From patchwork Thu Jan 4 15:08:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Deacon X-Patchwork-Id: 123431 Delivered-To: patch@linaro.org Received: by 10.80.135.92 with SMTP id 28csp6818802edv; Thu, 4 Jan 2018 07:08:57 -0800 (PST) X-Google-Smtp-Source: ACJfBosX/rkDkeDdPenk0vz4qvB6GzbUDVAWJkc3by0pquFuqiCpl+oXoVOyjdMvUtxHUF4yJQe7 X-Received: by 10.101.71.205 with SMTP id f13mr4185288pgs.389.1515078537373; Thu, 04 Jan 2018 07:08:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1515078537; cv=none; d=google.com; s=arc-20160816; b=eohwCB+YyNhHCU5cD16vQilNyKKRKarZytByahFmHH2/qp9vOf8kTPE8hFDVbgWYQj 0W3KXYERHi0cmL3gkuRrb1nNNPJxJjNp8sRu/CP9EZYG8ZMFWlu+LWKKU7jyiBQNkqO1 SELka1kQj4RV/2T/LF10RfXY605aUVod6e7VR6bSSke/TV/xq9FZroQ2Qi4FHcvgkUDx +JW1yD9kp5tPv3OvFCWmdX22P675m2qETS2lZdyNMhHNb4X5D/hJ6r6mOxyYU7CwCMxR 9GUdvTz64N7Dr0RKKUSGk08Uz/IXBJNkxmqXHoRftCSodxp+6POheJLMCnYjGei/tpoO FWfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=iU8kMQ0pokhPRCqxAoTSuFb7OZL2abPGGeeN7SCOOtA=; b=ZV6rR+g4RkehGV1V1Xt2HaxdKmarzpEDUirotzPMnnHMB9UprmumDzeWCojGfmlp3H 20LNWiRv9k++VqusJjc8/RQRIS19V29lbSs3wncd4cFg3knL+qITtU9kNRmh7IlsSzI2 VEqmvWL4i+h8HM0TwgE6X2GLOK99S5sCfT01YH90RrY6TAbpwaFUjtNb0WmdIunJk515 BiVxCY164FldYwKBuz6aBQVQ2IV2Qu1f8+Uy7iAtjuXzkWx6J2crWqpiweOoxeDVLl5+ 7rsHSx+7S99bNGy26dham3lNrBu8wxdKZy+yhQbT4zfe1a3jxWb06cib9WqWetR8Cuqw FVgA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d62si2137613pgc.703.2018.01.04.07.08.57; Thu, 04 Jan 2018 07:08:57 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753440AbeADPIx (ORCPT + 22 others); Thu, 4 Jan 2018 10:08:53 -0500 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:33784 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753369AbeADPIk (ORCPT ); Thu, 4 Jan 2018 10:08:40 -0500 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6E48B80D; Thu, 4 Jan 2018 07:08:40 -0800 (PST) Received: from edgewater-inn.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 402B03F41F; Thu, 4 Jan 2018 07:08:40 -0800 (PST) Received: by edgewater-inn.cambridge.arm.com (Postfix, from userid 1000) id 6BC421AE0DBD; Thu, 4 Jan 2018 15:08:40 +0000 (GMT) From: Will Deacon To: linux-arm-kernel@lists.infradead.org Cc: catalin.marinas@arm.com, ard.biesheuvel@linaro.org, marc.zyngier@arm.com, lorenzo.pieralisi@arm.com, christoffer.dall@linaro.org, linux-kernel@vger.kernel.org, Will Deacon Subject: [PATCH 00/11] arm64 kpti hardening and variant 2 workarounds Date: Thu, 4 Jan 2018 15:08:24 +0000 Message-Id: <1515078515-13723-1-git-send-email-will.deacon@arm.com> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi all, This set of patches builds on top of the arm64 kpti patches[1] queued for 4.16 and further hardens the arm64 Linux kernel against the side-channel attacks recently published by Google Project Zero. In particular, the series does the following: * Enable kpti by default on arm64, based on the value of ID_AA64PFR0_EL1.CSV3 * Prevent speculative resteering of the indirect branch in the exception trampoline page, which resides at a fixed virtual address to avoid a KASLR leak * Add hooks to changes of context where the branch predictor could theoretically resteer the speculative instruction stream having been trained by userspace or a guest OS. These hooks are signal delivery (to prevent training the branch predictor on kernel addresses from userspace), switch_mm (return to user if SW PAN is enabled) and exit from a guest VM. * Implement a dummy PSCI "VERSION" call as the hook for affected Cortex-A CPUs. This will invalidate the predictor state with the latest Arm Trusted Firmware patches which will appear at [2] and SoC vendors with affected CPUs are strongly encouraged to update. We plan to switch to a more efficient, special-purpose call when it is available and the PSCI spec has been updated accordingly. I'd like to get this in for 4.16, but that doesn't mean we can't improve it further once it's merged. For more information about the impact of this issue and the software migitations for Arm processors, please see http://www.arm.com/security-update. Thanks, Will [1] https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/tag/?h=kpti-base [2] https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-6 --->8 Marc Zyngier (3): arm64: Move post_ttbr_update_workaround to C code arm64: KVM: Use per-CPU vector when BP hardening is enabled arm64: KVM: Make PSCI_VERSION a fast path Will Deacon (8): arm64: use RET instruction for exiting the trampoline arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry arm64: Take into account ID_AA64PFR0_EL1.CSV3 arm64: cpufeature: Pass capability structure to ->enable callback drivers/firmware: Expose psci_get_version through psci_ops structure arm64: Add skeleton to harden the branch predictor against aliasing attacks arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 arm64: Implement branch predictor hardening for affected Cortex-A CPUs arch/arm/include/asm/kvm_mmu.h | 10 ++++ arch/arm64/Kconfig | 30 +++++++--- arch/arm64/include/asm/assembler.h | 13 ----- arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cputype.h | 4 ++ arch/arm64/include/asm/kvm_mmu.h | 38 ++++++++++++ arch/arm64/include/asm/mmu.h | 37 ++++++++++++ arch/arm64/include/asm/sysreg.h | 2 + arch/arm64/kernel/Makefile | 4 ++ arch/arm64/kernel/bpi.S | 79 +++++++++++++++++++++++++ arch/arm64/kernel/cpu_errata.c | 116 +++++++++++++++++++++++++++++++++++++ arch/arm64/kernel/cpufeature.c | 12 +++- arch/arm64/kernel/entry.S | 7 ++- arch/arm64/kvm/hyp/switch.c | 15 ++++- arch/arm64/mm/context.c | 11 ++++ arch/arm64/mm/fault.c | 1 + arch/arm64/mm/proc.S | 3 +- drivers/firmware/psci.c | 2 + include/linux/psci.h | 1 + virt/kvm/arm/arm.c | 8 ++- 20 files changed, 366 insertions(+), 30 deletions(-) create mode 100644 arch/arm64/kernel/bpi.S -- 2.1.4