Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752738AbeADSSL (ORCPT + 1 other); Thu, 4 Jan 2018 13:18:11 -0500 Received: from mga06.intel.com ([134.134.136.31]:8415 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752637AbeADSSH (ORCPT ); Thu, 4 Jan 2018 13:18:07 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,315,1511856000"; d="scan'208";a="21446989" From: Tim Chen To: Thomas Gleixner , Andy Lutomirski , Linus Torvalds , Greg KH Cc: Tim Chen , Dave Hansen , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , linux-kernel@vger.kernel.org, David Woodhouse Subject: [PATCH 5/7] x86: Use IBRS for firmware update path Date: Thu, 4 Jan 2018 09:56:46 -0800 Message-Id: <8d3710432534b27d224283557c4629cd1aa5b0ea.1515086770.git.tim.c.chen@linux.intel.com> X-Mailer: git-send-email 2.9.4 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: From: David Woodhouse We are impervious to the indirect branch prediction attack with retpoline but firmware won't be, so we still need to set IBRS to protect firmware code execution when calling into firmware at runtime. Signed-off-by: David Woodhouse Signed-off-by: Tim Chen --- arch/x86/include/asm/apm.h | 6 ++++++ arch/x86/include/asm/efi.h | 16 ++++++++++++++-- arch/x86/include/asm/spec_ctrl.h | 37 +++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h index 4d4015d..1ca4f7b 100644 --- a/arch/x86/include/asm/apm.h +++ b/arch/x86/include/asm/apm.h @@ -7,6 +7,8 @@ #ifndef _ASM_X86_MACH_DEFAULT_APM_H #define _ASM_X86_MACH_DEFAULT_APM_H +#include + #ifdef APM_ZERO_SEGS # define APM_DO_ZERO_SEGS \ "pushl %%ds\n\t" \ @@ -28,6 +30,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, u32 *eax, u32 *ebx, u32 *ecx, u32 *edx, u32 *esi) { + unprotected_firmware_begin(); /* * N.B. We do NOT need a cld after the BIOS call * because we always save and restore the flags. @@ -44,6 +47,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, "=S" (*esi) : "a" (func), "b" (ebx_in), "c" (ecx_in) : "memory", "cc"); + unprotected_formware_end(); } static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, @@ -52,6 +56,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, int cx, dx, si; bool error; + unprotected_firmware_begin(); /* * N.B. We do NOT need a cld after the BIOS call * because we always save and restore the flags. @@ -68,6 +73,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, "=S" (si) : "a" (func), "b" (ebx_in), "c" (ecx_in) : "memory", "cc"); + unprotected_formware_end(); return error; } diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index 85f6ccb..25bd506 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -6,6 +6,7 @@ #include #include #include +#include /* * We map the EFI regions needed for runtime services non-contiguously, @@ -36,8 +37,17 @@ extern asmlinkage unsigned long efi_call_phys(void *, ...); -#define arch_efi_call_virt_setup() kernel_fpu_begin() -#define arch_efi_call_virt_teardown() kernel_fpu_end() +#define arch_efi_call_virt_setup() \ +{( \ + kernel_fpu_begin(); \ + unprotected_firmware_begin(); \ +)} + +#define arch_efi_call_virt_teardown() \ +{( \ + unprotected_firmware_end(); \ + kernel_fpu_end(); \ +)} /* * Wrap all the virtual calls in a way that forces the parameters on the stack. @@ -73,6 +83,7 @@ struct efi_scratch { efi_sync_low_kernel_mappings(); \ preempt_disable(); \ __kernel_fpu_begin(); \ + unprotected_firmware_begin(); \ \ if (efi_scratch.use_pgd) { \ efi_scratch.prev_cr3 = __read_cr3(); \ @@ -91,6 +102,7 @@ struct efi_scratch { __flush_tlb_all(); \ } \ \ + unprotected_firmware_end(); \ __kernel_fpu_end(); \ preempt_enable(); \ }) diff --git a/arch/x86/include/asm/spec_ctrl.h b/arch/x86/include/asm/spec_ctrl.h index 28b0314..23b2804 100644 --- a/arch/x86/include/asm/spec_ctrl.h +++ b/arch/x86/include/asm/spec_ctrl.h @@ -113,5 +113,42 @@ static inline void unprotected_speculation_end(void) rmb(); } + +#if defined(RETPOLINE) +/* + * RETPOLINE does not protect against indirect speculation + * in firmware code. Enable IBRS to protect firmware execution. + */ +static inline void unprotected_firmware_begin(void) +{ + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL)) + __disable_indirect_speculation(); + else + /* + * If we intended to disable indirect speculation + * but come here due to mis-speculation, we need + * to stop the mis-speculation with rmb. + */ + rmb(); +} + +static inline void unprotected_firmware_end(void) +{ + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL)) + __enable_indirect_speculation(); +} + +#else +static inline void unprotected_firmware_begin(void) +{ + return; +} + +static inline void unprotected_firmware_end(void) +{ + return; +} +#endif + #endif /* __ASSEMBLY__ */ #endif /* _ASM_X86_SPEC_CTRL_H */ -- 2.9.4