From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
"Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
James Morse <james.morse@arm.com>
Subject: [PATCH 5.10 41/58] arm64: Use the clearbhb instruction in mitigations
Date: Thu, 10 Mar 2022 15:19:01 +0100 [thread overview]
Message-ID: <20220310140814.040787017@linuxfoundation.org> (raw)
In-Reply-To: <20220310140812.869208747@linuxfoundation.org>
From: James Morse <james.morse@arm.com>
commit 228a26b912287934789023b4132ba76065d9491c upstream.
Future CPUs may implement a clearbhb instruction that is sufficient
to mitigate SpectreBHB. CPUs that implement this instruction, but
not CSV2.3 must be affected by Spectre-BHB.
Add support to use this instruction as the BHB mitigation on CPUs
that support it. The instruction is in the hint space, so it will
be treated by a NOP as older CPUs.
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
[ modified for stable: Use a KVM vector template instead of alternatives,
removed bitmap of mitigations ]
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/assembler.h | 7 +++++++
arch/arm64/include/asm/cpufeature.h | 13 +++++++++++++
arch/arm64/include/asm/insn.h | 1 +
arch/arm64/include/asm/kvm_asm.h | 2 ++
arch/arm64/include/asm/sysreg.h | 1 +
arch/arm64/include/asm/vectors.h | 7 +++++++
arch/arm64/kernel/cpufeature.c | 1 +
arch/arm64/kernel/entry.S | 8 ++++++++
arch/arm64/kernel/proton-pack.c | 12 ++++++++++++
arch/arm64/kvm/hyp/smccc_wa.S | 9 +++++++++
10 files changed, 61 insertions(+)
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -98,6 +98,13 @@
.endm
/*
+ * Clear Branch History instruction
+ */
+ .macro clearbhb
+ hint #22
+ .endm
+
+/*
* Speculation barrier
*/
.macro sb
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -621,6 +621,19 @@ static inline bool supports_csv2p3(int s
return csv2_val == 3;
}
+static inline bool supports_clearbhb(int scope)
+{
+ u64 isar2;
+
+ if (scope == SCOPE_LOCAL_CPU)
+ isar2 = read_sysreg_s(SYS_ID_AA64ISAR2_EL1);
+ else
+ isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1);
+
+ return cpuid_feature_extract_unsigned_field(isar2,
+ ID_AA64ISAR2_CLEARBHB_SHIFT);
+}
+
static inline bool system_supports_32bit_el0(void)
{
return cpus_have_const_cap(ARM64_HAS_32BIT_EL0);
--- a/arch/arm64/include/asm/insn.h
+++ b/arch/arm64/include/asm/insn.h
@@ -65,6 +65,7 @@ enum aarch64_insn_hint_cr_op {
AARCH64_INSN_HINT_PSB = 0x11 << 5,
AARCH64_INSN_HINT_TSB = 0x12 << 5,
AARCH64_INSN_HINT_CSDB = 0x14 << 5,
+ AARCH64_INSN_HINT_CLEARBHB = 0x16 << 5,
AARCH64_INSN_HINT_BTI = 0x20 << 5,
AARCH64_INSN_HINT_BTIC = 0x22 << 5,
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -37,6 +37,7 @@
#define __SMCCC_WORKAROUND_1_SMC_SZ 36
#define __SMCCC_WORKAROUND_3_SMC_SZ 36
#define __SPECTRE_BHB_LOOP_SZ 44
+#define __SPECTRE_BHB_CLEARBHB_SZ 12
#define KVM_HOST_SMCCC_ID(id) \
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
@@ -205,6 +206,7 @@ extern char __smccc_workaround_3_smc[__S
extern char __spectre_bhb_loop_k8[__SPECTRE_BHB_LOOP_SZ];
extern char __spectre_bhb_loop_k24[__SPECTRE_BHB_LOOP_SZ];
extern char __spectre_bhb_loop_k32[__SPECTRE_BHB_LOOP_SZ];
+extern char __spectre_bhb_clearbhb[__SPECTRE_BHB_LOOP_SZ];
/*
* Obtain the PC-relative address of a kernel symbol
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -689,6 +689,7 @@
#define ID_AA64ISAR1_GPI_IMP_DEF 0x1
/* id_aa64isar2 */
+#define ID_AA64ISAR2_CLEARBHB_SHIFT 28
#define ID_AA64ISAR2_RPRES_SHIFT 4
#define ID_AA64ISAR2_WFXT_SHIFT 0
--- a/arch/arm64/include/asm/vectors.h
+++ b/arch/arm64/include/asm/vectors.h
@@ -32,6 +32,12 @@ enum arm64_bp_harden_el1_vectors {
* canonical vectors.
*/
EL1_VECTOR_BHB_FW,
+
+ /*
+ * Use the ClearBHB instruction, before branching to the canonical
+ * vectors.
+ */
+ EL1_VECTOR_BHB_CLEAR_INSN,
#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
/*
@@ -43,6 +49,7 @@ enum arm64_bp_harden_el1_vectors {
#ifndef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
#define EL1_VECTOR_BHB_LOOP -1
#define EL1_VECTOR_BHB_FW -1
+#define EL1_VECTOR_BHB_CLEAR_INSN -1
#endif /* !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
/* The vectors to use on return from EL0. e.g. to remap the kernel */
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -211,6 +211,7 @@ static const struct arm64_ftr_bits ftr_i
};
static const struct arm64_ftr_bits ftr_id_aa64isar2[] = {
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0),
ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_RPRES_SHIFT, 4, 0),
ARM64_FTR_END,
};
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -827,6 +827,7 @@ alternative_else_nop_endif
#define BHB_MITIGATION_NONE 0
#define BHB_MITIGATION_LOOP 1
#define BHB_MITIGATION_FW 2
+#define BHB_MITIGATION_INSN 3
.macro tramp_ventry, vector_start, regsize, kpti, bhb
.align 7
@@ -843,6 +844,11 @@ alternative_else_nop_endif
__mitigate_spectre_bhb_loop x30
.endif // \bhb == BHB_MITIGATION_LOOP
+ .if \bhb == BHB_MITIGATION_INSN
+ clearbhb
+ isb
+ .endif // \bhb == BHB_MITIGATION_INSN
+
.if \kpti == 1
/*
* Defend against branch aliasing attacks by pushing a dummy
@@ -919,6 +925,7 @@ SYM_CODE_START_NOALIGN(tramp_vectors)
#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_LOOP
generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_FW
+ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_INSN
#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_NONE
SYM_CODE_END(tramp_vectors)
@@ -981,6 +988,7 @@ SYM_CODE_START(__bp_harden_el1_vectors)
#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
generate_el1_vector bhb=BHB_MITIGATION_LOOP
generate_el1_vector bhb=BHB_MITIGATION_FW
+ generate_el1_vector bhb=BHB_MITIGATION_INSN
#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
SYM_CODE_END(__bp_harden_el1_vectors)
.popsection
--- a/arch/arm64/kernel/proton-pack.c
+++ b/arch/arm64/kernel/proton-pack.c
@@ -824,6 +824,7 @@ int arch_prctl_spec_ctrl_get(struct task
* - Mitigated by a branchy loop a CPU specific number of times, and listed
* in our "loop mitigated list".
* - Mitigated in software by the firmware Spectre v2 call.
+ * - Has the ClearBHB instruction to perform the mitigation.
* - Has the 'Exception Clears Branch History Buffer' (ECBHB) feature, so no
* software mitigation in the vectors is needed.
* - Has CSV2.3, so is unaffected.
@@ -949,6 +950,9 @@ bool is_spectre_bhb_affected(const struc
if (supports_csv2p3(scope))
return false;
+ if (supports_clearbhb(scope))
+ return true;
+
if (spectre_bhb_loop_affected(scope))
return true;
@@ -987,6 +991,8 @@ static int kvm_bhb_get_vecs_size(const c
start == __spectre_bhb_loop_k24 ||
start == __spectre_bhb_loop_k32)
return __SPECTRE_BHB_LOOP_SZ;
+ else if (start == __spectre_bhb_clearbhb)
+ return __SPECTRE_BHB_CLEARBHB_SZ;
return 0;
}
@@ -1027,6 +1033,7 @@ static void kvm_setup_bhb_slot(const cha
#define __spectre_bhb_loop_k8 NULL
#define __spectre_bhb_loop_k24 NULL
#define __spectre_bhb_loop_k32 NULL
+#define __spectre_bhb_clearbhb NULL
static void kvm_setup_bhb_slot(const char *hyp_vecs_start) { }
#endif /* CONFIG_KVM */
@@ -1046,6 +1053,11 @@ void spectre_bhb_enable_mitigation(const
pr_info_once("spectre-bhb mitigation disabled by command line option\n");
} else if (supports_ecbhb(SCOPE_LOCAL_CPU)) {
state = SPECTRE_MITIGATED;
+ } else if (supports_clearbhb(SCOPE_LOCAL_CPU)) {
+ kvm_setup_bhb_slot(__spectre_bhb_clearbhb);
+ this_cpu_set_vectors(EL1_VECTOR_BHB_CLEAR_INSN);
+
+ state = SPECTRE_MITIGATED;
} else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) {
switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) {
case 8:
--- a/arch/arm64/kvm/hyp/smccc_wa.S
+++ b/arch/arm64/kvm/hyp/smccc_wa.S
@@ -96,3 +96,12 @@ SYM_DATA_START(__spectre_bhb_loop_k32)
1: .org __spectre_bhb_loop_k32 + __SPECTRE_BHB_LOOP_SZ
.org 1b
SYM_DATA_END(__spectre_bhb_loop_k32)
+
+ .global __spectre_bhb_clearbhb
+SYM_DATA_START(__spectre_bhb_clearbhb)
+ esb
+ clearbhb
+ isb
+1: .org __spectre_bhb_clearbhb + __SPECTRE_BHB_CLEARBHB_SZ
+ .org 1b
+SYM_DATA_END(__spectre_bhb_clearbhb)
next prev parent reply other threads:[~2022-03-10 14:33 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-10 14:18 [PATCH 5.10 00/58] 5.10.105-rc2 review Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 01/58] x86,bugs: Unconditionally allow spectre_v2=retpoline,amd Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 02/58] x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 03/58] x86/speculation: Add eIBRS + Retpoline options Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 04/58] Documentation/hw-vuln: Update spectre doc Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 05/58] x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 06/58] x86/speculation: Use generic retpoline by default on AMD Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 07/58] x86/speculation: Update link to AMD speculation whitepaper Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 08/58] x86/speculation: Warn about Spectre v2 LFENCE mitigation Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 09/58] x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 10/58] ARM: report Spectre v2 status through sysfs Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 11/58] ARM: early traps initialisation Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 12/58] ARM: use LOADADDR() to get load address of sections Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 13/58] ARM: Spectre-BHB workaround Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 14/58] ARM: include unprivileged BPF status in Spectre V2 reporting Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 15/58] arm64: cputype: Add CPU implementor & types for the Apple M1 cores Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 16/58] arm64: Add Neoverse-N2, Cortex-A710 CPU part definition Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 17/58] arm64: Add Cortex-X2 " Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 18/58] arm64: Add Cortex-A510 " Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 19/58] arm64: Add HWCAP for self-synchronising virtual counter Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 20/58] arm64: add ID_AA64ISAR2_EL1 sys register Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 21/58] arm64: cpufeature: add HWCAP for FEAT_AFP Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 22/58] arm64: cpufeature: add HWCAP for FEAT_RPRES Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 23/58] arm64: entry.S: Add ventry overflow sanity checks Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 24/58] arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 25/58] arm64: entry: Make the trampoline cleanup optional Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 26/58] arm64: entry: Free up another register on kptis tramp_exit path Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 27/58] arm64: entry: Move the trampoline data page before the text page Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 28/58] arm64: entry: Allow tramp_alias to access symbols after the 4K boundary Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 29/58] arm64: entry: Dont assume tramp_vectors is the start of the vectors Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 30/58] arm64: entry: Move trampoline macros out of ifdefd section Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 31/58] arm64: entry: Make the kpti trampolines kpti sequence optional Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 32/58] arm64: entry: Allow the trampoline text to occupy multiple pages Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 33/58] arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 34/58] arm64: entry: Add vectors that have the bhb mitigation sequences Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 35/58] arm64: entry: Add macro for reading symbol addresses from the trampoline Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 36/58] arm64: Add percpu vectors for EL1 Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 37/58] arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 38/58] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A Greg Kroah-Hartman
2022-03-10 23:48 ` Pavel Machek
2022-03-11 6:42 ` Greg Kroah-Hartman
2022-03-15 12:20 ` James Morse
2022-03-15 12:27 ` James Morse
2022-03-15 12:41 ` Greg Kroah-Hartman
2022-03-15 12:29 ` Greg Kroah-Hartman
2022-03-10 14:18 ` [PATCH 5.10 39/58] arm64: Mitigate spectre style branch history side channels Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 40/58] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated Greg Kroah-Hartman
2022-03-10 14:19 ` Greg Kroah-Hartman [this message]
2022-03-10 14:19 ` [PATCH 5.10 42/58] arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 43/58] ARM: fix build error when BPF_SYSCALL is disabled Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 44/58] ARM: fix co-processor register typo Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 45/58] ARM: Do not use NOCROSSREFS directive with ld.lld Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 46/58] ARM: fix build warning in proc-v7-bugs.c Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 47/58] xen/xenbus: dont let xenbus_grant_ring() remove grants in error case Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 48/58] xen/grant-table: add gnttab_try_end_foreign_access() Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 49/58] xen/blkfront: dont use gnttab_query_foreign_access() for mapped status Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 50/58] xen/netfront: " Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 51/58] xen/scsifront: " Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 52/58] xen/gntalloc: dont use gnttab_query_foreign_access() Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 53/58] xen: remove gnttab_query_foreign_access() Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 54/58] xen/9p: use alloc/free_pages_exact() Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 55/58] xen/pvcalls: " Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 56/58] xen/gnttab: fix gnttab_end_foreign_access() without page specified Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 57/58] xen/netfront: react properly to failing gnttab_end_foreign_access_ref() Greg Kroah-Hartman
2022-03-10 14:19 ` [PATCH 5.10 58/58] Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" Greg Kroah-Hartman
2022-03-10 17:59 ` [PATCH 5.10 00/58] 5.10.105-rc2 review Pavel Machek
2022-03-10 18:48 ` Jon Hunter
2022-03-10 19:33 ` Shuah Khan
2022-03-10 22:36 ` Florian Fainelli
2022-03-11 1:04 ` Guenter Roeck
2022-03-11 6:48 ` Bagas Sanjaya
2022-03-11 10:11 ` Sudip Mukherjee
2022-03-11 11:52 ` Naresh Kamboju
2022-03-12 1:22 ` Fox Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220310140814.040787017@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=catalin.marinas@arm.com \
--cc=james.morse@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).