1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/arm-smccc.h>
3 #include <linux/kernel.h>
4 #include <linux/psci.h>
5 #include <linux/smp.h>
6
7 #include <asm/cp15.h>
8 #include <asm/cputype.h>
9 #include <asm/proc-fns.h>
10 #include <asm/system_misc.h>
11
12 #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
13 DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
14
15 extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
16 extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
17 extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
18 extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
19
harden_branch_predictor_bpiall(void)20 static void harden_branch_predictor_bpiall(void)
21 {
22 write_sysreg(0, BPIALL);
23 }
24
harden_branch_predictor_iciallu(void)25 static void harden_branch_predictor_iciallu(void)
26 {
27 write_sysreg(0, ICIALLU);
28 }
29
call_smc_arch_workaround_1(void)30 static void __maybe_unused call_smc_arch_workaround_1(void)
31 {
32 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
33 }
34
call_hvc_arch_workaround_1(void)35 static void __maybe_unused call_hvc_arch_workaround_1(void)
36 {
37 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
38 }
39
cpu_v7_spectre_init(void)40 static void cpu_v7_spectre_init(void)
41 {
42 const char *spectre_v2_method = NULL;
43 int cpu = smp_processor_id();
44
45 if (per_cpu(harden_branch_predictor_fn, cpu))
46 return;
47
48 switch (read_cpuid_part()) {
49 case ARM_CPU_PART_CORTEX_A8:
50 case ARM_CPU_PART_CORTEX_A9:
51 case ARM_CPU_PART_CORTEX_A12:
52 case ARM_CPU_PART_CORTEX_A17:
53 case ARM_CPU_PART_CORTEX_A73:
54 case ARM_CPU_PART_CORTEX_A75:
55 if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
56 goto bl_error;
57 per_cpu(harden_branch_predictor_fn, cpu) =
58 harden_branch_predictor_bpiall;
59 spectre_v2_method = "BPIALL";
60 break;
61
62 case ARM_CPU_PART_CORTEX_A15:
63 case ARM_CPU_PART_BRAHMA_B15:
64 if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
65 goto bl_error;
66 per_cpu(harden_branch_predictor_fn, cpu) =
67 harden_branch_predictor_iciallu;
68 spectre_v2_method = "ICIALLU";
69 break;
70
71 #ifdef CONFIG_ARM_PSCI
72 default:
73 /* Other ARM CPUs require no workaround */
74 if (read_cpuid_implementor() == ARM_CPU_IMP_ARM)
75 break;
76 /* fallthrough */
77 /* Cortex A57/A72 require firmware workaround */
78 case ARM_CPU_PART_CORTEX_A57:
79 case ARM_CPU_PART_CORTEX_A72: {
80 struct arm_smccc_res res;
81
82 if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
83 break;
84
85 switch (psci_ops.conduit) {
86 case PSCI_CONDUIT_HVC:
87 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
88 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
89 if ((int)res.a0 != 0)
90 break;
91 if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
92 goto bl_error;
93 per_cpu(harden_branch_predictor_fn, cpu) =
94 call_hvc_arch_workaround_1;
95 processor.switch_mm = cpu_v7_hvc_switch_mm;
96 spectre_v2_method = "hypervisor";
97 break;
98
99 case PSCI_CONDUIT_SMC:
100 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
101 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
102 if ((int)res.a0 != 0)
103 break;
104 if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
105 goto bl_error;
106 per_cpu(harden_branch_predictor_fn, cpu) =
107 call_smc_arch_workaround_1;
108 processor.switch_mm = cpu_v7_smc_switch_mm;
109 spectre_v2_method = "firmware";
110 break;
111
112 default:
113 break;
114 }
115 }
116 #endif
117 }
118
119 if (spectre_v2_method)
120 pr_info("CPU%u: Spectre v2: using %s workaround\n",
121 smp_processor_id(), spectre_v2_method);
122 return;
123
124 bl_error:
125 pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
126 cpu);
127 }
128 #else
cpu_v7_spectre_init(void)129 static void cpu_v7_spectre_init(void)
130 {
131 }
132 #endif
133
cpu_v7_check_auxcr_set(bool * warned,u32 mask,const char * msg)134 static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
135 u32 mask, const char *msg)
136 {
137 u32 aux_cr;
138
139 asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr));
140
141 if ((aux_cr & mask) != mask) {
142 if (!*warned)
143 pr_err("CPU%u: %s", smp_processor_id(), msg);
144 *warned = true;
145 return false;
146 }
147 return true;
148 }
149
150 static DEFINE_PER_CPU(bool, spectre_warned);
151
check_spectre_auxcr(bool * warned,u32 bit)152 static bool check_spectre_auxcr(bool *warned, u32 bit)
153 {
154 return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) &&
155 cpu_v7_check_auxcr_set(warned, bit,
156 "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n");
157 }
158
cpu_v7_ca8_ibe(void)159 void cpu_v7_ca8_ibe(void)
160 {
161 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
162 cpu_v7_spectre_init();
163 }
164
cpu_v7_ca15_ibe(void)165 void cpu_v7_ca15_ibe(void)
166 {
167 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
168 cpu_v7_spectre_init();
169 }
170
cpu_v7_bugs_init(void)171 void cpu_v7_bugs_init(void)
172 {
173 cpu_v7_spectre_init();
174 }
175
