proc-v7-bugs.c 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297
  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <linux/arm-smccc.h>
  3. #include <linux/kernel.h>
  4. #include <linux/smp.h>
  5. #include <asm/cp15.h>
  6. #include <asm/cputype.h>
  7. #include <asm/proc-fns.h>
  8. #include <asm/spectre.h>
  9. #include <asm/system_misc.h>
  10. #ifdef CONFIG_ARM_PSCI
  11. static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
  12. {
  13. struct arm_smccc_res res;
  14. arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
  15. ARM_SMCCC_ARCH_WORKAROUND_1, &res);
  16. switch ((int)res.a0) {
  17. case SMCCC_RET_SUCCESS:
  18. return SPECTRE_MITIGATED;
  19. case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED:
  20. return SPECTRE_UNAFFECTED;
  21. default:
  22. return SPECTRE_VULNERABLE;
  23. }
  24. }
  25. #else
  26. static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
  27. {
  28. return SPECTRE_VULNERABLE;
  29. }
  30. #endif
  31. #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
  32. DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
  33. extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  34. extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  35. extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  36. extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  37. static void harden_branch_predictor_bpiall(void)
  38. {
  39. write_sysreg(0, BPIALL);
  40. }
  41. static void harden_branch_predictor_iciallu(void)
  42. {
  43. write_sysreg(0, ICIALLU);
  44. }
  45. static void __maybe_unused call_smc_arch_workaround_1(void)
  46. {
  47. arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
  48. }
  49. static void __maybe_unused call_hvc_arch_workaround_1(void)
  50. {
  51. arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
  52. }
  53. static unsigned int spectre_v2_install_workaround(unsigned int method)
  54. {
  55. const char *spectre_v2_method = NULL;
  56. int cpu = smp_processor_id();
  57. if (per_cpu(harden_branch_predictor_fn, cpu))
  58. return SPECTRE_MITIGATED;
  59. switch (method) {
  60. case SPECTRE_V2_METHOD_BPIALL:
  61. per_cpu(harden_branch_predictor_fn, cpu) =
  62. harden_branch_predictor_bpiall;
  63. spectre_v2_method = "BPIALL";
  64. break;
  65. case SPECTRE_V2_METHOD_ICIALLU:
  66. per_cpu(harden_branch_predictor_fn, cpu) =
  67. harden_branch_predictor_iciallu;
  68. spectre_v2_method = "ICIALLU";
  69. break;
  70. case SPECTRE_V2_METHOD_HVC:
  71. per_cpu(harden_branch_predictor_fn, cpu) =
  72. call_hvc_arch_workaround_1;
  73. cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
  74. spectre_v2_method = "hypervisor";
  75. break;
  76. case SPECTRE_V2_METHOD_SMC:
  77. per_cpu(harden_branch_predictor_fn, cpu) =
  78. call_smc_arch_workaround_1;
  79. cpu_do_switch_mm = cpu_v7_smc_switch_mm;
  80. spectre_v2_method = "firmware";
  81. break;
  82. }
  83. if (spectre_v2_method)
  84. pr_info("CPU%u: Spectre v2: using %s workaround\n",
  85. smp_processor_id(), spectre_v2_method);
  86. return SPECTRE_MITIGATED;
  87. }
  88. #else
  89. static unsigned int spectre_v2_install_workaround(unsigned int method)
  90. {
  91. pr_info_once("Spectre V2: workarounds disabled by configuration\n");
  92. return SPECTRE_VULNERABLE;
  93. }
  94. #endif
  95. static void cpu_v7_spectre_v2_init(void)
  96. {
  97. unsigned int state, method = 0;
  98. switch (read_cpuid_part()) {
  99. case ARM_CPU_PART_CORTEX_A8:
  100. case ARM_CPU_PART_CORTEX_A9:
  101. case ARM_CPU_PART_CORTEX_A12:
  102. case ARM_CPU_PART_CORTEX_A17:
  103. case ARM_CPU_PART_CORTEX_A73:
  104. case ARM_CPU_PART_CORTEX_A75:
  105. state = SPECTRE_MITIGATED;
  106. method = SPECTRE_V2_METHOD_BPIALL;
  107. break;
  108. case ARM_CPU_PART_CORTEX_A15:
  109. case ARM_CPU_PART_BRAHMA_B15:
  110. state = SPECTRE_MITIGATED;
  111. method = SPECTRE_V2_METHOD_ICIALLU;
  112. break;
  113. case ARM_CPU_PART_BRAHMA_B53:
  114. /* Requires no workaround */
  115. state = SPECTRE_UNAFFECTED;
  116. break;
  117. default:
  118. /* Other ARM CPUs require no workaround */
  119. if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) {
  120. state = SPECTRE_UNAFFECTED;
  121. break;
  122. }
  123. fallthrough;
  124. /* Cortex A57/A72 require firmware workaround */
  125. case ARM_CPU_PART_CORTEX_A57:
  126. case ARM_CPU_PART_CORTEX_A72:
  127. state = spectre_v2_get_cpu_fw_mitigation_state();
  128. if (state != SPECTRE_MITIGATED)
  129. break;
  130. switch (arm_smccc_1_1_get_conduit()) {
  131. case SMCCC_CONDUIT_HVC:
  132. method = SPECTRE_V2_METHOD_HVC;
  133. break;
  134. case SMCCC_CONDUIT_SMC:
  135. method = SPECTRE_V2_METHOD_SMC;
  136. break;
  137. default:
  138. state = SPECTRE_VULNERABLE;
  139. break;
  140. }
  141. }
  142. if (state == SPECTRE_MITIGATED)
  143. state = spectre_v2_install_workaround(method);
  144. spectre_v2_update_state(state, method);
  145. }
  146. #ifdef CONFIG_HARDEN_BRANCH_HISTORY
  147. static int spectre_bhb_method;
  148. static const char *spectre_bhb_method_name(int method)
  149. {
  150. switch (method) {
  151. case SPECTRE_V2_METHOD_LOOP8:
  152. return "loop";
  153. case SPECTRE_V2_METHOD_BPIALL:
  154. return "BPIALL";
  155. default:
  156. return "unknown";
  157. }
  158. }
  159. static int spectre_bhb_install_workaround(int method)
  160. {
  161. if (spectre_bhb_method != method) {
  162. if (spectre_bhb_method) {
  163. pr_err("CPU%u: Spectre BHB: method disagreement, system vulnerable\n",
  164. smp_processor_id());
  165. return SPECTRE_VULNERABLE;
  166. }
  167. if (spectre_bhb_update_vectors(method) == SPECTRE_VULNERABLE)
  168. return SPECTRE_VULNERABLE;
  169. spectre_bhb_method = method;
  170. pr_info("CPU%u: Spectre BHB: enabling %s workaround for all CPUs\n",
  171. smp_processor_id(), spectre_bhb_method_name(method));
  172. }
  173. return SPECTRE_MITIGATED;
  174. }
  175. #else
  176. static int spectre_bhb_install_workaround(int method)
  177. {
  178. return SPECTRE_VULNERABLE;
  179. }
  180. #endif
  181. static void cpu_v7_spectre_bhb_init(void)
  182. {
  183. unsigned int state, method = 0;
  184. switch (read_cpuid_part()) {
  185. case ARM_CPU_PART_CORTEX_A15:
  186. case ARM_CPU_PART_BRAHMA_B15:
  187. case ARM_CPU_PART_CORTEX_A57:
  188. case ARM_CPU_PART_CORTEX_A72:
  189. state = SPECTRE_MITIGATED;
  190. method = SPECTRE_V2_METHOD_LOOP8;
  191. break;
  192. case ARM_CPU_PART_CORTEX_A73:
  193. case ARM_CPU_PART_CORTEX_A75:
  194. state = SPECTRE_MITIGATED;
  195. method = SPECTRE_V2_METHOD_BPIALL;
  196. break;
  197. default:
  198. state = SPECTRE_UNAFFECTED;
  199. break;
  200. }
  201. if (state == SPECTRE_MITIGATED)
  202. state = spectre_bhb_install_workaround(method);
  203. spectre_v2_update_state(state, method);
  204. }
  205. static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
  206. u32 mask, const char *msg)
  207. {
  208. u32 aux_cr;
  209. asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr));
  210. if ((aux_cr & mask) != mask) {
  211. if (!*warned)
  212. pr_err("CPU%u: %s", smp_processor_id(), msg);
  213. *warned = true;
  214. return false;
  215. }
  216. return true;
  217. }
  218. static DEFINE_PER_CPU(bool, spectre_warned);
  219. static bool check_spectre_auxcr(bool *warned, u32 bit)
  220. {
  221. return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) &&
  222. cpu_v7_check_auxcr_set(warned, bit,
  223. "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n");
  224. }
  225. void cpu_v7_ca8_ibe(void)
  226. {
  227. if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
  228. cpu_v7_spectre_v2_init();
  229. }
  230. void cpu_v7_ca15_ibe(void)
  231. {
  232. if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
  233. cpu_v7_spectre_v2_init();
  234. cpu_v7_spectre_bhb_init();
  235. }
  236. void cpu_v7_bugs_init(void)
  237. {
  238. cpu_v7_spectre_v2_init();
  239. cpu_v7_spectre_bhb_init();
  240. }