1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/arm-smccc.h>
3 #include <linux/kernel.h>
7 #include <asm/cputype.h>
8 #include <asm/proc-fns.h>
9 #include <asm/spectre.h>
10 #include <asm/system_misc.h>
12 #ifdef CONFIG_ARM_PSCI
13 static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
15 struct arm_smccc_res res;
17 arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
18 ARM_SMCCC_ARCH_WORKAROUND_1, &res);
20 switch ((int)res.a0) {
21 case SMCCC_RET_SUCCESS:
22 return SPECTRE_MITIGATED;
24 case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED:
25 return SPECTRE_UNAFFECTED;
28 return SPECTRE_VULNERABLE;
32 static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
34 return SPECTRE_VULNERABLE;
38 #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
39 DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
41 extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
42 extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
43 extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
44 extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm);
46 static void harden_branch_predictor_bpiall(void)
48 write_sysreg(0, BPIALL);
51 static void harden_branch_predictor_iciallu(void)
53 write_sysreg(0, ICIALLU);
56 static void __maybe_unused call_smc_arch_workaround_1(void)
58 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
61 static void __maybe_unused call_hvc_arch_workaround_1(void)
63 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
66 static unsigned int spectre_v2_install_workaround(unsigned int method)
68 const char *spectre_v2_method = NULL;
69 int cpu = smp_processor_id();
71 if (per_cpu(harden_branch_predictor_fn, cpu))
72 return SPECTRE_MITIGATED;
75 case SPECTRE_V2_METHOD_BPIALL:
76 per_cpu(harden_branch_predictor_fn, cpu) =
77 harden_branch_predictor_bpiall;
78 spectre_v2_method = "BPIALL";
81 case SPECTRE_V2_METHOD_ICIALLU:
82 per_cpu(harden_branch_predictor_fn, cpu) =
83 harden_branch_predictor_iciallu;
84 spectre_v2_method = "ICIALLU";
87 case SPECTRE_V2_METHOD_HVC:
88 per_cpu(harden_branch_predictor_fn, cpu) =
89 call_hvc_arch_workaround_1;
90 cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
91 spectre_v2_method = "hypervisor";
94 case SPECTRE_V2_METHOD_SMC:
95 per_cpu(harden_branch_predictor_fn, cpu) =
96 call_smc_arch_workaround_1;
97 cpu_do_switch_mm = cpu_v7_smc_switch_mm;
98 spectre_v2_method = "firmware";
102 if (spectre_v2_method)
103 pr_info("CPU%u: Spectre v2: using %s workaround\n",
104 smp_processor_id(), spectre_v2_method);
106 return SPECTRE_MITIGATED;
109 static unsigned int spectre_v2_install_workaround(unsigned int method)
111 pr_info("CPU%u: Spectre V2: workarounds disabled by configuration\n",
114 return SPECTRE_VULNERABLE;
118 static void cpu_v7_spectre_v2_init(void)
120 unsigned int state, method = 0;
122 switch (read_cpuid_part()) {
123 case ARM_CPU_PART_CORTEX_A8:
124 case ARM_CPU_PART_CORTEX_A9:
125 case ARM_CPU_PART_CORTEX_A12:
126 case ARM_CPU_PART_CORTEX_A17:
127 case ARM_CPU_PART_CORTEX_A73:
128 case ARM_CPU_PART_CORTEX_A75:
129 state = SPECTRE_MITIGATED;
130 method = SPECTRE_V2_METHOD_BPIALL;
133 case ARM_CPU_PART_CORTEX_A15:
134 case ARM_CPU_PART_BRAHMA_B15:
135 state = SPECTRE_MITIGATED;
136 method = SPECTRE_V2_METHOD_ICIALLU;
139 case ARM_CPU_PART_BRAHMA_B53:
140 /* Requires no workaround */
141 state = SPECTRE_UNAFFECTED;
145 /* Other ARM CPUs require no workaround */
146 if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) {
147 state = SPECTRE_UNAFFECTED;
153 /* Cortex A57/A72 require firmware workaround */
154 case ARM_CPU_PART_CORTEX_A57:
155 case ARM_CPU_PART_CORTEX_A72:
156 state = spectre_v2_get_cpu_fw_mitigation_state();
157 if (state != SPECTRE_MITIGATED)
160 switch (arm_smccc_1_1_get_conduit()) {
161 case SMCCC_CONDUIT_HVC:
162 method = SPECTRE_V2_METHOD_HVC;
165 case SMCCC_CONDUIT_SMC:
166 method = SPECTRE_V2_METHOD_SMC;
170 state = SPECTRE_VULNERABLE;
175 if (state == SPECTRE_MITIGATED)
176 state = spectre_v2_install_workaround(method);
178 spectre_v2_update_state(state, method);
181 #ifdef CONFIG_HARDEN_BRANCH_HISTORY
182 static int spectre_bhb_method;
184 static const char *spectre_bhb_method_name(int method)
187 case SPECTRE_V2_METHOD_LOOP8:
190 case SPECTRE_V2_METHOD_BPIALL:
198 static int spectre_bhb_install_workaround(int method)
200 if (spectre_bhb_method != method) {
201 if (spectre_bhb_method) {
202 pr_err("CPU%u: Spectre BHB: method disagreement, system vulnerable\n",
205 return SPECTRE_VULNERABLE;
208 if (spectre_bhb_update_vectors(method) == SPECTRE_VULNERABLE)
209 return SPECTRE_VULNERABLE;
211 spectre_bhb_method = method;
214 pr_info("CPU%u: Spectre BHB: using %s workaround\n",
215 smp_processor_id(), spectre_bhb_method_name(method));
217 return SPECTRE_MITIGATED;
220 static int spectre_bhb_install_workaround(int method)
222 return SPECTRE_VULNERABLE;
226 static void cpu_v7_spectre_bhb_init(void)
228 unsigned int state, method = 0;
230 switch (read_cpuid_part()) {
231 case ARM_CPU_PART_CORTEX_A15:
232 case ARM_CPU_PART_BRAHMA_B15:
233 case ARM_CPU_PART_CORTEX_A57:
234 case ARM_CPU_PART_CORTEX_A72:
235 state = SPECTRE_MITIGATED;
236 method = SPECTRE_V2_METHOD_LOOP8;
239 case ARM_CPU_PART_CORTEX_A73:
240 case ARM_CPU_PART_CORTEX_A75:
241 state = SPECTRE_MITIGATED;
242 method = SPECTRE_V2_METHOD_BPIALL;
246 state = SPECTRE_UNAFFECTED;
250 if (state == SPECTRE_MITIGATED)
251 state = spectre_bhb_install_workaround(method);
253 spectre_v2_update_state(state, method);
256 static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
257 u32 mask, const char *msg)
261 asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr));
263 if ((aux_cr & mask) != mask) {
265 pr_err("CPU%u: %s", smp_processor_id(), msg);
272 static DEFINE_PER_CPU(bool, spectre_warned);
274 static bool check_spectre_auxcr(bool *warned, u32 bit)
276 return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) &&
277 cpu_v7_check_auxcr_set(warned, bit,
278 "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n");
281 void cpu_v7_ca8_ibe(void)
283 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
284 cpu_v7_spectre_v2_init();
287 void cpu_v7_ca15_ibe(void)
289 if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
290 cpu_v7_spectre_v2_init();
291 cpu_v7_spectre_bhb_init();
294 void cpu_v7_bugs_init(void)
296 cpu_v7_spectre_v2_init();
297 cpu_v7_spectre_bhb_init();