Skip to content

Commit 187e076

Browse files
khusikakhusika
committed
Merge tag 'v6.1.139' into orange-pi-6.1-rk35xx
This is the 6.1.139 stable release * tag 'v6.1.139' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux: Linux 6.1.139 x86/its: FineIBT-paranoid vs ITS x86/alternatives: Remove faulty optimization x86/alternative: Optimize returns patching x86/its: Fix build errors when CONFIG_MODULES=n x86/its: Use dynamic thunks for indirect branches x86/ibt: Keep IBT disabled during alternative patching x86/its: Align RETs in BHB clear sequence to avoid thunking x86/its: Add "vmexit" option to skip mitigation on some CPUs x86/its: Enable Indirect Target Selection mitigation x86/its: Add support for ITS-safe return thunk x86/its: Add support for ITS-safe indirect thunk x86/its: Enumerate Indirect Target Selection (ITS) bug Documentation: x86/bugs/its: Add ITS documentation x86/speculation: Remove the extra #ifdef around CALL_NOSPEC x86/speculation: Add a conditional CS prefix to CALL_NOSPEC x86/speculation: Simplify and make CALL_NOSPEC consistent x86/bhi: Do not set BHI_DIS_S in 32-bit mode x86/bpf: Add IBHF call at end of classic BPF x86/bpf: Call branch history clearing sequence on exit arm64: proton-pack: Add new CPUs 'k' values for branch mitigation arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs arm64: proton-pack: Expose whether the branchy loop k value arm64: proton-pack: Expose whether the platform is mitigated by firmware arm64: insn: Add support for encoding DSB Revert "net: phy: microchip: force IRQ polling mode for lan88xx" io_uring: ensure deferred completions are posted for multishot io_uring: always arm linked timeouts prior to issue do_umount(): add missing barrier before refcount checks in sync case nvme: unblock ctrl state transition for firmware update drm/panel: simple: Update timings for AUO G101EVN010 MIPS: Fix MAX_REG_OFFSET iio: adc: dln2: Use aligned_s64 for timestamp iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 types: Complement the aligned types with signed 64-bit one iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. iio: accel: adxl367: fix setting odr for activity time update usb: usbtmc: Fix erroneous generic_read ioctl return usb: usbtmc: Fix erroneous wait_srq ioctl return usb: usbtmc: Fix erroneous get_stb ioctl error returns USB: usbtmc: use interruptible sleep in usbtmc_read usb: typec: ucsi: displayport: Fix NULL pointer access usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition usb: host: tegra: Prevent host controller crash when OTG port is used usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version usb: cdnsp: Fix issue with resuming from L1 ocfs2: stop quota recovery before disabling quotas ocfs2: implement handshaking with ocfs2 recovery thread ocfs2: switch osb->disable_recovery to enum module: ensure that kobject_put() is safe for module type kobjects xenbus: Use kref to track req lifetime usb: uhci-platform: Make the clock really optional drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush drm/amd/display: Copy AUX read reply data whenever length > 0 drm/amd/display: Fix wrong handling for AUX_DEFER case drm/amd/display: Remove incorrect checking in dmub aux handler drm/amd/display: Fix the checking condition in dmub aux handling drm/v3d: Add job to pending list if the reset was skipped iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo iio: adis16201: Correct inclinometer channel resolution iio: adc: ad7606: fix serial register access drm/amd/display: Shift DMUB AUX reply command if necessary x86/mm: Eliminate window where TLB flushes may be inadvertently skipped staging: axis-fifo: Correct handling of tx_fifo_depth for size validation staging: axis-fifo: Remove hardware resets for user errors staging: iio: adc: ad7816: Correct conditional logic for store mode Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 Input: synaptics - enable SMBus for HP Elitebook 850 G1 Input: synaptics - enable InterTouch on Dell Precision M3800 Input: synaptics - enable InterTouch on Dynabook Portege X30L-G Input: synaptics - enable InterTouch on Dynabook Portege X30-D Input: mtk-pmic-keys - fix possible null pointer dereference net: dsa: b53: fix learning on VLAN unaware bridges net: dsa: b53: always rejoin default untagged VLAN on bridge leave net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave net: dsa: b53: fix flushing old pvid VLAN on pvid change net: dsa: b53: fix clearing PVID of a port net: dsa: b53: allow leaky reserved multicast bpf: Scrub packet on bpf_redirect_peer netfilter: ipset: fix region locking in hash types ipvs: fix uninit-value for saddr in do_output_route4 ipv4: Drop tos parameter from flowi4_update_output() can: gw: fix RCU/BH usage in cgw_create_job() rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep() can: mcp251xfd: fix TDC setting for low data bit rates gre: Fix again IPv6 link-local address generation. sch_htb: make htb_deactivate() idempotent ksmbd: fix memory leak in parse_lease_state() openvswitch: Fix unsafe attribute parsing in output_userspace() ksmbd: prevent out-of-bounds stream writes by validating *pos can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls can: mcan: m_can_class_unregister(): fix order of unregistration calls arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 dm: add missing unlock on in dm_keyslot_evict() Signed-off-by: Khusika Dhamar Gusti <[email protected]>
2 parents b2a521d + 325285d commit 187e076

File tree

93 files changed

+1571
-388
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

93 files changed

+1571
-388
lines changed

‎Documentation/ABI/testing/sysfs-devices-system-cpu

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,7 @@ Description: information about CPUs heterogeneity.
514514

515515
What: /sys/devices/system/cpu/vulnerabilities
516516
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
517+
/sys/devices/system/cpu/vulnerabilities/indirect_target_selection
517518
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
518519
/sys/devices/system/cpu/vulnerabilities/l1tf
519520
/sys/devices/system/cpu/vulnerabilities/mds

‎Documentation/admin-guide/hw-vuln/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,4 @@ are configurable at compile, boot or run time.
2222
gather_data_sampling.rst
2323
srso
2424
reg-file-data-sampling
25+
indirect-target-selection

‎Documentation/admin-guide/hw-vuln/indirect-target-selection.rst

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
Indirect Target Selection (ITS)
4+
===============================
5+
6+
ITS is a vulnerability in some Intel CPUs that support Enhanced IBRS and were
7+
released before Alder Lake. ITS may allow an attacker to control the prediction
8+
of indirect branches and RETs located in the lower half of a cacheline.
9+
10+
ITS is assigned CVE-2024-28956 with a CVSS score of 4.7 (Medium).
11+
12+
Scope of Impact
13+
---------------
14+
- **eIBRS Guest/Host Isolation**: Indirect branches in KVM/kernel may still be
15+
predicted with unintended target corresponding to a branch in the guest.
16+
17+
- **Intra-Mode BTI**: In-kernel training such as through cBPF or other native
18+
gadgets.
19+
20+
- **Indirect Branch Prediction Barrier (IBPB)**: After an IBPB, indirect
21+
branches may still be predicted with targets corresponding to direct branches
22+
executed prior to the IBPB. This is fixed by the IPU 2025.1 microcode, which
23+
should be available via distro updates. Alternatively microcode can be
24+
obtained from Intel's github repository [#f1]_.
25+
26+
Affected CPUs
27+
-------------
28+
Below is the list of ITS affected CPUs [#f2]_ [#f3]_:
29+
30+
======================== ============ ==================== ===============
31+
Common name Family_Model eIBRS Intra-mode BTI
32+
Guest/Host Isolation
33+
======================== ============ ==================== ===============
34+
SKYLAKE_X (step >= 6) 06_55H Affected Affected
35+
ICELAKE_X 06_6AH Not affected Affected
36+
ICELAKE_D 06_6CH Not affected Affected
37+
ICELAKE_L 06_7EH Not affected Affected
38+
TIGERLAKE_L 06_8CH Not affected Affected
39+
TIGERLAKE 06_8DH Not affected Affected
40+
KABYLAKE_L (step >= 12) 06_8EH Affected Affected
41+
KABYLAKE (step >= 13) 06_9EH Affected Affected
42+
COMETLAKE 06_A5H Affected Affected
43+
COMETLAKE_L 06_A6H Affected Affected
44+
ROCKETLAKE 06_A7H Not affected Affected
45+
======================== ============ ==================== ===============
46+
47+
- All affected CPUs enumerate Enhanced IBRS feature.
48+
- IBPB isolation is affected on all ITS affected CPUs, and need a microcode
49+
update for mitigation.
50+
- None of the affected CPUs enumerate BHI_CTRL which was introduced in Golden
51+
Cove (Alder Lake and Sapphire Rapids). This can help guests to determine the
52+
host's affected status.
53+
- Intel Atom CPUs are not affected by ITS.
54+
55+
Mitigation
56+
----------
57+
As only the indirect branches and RETs that have their last byte of instruction
58+
in the lower half of the cacheline are vulnerable to ITS, the basic idea behind
59+
the mitigation is to not allow indirect branches in the lower half.
60+
61+
This is achieved by relying on existing retpoline support in the kernel, and in
62+
compilers. ITS-vulnerable retpoline sites are runtime patched to point to newly
63+
added ITS-safe thunks. These safe thunks consists of indirect branch in the
64+
second half of the cacheline. Not all retpoline sites are patched to thunks, if
65+
a retpoline site is evaluated to be ITS-safe, it is replaced with an inline
66+
indirect branch.
67+
68+
Dynamic thunks
69+
~~~~~~~~~~~~~~
70+
From a dynamically allocated pool of safe-thunks, each vulnerable site is
71+
replaced with a new thunk, such that they get a unique address. This could
72+
improve the branch prediction accuracy. Also, it is a defense-in-depth measure
73+
against aliasing.
74+
75+
Note, for simplicity, indirect branches in eBPF programs are always replaced
76+
with a jump to a static thunk in __x86_indirect_its_thunk_array. If required,
77+
in future this can be changed to use dynamic thunks.
78+
79+
All vulnerable RETs are replaced with a static thunk, they do not use dynamic
80+
thunks. This is because RETs get their prediction from RSB mostly that does not
81+
depend on source address. RETs that underflow RSB may benefit from dynamic
82+
thunks. But, RETs significantly outnumber indirect branches, and any benefit
83+
from a unique source address could be outweighed by the increased icache
84+
footprint and iTLB pressure.
85+
86+
Retpoline
87+
~~~~~~~~~
88+
Retpoline sequence also mitigates ITS-unsafe indirect branches. For this
89+
reason, when retpoline is enabled, ITS mitigation only relocates the RETs to
90+
safe thunks. Unless user requested the RSB-stuffing mitigation.
91+
92+
Mitigation in guests
93+
^^^^^^^^^^^^^^^^^^^^
94+
All guests deploy ITS mitigation by default, irrespective of eIBRS enumeration
95+
and Family/Model of the guest. This is because eIBRS feature could be hidden
96+
from a guest. One exception to this is when a guest enumerates BHI_DIS_S, which
97+
indicates that the guest is running on an unaffected host.
98+
99+
To prevent guests from unnecessarily deploying the mitigation on unaffected
100+
platforms, Intel has defined ITS_NO bit(62) in MSR IA32_ARCH_CAPABILITIES. When
101+
a guest sees this bit set, it should not enumerate the ITS bug. Note, this bit
102+
is not set by any hardware, but is **intended for VMMs to synthesize** it for
103+
guests as per the host's affected status.
104+
105+
Mitigation options
106+
^^^^^^^^^^^^^^^^^^
107+
The ITS mitigation can be controlled using the "indirect_target_selection"
108+
kernel parameter. The available options are:
109+
110+
======== ===================================================================
111+
on (default) Deploy the "Aligned branch/return thunks" mitigation.
112+
If spectre_v2 mitigation enables retpoline, aligned-thunks are only
113+
deployed for the affected RET instructions. Retpoline mitigates
114+
indirect branches.
115+
116+
off Disable ITS mitigation.
117+
118+
vmexit Equivalent to "=on" if the CPU is affected by guest/host isolation
119+
part of ITS. Otherwise, mitigation is not deployed. This option is
120+
useful when host userspace is not in the threat model, and only
121+
attacks from guest to host are considered.
122+
123+
force Force the ITS bug and deploy the default mitigation.
124+
======== ===================================================================
125+
126+
Sysfs reporting
127+
---------------
128+
129+
The sysfs file showing ITS mitigation status is:
130+
131+
/sys/devices/system/cpu/vulnerabilities/indirect_target_selection
132+
133+
Note, microcode mitigation status is not reported in this file.
134+
135+
The possible values in this file are:
136+
137+
.. list-table::
138+
139+
* - Not affected
140+
- The processor is not vulnerable.
141+
* - Vulnerable
142+
- System is vulnerable and no mitigation has been applied.
143+
* - Vulnerable, KVM: Not affected
144+
- System is vulnerable to intra-mode BTI, but not affected by eIBRS
145+
guest/host isolation.
146+
* - Mitigation: Aligned branch/return thunks
147+
- The mitigation is enabled, affected indirect branches and RETs are
148+
relocated to safe thunks.
149+
150+
References
151+
----------
152+
.. [#f1] Microcode repository - https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files
153+
154+
.. [#f2] Affected Processors list - https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
155+
156+
.. [#f3] Affected Processors list (machine readable) - https://github.com/intel/Intel-affected-processor-list

‎Documentation/admin-guide/kernel-parameters.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2025,6 +2025,20 @@
20252025
different crypto accelerators. This option can be used
20262026
to achieve best performance for particular HW.
20272027

2028+
indirect_target_selection= [X86,Intel] Mitigation control for Indirect
2029+
Target Selection(ITS) bug in Intel CPUs. Updated
2030+
microcode is also required for a fix in IBPB.
2031+
2032+
on: Enable mitigation (default).
2033+
off: Disable mitigation.
2034+
force: Force the ITS bug and deploy default
2035+
mitigation.
2036+
vmexit: Only deploy mitigation if CPU is affected by
2037+
guest/host isolation part of ITS.
2038+
2039+
For details see:
2040+
Documentation/admin-guide/hw-vuln/indirect-target-selection.rst
2041+
20282042
init= [KNL]
20292043
Format: <full_path>
20302044
Run specified binary instead of /sbin/init as init
@@ -3263,6 +3277,7 @@
32633277
expose users to several CPU vulnerabilities.
32643278
Equivalent to: if nokaslr then kpti=0 [ARM64]
32653279
gather_data_sampling=off [X86]
3280+
indirect_target_selection=off [X86]
32663281
kvm.nx_huge_pages=off [X86]
32673282
l1tf=off [X86]
32683283
mds=off [X86]

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 1
4-
SUBLEVEL = 138
4+
SUBLEVEL = 139
55
EXTRAVERSION =
66
NAME = Curry Ramen
77

‎arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,19 @@
144144
startup-delay-us = <20000>;
145145
};
146146

147+
reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc {
148+
compatible = "regulator-gpio";
149+
pinctrl-names = "default";
150+
pinctrl-0 = <&pinctrl_usdhc2_vsel>;
151+
gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>;
152+
regulator-max-microvolt = <3300000>;
153+
regulator-min-microvolt = <1800000>;
154+
states = <1800000 0x1>,
155+
<3300000 0x0>;
156+
regulator-name = "PMIC_USDHC_VSELECT";
157+
vin-supply = <&reg_nvcc_sd>;
158+
};
159+
147160
reserved-memory {
148161
#address-cells = <2>;
149162
#size-cells = <2>;
@@ -262,7 +275,7 @@
262275
"SODIMM_19",
263276
"",
264277
"",
265-
"",
278+
"PMIC_USDHC_VSELECT",
266279
"",
267280
"",
268281
"",
@@ -788,6 +801,7 @@
788801
pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_cd>;
789802
pinctrl-3 = <&pinctrl_usdhc2_sleep>, <&pinctrl_usdhc2_cd_sleep>;
790803
vmmc-supply = <&reg_usdhc2_vmmc>;
804+
vqmmc-supply = <&reg_usdhc2_vqmmc>;
791805
};
792806

793807
&wdog1 {
@@ -1210,13 +1224,17 @@
12101224
<MX8MM_IOMUXC_NAND_CLE_GPIO3_IO5 0x6>; /* SODIMM 76 */
12111225
};
12121226

1227+
pinctrl_usdhc2_vsel: usdhc2vselgrp {
1228+
fsl,pins =
1229+
<MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4 0x10>; /* PMIC_USDHC_VSELECT */
1230+
};
1231+
12131232
/*
12141233
* Note: Due to ERR050080 we use discrete external on-module resistors pulling-up to the
12151234
* on-module +V3.3_1.8_SD (LDO5) rail and explicitly disable the internal pull-ups here.
12161235
*/
12171236
pinctrl_usdhc2: usdhc2grp {
12181237
fsl,pins =
1219-
<MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>,
12201238
<MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x90>, /* SODIMM 78 */
12211239
<MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x90>, /* SODIMM 74 */
12221240
<MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x90>, /* SODIMM 80 */
@@ -1227,7 +1245,6 @@
12271245

12281246
pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
12291247
fsl,pins =
1230-
<MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>,
12311248
<MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x94>,
12321249
<MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x94>,
12331250
<MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x94>,
@@ -1238,7 +1255,6 @@
12381255

12391256
pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
12401257
fsl,pins =
1241-
<MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>,
12421258
<MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x96>,
12431259
<MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x96>,
12441260
<MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x96>,
@@ -1250,7 +1266,6 @@
12501266
/* Avoid backfeeding with removed card power */
12511267
pinctrl_usdhc2_sleep: usdhc2slpgrp {
12521268
fsl,pins =
1253-
<MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x0>,
12541269
<MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x0>,
12551270
<MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x0>,
12561271
<MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x0>,

‎arch/arm64/include/asm/cputype.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@
8181
#define ARM_CPU_PART_CORTEX_A78AE 0xD42
8282
#define ARM_CPU_PART_CORTEX_X1 0xD44
8383
#define ARM_CPU_PART_CORTEX_A510 0xD46
84+
#define ARM_CPU_PART_CORTEX_X1C 0xD4C
8485
#define ARM_CPU_PART_CORTEX_A520 0xD80
8586
#define ARM_CPU_PART_CORTEX_A710 0xD47
8687
#define ARM_CPU_PART_CORTEX_A715 0xD4D
@@ -159,6 +160,7 @@
159160
#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE)
160161
#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)
161162
#define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510)
163+
#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C)
162164
#define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520)
163165
#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)
164166
#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715)

‎arch/arm64/include/asm/insn.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -619,6 +619,7 @@ u32 aarch64_insn_gen_cas(enum aarch64_insn_register result,
619619
}
620620
#endif
621621
u32 aarch64_insn_gen_dmb(enum aarch64_insn_mb_type type);
622+
u32 aarch64_insn_gen_dsb(enum aarch64_insn_mb_type type);
622623

623624
s32 aarch64_get_branch_offset(u32 insn);
624625
u32 aarch64_set_branch_offset(u32 insn, s32 offset);

‎arch/arm64/include/asm/spectre.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,9 @@ enum mitigation_state arm64_get_meltdown_state(void);
9696

9797
enum mitigation_state arm64_get_spectre_bhb_state(void);
9898
bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);
99+
extern bool __nospectre_bhb;
100+
u8 get_spectre_bhb_loop_value(void);
101+
bool is_spectre_bhb_fw_mitigated(void);
99102
void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);
100103
#endif /* __ASSEMBLY__ */
101104
#endif /* __ASM_SPECTRE_H */

‎arch/arm64/kernel/proton-pack.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -903,6 +903,7 @@ static u8 spectre_bhb_loop_affected(void)
903903
MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE),
904904
MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
905905
MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
906+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
906907
MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
907908
MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
908909
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
@@ -1010,6 +1011,11 @@ bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry,
10101011
return true;
10111012
}
10121013

1014+
u8 get_spectre_bhb_loop_value(void)
1015+
{
1016+
return max_bhb_k;
1017+
}
1018+
10131019
static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot)
10141020
{
10151021
const char *v = arm64_get_bp_hardening_vector(slot);
@@ -1030,7 +1036,7 @@ static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot)
10301036
isb();
10311037
}
10321038

1033-
static bool __read_mostly __nospectre_bhb;
1039+
bool __read_mostly __nospectre_bhb;
10341040
static int __init parse_spectre_bhb_param(char *str)
10351041
{
10361042
__nospectre_bhb = true;
@@ -1108,6 +1114,11 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
11081114
update_mitigation_state(&spectre_bhb_state, state);
11091115
}
11101116

1117+
bool is_spectre_bhb_fw_mitigated(void)
1118+
{
1119+
return test_bit(BHB_FW, &system_bhb_mitigations);
1120+
}
1121+
11111122
/* Patched to NOP when enabled */
11121123
void noinstr spectre_bhb_patch_loop_mitigation_enable(struct alt_instr *alt,
11131124
__le32 *origptr,

0 commit comments

Comments
 (0)