arch/arm/mm/proc-v7-bugs.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/arm-smccc.h>
   3 #include <linux/kernel.h>
   4 #include <linux/psci.h>
   5 #include <linux/smp.h>
   6
   7 #include <asm/cp15.h>
   8 #include <asm/cputype.h>
   9 #include <asm/proc-fns.h>
  10 #include <asm/system_misc.h>
  11
  12 #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
  13 DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
  14
  15 extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  16 extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  17 extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  18 extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
  19
  20 static void harden_branch_predictor_bpiall(void)
  21 {
  22         write_sysreg(0, BPIALL);
  23 }
  24
  25 static void harden_branch_predictor_iciallu(void)
  26 {
  27         write_sysreg(0, ICIALLU);
  28 }
  29
  30 static void __maybe_unused call_smc_arch_workaround_1(void)
  31 {
  32         arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
  33 }
  34
  35 static void __maybe_unused call_hvc_arch_workaround_1(void)
  36 {
  37         arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
  38 }
  39
  40 static void cpu_v7_spectre_init(void)
  41 {
  42         const char *spectre_v2_method = NULL;
  43         int cpu = smp_processor_id();
  44
  45         if (per_cpu(harden_branch_predictor_fn, cpu))
  46                 return;
  47
  48         switch (read_cpuid_part()) {
  49         case ARM_CPU_PART_CORTEX_A8:
  50         case ARM_CPU_PART_CORTEX_A9:
  51         case ARM_CPU_PART_CORTEX_A12:
  52         case ARM_CPU_PART_CORTEX_A17:
  53         case ARM_CPU_PART_CORTEX_A73:
  54         case ARM_CPU_PART_CORTEX_A75:
  55                 if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
  56                         goto bl_error;
  57                 per_cpu(harden_branch_predictor_fn, cpu) =
  58                         harden_branch_predictor_bpiall;
  59                 spectre_v2_method = "BPIALL";
  60                 break;
  61
  62         case ARM_CPU_PART_CORTEX_A15:
  63         case ARM_CPU_PART_BRAHMA_B15:
  64                 if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
  65                         goto bl_error;
  66                 per_cpu(harden_branch_predictor_fn, cpu) =
  67                         harden_branch_predictor_iciallu;
  68                 spectre_v2_method = "ICIALLU";
  69                 break;
  70
  71 #ifdef CONFIG_ARM_PSCI
  72         default:
  73                 /* Other ARM CPUs require no workaround */
  74                 if (read_cpuid_implementor() == ARM_CPU_IMP_ARM)
  75                         break;
  76                 /* fallthrough */
  77                 /* Cortex A57/A72 require firmware workaround */
  78         case ARM_CPU_PART_CORTEX_A57:
  79         case ARM_CPU_PART_CORTEX_A72: {
  80                 struct arm_smccc_res res;
  81
  82                 if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
  83                         break;
  84
  85                 switch (psci_ops.conduit) {
  86                 case PSCI_CONDUIT_HVC:
  87                         arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
  88                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
  89                         if ((int)res.a0 != 0)
  90                                 break;
  91                         if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
  92                                 goto bl_error;
  93                         per_cpu(harden_branch_predictor_fn, cpu) =
  94                                 call_hvc_arch_workaround_1;
  95                         processor.switch_mm = cpu_v7_hvc_switch_mm;
  96                         spectre_v2_method = "hypervisor";
  97                         break;
  98
  99                 case PSCI_CONDUIT_SMC:
 100                         arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
 101                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
 102                         if ((int)res.a0 != 0)
 103                                 break;
 104                         if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
 105                                 goto bl_error;
 106                         per_cpu(harden_branch_predictor_fn, cpu) =
 107                                 call_smc_arch_workaround_1;
 108                         processor.switch_mm = cpu_v7_smc_switch_mm;
 109                         spectre_v2_method = "firmware";
 110                         break;
 111
 112                 default:
 113                         break;
 114                 }
 115         }
 116 #endif
 117         }
 118
 119         if (spectre_v2_method)
 120                 pr_info("CPU%u: Spectre v2: using %s workaround\n",
 121                         smp_processor_id(), spectre_v2_method);
 122         return;
 123
 124 bl_error:
 125         pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
 126                 cpu);
 127 }
 128 #else
 129 static void cpu_v7_spectre_init(void)
 130 {
 131 }
 132 #endif
 133
 134 static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
 135                                                   u32 mask, const char *msg)
 136 {
 137         u32 aux_cr;
 138
 139         asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr));
 140
 141         if ((aux_cr & mask) != mask) {
 142                 if (!*warned)
 143                         pr_err("CPU%u: %s", smp_processor_id(), msg);
 144                 *warned = true;
 145                 return false;
 146         }
 147         return true;
 148 }
 149
 150 static DEFINE_PER_CPU(bool, spectre_warned);
 151
 152 static bool check_spectre_auxcr(bool *warned, u32 bit)
 153 {
 154         return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) &&
 155                 cpu_v7_check_auxcr_set(warned, bit,
 156                                        "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n");
 157 }
 158
 159 void cpu_v7_ca8_ibe(void)
 160 {
 161         if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
 162                 cpu_v7_spectre_init();
 163 }
 164
 165 void cpu_v7_ca15_ibe(void)
 166 {
 167         if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
 168                 cpu_v7_spectre_init();
 169 }
 170
 171 void cpu_v7_bugs_init(void)
 172 {
 173         cpu_v7_spectre_init();
 174 }