mirror of
https://github.com/raspberrypi/linux.git
synced 2025-12-21 09:12:05 +00:00
94a855111e
Pull x86 core updates from Borislav Petkov:
- Add the call depth tracking mitigation for Retbleed which has been
long in the making. It is a lighterweight software-only fix for
Skylake-based cores where enabling IBRS is a big hammer and causes a
significant performance impact.
What it basically does is, it aligns all kernel functions to 16 bytes
boundary and adds a 16-byte padding before the function, objtool
collects all functions' locations and when the mitigation gets
applied, it patches a call accounting thunk which is used to track
the call depth of the stack at any time.
When that call depth reaches a magical, microarchitecture-specific
value for the Return Stack Buffer, the code stuffs that RSB and
avoids its underflow which could otherwise lead to the Intel variant
of Retbleed.
This software-only solution brings a lot of the lost performance
back, as benchmarks suggest:
https://lore.kernel.org/all/20220915111039.092790446@infradead.org/
That page above also contains a lot more detailed explanation of the
whole mechanism
- Implement a new control flow integrity scheme called FineIBT which is
based on the software kCFI implementation and uses hardware IBT
support where present to annotate and track indirect branches using a
hash to validate them
- Other misc fixes and cleanups
* tag 'x86_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (80 commits)
x86/paravirt: Use common macro for creating simple asm paravirt functions
x86/paravirt: Remove clobber bitmask from .parainstructions
x86/debug: Include percpu.h in debugreg.h to get DECLARE_PER_CPU() et al
x86/cpufeatures: Move X86_FEATURE_CALL_DEPTH from bit 18 to bit 19 of word 11, to leave space for WIP X86_FEATURE_SGX_EDECCSSA bit
x86/Kconfig: Enable kernel IBT by default
x86,pm: Force out-of-line memcpy()
objtool: Fix weak hole vs prefix symbol
objtool: Optimize elf_dirty_reloc_sym()
x86/cfi: Add boot time hash randomization
x86/cfi: Boot time selection of CFI scheme
x86/ibt: Implement FineIBT
objtool: Add --cfi to generate the .cfi_sites section
x86: Add prefix symbols for function padding
objtool: Add option to generate prefix symbols
objtool: Avoid O(bloody terrible) behaviour -- an ode to libelf
objtool: Slice up elf_create_section_symbol()
kallsyms: Revert "Take callthunks into account"
x86: Unconfuse CONFIG_ and X86_FEATURE_ namespaces
x86/retpoline: Fix crash printing warning
x86/paravirt: Fix a !PARAVIRT build warning
...
130 lines
3.4 KiB
C
130 lines
3.4 KiB
C
#ifndef _ASM_X86_DISABLED_FEATURES_H
|
|
#define _ASM_X86_DISABLED_FEATURES_H
|
|
|
|
/* These features, although they might be available in a CPU
|
|
* will not be used because the compile options to support
|
|
* them are not present.
|
|
*
|
|
* This code allows them to be checked and disabled at
|
|
* compile time without an explicit #ifdef. Use
|
|
* cpu_feature_enabled().
|
|
*/
|
|
|
|
#ifdef CONFIG_X86_UMIP
|
|
# define DISABLE_UMIP 0
|
|
#else
|
|
# define DISABLE_UMIP (1<<(X86_FEATURE_UMIP & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_X86_64
|
|
# define DISABLE_VME (1<<(X86_FEATURE_VME & 31))
|
|
# define DISABLE_K6_MTRR (1<<(X86_FEATURE_K6_MTRR & 31))
|
|
# define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31))
|
|
# define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31))
|
|
# define DISABLE_PCID 0
|
|
#else
|
|
# define DISABLE_VME 0
|
|
# define DISABLE_K6_MTRR 0
|
|
# define DISABLE_CYRIX_ARR 0
|
|
# define DISABLE_CENTAUR_MCR 0
|
|
# define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31))
|
|
#endif /* CONFIG_X86_64 */
|
|
|
|
#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
|
|
# define DISABLE_PKU 0
|
|
# define DISABLE_OSPKE 0
|
|
#else
|
|
# define DISABLE_PKU (1<<(X86_FEATURE_PKU & 31))
|
|
# define DISABLE_OSPKE (1<<(X86_FEATURE_OSPKE & 31))
|
|
#endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */
|
|
|
|
#ifdef CONFIG_X86_5LEVEL
|
|
# define DISABLE_LA57 0
|
|
#else
|
|
# define DISABLE_LA57 (1<<(X86_FEATURE_LA57 & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_PAGE_TABLE_ISOLATION
|
|
# define DISABLE_PTI 0
|
|
#else
|
|
# define DISABLE_PTI (1 << (X86_FEATURE_PTI & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_RETPOLINE
|
|
# define DISABLE_RETPOLINE 0
|
|
#else
|
|
# define DISABLE_RETPOLINE ((1 << (X86_FEATURE_RETPOLINE & 31)) | \
|
|
(1 << (X86_FEATURE_RETPOLINE_LFENCE & 31)))
|
|
#endif
|
|
|
|
#ifdef CONFIG_RETHUNK
|
|
# define DISABLE_RETHUNK 0
|
|
#else
|
|
# define DISABLE_RETHUNK (1 << (X86_FEATURE_RETHUNK & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_CPU_UNRET_ENTRY
|
|
# define DISABLE_UNRET 0
|
|
#else
|
|
# define DISABLE_UNRET (1 << (X86_FEATURE_UNRET & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_CALL_DEPTH_TRACKING
|
|
# define DISABLE_CALL_DEPTH_TRACKING 0
|
|
#else
|
|
# define DISABLE_CALL_DEPTH_TRACKING (1 << (X86_FEATURE_CALL_DEPTH & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_INTEL_IOMMU_SVM
|
|
# define DISABLE_ENQCMD 0
|
|
#else
|
|
# define DISABLE_ENQCMD (1 << (X86_FEATURE_ENQCMD & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_X86_SGX
|
|
# define DISABLE_SGX 0
|
|
#else
|
|
# define DISABLE_SGX (1 << (X86_FEATURE_SGX & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_XEN_PV
|
|
# define DISABLE_XENPV 0
|
|
#else
|
|
# define DISABLE_XENPV (1 << (X86_FEATURE_XENPV & 31))
|
|
#endif
|
|
|
|
#ifdef CONFIG_INTEL_TDX_GUEST
|
|
# define DISABLE_TDX_GUEST 0
|
|
#else
|
|
# define DISABLE_TDX_GUEST (1 << (X86_FEATURE_TDX_GUEST & 31))
|
|
#endif
|
|
|
|
/*
|
|
* Make sure to add features to the correct mask
|
|
*/
|
|
#define DISABLED_MASK0 (DISABLE_VME)
|
|
#define DISABLED_MASK1 0
|
|
#define DISABLED_MASK2 0
|
|
#define DISABLED_MASK3 (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR)
|
|
#define DISABLED_MASK4 (DISABLE_PCID)
|
|
#define DISABLED_MASK5 0
|
|
#define DISABLED_MASK6 0
|
|
#define DISABLED_MASK7 (DISABLE_PTI)
|
|
#define DISABLED_MASK8 (DISABLE_XENPV|DISABLE_TDX_GUEST)
|
|
#define DISABLED_MASK9 (DISABLE_SGX)
|
|
#define DISABLED_MASK10 0
|
|
#define DISABLED_MASK11 (DISABLE_RETPOLINE|DISABLE_RETHUNK|DISABLE_UNRET| \
|
|
DISABLE_CALL_DEPTH_TRACKING)
|
|
#define DISABLED_MASK12 0
|
|
#define DISABLED_MASK13 0
|
|
#define DISABLED_MASK14 0
|
|
#define DISABLED_MASK15 0
|
|
#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP| \
|
|
DISABLE_ENQCMD)
|
|
#define DISABLED_MASK17 0
|
|
#define DISABLED_MASK18 0
|
|
#define DISABLED_MASK19 0
|
|
#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
|
|
|
|
#endif /* _ASM_X86_DISABLED_FEATURES_H */
|