linux-arm-kernel.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v4 0/6] 32bit ARM branch predictor hardening
@ 2018-02-01 11:07 Marc Zyngier
  2018-02-01 11:07 ` [PATCH v4 1/6] arm: Add BTB invalidation on switch_mm for Cortex-A9, A12 and A17 Marc Zyngier
                   ` (8 more replies)
  0 siblings, 9 replies; 17+ messages in thread
From: Marc Zyngier @ 2018-02-01 11:07 UTC (permalink / raw)
  To: linux-arm-kernel

This small series implements some basic BP hardening by invalidating
the BTB on 32bit ARM CPUs that are known to be susceptible to aliasing
attacks (Spectre variant 2). It doesn't help non-ARM 32bit CPUs, nor
32bit kernels that run on 64bit capable CPUs. This series doesn't
mitigate Spectre variant 1 either.

These patches are closely modelled against what we do on arm64,
although simpler as we can rely on an architected instruction to
perform the invalidation. The notable exception is Cortex-A15, where
BTB invalidation behaves like a NOP, and the only way to shoot the
predictor down is to invalidate the icache *and* to have ACTLR[0] set
to 1 (which is a secure-only operation).

The first patch reuses the Cortex-A8 BTB invalidation in switch_mm and
generalises it to be used on all affected CPUs. The second perform the
same invalidation on prefetch abort outside of the userspace
range. The third one nukes it on guest exit, and results in some major
surgery as we cannot take a branch from the vectors (that, and Thumb2
being a massive pain).

Patches 4 to 6 are doing a similar thing for Cortex-A15, with the
aforementioned ICIALLU.

To sum up the requirements:

- Cortex-A15 need to have ACTLR.IBE (bit 0) set to 1 from secure
  mode. Cortex-A8 also needs to have ACTLR.IBE (bit 6) set, overlaping
  with ARM_ERRATA_430973 which also requires it.
- Cortex-A9, A12 and A17 do not require any extra configuration.

Note 1: Contrary to the initial version, this new series relies on
the arm64/kpti branch (I reuse the per-CPU vector hook for KVM).

Note 2: M-class CPUs are not affected and for R-class cores, the
mitigation doesn't make much sense since we do not enforce user/kernel
isolation.

[Christoffer: since the patches have significantly changed since v3,
I've dropped your RB tags]

* From v3:
  - Added configuration option
  - Reorganized the proc-v7 code to be neater
  - Make the Thumb2 KVM madness Thumb2 specific
  - Cleanups all over

* From v2:
  - Fixed !MMU build
  - Small KVM optimisation (suggested by Robin)
  - Fixed register zeroing in cpu_v7_btbinv_switch_mm (noticed by
    Andre)
  
* From v1:
  - Fixed broken hyp_fiq vector (noticed by Ard)
  - Fixed broken BTB invalidation in LPAE switch_mm (reported by Andre)
  - Revamped invalidation on PABT (noticed by James on arm64,
    suggested by Will)
  - Rewrote the whole HYP sequence, as Thumb2 was pretty unhappy about
    arithmetic with the stack pointer

Marc Zyngier (6):
  arm: Add BTB invalidation on switch_mm for Cortex-A9, A12 and A17
  arm: Invalidate BTB on prefetch abort outside of user mapping on
    Cortex A8, A9, A12 and A17
  arm: KVM: Invalidate BTB on guest exit for Cortex-A12/A17
  arm: Add icache invalidation on switch_mm for Cortex-A15
  arm: Invalidate icache on prefetch abort outside of user mapping on
    Cortex-A15
  arm: KVM: Invalidate icache on guest exit for Cortex-A15

 arch/arm/include/asm/cp15.h    |  3 ++
 arch/arm/include/asm/kvm_asm.h |  2 -
 arch/arm/include/asm/kvm_mmu.h | 23 +++++++++-
 arch/arm/kvm/hyp/hyp-entry.S   | 95 +++++++++++++++++++++++++++++++++++++++++-
 arch/arm/mm/Kconfig            | 17 ++++++++
 arch/arm/mm/fault.c            | 29 +++++++++++++
 arch/arm/mm/fsr-2level.c       |  4 +-
 arch/arm/mm/fsr-3level.c       | 69 ++++++++++++++++++++++++++++++
 arch/arm/mm/proc-v7-2level.S   | 14 ++++++-
 arch/arm/mm/proc-v7-3level.S   | 15 +++++++
 arch/arm/mm/proc-v7.S          | 53 +++++++++++++++++++++--
 11 files changed, 312 insertions(+), 12 deletions(-)

-- 
2.14.2

^ permalink raw reply	[flat|nested] 17+ messages in thread
end of thread, other threads:[~2018-02-05 10:22 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-02-01 11:07 [PATCH v4 0/6] 32bit ARM branch predictor hardening Marc Zyngier
2018-02-01 11:07 ` [PATCH v4 1/6] arm: Add BTB invalidation on switch_mm for Cortex-A9, A12 and A17 Marc Zyngier
2018-02-01 11:07 ` [PATCH v4 2/6] arm: Invalidate BTB on prefetch abort outside of user mapping on Cortex A8, A9, " Marc Zyngier
2018-02-01 11:07 ` [PATCH v4 3/6] arm: KVM: Invalidate BTB on guest exit for Cortex-A12/A17 Marc Zyngier
2018-02-01 11:34   ` Robin Murphy
2018-02-01 14:54     ` Robin Murphy
2018-02-01 11:07 ` [PATCH v4 4/6] arm: Add icache invalidation on switch_mm for Cortex-A15 Marc Zyngier
2018-02-05 10:00   ` Christoffer Dall
2018-02-05 10:09     ` Marc Zyngier
2018-02-01 11:07 ` [PATCH v4 5/6] arm: Invalidate icache on prefetch abort outside of user mapping on Cortex-A15 Marc Zyngier
2018-02-01 11:07 ` [PATCH v4 6/6] arm: KVM: Invalidate icache on guest exit for Cortex-A15 Marc Zyngier
2018-02-01 11:46   ` Robin Murphy
2018-02-04  2:51 ` [PATCH v4 0/6] 32bit ARM branch predictor hardening Florian Fainelli
2018-02-04 10:39   ` Marc Zyngier
2018-02-05 10:01 ` Christoffer Dall
2018-02-05 10:22   ` Marc Zyngier
2018-02-05 10:14 ` Andre Przywara

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).