1 // SPDX-License-Identifier: GPL-2.0-only
6  *   https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
20 #include <linux/arm-smccc.h>
71  * - Mitigated in hardware and advertised by ID_AA64PFR0_EL1.CSV2.
72  * - Mitigated in hardware and listed in our "safe list".
73  * - Mitigated in software by firmware.
74  * - Mitigated in software by a CPU-specific dance in the kernel and a
75  *   firmware call at EL2.
76  * - Vulnerable.
96 		pr_info_once("spectre-v2 mitigation disabled by command line option\n");  in spectre_v2_mitigations_off()
136 		 * Platforms affected by Spectre-BHB can't report  in cpu_show_spectre_v2()
137 		 * "Not affected" for Spectre-v2.  in cpu_show_spectre_v2()
225 atomic_t arm64_el2_vector_last_slot = ATOMIC_INIT(-1);
234 		memcpy(dst + i, hyp_vecs_start, hyp_vecs_end - hyp_vecs_start);  in __copy_hyp_vect_bpi()
242 	int cpu, slot = -1;  in install_bp_hardening_cb()
249 	 * the door when we're a guest. Skip the hyp-vectors work.  in install_bp_hardening_cb()
264 	if (slot == -1) {  in install_bp_hardening_cb()
340 	 * Prefer a CPU-specific workaround if it exists. Note that we  in spectre_v2_enable_fw_mitigation()
341 	 * still rely on firmware for the mitigation at EL2.  in spectre_v2_enable_fw_mitigation()
367  * - Mitigated in hardware and listed in our "safe list".
368  * - Mitigated in hardware via PSTATE.SSBS.
369  * - Mitigated in software by firmware (sometimes referred to as SSBD).
374  * on a per-task basis, but can also be forced on for the kernel, necessitating
375  * both context-switch *and* entry/exit hooks. To make it even worse, some CPUs
377  * being stale when re-entering the kernel. The usual big.LITTLE caveats apply,
378  * so you can have systems that have both firmware and SSBS mitigations. This
381  * be opt-in for userspace. Yes, really, the cure is worse than the disease.
383  * The only good part is that if the firmware mitigation is present, then it is
385  * vulnerable CPU if one of the boot CPUs is using the firmware mitigation.
387  * Give me a VAX-11/780 any day of the week...
391 /* This is the per-cpu state tracking whether we need to talk to firmware */
406 	{ "force-on",	SPECTRE_V4_POLICY_MITIGATION_ENABLED, },
407 	{ "force-off",	SPECTRE_V4_POLICY_MITIGATION_DISABLED, },
415 		return -EINVAL;  in parse_spectre_v4_param()
420 		if (strncmp(str, param->str, strlen(param->str)))  in parse_spectre_v4_param()
423 		__spectre_v4_policy = param->policy;  in parse_spectre_v4_param()
427 	return -EINVAL;  in parse_spectre_v4_param()
444 		pr_info_once("spectre-v4 mitigation disabled by command-line option\n");  in spectre_v4_mitigations_off()
546 		regs->pstate |= PSR_SSBS_BIT;  in ssbs_emulation_handler()
548 		regs->pstate &= ~PSR_SSBS_BIT;  in ssbs_emulation_handler()
587 	/* SCTLR_EL1.DSSBS was initialised to 0 during boot */  in spectre_v4_enable_hw_mitigation()
593  * Patch a branch over the Spectre-v4 mitigation code with a NOP so that
594  * we fallthrough and check whether firmware needs to be called on this CPU.
600 	BUG_ON(nr_inst != 1); /* Branch -> NOP */  in spectre_v4_patch_fw_mitigation_enable()
613  * Patch a NOP in the Spectre-v4 mitigation code with an SMC/HVC instruction
614  * to call into firmware to adjust the mitigation state.
622 	BUG_ON(nr_inst != 1); /* NOP -> HVC/SMC */  in smccc_patch_fw_mitigation_conduit()
677 		regs->pstate |= bit;  in __update_pstate_ssbs()
679 		regs->pstate &= ~bit;  in __update_pstate_ssbs()
685 	bool ssbs = false, kthread = tsk->flags & PF_KTHREAD;  in spectre_v4_enable_task_mitigation()
696  * The Spectre-v4 mitigation can be controlled via a prctl() from userspace.
723 		 * re-enabled.  in ssbd_prctl_set()
726 			return -EPERM;  in ssbd_prctl_set()
730 		 * off and we again prevent it from being re-enabled.  in ssbd_prctl_set()
733 			return -EPERM;  in ssbd_prctl_set()
744 			return -EPERM;  in ssbd_prctl_set()
752 			return -EPERM;  in ssbd_prctl_set()
765 			return -EPERM;  in ssbd_prctl_set()
772 		return -ERANGE;  in ssbd_prctl_set()
786 		return -ENODEV;  in arch_prctl_spec_ctrl_set()
829 		return -ENODEV;  in arch_prctl_spec_ctrl_get()
837  * - Mitigated by a branchy loop a CPU specific number of times, and listed
839  * - Mitigated in software by the firmware Spectre v2 call.
840  * - Has the ClearBHB instruction to perform the mitigation.
841  * - Has the 'Exception Clears Branch History Buffer' (ECBHB) feature, so no
843  * - Has CSV2.3, so is unaffected.
993 	 * user-space.  in this_cpu_set_vectors()
1019 	int cpu, slot = -1, size;  in kvm_setup_bhb_slot()
1038 	if (slot == -1) {  in kvm_setup_bhb_slot()
1066 		/* No point mitigating Spectre-BHB alone. */  in spectre_bhb_enable_mitigation()
1068 		pr_info_once("spectre-bhb mitigation disabled by compile time option\n");  in spectre_bhb_enable_mitigation()
1070 		pr_info_once("spectre-bhb mitigation disabled by command line option\n");  in spectre_bhb_enable_mitigation()
1116 	BUG_ON(nr_inst != 1); /* MOV -> MOV */  in spectre_bhb_patch_loop_iter()