Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2532e27 authored by Jeremy Linton's avatar Jeremy Linton Committed by Will Deacon
Browse files

arm64: add sysfs vulnerability show for spectre-v2 



Track whether all the cores in the machine are vulnerable to Spectre-v2,
and whether all the vulnerable cores have been mitigated. We then expose
this information to userspace via sysfs.

Signed-off-by: default avatarJeremy Linton <jeremy.linton@arm.com>
Reviewed-by: default avatarAndre Przywara <andre.przywara@arm.com>
Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
parent 8c1e3d2b

arch/arm64/kernel/cpu_errata.c

+26 −1
Original line number Diff line number Diff line
@@ -512,6 +512,10 @@ cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused) 
	.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,			\

	CAP_MIDR_RANGE_LIST(midr_list)



/* Track overall mitigation state. We are only mitigated if all cores are ok */

static bool __hardenbp_enab = true;

static bool __spectrev2_safe = true;



/*

 * List of CPUs that do not need any Spectre-v2 mitigation at all.

 */
@@ -522,6 +526,10 @@ static const struct midr_range spectre_v2_safe_list[] = { 
	{ /* sentinel */ }

};



/*

 * Track overall bp hardening for all heterogeneous cores in the machine.

 * We are only considered "safe" if all booted cores are known safe.

 */

static bool __maybe_unused

check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)

{
@@ -543,6 +551,8 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope) 
	if (!need_wa)

		return false;



	__spectrev2_safe = false;



	if (!IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR)) {

		pr_warn_once("spectrev2 mitigation disabled by kernel configuration\n");

		__hardenbp_enab = false;
@@ -552,11 +562,14 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope) 
	/* forced off */

	if (__nospectre_v2) {

		pr_info_once("spectrev2 mitigation disabled by command line option\n");

		__hardenbp_enab = false;

		return false;

	}



	if (need_wa < 0)

	if (need_wa < 0) {

		pr_warn_once("ARM_SMCCC_ARCH_WORKAROUND_1 missing from firmware\n");

		__hardenbp_enab = false;

	}



	return (need_wa > 0);

}
@@ -779,3 +792,15 @@ ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, 
{

	return sprintf(buf, "Mitigation: __user pointer sanitization\n");

}



ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr,

		char *buf)

{

	if (__spectrev2_safe)

		return sprintf(buf, "Not affected\n");



	if (__hardenbp_enab)

		return sprintf(buf, "Mitigation: Branch predictor hardening\n");



	return sprintf(buf, "Vulnerable\n");

}