From b143f00b1605f588e02349914b6fcb0fd3bab55e Mon Sep 17 00:00:00 2001 From: sigsegv7 Date: Mon, 25 Sep 2023 05:28:54 -0400 Subject: kernel/amd64: Add spectre mitigation support Add spectre mitigation support for AMD64 hosts which may be enabled via the --enable-spectre-mitigation configure flag. This commit currently only adds IBRS support but more techniques may be added later on. Signed-off-by: sigsegv7 --- sys/arch/amd64/spectre.S | 49 ++++++++++++++++++++++++++++++ sys/arch/amd64/spectre.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 127 insertions(+) create mode 100644 sys/arch/amd64/spectre.S create mode 100644 sys/arch/amd64/spectre.c (limited to 'sys/arch') diff --git a/sys/arch/amd64/spectre.S b/sys/arch/amd64/spectre.S new file mode 100644 index 0000000..f91f744 --- /dev/null +++ b/sys/arch/amd64/spectre.S @@ -0,0 +1,49 @@ +/* + * Copyright (c) 2023 Ian Marco Moffett and the VegaOS team. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of VegaOS nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +.text +.globl __can_mitigate_spectre + +__can_mitigate_spectre: + xor %ecx, %ecx // NULL out ECX + mov $0x7, %eax // 0x7 (Check IBRS) + cpuid + + /* Check if supported (if EDX[26] == 1) */ + mov $1, %ebx + shl $26, %ebx + test %ebx, %edx + jnz supported +not_supported: + xor %rax, %rax + jmp 1f +supported: + mov $1, %rax +1: + ret diff --git a/sys/arch/amd64/spectre.c b/sys/arch/amd64/spectre.c new file mode 100644 index 0000000..00b0237 --- /dev/null +++ b/sys/arch/amd64/spectre.c @@ -0,0 +1,78 @@ +/* + * Copyright (c) 2023 Ian Marco Moffett and the VegaOS team. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of VegaOS nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include +#include +#include +#include + +__MODULE_NAME("spectre"); +__KERNEL_META("$Vega$: spectre.c, Ian Marco Moffett, " + "Spectre mitigation support"); + +#if __SPECTRE_MITIGATION == 1 + +/* + * Returns true if Indirect Branch Restricted Speculation (IBRS) + * is supported. + */ +__naked bool +__can_mitigate_spectre(void); + +/* + * Returns EXIT_FAILURE if not supported, returns + * EXIT_SUCCESS if mitigation is now active. + * + * This function will be NULL if spectre mitigation isn't enabled; + * therefore it is wise to verify to prevent access violations and + * undefined behaviour. + * + * This behaviour is governed by the __SPECTRE_MITIGATION define + * + * TODO: Try to enable others, not just IBRS + */ +__weak int +try_spectre_mitigate(void) +{ + uint64_t tmp; + + if (!__can_mitigate_spectre()) { + KINFO("IBRS not supported; spectre mitigation NOT enabled\n"); + return EXIT_FAILURE; + } + + KINFO("IBRS supported; spectre mitigation enabled\n"); + tmp = rdmsr(IA32_SPEC_CTL); + tmp |= __BIT(0); /* IBRS */ + wrmsr(IA32_SPEC_CTL, tmp); + return EXIT_SUCCESS; +} + +#endif /* __SPECTRE_MITIGATION == 1 */ -- cgit v1.2.3