CPU_PART_CORTEX_A53 0xD03
#define ARM_CPU_PART_CORTEX_A55 0xD05
+#define ARM_CPU_PART_CORTEX_A73 0xD09
+#define ARM_CPU_PART_CORTEX_A75 0xD0A
#define APM_CPU_PART_POTENZA 0x000
#define CAVIUM_CPU_PART_THUNDERX 0x0A1
#define MIDR_CORTEX_A55 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55)
+#define MIDR_CORTEX_A72 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
+#define MIDR_CORTEX_A73 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73)
+#define MIDR_CORTEX_A75 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A75)
#ifndef __ASSEMBLY__
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 30/44] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (28 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 29/44] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 31/44] arm64: Implement branch predictor hardening for affected Cortex-A CPUs Viresh Kumar
` (14 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 06f1494f837da8997d670a1ba87add7963b08922 upstream.
Some minor erratum may not be fixed in further revisions of a core,
leading to a situation where the workaround needs to be updated each
time an updated core is released.
Introduce a MIDR_ALL_VERSIONS match helper that will work for all
versions of that MIDR, once and for all.
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpu_errata.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 19c51d1cd302..80765feae955 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -124,6 +124,13 @@ static void install_bp_hardening_cb(const struct arm64_cpu_capabilities *entry,
.midr_range_min = min, \
.midr_range_max = max
+#define MIDR_ALL_VERSIONS(model) \
+ .def_scope = SCOPE_LOCAL_CPU, \
+ .matches = is_affected_midr_range, \
+ .midr_model = model, \
+ .midr_range_min = 0, \
+ .midr_range_max = (MIDR_VARIANT_MASK | MIDR_REVISION_MASK)
+
const struct arm64_cpu_capabilities arm64_errata[] = {
#if defined(CONFIG_ARM64_ERRATUM_826319) || \
defined(CONFIG_ARM64_ERRATUM_827319) || \
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 31/44] arm64: Implement branch predictor hardening for affected Cortex-A CPUs
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (29 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 30/44] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 32/44] arm64: cputype info for Broadcom Vulcan Viresh Kumar
` (13 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit aa6acde65e03186b5add8151e1ffe36c3c62639b upstream.
Cortex-A57, A72, A73 and A75 are susceptible to branch predictor aliasing
and can theoretically be attacked by malicious code.
This patch implements a PSCI-based mitigation for these CPUs when available.
The call into firmware will invalidate the branch predictor state, preventing
any malicious entries from affecting other victim contexts.
Co-developed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/bpi.S | 24 +++++++++++++++++++
arch/arm64/kernel/cpu_errata.c | 42 ++++++++++++++++++++++++++++++++++
2 files changed, 66 insertions(+)
diff --git a/arch/arm64/kernel/bpi.S b/arch/arm64/kernel/bpi.S
index 06a931eb2673..dec95bd82e31 100644
--- a/arch/arm64/kernel/bpi.S
+++ b/arch/arm64/kernel/bpi.S
@@ -53,3 +53,27 @@ ENTRY(__bp_harden_hyp_vecs_start)
vectors __kvm_hyp_vector
.endr
ENTRY(__bp_harden_hyp_vecs_end)
+ENTRY(__psci_hyp_bp_inval_start)
+ sub sp, sp, #(8 * 18)
+ stp x16, x17, [sp, #(16 * 0)]
+ stp x14, x15, [sp, #(16 * 1)]
+ stp x12, x13, [sp, #(16 * 2)]
+ stp x10, x11, [sp, #(16 * 3)]
+ stp x8, x9, [sp, #(16 * 4)]
+ stp x6, x7, [sp, #(16 * 5)]
+ stp x4, x5, [sp, #(16 * 6)]
+ stp x2, x3, [sp, #(16 * 7)]
+ stp x0, x1, [sp, #(16 * 8)]
+ mov x0, #0x84000000
+ smc #0
+ ldp x16, x17, [sp, #(16 * 0)]
+ ldp x14, x15, [sp, #(16 * 1)]
+ ldp x12, x13, [sp, #(16 * 2)]
+ ldp x10, x11, [sp, #(16 * 3)]
+ ldp x8, x9, [sp, #(16 * 4)]
+ ldp x6, x7, [sp, #(16 * 5)]
+ ldp x4, x5, [sp, #(16 * 6)]
+ ldp x2, x3, [sp, #(16 * 7)]
+ ldp x0, x1, [sp, #(16 * 8)]
+ add sp, sp, #(8 * 18)
+ENTRY(__psci_hyp_bp_inval_end)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 80765feae955..dbd7b944a37e 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -50,6 +50,8 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
#ifdef CONFIG_KVM
+extern char __psci_hyp_bp_inval_start[], __psci_hyp_bp_inval_end[];
+
static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
const char *hyp_vecs_end)
{
@@ -91,6 +93,9 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
spin_unlock(&bp_lock);
}
#else
+#define __psci_hyp_bp_inval_start NULL
+#define __psci_hyp_bp_inval_end NULL
+
static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
const char *hyp_vecs_start,
const char *hyp_vecs_end)
@@ -115,6 +120,21 @@ static void install_bp_hardening_cb(const struct arm64_cpu_capabilities *entry,
__install_bp_hardening_cb(fn, hyp_vecs_start, hyp_vecs_end);
}
+
+#include <linux/psci.h>
+
+static int enable_psci_bp_hardening(void *data)
+{
+ const struct arm64_cpu_capabilities *entry = data;
+
+ if (psci_ops.get_version)
+ install_bp_hardening_cb(entry,
+ (bp_hardening_cb_t)psci_ops.get_version,
+ __psci_hyp_bp_inval_start,
+ __psci_hyp_bp_inval_end);
+
+ return 0;
+}
#endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
#define MIDR_RANGE(model, min, max) \
@@ -192,6 +212,28 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
MIDR_RANGE(MIDR_THUNDERX, 0x00,
(1 << MIDR_VARIANT_SHIFT) | 1),
},
+#endif
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
+ .enable = enable_psci_bp_hardening,
+ },
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
+ .enable = enable_psci_bp_hardening,
+ },
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+ .enable = enable_psci_bp_hardening,
+ },
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A75),
+ .enable = enable_psci_bp_hardening,
+ },
#endif
{
}
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 32/44] arm64: cputype info for Broadcom Vulcan
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (30 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 31/44] arm64: Implement branch predictor hardening for affected Cortex-A CPUs Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 33/44] arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs Viresh Kumar
` (12 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Jayachandran C <jchandra@broadcom.com>
commit 9eb8a2cdf65ce47c3aa68f1297c84d8bcf5a7b3a upstream.
Add Broadcom Vulcan implementor ID and part ID in cputype.h. This is
to document the values.
Signed-off-by: Jayachandran C <jchandra@broadcom.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cputype.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 2a1f44646048..c6976dd6c32a 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -73,6 +73,7 @@
#define ARM_CPU_IMP_ARM 0x41
#define ARM_CPU_IMP_APM 0x50
#define ARM_CPU_IMP_CAVIUM 0x43
+#define ARM_CPU_IMP_BRCM 0x42
#define ARM_CPU_PART_AEM_V8 0xD0F
#define ARM_CPU_PART_FOUNDATION 0xD00
@@ -87,6 +88,8 @@
#define CAVIUM_CPU_PART_THUNDERX 0x0A1
+#define BRCM_CPU_PART_VULCAN 0x516
+
#define MIDR_CORTEX_A55 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55)
#define MIDR_CORTEX_A72 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
#define MIDR_CORTEX_A73 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73)
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 33/44] arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (31 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 32/44] arm64: cputype info for Broadcom Vulcan Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 34/44] arm64: Branch predictor hardening for Cavium ThunderX2 Viresh Kumar
` (11 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Jayachandran C <jnair@caviumnetworks.com>
commit 0d90718871fe80f019b7295ec9d2b23121e396fb upstream.
Add the older Broadcom ID as well as the new Cavium ID for ThunderX2
CPUs.
Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/cputype.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index c6976dd6c32a..9cc7d485c812 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -87,6 +87,7 @@
#define APM_CPU_PART_POTENZA 0x000
#define CAVIUM_CPU_PART_THUNDERX 0x0A1
+#define CAVIUM_CPU_PART_THUNDERX2 0x0AF
#define BRCM_CPU_PART_VULCAN 0x516
@@ -94,6 +95,8 @@
#define MIDR_CORTEX_A72 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
#define MIDR_CORTEX_A73 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73)
#define MIDR_CORTEX_A75 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A75)
+#define MIDR_CAVIUM_THUNDERX2 MIDR_CPU_PART(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX2)
+#define MIDR_BRCM_VULCAN MIDR_CPU_PART(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN)
#ifndef __ASSEMBLY__
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 34/44] arm64: Branch predictor hardening for Cavium ThunderX2
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (32 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 33/44] arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 35/44] ARM: 8478/2: arm/arm64: add arm-smccc Viresh Kumar
` (10 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Jayachandran C <jnair@caviumnetworks.com>
commit f3d795d9b360523beca6d13ba64c2c532f601149 upstream.
Use PSCI based mitigation for speculative execution attacks targeting
the branch predictor. We use the same mechanism as the one used for
Cortex-A CPUs, we expect the PSCI version call to have a side effect
of clearing the BTBs.
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/cpu_errata.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index dbd7b944a37e..ff22915a2865 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -234,6 +234,16 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
MIDR_ALL_VERSIONS(MIDR_CORTEX_A75),
.enable = enable_psci_bp_hardening,
},
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+ .enable = enable_psci_bp_hardening,
+ },
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
+ .enable = enable_psci_bp_hardening,
+ },
#endif
{
}
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 35/44] ARM: 8478/2: arm/arm64: add arm-smccc
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (33 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 34/44] arm64: Branch predictor hardening for Cavium ThunderX2 Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 36/44] arm/arm64: KVM: Advertise SMCCC v1.1 Viresh Kumar
` (9 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Jens Wiklander <jens.wiklander@linaro.org>
commit 98dd64f34f47ce19b388d9015f767f48393a81eb upstream.
Adds helpers to do SMC and HVC based on ARM SMC Calling Convention.
CONFIG_HAVE_ARM_SMCCC is enabled for architectures that may support the
SMC or HVC instruction. It's the responsibility of the caller to know if
the SMC instruction is supported by the platform.
This patch doesn't provide an implementation of the declared functions.
Later patches will bring in implementations and set
CONFIG_HAVE_ARM_SMCCC for ARM and ARM64 respectively.
Reviewed-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[ v4.4: Added #ifndef __ASSEMBLY__ section to fix compilation issues ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
drivers/firmware/Kconfig | 3 ++
include/linux/arm-smccc.h | 107 ++++++++++++++++++++++++++++++++++++++
2 files changed, 110 insertions(+)
create mode 100644 include/linux/arm-smccc.h
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index cf478fe6b335..49a3a1185bb6 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -173,6 +173,9 @@ config QCOM_SCM_64
def_bool y
depends on QCOM_SCM && ARM64
+config HAVE_ARM_SMCCC
+ bool
+
source "drivers/firmware/broadcom/Kconfig"
source "drivers/firmware/google/Kconfig"
source "drivers/firmware/efi/Kconfig"
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
new file mode 100644
index 000000000000..611d10580340
--- /dev/null
+++ b/include/linux/arm-smccc.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#ifndef __LINUX_ARM_SMCCC_H
+#define __LINUX_ARM_SMCCC_H
+
+#include <linux/linkage.h>
+#include <linux/types.h>
+
+/*
+ * This file provides common defines for ARM SMC Calling Convention as
+ * specified in
+ * http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
+ */
+
+#define ARM_SMCCC_STD_CALL 0
+#define ARM_SMCCC_FAST_CALL 1
+#define ARM_SMCCC_TYPE_SHIFT 31
+
+#define ARM_SMCCC_SMC_32 0
+#define ARM_SMCCC_SMC_64 1
+#define ARM_SMCCC_CALL_CONV_SHIFT 30
+
+#define ARM_SMCCC_OWNER_MASK 0x3F
+#define ARM_SMCCC_OWNER_SHIFT 24
+
+#define ARM_SMCCC_FUNC_MASK 0xFFFF
+
+#define ARM_SMCCC_IS_FAST_CALL(smc_val) \
+ ((smc_val) & (ARM_SMCCC_FAST_CALL << ARM_SMCCC_TYPE_SHIFT))
+#define ARM_SMCCC_IS_64(smc_val) \
+ ((smc_val) & (ARM_SMCCC_SMC_64 << ARM_SMCCC_CALL_CONV_SHIFT))
+#define ARM_SMCCC_FUNC_NUM(smc_val) ((smc_val) & ARM_SMCCC_FUNC_MASK)
+#define ARM_SMCCC_OWNER_NUM(smc_val) \
+ (((smc_val) >> ARM_SMCCC_OWNER_SHIFT) & ARM_SMCCC_OWNER_MASK)
+
+#define ARM_SMCCC_CALL_VAL(type, calling_convention, owner, func_num) \
+ (((type) << ARM_SMCCC_TYPE_SHIFT) | \
+ ((calling_convention) << ARM_SMCCC_CALL_CONV_SHIFT) | \
+ (((owner) & ARM_SMCCC_OWNER_MASK) << ARM_SMCCC_OWNER_SHIFT) | \
+ ((func_num) & ARM_SMCCC_FUNC_MASK))
+
+#define ARM_SMCCC_OWNER_ARCH 0
+#define ARM_SMCCC_OWNER_CPU 1
+#define ARM_SMCCC_OWNER_SIP 2
+#define ARM_SMCCC_OWNER_OEM 3
+#define ARM_SMCCC_OWNER_STANDARD 4
+#define ARM_SMCCC_OWNER_TRUSTED_APP 48
+#define ARM_SMCCC_OWNER_TRUSTED_APP_END 49
+#define ARM_SMCCC_OWNER_TRUSTED_OS 50
+#define ARM_SMCCC_OWNER_TRUSTED_OS_END 63
+
+#ifndef __ASSEMBLY__
+
+/**
+ * struct arm_smccc_res - Result from SMC/HVC call
+ * @a0-a3 result values from registers 0 to 3
+ */
+struct arm_smccc_res {
+ unsigned long a0;
+ unsigned long a1;
+ unsigned long a2;
+ unsigned long a3;
+};
+
+/**
+ * arm_smccc_smc() - make SMC calls
+ * @a0-a7: arguments passed in registers 0 to 7
+ * @res: result values from registers 0 to 3
+ *
+ * This function is used to make SMC calls following SMC Calling Convention.
+ * The content of the supplied param are copied to registers 0 to 7 prior
+ * to the SMC instruction. The return values are updated with the content
+ * from register 0 to 3 on return from the SMC instruction.
+ */
+asmlinkage void arm_smccc_smc(unsigned long a0, unsigned long a1,
+ unsigned long a2, unsigned long a3, unsigned long a4,
+ unsigned long a5, unsigned long a6, unsigned long a7,
+ struct arm_smccc_res *res);
+
+/**
+ * arm_smccc_hvc() - make HVC calls
+ * @a0-a7: arguments passed in registers 0 to 7
+ * @res: result values from registers 0 to 3
+ *
+ * This function is used to make HVC calls following SMC Calling
+ * Convention. The content of the supplied param are copied to registers 0
+ * to 7 prior to the HVC instruction. The return values are updated with
+ * the content from register 0 to 3 on return from the HVC instruction.
+ */
+asmlinkage void arm_smccc_hvc(unsigned long a0, unsigned long a1,
+ unsigned long a2, unsigned long a3, unsigned long a4,
+ unsigned long a5, unsigned long a6, unsigned long a7,
+ struct arm_smccc_res *res);
+
+#endif /*__ASSEMBLY__*/
+#endif /*__LINUX_ARM_SMCCC_H*/
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 36/44] arm/arm64: KVM: Advertise SMCCC v1.1
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (34 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 35/44] ARM: 8478/2: arm/arm64: add arm-smccc Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 37/44] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Viresh Kumar
` (8 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 09e6be12effdb33bf7210c8867bbd213b66a499e upstream.
The new SMC Calling Convention (v1.1) allows for a reduced overhead
when calling into the firmware, and provides a new feature discovery
mechanism.
Make it visible to KVM guests.
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ Viresh: Picked only arm-smccc.h changes ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
include/linux/arm-smccc.h | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
index 611d10580340..da9f3916f9a9 100644
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -60,6 +60,19 @@
#define ARM_SMCCC_OWNER_TRUSTED_OS 50
#define ARM_SMCCC_OWNER_TRUSTED_OS_END 63
+#define ARM_SMCCC_VERSION_1_0 0x10000
+#define ARM_SMCCC_VERSION_1_1 0x10001
+
+#define ARM_SMCCC_VERSION_FUNC_ID \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
+ ARM_SMCCC_SMC_32, \
+ 0, 0)
+
+#define ARM_SMCCC_ARCH_FEATURES_FUNC_ID \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
+ ARM_SMCCC_SMC_32, \
+ 0, 1)
+
#ifndef __ASSEMBLY__
/**
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 37/44] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (35 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 36/44] arm/arm64: KVM: Advertise SMCCC v1.1 Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 38/44] firmware/psci: Expose PSCI conduit Viresh Kumar
` (7 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 6167ec5c9145cdf493722dfd80a5d48bafc4a18a upstream.
A new feature of SMCCC 1.1 is that it offers firmware-based CPU
workarounds. In particular, SMCCC_ARCH_WORKAROUND_1 provides
BP hardening for CVE-2017-5715.
If the host has some mitigation for this issue, report that
we deal with it using SMCCC_ARCH_WORKAROUND_1, as we apply the
host workaround on every guest exit.
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ Viresh: Picked on only arm-smccc.h changes ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
include/linux/arm-smccc.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
index da9f3916f9a9..1f02e4045a9e 100644
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -73,6 +73,11 @@
ARM_SMCCC_SMC_32, \
0, 1)
+#define ARM_SMCCC_ARCH_WORKAROUND_1 \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
+ ARM_SMCCC_SMC_32, \
+ 0, 0x8000)
+
#ifndef __ASSEMBLY__
/**
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 38/44] firmware/psci: Expose PSCI conduit
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (36 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 37/44] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 39/44] firmware/psci: Expose SMCCC version through psci_ops Viresh Kumar
` (6 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 09a8d6d48499f93e2abde691f5800081cd858726 upstream.
In order to call into the firmware to apply workarounds, it is
useful to find out whether we're using HVC or SMC. Let's expose
this through the psci_ops.
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
drivers/firmware/psci.c | 28 +++++++++++++++++++++++-----
include/linux/psci.h | 7 +++++++
2 files changed, 30 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c
index 290f8982e7b3..7b2665f6b38d 100644
--- a/drivers/firmware/psci.c
+++ b/drivers/firmware/psci.c
@@ -54,7 +54,9 @@ bool psci_tos_resident_on(int cpu)
return cpu == resident_cpu;
}
-struct psci_operations psci_ops;
+struct psci_operations psci_ops = {
+ .conduit = PSCI_CONDUIT_NONE,
+};
typedef unsigned long (psci_fn)(unsigned long, unsigned long,
unsigned long, unsigned long);
@@ -187,6 +189,22 @@ static unsigned long psci_migrate_info_up_cpu(void)
0, 0, 0);
}
+static void set_conduit(enum psci_conduit conduit)
+{
+ switch (conduit) {
+ case PSCI_CONDUIT_HVC:
+ invoke_psci_fn = __invoke_psci_fn_hvc;
+ break;
+ case PSCI_CONDUIT_SMC:
+ invoke_psci_fn = __invoke_psci_fn_smc;
+ break;
+ default:
+ WARN(1, "Unexpected PSCI conduit %d\n", conduit);
+ }
+
+ psci_ops.conduit = conduit;
+}
+
static int get_set_conduit_method(struct device_node *np)
{
const char *method;
@@ -199,9 +217,9 @@ static int get_set_conduit_method(struct device_node *np)
}
if (!strcmp("hvc", method)) {
- invoke_psci_fn = __invoke_psci_fn_hvc;
+ set_conduit(PSCI_CONDUIT_HVC);
} else if (!strcmp("smc", method)) {
- invoke_psci_fn = __invoke_psci_fn_smc;
+ set_conduit(PSCI_CONDUIT_SMC);
} else {
pr_warn("invalid \"method\" property: %s\n", method);
return -EINVAL;
@@ -463,9 +481,9 @@ int __init psci_acpi_init(void)
pr_info("probing for conduit method from ACPI.\n");
if (acpi_psci_use_hvc())
- invoke_psci_fn = __invoke_psci_fn_hvc;
+ set_conduit(PSCI_CONDUIT_HVC);
else
- invoke_psci_fn = __invoke_psci_fn_smc;
+ set_conduit(PSCI_CONDUIT_SMC);
return psci_probe();
}
diff --git a/include/linux/psci.h b/include/linux/psci.h
index 04b4d92c7791..e071a1b8ddb5 100644
--- a/include/linux/psci.h
+++ b/include/linux/psci.h
@@ -24,6 +24,12 @@ bool psci_tos_resident_on(int cpu);
bool psci_power_state_loses_context(u32 state);
bool psci_power_state_is_valid(u32 state);
+enum psci_conduit {
+ PSCI_CONDUIT_NONE,
+ PSCI_CONDUIT_SMC,
+ PSCI_CONDUIT_HVC,
+};
+
struct psci_operations {
u32 (*get_version)(void);
int (*cpu_suspend)(u32 state, unsigned long entry_point);
@@ -33,6 +39,7 @@ struct psci_operations {
int (*affinity_info)(unsigned long target_affinity,
unsigned long lowest_affinity_level);
int (*migrate_info_type)(void);
+ enum psci_conduit conduit;
};
extern struct psci_operations psci_ops;
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 39/44] firmware/psci: Expose SMCCC version through psci_ops
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (37 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 38/44] firmware/psci: Expose PSCI conduit Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 40/44] arm/arm64: smccc: Make function identifiers an unsigned quantity Viresh Kumar
` (5 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit e78eef554a912ef6c1e0bbf97619dafbeae3339f upstream.
Since PSCI 1.0 allows the SMCCC version to be (indirectly) probed,
let's do that at boot time, and expose the version of the calling
convention as part of the psci_ops structure.
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Included arm-smccc.h ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
drivers/firmware/psci.c | 28 ++++++++++++++++++++++++++++
include/linux/psci.h | 6 ++++++
2 files changed, 34 insertions(+)
diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c
index 7b2665f6b38d..0809a48e8089 100644
--- a/drivers/firmware/psci.c
+++ b/drivers/firmware/psci.c
@@ -13,6 +13,7 @@
#define pr_fmt(fmt) "psci: " fmt
+#include <linux/arm-smccc.h>
#include <linux/errno.h>
#include <linux/linkage.h>
#include <linux/of.h>
@@ -56,6 +57,7 @@ bool psci_tos_resident_on(int cpu)
struct psci_operations psci_ops = {
.conduit = PSCI_CONDUIT_NONE,
+ .smccc_version = SMCCC_VERSION_1_0,
};
typedef unsigned long (psci_fn)(unsigned long, unsigned long,
@@ -320,6 +322,31 @@ static void __init psci_init_migrate(void)
pr_info("Trusted OS resident on physical CPU 0x%lx\n", cpuid);
}
+static void __init psci_init_smccc(void)
+{
+ u32 ver = ARM_SMCCC_VERSION_1_0;
+ int feature;
+
+ feature = psci_features(ARM_SMCCC_VERSION_FUNC_ID);
+
+ if (feature != PSCI_RET_NOT_SUPPORTED) {
+ u32 ret;
+ ret = invoke_psci_fn(ARM_SMCCC_VERSION_FUNC_ID, 0, 0, 0);
+ if (ret == ARM_SMCCC_VERSION_1_1) {
+ psci_ops.smccc_version = SMCCC_VERSION_1_1;
+ ver = ret;
+ }
+ }
+
+ /*
+ * Conveniently, the SMCCC and PSCI versions are encoded the
+ * same way. No, this isn't accidental.
+ */
+ pr_info("SMC Calling Convention v%d.%d\n",
+ PSCI_VERSION_MAJOR(ver), PSCI_VERSION_MINOR(ver));
+
+}
+
static void __init psci_0_2_set_functions(void)
{
pr_info("Using standard PSCI v0.2 function IDs\n");
@@ -368,6 +395,7 @@ static int __init psci_probe(void)
psci_init_migrate();
if (PSCI_VERSION_MAJOR(ver) >= 1) {
+ psci_init_smccc();
psci_init_cpu_suspend();
psci_init_system_suspend();
}
diff --git a/include/linux/psci.h b/include/linux/psci.h
index e071a1b8ddb5..e5c3277bfd78 100644
--- a/include/linux/psci.h
+++ b/include/linux/psci.h
@@ -30,6 +30,11 @@ enum psci_conduit {
PSCI_CONDUIT_HVC,
};
+enum smccc_version {
+ SMCCC_VERSION_1_0,
+ SMCCC_VERSION_1_1,
+};
+
struct psci_operations {
u32 (*get_version)(void);
int (*cpu_suspend)(u32 state, unsigned long entry_point);
@@ -40,6 +45,7 @@ struct psci_operations {
unsigned long lowest_affinity_level);
int (*migrate_info_type)(void);
enum psci_conduit conduit;
+ enum smccc_version smccc_version;
};
extern struct psci_operations psci_ops;
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 40/44] arm/arm64: smccc: Make function identifiers an unsigned quantity
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (38 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 39/44] firmware/psci: Expose SMCCC version through psci_ops Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 41/44] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Viresh Kumar
` (4 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit ded4c39e93f3b72968fdb79baba27f3b83dad34c upstream.
Function identifiers are a 32bit, unsigned quantity. But we never
tell so to the compiler, resulting in the following:
4ac: b26187e0 mov x0, #0xffffffff80000001
We thus rely on the firmware narrowing it for us, which is not
always a reasonable expectation.
Cc: stable@vger.kernel.org
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
include/linux/arm-smccc.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
index 1f02e4045a9e..4c45fd75db5d 100644
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -16,6 +16,7 @@
#include <linux/linkage.h>
#include <linux/types.h>
+#include <uapi/linux/const.h>
/*
* This file provides common defines for ARM SMC Calling Convention as
@@ -23,8 +24,8 @@
* http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
*/
-#define ARM_SMCCC_STD_CALL 0
-#define ARM_SMCCC_FAST_CALL 1
+#define ARM_SMCCC_STD_CALL _AC(0,U)
+#define ARM_SMCCC_FAST_CALL _AC(1,U)
#define ARM_SMCCC_TYPE_SHIFT 31
#define ARM_SMCCC_SMC_32 0
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 41/44] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (39 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 40/44] arm/arm64: smccc: Make function identifiers an unsigned quantity Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 42/44] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Viresh Kumar
` (3 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit f2d3b2e8759a5833df6f022e42df2d581e6d843c upstream.
One of the major improvement of SMCCC v1.1 is that it only clobbers
the first 4 registers, both on 32 and 64bit. This means that it
becomes very easy to provide an inline version of the SMC call
primitive, and avoid performing a function call to stash the
registers that would otherwise be clobbered by SMCCC v1.0.
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
include/linux/arm-smccc.h | 141 ++++++++++++++++++++++++++++++++++++++
1 file changed, 141 insertions(+)
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
index 4c45fd75db5d..60c2ad6316d8 100644
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -122,5 +122,146 @@ asmlinkage void arm_smccc_hvc(unsigned long a0, unsigned long a1,
unsigned long a5, unsigned long a6, unsigned long a7,
struct arm_smccc_res *res);
+/* SMCCC v1.1 implementation madness follows */
+#ifdef CONFIG_ARM64
+
+#define SMCCC_SMC_INST "smc #0"
+#define SMCCC_HVC_INST "hvc #0"
+
+#elif defined(CONFIG_ARM)
+#include <asm/opcodes-sec.h>
+#include <asm/opcodes-virt.h>
+
+#define SMCCC_SMC_INST __SMC(0)
+#define SMCCC_HVC_INST __HVC(0)
+
+#endif
+
+#define ___count_args(_0, _1, _2, _3, _4, _5, _6, _7, _8, x, ...) x
+
+#define __count_args(...) \
+ ___count_args(__VA_ARGS__, 7, 6, 5, 4, 3, 2, 1, 0)
+
+#define __constraint_write_0 \
+ "+r" (r0), "=&r" (r1), "=&r" (r2), "=&r" (r3)
+#define __constraint_write_1 \
+ "+r" (r0), "+r" (r1), "=&r" (r2), "=&r" (r3)
+#define __constraint_write_2 \
+ "+r" (r0), "+r" (r1), "+r" (r2), "=&r" (r3)
+#define __constraint_write_3 \
+ "+r" (r0), "+r" (r1), "+r" (r2), "+r" (r3)
+#define __constraint_write_4 __constraint_write_3
+#define __constraint_write_5 __constraint_write_4
+#define __constraint_write_6 __constraint_write_5
+#define __constraint_write_7 __constraint_write_6
+
+#define __constraint_read_0
+#define __constraint_read_1
+#define __constraint_read_2
+#define __constraint_read_3
+#define __constraint_read_4 "r" (r4)
+#define __constraint_read_5 __constraint_read_4, "r" (r5)
+#define __constraint_read_6 __constraint_read_5, "r" (r6)
+#define __constraint_read_7 __constraint_read_6, "r" (r7)
+
+#define __declare_arg_0(a0, res) \
+ struct arm_smccc_res *___res = res; \
+ register u32 r0 asm("r0") = a0; \
+ register unsigned long r1 asm("r1"); \
+ register unsigned long r2 asm("r2"); \
+ register unsigned long r3 asm("r3")
+
+#define __declare_arg_1(a0, a1, res) \
+ struct arm_smccc_res *___res = res; \
+ register u32 r0 asm("r0") = a0; \
+ register typeof(a1) r1 asm("r1") = a1; \
+ register unsigned long r2 asm("r2"); \
+ register unsigned long r3 asm("r3")
+
+#define __declare_arg_2(a0, a1, a2, res) \
+ struct arm_smccc_res *___res = res; \
+ register u32 r0 asm("r0") = a0; \
+ register typeof(a1) r1 asm("r1") = a1; \
+ register typeof(a2) r2 asm("r2") = a2; \
+ register unsigned long r3 asm("r3")
+
+#define __declare_arg_3(a0, a1, a2, a3, res) \
+ struct arm_smccc_res *___res = res; \
+ register u32 r0 asm("r0") = a0; \
+ register typeof(a1) r1 asm("r1") = a1; \
+ register typeof(a2) r2 asm("r2") = a2; \
+ register typeof(a3) r3 asm("r3") = a3
+
+#define __declare_arg_4(a0, a1, a2, a3, a4, res) \
+ __declare_arg_3(a0, a1, a2, a3, res); \
+ register typeof(a4) r4 asm("r4") = a4
+
+#define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \
+ __declare_arg_4(a0, a1, a2, a3, a4, res); \
+ register typeof(a5) r5 asm("r5") = a5
+
+#define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \
+ __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \
+ register typeof(a6) r6 asm("r6") = a6
+
+#define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \
+ __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \
+ register typeof(a7) r7 asm("r7") = a7
+
+#define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
+#define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__)
+
+#define ___constraints(count) \
+ : __constraint_write_ ## count \
+ : __constraint_read_ ## count \
+ : "memory"
+#define __constraints(count) ___constraints(count)
+
+/*
+ * We have an output list that is not necessarily used, and GCC feels
+ * entitled to optimise the whole sequence away. "volatile" is what
+ * makes it stick.
+ */
+#define __arm_smccc_1_1(inst, ...) \
+ do { \
+ __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \
+ asm volatile(inst "\n" \
+ __constraints(__count_args(__VA_ARGS__))); \
+ if (___res) \
+ *___res = (typeof(*___res)){r0, r1, r2, r3}; \
+ } while (0)
+
+/*
+ * arm_smccc_1_1_smc() - make an SMCCC v1.1 compliant SMC call
+ *
+ * This is a variadic macro taking one to eight source arguments, and
+ * an optional return structure.
+ *
+ * @a0-a7: arguments passed in registers 0 to 7
+ * @res: result values from registers 0 to 3
+ *
+ * This macro is used to make SMC calls following SMC Calling Convention v1.1.
+ * The content of the supplied param are copied to registers 0 to 7 prior
+ * to the SMC instruction. The return values are updated with the content
+ * from register 0 to 3 on return from the SMC instruction if not NULL.
+ */
+#define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__)
+
+/*
+ * arm_smccc_1_1_hvc() - make an SMCCC v1.1 compliant HVC call
+ *
+ * This is a variadic macro taking one to eight source arguments, and
+ * an optional return structure.
+ *
+ * @a0-a7: arguments passed in registers 0 to 7
+ * @res: result values from registers 0 to 3
+ *
+ * This macro is used to make HVC calls following SMC Calling Convention v1.1.
+ * The content of the supplied param are copied to registers 0 to 7 prior
+ * to the HVC instruction. The return values are updated with the content
+ * from register 0 to 3 on return from the HVC instruction if not NULL.
+ */
+#define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__)
+
#endif /*__ASSEMBLY__*/
#endif /*__LINUX_ARM_SMCCC_H*/
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 42/44] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (40 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 41/44] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 43/44] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround Viresh Kumar
` (2 subsequent siblings)
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit b092201e0020614127f495c092e0a12d26a2116e upstream.
Add the detection and runtime code for ARM_SMCCC_ARCH_WORKAROUND_1.
It is lovely. Really.
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/bpi.S | 20 ++++++++++
arch/arm64/kernel/cpu_errata.c | 68 +++++++++++++++++++++++++++++++++-
2 files changed, 87 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/bpi.S b/arch/arm64/kernel/bpi.S
index dec95bd82e31..c72f261f4b64 100644
--- a/arch/arm64/kernel/bpi.S
+++ b/arch/arm64/kernel/bpi.S
@@ -17,6 +17,7 @@
*/
#include <linux/linkage.h>
+#include <linux/arm-smccc.h>
.macro ventry target
.rept 31
@@ -77,3 +78,22 @@ ENTRY(__psci_hyp_bp_inval_start)
ldp x0, x1, [sp, #(16 * 8)]
add sp, sp, #(8 * 18)
ENTRY(__psci_hyp_bp_inval_end)
+
+.macro smccc_workaround_1 inst
+ sub sp, sp, #(8 * 4)
+ stp x2, x3, [sp, #(8 * 0)]
+ stp x0, x1, [sp, #(8 * 2)]
+ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_1
+ \inst #0
+ ldp x2, x3, [sp, #(8 * 0)]
+ ldp x0, x1, [sp, #(8 * 2)]
+ add sp, sp, #(8 * 4)
+.endm
+
+ENTRY(__smccc_workaround_1_smc_start)
+ smccc_workaround_1 smc
+ENTRY(__smccc_workaround_1_smc_end)
+
+ENTRY(__smccc_workaround_1_hvc_start)
+ smccc_workaround_1 hvc
+ENTRY(__smccc_workaround_1_hvc_end)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index ff22915a2865..d5fd7be563bc 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -51,6 +51,10 @@ DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
#ifdef CONFIG_KVM
extern char __psci_hyp_bp_inval_start[], __psci_hyp_bp_inval_end[];
+extern char __smccc_workaround_1_smc_start[];
+extern char __smccc_workaround_1_smc_end[];
+extern char __smccc_workaround_1_hvc_start[];
+extern char __smccc_workaround_1_hvc_end[];
static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
const char *hyp_vecs_end)
@@ -95,6 +99,10 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
#else
#define __psci_hyp_bp_inval_start NULL
#define __psci_hyp_bp_inval_end NULL
+#define __smccc_workaround_1_smc_start NULL
+#define __smccc_workaround_1_smc_end NULL
+#define __smccc_workaround_1_hvc_start NULL
+#define __smccc_workaround_1_hvc_end NULL
static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
const char *hyp_vecs_start,
@@ -121,17 +129,75 @@ static void install_bp_hardening_cb(const struct arm64_cpu_capabilities *entry,
__install_bp_hardening_cb(fn, hyp_vecs_start, hyp_vecs_end);
}
+#include <uapi/linux/psci.h>
+#include <linux/arm-smccc.h>
#include <linux/psci.h>
+static void call_smc_arch_workaround_1(void)
+{
+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
+}
+
+static void call_hvc_arch_workaround_1(void)
+{
+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
+}
+
+static bool check_smccc_arch_workaround_1(const struct arm64_cpu_capabilities *entry)
+{
+ bp_hardening_cb_t cb;
+ void *smccc_start, *smccc_end;
+ struct arm_smccc_res res;
+
+ if (!entry->matches(entry, SCOPE_LOCAL_CPU))
+ return false;
+
+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
+ return false;
+
+ switch (psci_ops.conduit) {
+ case PSCI_CONDUIT_HVC:
+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if (res.a0)
+ return false;
+ cb = call_hvc_arch_workaround_1;
+ smccc_start = __smccc_workaround_1_hvc_start;
+ smccc_end = __smccc_workaround_1_hvc_end;
+ break;
+
+ case PSCI_CONDUIT_SMC:
+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if (res.a0)
+ return false;
+ cb = call_smc_arch_workaround_1;
+ smccc_start = __smccc_workaround_1_smc_start;
+ smccc_end = __smccc_workaround_1_smc_end;
+ break;
+
+ default:
+ return false;
+ }
+
+ install_bp_hardening_cb(entry, cb, smccc_start, smccc_end);
+
+ return true;
+}
+
static int enable_psci_bp_hardening(void *data)
{
const struct arm64_cpu_capabilities *entry = data;
- if (psci_ops.get_version)
+ if (psci_ops.get_version) {
+ if (check_smccc_arch_workaround_1(entry))
+ return 0;
+
install_bp_hardening_cb(entry,
(bp_hardening_cb_t)psci_ops.get_version,
__psci_hyp_bp_inval_start,
__psci_hyp_bp_inval_end);
+ }
return 0;
}
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 43/44] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (41 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 42/44] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference Viresh Kumar
2019-08-29 16:18 ` [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Mark Rutland
44 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Marc Zyngier <marc.zyngier@arm.com>
commit 3a0a397ff5ff8b56ca9f7908b75dee6bf0b5fabb upstream.
Now that we've standardised on SMCCC v1.1 to perform the branch
prediction invalidation, let's drop the previous band-aid.
If vendors haven't updated their firmware to do SMCCC 1.1, they
haven't updated PSCI either, so we don't loose anything.
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ v4.4: Dropped switch.c changes ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/kernel/bpi.S | 24 ------------------
arch/arm64/kernel/cpu_errata.c | 45 ++++++++++------------------------
2 files changed, 13 insertions(+), 56 deletions(-)
diff --git a/arch/arm64/kernel/bpi.S b/arch/arm64/kernel/bpi.S
index c72f261f4b64..dc4eb154e33b 100644
--- a/arch/arm64/kernel/bpi.S
+++ b/arch/arm64/kernel/bpi.S
@@ -54,30 +54,6 @@ ENTRY(__bp_harden_hyp_vecs_start)
vectors __kvm_hyp_vector
.endr
ENTRY(__bp_harden_hyp_vecs_end)
-ENTRY(__psci_hyp_bp_inval_start)
- sub sp, sp, #(8 * 18)
- stp x16, x17, [sp, #(16 * 0)]
- stp x14, x15, [sp, #(16 * 1)]
- stp x12, x13, [sp, #(16 * 2)]
- stp x10, x11, [sp, #(16 * 3)]
- stp x8, x9, [sp, #(16 * 4)]
- stp x6, x7, [sp, #(16 * 5)]
- stp x4, x5, [sp, #(16 * 6)]
- stp x2, x3, [sp, #(16 * 7)]
- stp x0, x1, [sp, #(16 * 8)]
- mov x0, #0x84000000
- smc #0
- ldp x16, x17, [sp, #(16 * 0)]
- ldp x14, x15, [sp, #(16 * 1)]
- ldp x12, x13, [sp, #(16 * 2)]
- ldp x10, x11, [sp, #(16 * 3)]
- ldp x8, x9, [sp, #(16 * 4)]
- ldp x6, x7, [sp, #(16 * 5)]
- ldp x4, x5, [sp, #(16 * 6)]
- ldp x2, x3, [sp, #(16 * 7)]
- ldp x0, x1, [sp, #(16 * 8)]
- add sp, sp, #(8 * 18)
-ENTRY(__psci_hyp_bp_inval_end)
.macro smccc_workaround_1 inst
sub sp, sp, #(8 * 4)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index d5fd7be563bc..2a17789bb963 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -50,7 +50,6 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
#ifdef CONFIG_KVM
-extern char __psci_hyp_bp_inval_start[], __psci_hyp_bp_inval_end[];
extern char __smccc_workaround_1_smc_start[];
extern char __smccc_workaround_1_smc_end[];
extern char __smccc_workaround_1_hvc_start[];
@@ -97,8 +96,6 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
spin_unlock(&bp_lock);
}
#else
-#define __psci_hyp_bp_inval_start NULL
-#define __psci_hyp_bp_inval_end NULL
#define __smccc_workaround_1_smc_start NULL
#define __smccc_workaround_1_smc_end NULL
#define __smccc_workaround_1_hvc_start NULL
@@ -143,24 +140,25 @@ static void call_hvc_arch_workaround_1(void)
arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
}
-static bool check_smccc_arch_workaround_1(const struct arm64_cpu_capabilities *entry)
+static int enable_smccc_arch_workaround_1(void *data)
{
+ const struct arm64_cpu_capabilities *entry = data;
bp_hardening_cb_t cb;
void *smccc_start, *smccc_end;
struct arm_smccc_res res;
if (!entry->matches(entry, SCOPE_LOCAL_CPU))
- return false;
+ return 0;
if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
- return false;
+ return 0;
switch (psci_ops.conduit) {
case PSCI_CONDUIT_HVC:
arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
ARM_SMCCC_ARCH_WORKAROUND_1, &res);
if (res.a0)
- return false;
+ return 0;
cb = call_hvc_arch_workaround_1;
smccc_start = __smccc_workaround_1_hvc_start;
smccc_end = __smccc_workaround_1_hvc_end;
@@ -170,35 +168,18 @@ static bool check_smccc_arch_workaround_1(const struct arm64_cpu_capabilities *e
arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
ARM_SMCCC_ARCH_WORKAROUND_1, &res);
if (res.a0)
- return false;
+ return 0;
cb = call_smc_arch_workaround_1;
smccc_start = __smccc_workaround_1_smc_start;
smccc_end = __smccc_workaround_1_smc_end;
break;
default:
- return false;
+ return 0;
}
install_bp_hardening_cb(entry, cb, smccc_start, smccc_end);
- return true;
-}
-
-static int enable_psci_bp_hardening(void *data)
-{
- const struct arm64_cpu_capabilities *entry = data;
-
- if (psci_ops.get_version) {
- if (check_smccc_arch_workaround_1(entry))
- return 0;
-
- install_bp_hardening_cb(entry,
- (bp_hardening_cb_t)psci_ops.get_version,
- __psci_hyp_bp_inval_start,
- __psci_hyp_bp_inval_end);
- }
-
return 0;
}
#endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
@@ -283,32 +264,32 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_CORTEX_A75),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
{
.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
- .enable = enable_psci_bp_hardening,
+ .enable = enable_smccc_arch_workaround_1,
},
#endif
{
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (42 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 43/44] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround Viresh Kumar
@ 2019-08-29 11:34 ` Viresh Kumar
2019-08-30 9:42 ` Mark Rutland
2019-08-29 16:18 ` [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Mark Rutland
44 siblings, 1 reply; 64+ messages in thread
From: Viresh Kumar @ 2019-08-29 11:34 UTC (permalink / raw)
To: stable, Julien Thierry, Mark Rutland
Cc: Viresh Kumar, linux-arm-kernel, Catalin Marinas, Marc Zyngier,
Will Deacon, Russell King, Vincent Guittot, mark.brown
From: Will Deacon <will.deacon@arm.com>
commit 91b2d3442f6a44dce875670d702af22737ad5eff upstream.
The arm64 futex code has some explicit dereferencing of user pointers
where performing atomic operations in response to a futex command. This
patch uses masking to limit any speculative futex operations to within
the user address space.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
---
arch/arm64/include/asm/futex.h | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index 34d4d2e2f561..8ab6e83cb629 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -53,9 +53,10 @@
: "memory")
static inline int
-arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
+arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
{
int oldval = 0, ret, tmp;
+ u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
pagefault_disable();
@@ -93,15 +94,17 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
}
static inline int
-futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
u32 oldval, u32 newval)
{
int ret = 0;
u32 val, tmp;
+ u32 __user *uaddr;
- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ if (!access_ok(VERIFY_WRITE, _uaddr, sizeof(u32)))
return -EFAULT;
+ uaddr = __uaccess_mask_ptr(_uaddr);
asm volatile("// futex_atomic_cmpxchg_inatomic\n"
ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
" prfm pstl1strm, %2\n"
--
2.21.0.rc0.269.g1a574e7a288b
^ permalink raw reply related [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference Viresh Kumar
@ 2019-08-30 9:42 ` Mark Rutland
2019-09-03 5:15 ` Viresh Kumar
0 siblings, 1 reply; 64+ messages in thread
From: Mark Rutland @ 2019-08-30 9:42 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:04:29PM +0530, Viresh Kumar wrote:
> From: Will Deacon <will.deacon@arm.com>
>
> commit 91b2d3442f6a44dce875670d702af22737ad5eff upstream.
>
> The arm64 futex code has some explicit dereferencing of user pointers
> where performing atomic operations in response to a futex command. This
> patch uses masking to limit any speculative futex operations to within
> the user address space.
>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
This would have made more sense immediately following patch 11, as in
mainline and the v4.9 backport. Having things applied in the same order
makes it much easier to compare and verify.
Regardless:
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [v4.4 backport]
Mark.
> ---
> arch/arm64/include/asm/futex.h | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
> index 34d4d2e2f561..8ab6e83cb629 100644
> --- a/arch/arm64/include/asm/futex.h
> +++ b/arch/arm64/include/asm/futex.h
> @@ -53,9 +53,10 @@
> : "memory")
>
> static inline int
> -arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
> +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
> {
> int oldval = 0, ret, tmp;
> + u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
>
> pagefault_disable();
>
> @@ -93,15 +94,17 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
> }
>
> static inline int
> -futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
> +futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
> u32 oldval, u32 newval)
> {
> int ret = 0;
> u32 val, tmp;
> + u32 __user *uaddr;
>
> - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
> + if (!access_ok(VERIFY_WRITE, _uaddr, sizeof(u32)))
> return -EFAULT;
>
> + uaddr = __uaccess_mask_ptr(_uaddr);
> asm volatile("// futex_atomic_cmpxchg_inatomic\n"
> ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
> " prfm pstl1strm, %2\n"
> --
> 2.21.0.rc0.269.g1a574e7a288b
>
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference
2019-08-30 9:42 ` Mark Rutland
@ 2019-09-03 5:15 ` Viresh Kumar
0 siblings, 0 replies; 64+ messages in thread
From: Viresh Kumar @ 2019-09-03 5:15 UTC (permalink / raw)
To: Mark Rutland
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On 30-08-19, 10:42, Mark Rutland wrote:
> On Thu, Aug 29, 2019 at 05:04:29PM +0530, Viresh Kumar wrote:
> > From: Will Deacon <will.deacon@arm.com>
> >
> > commit 91b2d3442f6a44dce875670d702af22737ad5eff upstream.
> >
> > The arm64 futex code has some explicit dereferencing of user pointers
> > where performing atomic operations in response to a futex command. This
> > patch uses masking to limit any speculative futex operations to within
> > the user address space.
> >
> > Signed-off-by: Will Deacon <will.deacon@arm.com>
> > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
>
> This would have made more sense immediately following patch 11, as in
> mainline and the v4.9 backport. Having things applied in the same order
> makes it much easier to compare and verify.
Ahh, indeed the order was that way in the arm64/kpti branch, but not
in the stable branch where it got applied at the end and I followed
that order :(
Fixed the ordering now. Thanks.
--
viresh
^ permalink raw reply [flat|nested] 64+ messages in thread
* Re: [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches
2019-08-29 11:33 [PATCH ARM64 v4.4 V3 00/44] V4.4 backport of arm64 Spectre patches Viresh Kumar
` (43 preceding siblings ...)
2019-08-29 11:34 ` [PATCH ARM64 v4.4 V3 44/44] arm64: futex: Mask __user pointers prior to dereference Viresh Kumar
@ 2019-08-29 16:18 ` Mark Rutland
44 siblings, 0 replies; 64+ messages in thread
From: Mark Rutland @ 2019-08-29 16:18 UTC (permalink / raw)
To: Viresh Kumar
Cc: stable, Julien Thierry, linux-arm-kernel, Catalin Marinas,
Marc Zyngier, Will Deacon, Russell King, Vincent Guittot,
mark.brown
On Thu, Aug 29, 2019 at 05:03:45PM +0530, Viresh Kumar wrote:
> Hello,
Hi Viresh,
> This series backports arm64 spectre patches to v4.4 stable kernel. I
> have started this backport with Mark Rutland's backport of Spectre to
> 4.9 [1] and tried applying the upstream version of them over 4.4 and
> resolved conflicts by checking how they have been resolved in 4.9.
>
> The KVM changes are mostly dropped as the KVM code in v4.4 is quite
> different and it makes backport more complex. This was suggested by the
> ARM team.
I'm reviewing this backport now, but it's going to take me a few days to
get through the entire series, so please don't be surprised if I'm quiet
until the middle of next week.
If I spot any issues I'll reply immediately, but please poke if I
haven't said anything by Wednesday.
Thanks,
Mark.
^ permalink raw reply [flat|nested] 64+ messages in thread