[prev in list] [next in list] [prev in thread] [next in thread]
List: xen-devel
Subject: [Xen-devel] [PATCH v2 6/7] xen/arm32: Invalidate icache on guest exist for Cortex-A15
From: Julien Grall <julien.grall () linaro ! org>
Date: 2018-01-31 16:53:33
Message-ID: 20180131165334.23175-7-julien.grall () arm ! com
[Download RAW message or body]
From: Julien Grall <julien.grall@linaro.org>
In order to avoid aliasing attacks against the branch predictor on
Cortex A-15, let's invalidate the BTB on guest exit, which can only be
done by invalidating the icache (with ACTLR[0] being set).
We use the same hack as for A12/A17 to perform the vector decoding.
This is based on Linux patch from the kpti branch in [1].
[1] https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
Changes in v2:
- Add Stefano's reviewed-by
---
xen/arch/arm/arm32/entry.S | 21 +++++++++++++++++++++
xen/arch/arm/cpuerrata.c | 13 +++++++++++++
2 files changed, 34 insertions(+)
diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S
index a295f3ad67..837f64d20d 100644
--- a/xen/arch/arm/arm32/entry.S
+++ b/xen/arch/arm/arm32/entry.S
@@ -161,6 +161,26 @@ GLOBAL(hyp_traps_vector)
b trap_fiq /* 0x1c - FIQ */
.align 5
+GLOBAL(hyp_traps_vector_ic_inv)
+ /*
+ * We encode the exception entry in the bottom 3 bits of
+ * SP, and we have to guarantee to be 8 bytes aligned.
+ */
+ add sp, sp, #1 /* Reset 7 */
+ add sp, sp, #1 /* Undef 6 */
+ add sp, sp, #1 /* Hypervisor call 5 */
+ add sp, sp, #1 /* Prefetch abort 4 */
+ add sp, sp, #1 /* Data abort 3 */
+ add sp, sp, #1 /* Hypervisor 2 */
+ add sp, sp, #1 /* IRQ 1 */
+ nop /* FIQ 0 */
+
+ mcr p15, 0, r0, c7, c5, 0 /* ICIALLU */
+ isb
+
+ b decode_vectors
+
+ .align 5
GLOBAL(hyp_traps_vector_bp_inv)
/*
* We encode the exception entry in the bottom 3 bits of
@@ -178,6 +198,7 @@ GLOBAL(hyp_traps_vector_bp_inv)
mcr p15, 0, r0, c7, c5, 6 /* BPIALL */
isb
+decode_vectors:
/*
* As we cannot use any temporary registers and cannot
* clobber SP, we can decode the exception entry using
diff --git a/xen/arch/arm/cpuerrata.c b/xen/arch/arm/cpuerrata.c
index c79e6d65d3..9c7458ef06 100644
--- a/xen/arch/arm/cpuerrata.c
+++ b/xen/arch/arm/cpuerrata.c
@@ -180,6 +180,7 @@ static int enable_psci_bp_hardening(void *data)
DEFINE_PER_CPU_READ_MOSTLY(const char *, bp_harden_vecs);
extern char hyp_traps_vector_bp_inv[];
+extern char hyp_traps_vector_ic_inv[];
static void __maybe_unused
install_bp_hardening_vecs(const struct arm_cpu_capabilities *entry,
@@ -205,6 +206,13 @@ static int enable_bp_inv_hardening(void *data)
return 0;
}
+static int enable_ic_inv_hardening(void *data)
+{
+ install_bp_hardening_vecs(data, hyp_traps_vector_ic_inv,
+ "execute ICIALLU");
+ return 0;
+}
+
#endif
#define MIDR_RANGE(model, min, max) \
@@ -302,6 +310,11 @@ static const struct arm_cpu_capabilities arm_errata[] = {
MIDR_ALL_VERSIONS(MIDR_CORTEX_A17),
.enable = enable_bp_inv_hardening,
},
+ {
+ .capability = ARM_HARDEN_BRANCH_PREDICTOR,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A15),
+ .enable = enable_ic_inv_hardening,
+ },
#endif
{},
};
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic