From patchwork Fri Apr 8 12:00:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Deacon X-Patchwork-Id: 12806680 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 911C2C433F5 for ; Fri, 8 Apr 2022 12:37:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Subject:Cc:To: From:Date:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=njR41wM9hXCBuni85e2Lk/hPq11ltKysAYblRILqbWU=; b=blCDtPZVF3kOp4 6+xsFQe88iivNkTe8KnNYZTL0zfM5RCJvK3Yh3gMLRW8ATf3W45SNFE5M4b5fBJ7S/QOphmrtg4PZ SkHBDR00sp4z4CmNYHNcBz70o+/is9ey86/TmmKK8BCWGPCdqu952TsCaV+BRUS6oJgt9/Usbcz6J eoqmwOhnEpUPv9x1kV0948tFnmxCHNxbKeaA0tf+T7KgTUY4kvUE/NwHEscxdMh8B70ahW3EBlrVA +kb154Sdw/jDweTL9omWrUR0UQgUh7Xwg53gHddSZ43WeBweVoLSDSN/euN9clLCPg3DkYyzubMt3 ZvS8AzGxO+D/TFnVYZfA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ncnqE-00H2yQ-7U; Fri, 08 Apr 2022 12:35:55 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ncnIF-00GoyS-UX for linux-arm-kernel@lists.infradead.org; Fri, 08 Apr 2022 12:00:49 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FB0961BFB; Fri, 8 Apr 2022 12:00:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6DBB7C385A3; Fri, 8 Apr 2022 12:00:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1649419246; bh=DRv3mm8f90dK7Yzygr45t/zBtQo9zFMAVRIqHpVBdwE=; h=Date:From:To:Cc:Subject:From; b=G3w5x4c++6cZhm+qV6V7vd7WWzsoQpPUtw5fKyO0m9gfkdtJC+1jqUjukQxnLZAku JarSUwGfNA2+dPkrgDu/zXY8dwaKdizyLQaO18QdRnHbVlzzHZakaUrgGljVGdD8+h DjG+0T0t4GbM7QKjWIfWp95cLUPpnLWNA/FjRsw3AKqzFuj84ebJCmHJNcLQJA5vc8 21MH8q7oimWZKavhaaFzWB8oDht5nMdNrwW70RCRaW2EuzQCQ6H0o/3H5PgLPpqGcL 8hoB4m7SJ2BrCQJr4f8Mz91Xv4aOkoUlgi7CUH6Yl3e0dtYRYEIhu8zJB5fD74zQTW iir8FTQI594pQ== Date: Fri, 8 Apr 2022 13:00:41 +0100 From: Will Deacon To: linux-arm-kernel@lists.infradead.org, james.morse@arm.com Cc: linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, maz@kernel.org, catalin.marinas@arm.com, mark.rutland@arm.com Subject: arm64 spectre-bhb backports break boot on stable kernels <= v5.4 Message-ID: <20220408120041.GB27685@willie-the-truck> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220408_050048_142372_D1ED6911 X-CRM114-Status: GOOD ( 10.77 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi James, Booting stable kernels <= v5.4 on arm64 with CONFIG_HARDEN_BRANCH_PREDICTOR=n results in a NULL pointer dereference during boot due to kvm_get_hyp_vector() dereferencing a NULL pointer from arm64_get_bp_hardening_data(): [ 2.384444] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 2.384461] pstate: 20400085 (nzCv daIf +PAN -UAO) [ 2.384472] pc : cpu_hyp_reinit+0x114/0x30c [ 2.384476] lr : cpu_hyp_reinit+0x80/0x30c [ 2.384477] sp : ffff800010013e20 [ 2.384479] x29: ffff800010013e20 x28: ffff0000df033f00 [ 2.384484] x27: ffff800011caa000 x26: ffff0000de58e000 [ 2.384487] x25: ffff800011e57000 x24: ffff800011caad90 [ 2.384490] x23: ffff800011c778e0 x22: ffff800011a56000 [ 2.384494] x21: ffff800011a56000 x20: 0000b471121a6000 [ 2.384497] x19: 00000000de588000 x18: 0000000000000000 [ 2.384500] x17: 0000000000000000 x16: 0000000000000400 [ 2.384503] x15: 0000000000001000 x14: 00000000000007f2 [ 2.384507] x13: 0000000000000004 x12: 0000000000000002 [ 2.384510] x11: 0000000000000000 x10: 00000000121a6000 [ 2.384513] x9 : ffff800011c77fd8 x8 : 0000000000000010 [ 2.384516] x7 : 4f422effff306b64 x6 : 0000008080000000 [ 2.384519] x5 : 0000008080000000 x4 : ffff800011fabc94 [ 2.384522] x3 : ffff800011f5bde0 x2 : 0000000000000001 [ 2.384526] x1 : 00000000121a0000 x0 : ffff8000118f962d [ 2.384529] Call trace: [ 2.384533] cpu_hyp_reinit+0x114/0x30c [ 2.384537] _kvm_arch_hardware_enable+0x30/0x54 [ 2.384541] flush_smp_call_function_queue+0xe4/0x154 [ 2.384544] generic_smp_call_function_single_interrupt+0x10/0x18 [ 2.384549] ipi_handler+0x170/0x2b0 [ 2.384555] handle_percpu_devid_fasteoi_ipi+0x120/0x1cc [ 2.384560] __handle_domain_irq+0x9c/0xf4 [ 2.384563] gic_handle_irq+0x6c/0xe4 [ 2.384566] el1_irq+0xf0/0x1c0 [ 2.384570] arch_cpu_idle+0x28/0x44 [ 2.384574] do_idle+0x100/0x2a8 [ 2.384577] cpu_startup_entry+0x20/0x24 [ 2.384581] secondary_start_kernel+0x1b0/0x1cc [ 2.384589] Code: b9469d08 7100011f 540003ad 52800208 (f9400108) [ 2.384600] ---[ end trace 266d08dbf96ff143 ]--- [ 2.385171] Kernel panic - not syncing: Fatal exception in interrupt The faulting load is the access to 'data->template_start', for which the compiler emits the hilarious: mov w8, #0x10 ldr x8, [x8] I can bodge this as below (untested), but it's pretty grotty. Please can you take a look? Cheers, Will --->8 diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 33b33416fea4..3bc1380f5524 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -939,6 +939,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .cpu_enable = cpu_enable_ssbd_mitigation, .midr_range_list = arm64_ssb_cpus, }, +#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR { .desc = "Spectre-BHB", .capability = ARM64_SPECTRE_BHB, @@ -946,6 +947,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .matches = is_spectre_bhb_affected, .cpu_enable = spectre_bhb_enable_mitigation, }, +#endif #ifdef CONFIG_ARM64_ERRATUM_1418040 { .desc = "ARM erratum 1418040",