From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 88C5DC46CA1 for ; Mon, 16 Oct 2023 08:03:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:In-Reply-To: Date:From:Cc:To:Subject:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:References: List-Owner; bh=w51wWCKFQNVS1oPqx8ANOJxaV8sB50jrP4GUn6lzUA4=; b=TQ9/Ca/RyB59p3 XrW4K1LOYyaO09k0ppaK/fja9zpU0sJC5DJCfMILzceOzFBGZTDqLwvRXw+E/SDmawXuUUNZvdAq+ 9FKXezLWdVFnzgQiiwnciCb8VTUyft0D3q9yOmAnhQHmRw6nwmMm2QOmbrYg8EUsVny+v0FpF4Vdr j6j0CK8NCzSrWKjwqd8sGyxCpMD2u38gDRIZzRYBdMiVE470X25SoG6RV+fV+2e9wI7KP5eIbhiaE uRjkyH7m3yhGzJdbHRI6sVEnhLceOKDrpqqhshavt9nF4bGOKrUwjuCa6/cW0mygv4LzhNT3EOaPT +Fsw4tcd8FFeQVWE2Emg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qsIZV-008kfs-0i; Mon, 16 Oct 2023 08:03:29 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qsIZ5-008kQy-0S for linux-arm-kernel@lists.infradead.org; Mon, 16 Oct 2023 08:03:08 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 333E260DB7; Mon, 16 Oct 2023 08:03:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C8AEC433C7; Mon, 16 Oct 2023 08:03:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1697443381; bh=UA360Git4ZHo/LEa/KDOez500EQliugwUmMmpM4dmtE=; h=Subject:To:Cc:From:Date:In-Reply-To:From; b=HYBeqQqcIbgi5UGlI/7E7SQUzObK/5jJkspzmItNA4aQv/8ZJ9oIbj6JpeIF1BkTA zurhltl4nNp7KC08bCTDZTsDvlO48aUdZXrRKhdHW4lrQklRiVzXqH55mjAbDH/C/B +XBv4EIbSH70iUtWbSBD57+HyUlSlO/5EoPWMd5w= Subject: Patch "arm64: factor out EL1 SSBS emulation hook" has been added to the 5.10-stable tree To: anshuman.khandual@arm.com,ardb@kernel.org,broonie@kernel.org,catalin.marinas@arm.com,ebiederm@xmission.com,f.fainelli@gmail.com,gregkh@linuxfoundation.org,haibinzhang@tencent.com,hewenliang4@huawei.com,james.morse@arm.com,joey.gouly@arm.com,linux-arm-kernel@lists.infradead.org,mark.rutland@arm.com,peterz@infradead.org,ruanjinjie@huawei.com,sashal@kernel.org,scott@os.amperecomputing.com,stable@kernel.org,will@kernel.org,youngmin.nam@samsung.com,yuzenghui@huawei.com Cc: From: Date: Mon, 16 Oct 2023 10:02:24 +0200 In-Reply-To: <20231011100545.979577-9-ruanjinjie@huawei.com> Message-ID: <2023101624-marital-emphasize-d5cd@gregkh> MIME-Version: 1.0 X-stable: commit X-Patchwork-Hint: ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231016_010303_298437_0A4EAD37 X-CRM114-Status: GOOD ( 21.47 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org This is a note to let you know that I've just added the patch titled arm64: factor out EL1 SSBS emulation hook to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: arm64-factor-out-el1-ssbs-emulation-hook.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From ruanjinjie@huawei.com Wed Oct 11 12:07:07 2023 From: Jinjie Ruan Date: Wed, 11 Oct 2023 10:05:38 +0000 Subject: arm64: factor out EL1 SSBS emulation hook To: , , , , , , , , , , , , , , , , , , Cc: Message-ID: <20231011100545.979577-9-ruanjinjie@huawei.com> From: Mark Rutland commit bff8f413c71ffc3cb679dbd9a5632b33af563f9f upstream. Currently call_undef_hook() is used to handle UNDEFINED exceptions from EL0 and EL1. As support for deprecated instructions may be enabled independently, the handlers for individual instructions are organised as a linked list of struct undef_hook which can be manipulated dynamically. As this can be manipulated dynamically, the list is protected with a raw_spinlock which must be acquired when handling UNDEFINED exceptions or when manipulating the list of handlers. This locking is unfortunate as it serialises handling of UNDEFINED exceptions, and requires RCU to be enabled for lockdep, requiring the use of RCU_NONIDLE() in resume path of cpu_suspend() since commit: a2c42bbabbe260b7 ("arm64: spectre: Prevent lockdep splat on v4 mitigation enable path") The list of UNDEFINED handlers largely consist of handlers for exceptions taken from EL0, and the only handler for exceptions taken from EL1 handles `MSR SSBS, #imm` on CPUs which feature PSTATE.SSBS but lack the corresponding MSR (Immediate) instruction. Other than this we never expect to take an UNDEFINED exception from EL1 in normal operation. This patch reworks do_el0_undef() to invoke the EL1 SSBS handler directly, relegating call_undef_hook() to only handle EL0 UNDEFs. This removes redundant work to iterate the list for EL1 UNDEFs, and removes the need for locking, permitting EL1 UNDEFs to be handled in parallel without contention. The RCU_NONIDLE() call in cpu_suspend() will be removed in a subsequent patch, as there are other potential issues with the use of instrumentable code and RCU in the CPU suspend code. I've tested this by forcing the detection of SSBS on a CPU that doesn't have it, and verifying that the try_emulate_el1_ssbs() callback is invoked. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: James Morse Cc: Joey Gouly Cc: Peter Zijlstra Cc: Will Deacon Link: https://lore.kernel.org/r/20221019144123.612388-4-mark.rutland@arm.com Signed-off-by: Will Deacon Signed-off-by: Jinjie Ruan Signed-off-by: Greg Kroah-Hartman --- arch/arm64/include/asm/spectre.h | 2 ++ arch/arm64/kernel/proton-pack.c | 26 +++++++------------------- arch/arm64/kernel/traps.c | 15 ++++++++------- 3 files changed, 17 insertions(+), 26 deletions(-) --- a/arch/arm64/include/asm/spectre.h +++ b/arch/arm64/include/asm/spectre.h @@ -18,6 +18,7 @@ enum mitigation_state { SPECTRE_VULNERABLE, }; +struct pt_regs; struct task_struct; enum mitigation_state arm64_get_spectre_v2_state(void); @@ -33,4 +34,5 @@ enum mitigation_state arm64_get_spectre_ bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope); u8 spectre_bhb_loop_affected(int scope); void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused); +bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr); #endif /* __ASM_SPECTRE_H */ --- a/arch/arm64/kernel/proton-pack.c +++ b/arch/arm64/kernel/proton-pack.c @@ -537,10 +537,13 @@ bool has_spectre_v4(const struct arm64_c return state != SPECTRE_UNAFFECTED; } -static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr) +bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr) { - if (user_mode(regs)) - return 1; + const u32 instr_mask = ~(1U << PSTATE_Imm_shift); + const u32 instr_val = 0xd500401f | PSTATE_SSBS; + + if ((instr & instr_mask) != instr_val) + return false; if (instr & BIT(PSTATE_Imm_shift)) regs->pstate |= PSR_SSBS_BIT; @@ -548,19 +551,11 @@ static int ssbs_emulation_handler(struct regs->pstate &= ~PSR_SSBS_BIT; arm64_skip_faulting_instruction(regs, 4); - return 0; + return true; } -static struct undef_hook ssbs_emulation_hook = { - .instr_mask = ~(1U << PSTATE_Imm_shift), - .instr_val = 0xd500401f | PSTATE_SSBS, - .fn = ssbs_emulation_handler, -}; - static enum mitigation_state spectre_v4_enable_hw_mitigation(void) { - static bool undef_hook_registered = false; - static DEFINE_RAW_SPINLOCK(hook_lock); enum mitigation_state state; /* @@ -571,13 +566,6 @@ static enum mitigation_state spectre_v4_ if (state != SPECTRE_MITIGATED || !this_cpu_has_cap(ARM64_SSBS)) return state; - raw_spin_lock(&hook_lock); - if (!undef_hook_registered) { - register_undef_hook(&ssbs_emulation_hook); - undef_hook_registered = true; - } - raw_spin_unlock(&hook_lock); - if (spectre_v4_mitigations_off()) { sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_DSSBS); asm volatile(SET_PSTATE_SSBS(1)); --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -311,12 +311,7 @@ static int call_undef_hook(struct pt_reg int (*fn)(struct pt_regs *regs, u32 instr) = NULL; void __user *pc = (void __user *)instruction_pointer(regs); - if (!user_mode(regs)) { - __le32 instr_le; - if (get_kernel_nofault(instr_le, (__force __le32 *)pc)) - goto exit; - instr = le32_to_cpu(instr_le); - } else if (compat_thumb_mode(regs)) { + if (compat_thumb_mode(regs)) { /* 16-bit Thumb instruction */ __le16 instr_le; if (get_user(instr_le, (__le16 __user *)pc)) @@ -409,9 +404,15 @@ void do_el0_undef(struct pt_regs *regs, void do_el1_undef(struct pt_regs *regs, unsigned long esr) { - if (call_undef_hook(regs) == 0) + u32 insn; + + if (aarch64_insn_read((void *)regs->pc, &insn)) + goto out_err; + + if (try_emulate_el1_ssbs(regs, insn)) return; +out_err: die("Oops - Undefined instruction", regs, esr); } Patches currently in stable-queue which might be from ruanjinjie@huawei.com are queue-5.10/arm64-factor-insn-read-out-of-call_undef_hook.patch queue-5.10/arm64-rework-el0-mrs-emulation.patch queue-5.10/arm64-die-pass-err-as-long.patch queue-5.10/arm64-armv8_deprecated-rework-deprected-instruction-handling.patch queue-5.10/arm64-armv8_deprecated-fix-unused-function-error.patch queue-5.10/arm64-armv8_deprecated-move-aarch32-helper-earlier.patch queue-5.10/arm64-consistently-pass-esr_elx-to-die.patch queue-5.10/arm64-factor-out-el1-ssbs-emulation-hook.patch queue-5.10/arm64-report-el1-undefs-better.patch queue-5.10/arm64-armv8_deprecated-fold-ops-into-insn_emulation.patch queue-5.10/arm64-rework-bti-exception-handling.patch queue-5.10/arm64-rework-fpac-exception-handling.patch queue-5.10/arm64-split-el0-el1-undef-handlers.patch queue-5.10/arm64-allow-kprobes-on-el0-handlers.patch queue-5.10/arm64-armv8_deprecated-move-emulation-functions.patch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel