Mitigate Spectre-BHB by using core-specific trampoline vectors. On some cores
authorpatrick <patrick@openbsd.org>
Sat, 10 Dec 2022 10:13:58 +0000 (10:13 +0000)
committerpatrick <patrick@openbsd.org>
Sat, 10 Dec 2022 10:13:58 +0000 (10:13 +0000)
commit16569a756dd08f526f84d791d00af06e491e2e85
tree0e977f7e2b022c26f243d47ef5ad67ca7cd6c317
parentd7645d516ae314f78fbc83099faa0696698318f9
Mitigate Spectre-BHB by using core-specific trampoline vectors.  On some cores
Spectre-BHB can be mitigated by using a loop that branches a number of times.
For cores where this does not suffice, or where Spectre-V2 needs to be handled
as well, try and call into a new PSCI function that mitigates both Spectre-V2
and Spectre-BHB.  Some newer machines, which might not be in anyone's hands
yet, have an instruction (CLRBHB) that clears the BHB.  If ECBHB is set, the
BHB isn't vulnerable.  If we have CSV2_3/HCXT, it's not vulnerable at all.

No visible performance dropoff on a MacchiatoBin (4xA72) or Lenovo x13s (4xA78C+
4xX1C), but around 2-3% on a LX2K (16xA72) and RK3399 (4xA53+2xA72).

ok kettenis@
sys/arch/arm64/arm64/cpu.c
sys/arch/arm64/arm64/exception.S
sys/arch/arm64/arm64/genassym.cf
sys/arch/arm64/arm64/pmap.c
sys/arch/arm64/arm64/trampoline.S
sys/arch/arm64/include/cpu.h
sys/dev/fdt/psci.c
sys/dev/fdt/pscivar.h