1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/arm-smccc.h>
3 #include <linux/kernel.h>
4 #include <linux/psci.h>
8 #include <asm/cputype.h>
9 #include <asm/proc-fns.h>
10 #include <asm/spectre.h>
11 #include <asm/system_misc.h>
13 #ifdef CONFIG_ARM_PSCI
14 #define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1
15 static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
17 struct arm_smccc_res res;
19 arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
20 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
22 switch ((int)res.a0) {
23 case SMCCC_RET_SUCCESS:
24 return SPECTRE_MITIGATED;
26 case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED:
27 return SPECTRE_UNAFFECTED;
30 return SPECTRE_VULNERABLE;
34 static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
36 return SPECTRE_VULNERABLE;
40 #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
41 DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
43 extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
44 extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
45 extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
46 extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
48 static void harden_branch_predictor_bpiall(void)
50 write_sysreg(0, BPIALL);
53 static void harden_branch_predictor_iciallu(void)
55 write_sysreg(0, ICIALLU);
58 static void __maybe_unused call_smc_arch_workaround_1(void)
60 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
63 static void __maybe_unused call_hvc_arch_workaround_1(void)
65 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
68 static unsigned int spectre_v2_install_workaround(unsigned int method)
70 const char *spectre_v2_method = NULL;
71 int cpu = smp_processor_id();
73 if (per_cpu(harden_branch_predictor_fn, cpu))
74 return SPECTRE_MITIGATED;
77 case SPECTRE_V2_METHOD_BPIALL:
78 per_cpu(harden_branch_predictor_fn, cpu) =
79 harden_branch_predictor_bpiall;
80 spectre_v2_method = "BPIALL";
83 case SPECTRE_V2_METHOD_ICIALLU:
84 per_cpu(harden_branch_predictor_fn, cpu) =
85 harden_branch_predictor_iciallu;
86 spectre_v2_method = "ICIALLU";
89 case SPECTRE_V2_METHOD_HVC:
90 per_cpu(harden_branch_predictor_fn, cpu) =
91 call_hvc_arch_workaround_1;
92 cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
93 spectre_v2_method = "hypervisor";
96 case SPECTRE_V2_METHOD_SMC:
97 per_cpu(harden_branch_predictor_fn, cpu) =
98 call_smc_arch_workaround_1;
99 cpu_do_switch_mm = cpu_v7_smc_switch_mm;
100 spectre_v2_method = "firmware";
104 if (spectre_v2_method)
105 pr_info("CPU%u: Spectre v2: using %s workaround\n",
106 smp_processor_id(), spectre_v2_method);
108 return SPECTRE_MITIGATED;
111 static unsigned int spectre_v2_install_workaround(unsigned int method)
113 pr_info_once("Spectre V2: workarounds disabled by configuration\n");
115 return SPECTRE_VULNERABLE;
119 static void cpu_v7_spectre_v2_init(void)
121 unsigned int state, method = 0;
123 switch (read_cpuid_part()) {
124 case ARM_CPU_PART_CORTEX_A8:
125 case ARM_CPU_PART_CORTEX_A9:
126 case ARM_CPU_PART_CORTEX_A12:
127 case ARM_CPU_PART_CORTEX_A17:
128 case ARM_CPU_PART_CORTEX_A73:
129 case ARM_CPU_PART_CORTEX_A75:
130 state = SPECTRE_MITIGATED;
131 method = SPECTRE_V2_METHOD_BPIALL;
134 case ARM_CPU_PART_CORTEX_A15:
135 case ARM_CPU_PART_BRAHMA_B15:
136 state = SPECTRE_MITIGATED;
137 method = SPECTRE_V2_METHOD_ICIALLU;
141 /* Other ARM CPUs require no workaround */
142 if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) {
143 state = SPECTRE_UNAFFECTED;
147 /* Cortex A57/A72 require firmware workaround */
148 case ARM_CPU_PART_CORTEX_A57:
149 case ARM_CPU_PART_CORTEX_A72: {
150 struct arm_smccc_res res;
152 state = spectre_v2_get_cpu_fw_mitigation_state();
153 if (state != SPECTRE_MITIGATED)
156 if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
159 switch (psci_ops.conduit) {
160 case PSCI_CONDUIT_HVC:
161 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
162 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
163 if ((int)res.a0 != 0)
165 method = SPECTRE_V2_METHOD_HVC;
168 case PSCI_CONDUIT_SMC:
169 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
170 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
171 if ((int)res.a0 != 0)
173 method = SPECTRE_V2_METHOD_SMC;
177 state = SPECTRE_VULNERABLE;
183 if (state == SPECTRE_MITIGATED)
184 state = spectre_v2_install_workaround(method);
186 spectre_v2_update_state(state, method);
189 #ifdef CONFIG_HARDEN_BRANCH_HISTORY
190 static int spectre_bhb_method;
192 static const char *spectre_bhb_method_name(int method)
195 case SPECTRE_V2_METHOD_LOOP8:
198 case SPECTRE_V2_METHOD_BPIALL:
206 static int spectre_bhb_install_workaround(int method)
208 if (spectre_bhb_method != method) {
209 if (spectre_bhb_method) {
210 pr_err("CPU%u: Spectre BHB: method disagreement, system vulnerable\n",
213 return SPECTRE_VULNERABLE;
216 if (spectre_bhb_update_vectors(method) == SPECTRE_VULNERABLE)
217 return SPECTRE_VULNERABLE;
219 spectre_bhb_method = method;
221 pr_info("CPU%u: Spectre BHB: enabling %s workaround for all CPUs\n",
222 smp_processor_id(), spectre_bhb_method_name(method));
225 return SPECTRE_MITIGATED;
228 static int spectre_bhb_install_workaround(int method)
230 return SPECTRE_VULNERABLE;
234 static void cpu_v7_spectre_bhb_init(void)
236 unsigned int state, method = 0;
238 switch (read_cpuid_part()) {
239 case ARM_CPU_PART_CORTEX_A15:
240 case ARM_CPU_PART_BRAHMA_B15:
241 case ARM_CPU_PART_CORTEX_A57:
242 case ARM_CPU_PART_CORTEX_A72:
243 state = SPECTRE_MITIGATED;
244 method = SPECTRE_V2_METHOD_LOOP8;
247 case ARM_CPU_PART_CORTEX_A73:
248 case ARM_CPU_PART_CORTEX_A75:
249 state = SPECTRE_MITIGATED;
250 method = SPECTRE_V2_METHOD_BPIALL;
254 state = SPECTRE_UNAFFECTED;
258 if (state == SPECTRE_MITIGATED)
259 state = spectre_bhb_install_workaround(method);
261 spectre_v2_update_state(state, method);
264 static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
265 u32 mask, const char *msg)
269 asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr));
271 if ((aux_cr & mask) != mask) {
273 pr_err("CPU%u: %s", smp_processor_id(), msg);
280 static DEFINE_PER_CPU(bool, spectre_warned);
282 static bool check_spectre_auxcr(bool *warned, u32 bit)
284 return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) &&
285 cpu_v7_check_auxcr_set(warned, bit,
286 "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n");
289 void cpu_v7_ca8_ibe(void)
291 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
292 cpu_v7_spectre_v2_init();
295 void cpu_v7_ca15_ibe(void)
297 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
298 cpu_v7_spectre_v2_init();
299 cpu_v7_spectre_bhb_init();
302 void cpu_v7_bugs_init(void)
304 cpu_v7_spectre_v2_init();
305 cpu_v7_spectre_bhb_init();