releases/4.4.180/x86-speculation-mds-add-mitigation-control-for-mds.patch

   1 From foo@baz Tue 14 May 2019 08:29:35 PM CEST
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Mon, 18 Feb 2019 22:04:08 +0100
   4 Subject: x86/speculation/mds: Add mitigation control for MDS
   5
   6 From: Thomas Gleixner <tglx@linutronix.de>
   7
   8 commit bc1241700acd82ec69fde98c5763ce51086269f8 upstream.
   9
  10 Now that the mitigations are in place, add a command line parameter to
  11 control the mitigation, a mitigation selector function and a SMT update
  12 mechanism.
  13
  14 This is the minimal straight forward initial implementation which just
  15 provides an always on/off mode. The command line parameter is:
  16
  17   mds=[full|off]
  18
  19 This is consistent with the existing mitigations for other speculative
  20 hardware vulnerabilities.
  21
  22 The idle invocation is dynamically updated according to the SMT state of
  23 the system similar to the dynamic update of the STIBP mitigation. The idle
  24 mitigation is limited to CPUs which are only affected by MSBDS and not any
  25 other variant, because the other variants cannot be mitigated on SMT
  26 enabled systems.
  27
  28 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  29 Reviewed-by: Borislav Petkov <bp@suse.de>
  30 Reviewed-by: Jon Masters <jcm@redhat.com>
  31 Tested-by: Jon Masters <jcm@redhat.com>
  32 [bwh: Backported to 4.4:
  33  - Drop " __ro_after_init"
  34  - Adjust filename, context]
  35 Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37 ---
  38  Documentation/kernel-parameters.txt |   22 +++++++++++
  39  arch/x86/include/asm/processor.h    |    6 +++
  40  arch/x86/kernel/cpu/bugs.c          |   70 ++++++++++++++++++++++++++++++++++++
  41  3 files changed, 98 insertions(+)
  42
  43 --- a/Documentation/kernel-parameters.txt
  44 +++ b/Documentation/kernel-parameters.txt
  45 @@ -2035,6 +2035,28 @@ bytes respectively. Such letter suffixes
  46                         Format: <first>,<last>
  47                         Specifies range of consoles to be captured by the MDA.
  48
  49 +       mds=            [X86,INTEL]
  50 +                       Control mitigation for the Micro-architectural Data
  51 +                       Sampling (MDS) vulnerability.
  52 +
  53 +                       Certain CPUs are vulnerable to an exploit against CPU
  54 +                       internal buffers which can forward information to a
  55 +                       disclosure gadget under certain conditions.
  56 +
  57 +                       In vulnerable processors, the speculatively
  58 +                       forwarded data can be used in a cache side channel
  59 +                       attack, to access data to which the attacker does
  60 +                       not have direct access.
  61 +
  62 +                       This parameter controls the MDS mitigation. The
  63 +                       options are:
  64 +
  65 +                       full    - Enable MDS mitigation on vulnerable CPUs
  66 +                       off     - Unconditionally disable MDS mitigation
  67 +
  68 +                       Not specifying this option is equivalent to
  69 +                       mds=full.
  70 +
  71         mem=nn[KMG]     [KNL,BOOT] Force usage of a specific amount of memory
  72                         Amount of memory to be used when the kernel is not able
  73                         to see the whole system memory or for test.
  74 --- a/arch/x86/include/asm/processor.h
  75 +++ b/arch/x86/include/asm/processor.h
  76 @@ -845,4 +845,10 @@ bool xen_set_default_idle(void);
  77
  78  void stop_this_cpu(void *dummy);
  79  void df_debug(struct pt_regs *regs, long error_code);
  80 +
  81 +enum mds_mitigations {
  82 +       MDS_MITIGATION_OFF,
  83 +       MDS_MITIGATION_FULL,
  84 +};
  85 +
  86  #endif /* _ASM_X86_PROCESSOR_H */
  87 --- a/arch/x86/kernel/cpu/bugs.c
  88 +++ b/arch/x86/kernel/cpu/bugs.c
  89 @@ -32,6 +32,7 @@
  90  static void __init spectre_v2_select_mitigation(void);
  91  static void __init ssb_select_mitigation(void);
  92  static void __init l1tf_select_mitigation(void);
  93 +static void __init mds_select_mitigation(void);
  94
  95  /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
  96  u64 x86_spec_ctrl_base;
  97 @@ -96,6 +97,8 @@ void __init check_bugs(void)
  98
  99         l1tf_select_mitigation();
 100
 101 +       mds_select_mitigation();
 102 +
 103  #ifdef CONFIG_X86_32
 104         /*
 105          * Check whether we are able to run this kernel safely on SMP.
 106 @@ -202,6 +205,50 @@ static void x86_amd_ssb_disable(void)
 107  }
 108
 109  #undef pr_fmt
 110 +#define pr_fmt(fmt)    "MDS: " fmt
 111 +
 112 +/* Default mitigation for L1TF-affected CPUs */
 113 +static enum mds_mitigations mds_mitigation = MDS_MITIGATION_FULL;
 114 +
 115 +static const char * const mds_strings[] = {
 116 +       [MDS_MITIGATION_OFF]    = "Vulnerable",
 117 +       [MDS_MITIGATION_FULL]   = "Mitigation: Clear CPU buffers"
 118 +};
 119 +
 120 +static void __init mds_select_mitigation(void)
 121 +{
 122 +       if (!boot_cpu_has_bug(X86_BUG_MDS)) {
 123 +               mds_mitigation = MDS_MITIGATION_OFF;
 124 +               return;
 125 +       }
 126 +
 127 +       if (mds_mitigation == MDS_MITIGATION_FULL) {
 128 +               if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
 129 +                       static_branch_enable(&mds_user_clear);
 130 +               else
 131 +                       mds_mitigation = MDS_MITIGATION_OFF;
 132 +       }
 133 +       pr_info("%s\n", mds_strings[mds_mitigation]);
 134 +}
 135 +
 136 +static int __init mds_cmdline(char *str)
 137 +{
 138 +       if (!boot_cpu_has_bug(X86_BUG_MDS))
 139 +               return 0;
 140 +
 141 +       if (!str)
 142 +               return -EINVAL;
 143 +
 144 +       if (!strcmp(str, "off"))
 145 +               mds_mitigation = MDS_MITIGATION_OFF;
 146 +       else if (!strcmp(str, "full"))
 147 +               mds_mitigation = MDS_MITIGATION_FULL;
 148 +
 149 +       return 0;
 150 +}
 151 +early_param("mds", mds_cmdline);
 152 +
 153 +#undef pr_fmt
 154  #define pr_fmt(fmt)     "Spectre V2 : " fmt
 155
 156  static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
 157 @@ -599,6 +646,26 @@ static void update_indir_branch_cond(voi
 158                 static_branch_disable(&switch_to_cond_stibp);
 159  }
 160
 161 +/* Update the static key controlling the MDS CPU buffer clear in idle */
 162 +static void update_mds_branch_idle(void)
 163 +{
 164 +       /*
 165 +        * Enable the idle clearing if SMT is active on CPUs which are
 166 +        * affected only by MSBDS and not any other MDS variant.
 167 +        *
 168 +        * The other variants cannot be mitigated when SMT is enabled, so
 169 +        * clearing the buffers on idle just to prevent the Store Buffer
 170 +        * repartitioning leak would be a window dressing exercise.
 171 +        */
 172 +       if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
 173 +               return;
 174 +
 175 +       if (sched_smt_active())
 176 +               static_branch_enable(&mds_idle_clear);
 177 +       else
 178 +               static_branch_disable(&mds_idle_clear);
 179 +}
 180 +
 181  void arch_smt_update(void)
 182  {
 183         /* Enhanced IBRS implies STIBP. No update required. */
 184 @@ -619,6 +686,9 @@ void arch_smt_update(void)
 185                 break;
 186         }
 187
 188 +       if (mds_mitigation == MDS_MITIGATION_FULL)
 189 +               update_mds_branch_idle();
 190 +
 191         mutex_unlock(&spec_ctrl_mutex);
 192  }
 193