diff options
| -rw-r--r-- | Makefile.in | 16 | ||||
| -rw-r--r-- | configure.ac | 12 | ||||
| -rw-r--r-- | sys/arch/amd64/spectre.S | 49 | ||||
| -rw-r--r-- | sys/arch/amd64/spectre.c | 78 | ||||
| -rw-r--r-- | sys/include/arch/amd64/msr.h | 2 | ||||
| -rw-r--r-- | sys/include/arch/amd64/spectre.h | 38 |
6 files changed, 194 insertions, 1 deletions
diff --git a/Makefile.in b/Makefile.in index 7f1fa5e..63a0a35 100644 --- a/Makefile.in +++ b/Makefile.in @@ -1,5 +1,18 @@ .SILENT: + +############################### +# Feature stuff +############################### +override SPECTRE_MITIGATION = @SPECTRE_MITIGATION@ + +ifeq ($(SPECTRE_MITIGATION), 1) + override SPECTRE_FLAGS=-D__SPECTRE_MITIGATION +else + override SPECTRE_FLAGS= +endif + + ############################### # CFLAGS, QEMU flags + misc ############################### @@ -9,7 +22,8 @@ override PROMPT := printf "%s\t\t%s\n" override KERNEL_DEFINES = -DVEGA_VERSION="\"$(VEGA_VERSION)\""\ -DVEGA_BUILDDATE="\"@VEGA_BUILDDATE@\""\ -DVEGA_BUILDBRANCH="\"@VEGA_BUILDBRANCH@\""\ - -DVEGA_ARCH="\"@ARCH@\"" + -DVEGA_ARCH="\"@ARCH@\""\ + $(SPECTRE_FLAGS) override KERNEL_CFLAGS = @KERNEL_CFLAGS@ $(KERNEL_DEFINES) override KERNEL_LDFLAGS = -nostdlib -zmax-page-size=0x1000 -static -Tconf/link-$(ARCH).ld override QEMU_FLAGS = @QEMU_FLAGS@ diff --git a/configure.ac b/configure.ac index 5d2d9a0..253b69d 100644 --- a/configure.ac +++ b/configure.ac @@ -16,6 +16,18 @@ QEMU_FLAGS_X86_64="--enable-kvm -monitor stdio \\ VEGA_BUILDDATE=`export LANG=en_US.UTF-8 ; date` VEGA_BUILDBRANCH="`basename $PWD`" +# Enable Spectre mitigation option +AC_ARG_ENABLE([spectre-mitigation], + [AS_HELP_STRING([--enable-spectre-mitigation], [Enable Spectre mitigation (IBRS or similar)])],, + [enable_spectre_mitigation=$enableval]) + + +if test "x$enable_spectre_mitigation" = "xyes"; then + AC_SUBST(SPECTRE_MITIGATION, [1]) +else + AC_SUBST(SPECTRE_MITIGATION, [0]) +fi + AC_SUBST(VEGA_BUILDDATE, [$VEGA_BUILDDATE]) AC_SUBST(VEGA_BUILDBRANCH, [$VEGA_BUILDBRANCH]) diff --git a/sys/arch/amd64/spectre.S b/sys/arch/amd64/spectre.S new file mode 100644 index 0000000..f91f744 --- /dev/null +++ b/sys/arch/amd64/spectre.S @@ -0,0 +1,49 @@ +/* + * Copyright (c) 2023 Ian Marco Moffett and the VegaOS team. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of VegaOS nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +.text +.globl __can_mitigate_spectre + +__can_mitigate_spectre: + xor %ecx, %ecx // NULL out ECX + mov $0x7, %eax // 0x7 (Check IBRS) + cpuid + + /* Check if supported (if EDX[26] == 1) */ + mov $1, %ebx + shl $26, %ebx + test %ebx, %edx + jnz supported +not_supported: + xor %rax, %rax + jmp 1f +supported: + mov $1, %rax +1: + ret diff --git a/sys/arch/amd64/spectre.c b/sys/arch/amd64/spectre.c new file mode 100644 index 0000000..00b0237 --- /dev/null +++ b/sys/arch/amd64/spectre.c @@ -0,0 +1,78 @@ +/* + * Copyright (c) 2023 Ian Marco Moffett and the VegaOS team. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of VegaOS nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include <machine/spectre.h> +#include <machine/cpuid.h> +#include <machine/msr.h> +#include <sys/syslog.h> +#include <sys/types.h> + +__MODULE_NAME("spectre"); +__KERNEL_META("$Vega$: spectre.c, Ian Marco Moffett, " + "Spectre mitigation support"); + +#if __SPECTRE_MITIGATION == 1 + +/* + * Returns true if Indirect Branch Restricted Speculation (IBRS) + * is supported. + */ +__naked bool +__can_mitigate_spectre(void); + +/* + * Returns EXIT_FAILURE if not supported, returns + * EXIT_SUCCESS if mitigation is now active. + * + * This function will be NULL if spectre mitigation isn't enabled; + * therefore it is wise to verify to prevent access violations and + * undefined behaviour. + * + * This behaviour is governed by the __SPECTRE_MITIGATION define + * + * TODO: Try to enable others, not just IBRS + */ +__weak int +try_spectre_mitigate(void) +{ + uint64_t tmp; + + if (!__can_mitigate_spectre()) { + KINFO("IBRS not supported; spectre mitigation NOT enabled\n"); + return EXIT_FAILURE; + } + + KINFO("IBRS supported; spectre mitigation enabled\n"); + tmp = rdmsr(IA32_SPEC_CTL); + tmp |= __BIT(0); /* IBRS */ + wrmsr(IA32_SPEC_CTL, tmp); + return EXIT_SUCCESS; +} + +#endif /* __SPECTRE_MITIGATION == 1 */ diff --git a/sys/include/arch/amd64/msr.h b/sys/include/arch/amd64/msr.h index 9d3a8bf..ebd2776 100644 --- a/sys/include/arch/amd64/msr.h +++ b/sys/include/arch/amd64/msr.h @@ -33,6 +33,8 @@ #include <sys/types.h> #include <sys/cdefs.h> +#define IA32_SPEC_CTL 0x00000048 + static inline uint64_t rdmsr(uint32_t msr_addr) { diff --git a/sys/include/arch/amd64/spectre.h b/sys/include/arch/amd64/spectre.h new file mode 100644 index 0000000..a4c01fb --- /dev/null +++ b/sys/include/arch/amd64/spectre.h @@ -0,0 +1,38 @@ +/* + * Copyright (c) 2023 Ian Marco Moffett and the VegaOS team. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of VegaOS nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef _AMD64_SPECTRE_H_ +#define _AMD64_SPECTRE_H_ + +#include <sys/cdefs.h> +#include <sys/errno.h> + +__weak int try_spectre_mitigate(void); + +#endif |