1 // SPDX-License-Identifier: GPL-2.0+ 2 3 /* 4 * Copyright 2018-2019 IBM Corporation. 5 */ 6 7 #define __SANE_USERSPACE_TYPES__ 8 9 #include <sys/types.h> 10 #include <stdint.h> 11 #include <malloc.h> 12 #include <unistd.h> 13 #include <stdlib.h> 14 #include <string.h> 15 #include <stdio.h> 16 #include <sys/prctl.h> 17 #include "utils.h" 18 19 #include "../pmu/event.h" 20 21 22 extern void pattern_cache_loop(void); 23 extern void indirect_branch_loop(void); 24 25 static int do_count_loop(struct event *events, bool is_p9, s64 *miss_percent) 26 { 27 u64 pred, mpred; 28 29 prctl(PR_TASK_PERF_EVENTS_ENABLE); 30 31 if (is_p9) 32 pattern_cache_loop(); 33 else 34 indirect_branch_loop(); 35 36 prctl(PR_TASK_PERF_EVENTS_DISABLE); 37 38 event_read(&events[0]); 39 event_read(&events[1]); 40 41 // We could scale all the events by running/enabled but we're lazy 42 // As long as the PMU is uncontended they should all run 43 FAIL_IF(events[0].result.running != events[0].result.enabled); 44 FAIL_IF(events[1].result.running != events[1].result.enabled); 45 46 pred = events[0].result.value; 47 mpred = events[1].result.value; 48 49 if (is_p9) { 50 event_read(&events[2]); 51 event_read(&events[3]); 52 FAIL_IF(events[2].result.running != events[2].result.enabled); 53 FAIL_IF(events[3].result.running != events[3].result.enabled); 54 55 pred += events[2].result.value; 56 mpred += events[3].result.value; 57 } 58 59 *miss_percent = 100 * mpred / pred; 60 61 return 0; 62 } 63 64 static void setup_event(struct event *e, u64 config, char *name) 65 { 66 event_init_named(e, config, name); 67 68 e->attr.disabled = 1; 69 e->attr.exclude_kernel = 1; 70 e->attr.exclude_hv = 1; 71 e->attr.exclude_idle = 1; 72 } 73 74 enum spectre_v2_state { 75 VULNERABLE = 0, 76 UNKNOWN = 1, // Works with FAIL_IF() 77 NOT_AFFECTED, 78 BRANCH_SERIALISATION, 79 COUNT_CACHE_DISABLED, 80 COUNT_CACHE_FLUSH_SW, 81 COUNT_CACHE_FLUSH_HW, 82 BTB_FLUSH, 83 }; 84 85 static enum spectre_v2_state get_sysfs_state(void) 86 { 87 enum spectre_v2_state state = UNKNOWN; 88 char buf[256]; 89 int len; 90 91 memset(buf, 0, sizeof(buf)); 92 FAIL_IF(read_sysfs_file("devices/system/cpu/vulnerabilities/spectre_v2", buf, sizeof(buf))); 93 94 // Make sure it's NULL terminated 95 buf[sizeof(buf) - 1] = '\0'; 96 97 // Trim the trailing newline 98 len = strlen(buf); 99 FAIL_IF(len < 1); 100 buf[len - 1] = '\0'; 101 102 printf("sysfs reports: '%s'\n", buf); 103 104 // Order matters 105 if (strstr(buf, "Vulnerable")) 106 state = VULNERABLE; 107 else if (strstr(buf, "Not affected")) 108 state = NOT_AFFECTED; 109 else if (strstr(buf, "Indirect branch serialisation (kernel only)")) 110 state = BRANCH_SERIALISATION; 111 else if (strstr(buf, "Indirect branch cache disabled")) 112 state = COUNT_CACHE_DISABLED; 113 else if (strstr(buf, "Software count cache flush (hardware accelerated)")) 114 state = COUNT_CACHE_FLUSH_HW; 115 else if (strstr(buf, "Software count cache flush")) 116 state = COUNT_CACHE_FLUSH_SW; 117 else if (strstr(buf, "Branch predictor state flush")) 118 state = BTB_FLUSH; 119 120 return state; 121 } 122 123 #define PM_BR_PRED_CCACHE 0x040a4 // P8 + P9 124 #define PM_BR_MPRED_CCACHE 0x040ac // P8 + P9 125 #define PM_BR_PRED_PCACHE 0x048a0 // P9 only 126 #define PM_BR_MPRED_PCACHE 0x048b0 // P9 only 127 128 int spectre_v2_test(void) 129 { 130 enum spectre_v2_state state; 131 struct event events[4]; 132 s64 miss_percent; 133 bool is_p9; 134 135 // The PMU events we use only work on Power8 or later 136 SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_2_07)); 137 138 state = get_sysfs_state(); 139 if (state == UNKNOWN) { 140 printf("Error: couldn't determine spectre_v2 mitigation state?\n"); 141 return -1; 142 } 143 144 memset(events, 0, sizeof(events)); 145 146 setup_event(&events[0], PM_BR_PRED_CCACHE, "PM_BR_PRED_CCACHE"); 147 setup_event(&events[1], PM_BR_MPRED_CCACHE, "PM_BR_MPRED_CCACHE"); 148 FAIL_IF(event_open(&events[0])); 149 FAIL_IF(event_open_with_group(&events[1], events[0].fd) == -1); 150 151 is_p9 = ((mfspr(SPRN_PVR) >> 16) & 0xFFFF) == 0x4e; 152 153 if (is_p9) { 154 // Count pattern cache too 155 setup_event(&events[2], PM_BR_PRED_PCACHE, "PM_BR_PRED_PCACHE"); 156 setup_event(&events[3], PM_BR_MPRED_PCACHE, "PM_BR_MPRED_PCACHE"); 157 158 FAIL_IF(event_open_with_group(&events[2], events[0].fd) == -1); 159 FAIL_IF(event_open_with_group(&events[3], events[0].fd) == -1); 160 } 161 162 FAIL_IF(do_count_loop(events, is_p9, &miss_percent)); 163 164 event_report_justified(&events[0], 18, 10); 165 event_report_justified(&events[1], 18, 10); 166 event_close(&events[0]); 167 event_close(&events[1]); 168 169 if (is_p9) { 170 event_report_justified(&events[2], 18, 10); 171 event_report_justified(&events[3], 18, 10); 172 event_close(&events[2]); 173 event_close(&events[3]); 174 } 175 176 printf("Miss percent %lld %%\n", miss_percent); 177 178 switch (state) { 179 case VULNERABLE: 180 case NOT_AFFECTED: 181 case COUNT_CACHE_FLUSH_SW: 182 case COUNT_CACHE_FLUSH_HW: 183 // These should all not affect userspace branch prediction 184 if (miss_percent > 15) { 185 if (miss_percent > 95) { 186 /* 187 * Such a mismatch may be caused by a system being unaware 188 * the count cache is disabled. This may be to enable 189 * guest migration between hosts with different settings. 190 * Return skip code to avoid detecting this as an error. 191 * We are not vulnerable and reporting otherwise, so 192 * missing such a mismatch is safe. 193 */ 194 printf("Branch misses > 95%% unexpected in this configuration.\n"); 195 printf("Count cache likely disabled without Linux knowing.\n"); 196 if (state == COUNT_CACHE_FLUSH_SW) 197 printf("WARNING: Kernel performing unnecessary flushes.\n"); 198 return 4; 199 } 200 printf("Branch misses > 15%% unexpected in this configuration!\n"); 201 printf("Possible mismatch between reported & actual mitigation\n"); 202 203 return 1; 204 } 205 break; 206 case BRANCH_SERIALISATION: 207 // This seems to affect userspace branch prediction a bit? 208 if (miss_percent > 25) { 209 printf("Branch misses > 25%% unexpected in this configuration!\n"); 210 printf("Possible mismatch between reported & actual mitigation\n"); 211 return 1; 212 } 213 break; 214 case COUNT_CACHE_DISABLED: 215 if (miss_percent < 95) { 216 printf("Branch misses < 95%% unexpected in this configuration!\n"); 217 printf("Possible mismatch between reported & actual mitigation\n"); 218 return 1; 219 } 220 break; 221 case UNKNOWN: 222 case BTB_FLUSH: 223 printf("Not sure!\n"); 224 return 1; 225 } 226 227 printf("OK - Measured branch prediction rates match reported spectre v2 mitigation.\n"); 228 229 return 0; 230 } 231 232 int main(int argc, char *argv[]) 233 { 234 return test_harness(spectre_v2_test, "spectre_v2"); 235 } 236