Commit 1c3543b5 authored by James Morse's avatar James Morse Committed by Zheng Zengkai
Browse files

arm64: Mitigate spectre style branch history side channels 

stable inclusion
from stable-v5.10.105
commit e192c8baa69ac8a5585d61ac535aa1e5eb795e80
category: bugfix
bugzilla: 186460 https://gitee.com/src-openeuler/kernel/issues/I53MHA
CVE: CVE-2022-23960

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e192c8baa69a



--------------------------------

commit 558c303c upstream.

Speculation attacks against some high-performance processors can
make use of branch history to influence future speculation.
When taking an exception from user-space, a sequence of branches
or a firmware call overwrites or invalidates the branch history.

The sequence of branches is added to the vectors, and should appear
before the first indirect branch. For systems using KPTI the sequence
is added to the kpti trampoline where it has a free register as the exit
from the trampoline is via a 'ret'. For systems not using KPTI, the same
register tricks are used to free up a register in the vectors.

For the firmware call, arch-workaround-3 clobbers 4 registers, so
there is no choice but to save them to the EL1 stack. This only happens
for entry from EL0, so if we take an exception due to the stack access,
it will not become re-entrant.

For KVM, the existing branch-predictor-hardening vectors are used.
When a spectre version of these vectors is in use, the firmware call
is sufficient to mitigate against Spectre-BHB. For the non-spectre
versions, the sequence of branches is added to the indirect vector.

Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
[ modified for stable, removed bitmap of mitigations,  use kvm template
  infrastructure ]
Signed-off-by: default avatarJames Morse <james.morse@arm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jiahao <chenjiahao16@huawei.com>
Reviewed-by: default avatarLiao Chang <liaochang1@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent dff9b3dd

arch/arm64/Kconfig

+9 −0
Original line number Diff line number Diff line
@@ -1319,6 +1319,15 @@ config UNMAP_KERNEL_AT_EL0 


	  If unsure, say Y.



config MITIGATE_SPECTRE_BRANCH_HISTORY

	bool "Mitigate Spectre style attacks against branch history" if EXPERT

	default y

	help

	  Speculation attacks against some high-performance processors can

	  make use of branch history to influence future speculation.

	  When taking an exception from user-space, a sequence of branches

	  or a firmware call overwrites the branch history.



config RODATA_FULL_DEFAULT_ENABLED

	bool "Apply r/o permissions of VM areas also to their linear aliases"

	default y

arch/arm64/include/asm/assembler.h

+3 −1
Original line number Diff line number Diff line
@@ -765,7 +765,9 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU 


	.macro __mitigate_spectre_bhb_loop      tmp

#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY

	mov	\tmp, #32

alternative_cb  spectre_bhb_patch_loop_iter

	mov	\tmp, #32		// Patched to correct the immediate

alternative_cb_end

.Lspectre_bhb_loop\@:

	b	. + 4

	subs	\tmp, \tmp, #1

arch/arm64/include/asm/cpufeature.h

+15 −0
Original line number Diff line number Diff line
@@ -608,6 +608,21 @@ static inline bool cpu_supports_mixed_endian_el0(void) 
	return id_aa64mmfr0_mixed_endian_el0(read_cpuid(ID_AA64MMFR0_EL1));

}



static inline bool supports_csv2p3(int scope)

{

	u64 pfr0;

	u8 csv2_val;



	if (scope == SCOPE_LOCAL_CPU)

		pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1);

	else

		pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);



	csv2_val = cpuid_feature_extract_unsigned_field(pfr0,

							ID_AA64PFR0_CSV2_SHIFT);

	return csv2_val == 3;

}



static inline bool system_supports_32bit_el0(void)

{

	return cpus_have_const_cap(ARM64_HAS_32BIT_EL0);

arch/arm64/include/asm/cputype.h

+8 −0
Original line number Diff line number Diff line
@@ -73,6 +73,10 @@ 
#define ARM_CPU_PART_CORTEX_A76		0xD0B

#define ARM_CPU_PART_NEOVERSE_N1	0xD0C

#define ARM_CPU_PART_CORTEX_A77		0xD0D

#define ARM_CPU_PART_NEOVERSE_V1	0xD40

#define ARM_CPU_PART_CORTEX_A78		0xD41

#define ARM_CPU_PART_CORTEX_X1		0xD44

#define ARM_CPU_PART_CORTEX_A78C	0xD4B



#define APM_CPU_PART_POTENZA		0x000
@@ -117,6 +121,10 @@ 
#define MIDR_CORTEX_A76	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76)

#define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1)

#define MIDR_CORTEX_A77	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77)

#define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1)

#define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78)

#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)

#define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)

#define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)

#define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)

#define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)

arch/arm64/include/asm/spectre.h

+3 −1
Original line number Diff line number Diff line
@@ -30,5 +30,7 @@ void spectre_v4_enable_mitigation(const struct arm64_cpu_capabilities *__unused) 
void spectre_v4_enable_task_mitigation(struct task_struct *tsk);



enum mitigation_state arm64_get_spectre_bhb_state(void);



bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);

u8 spectre_bhb_loop_affected(int scope);

void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);

#endif	/* __ASM_SPECTRE_H */