]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
x86/bugs: Restructure L1TF mitigation
authorDavid Kaplan <david.kaplan@amd.com>
Fri, 18 Apr 2025 16:17:20 +0000 (11:17 -0500)
committerBorislav Petkov (AMD) <bp@alien8.de>
Tue, 29 Apr 2025 16:57:30 +0000 (18:57 +0200)
Restructure L1TF to use select/apply functions to create consistent
vulnerability handling.

Define new AUTO mitigation for L1TF.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/20250418161721.1855190-16-david.kaplan@amd.com
arch/x86/include/asm/processor.h
arch/x86/kernel/cpu/bugs.c
arch/x86/kvm/vmx/vmx.c

index 5d2f7e5aff261ff540995990ab334cdb95df27fe..0973bed221721f5d657b2038f6152004133e4c14 100644 (file)
@@ -734,6 +734,7 @@ void store_cpu_caps(struct cpuinfo_x86 *info);
 
 enum l1tf_mitigations {
        L1TF_MITIGATION_OFF,
+       L1TF_MITIGATION_AUTO,
        L1TF_MITIGATION_FLUSH_NOWARN,
        L1TF_MITIGATION_FLUSH,
        L1TF_MITIGATION_FLUSH_NOSMT,
index fbb4f1378de1fce6a31b24d5139f866e9501aece..25d84e2a4f2ba3c5288b2d14a00859fe36772854 100644 (file)
@@ -67,6 +67,7 @@ static void __init spectre_v2_user_apply_mitigation(void);
 static void __init ssb_select_mitigation(void);
 static void __init ssb_apply_mitigation(void);
 static void __init l1tf_select_mitigation(void);
+static void __init l1tf_apply_mitigation(void);
 static void __init mds_select_mitigation(void);
 static void __init mds_update_mitigation(void);
 static void __init mds_apply_mitigation(void);
@@ -245,6 +246,7 @@ void __init cpu_select_mitigations(void)
        retbleed_apply_mitigation();
        spectre_v2_user_apply_mitigation();
        ssb_apply_mitigation();
+       l1tf_apply_mitigation();
        mds_apply_mitigation();
        taa_apply_mitigation();
        mmio_apply_mitigation();
@@ -2538,7 +2540,7 @@ EXPORT_SYMBOL_GPL(itlb_multihit_kvm_mitigation);
 
 /* Default mitigation for L1TF-affected CPUs */
 enum l1tf_mitigations l1tf_mitigation __ro_after_init =
-       IS_ENABLED(CONFIG_MITIGATION_L1TF) ? L1TF_MITIGATION_FLUSH : L1TF_MITIGATION_OFF;
+       IS_ENABLED(CONFIG_MITIGATION_L1TF) ? L1TF_MITIGATION_AUTO : L1TF_MITIGATION_OFF;
 #if IS_ENABLED(CONFIG_KVM_INTEL)
 EXPORT_SYMBOL_GPL(l1tf_mitigation);
 #endif
@@ -2585,23 +2587,34 @@ static void override_cache_bits(struct cpuinfo_x86 *c)
 }
 
 static void __init l1tf_select_mitigation(void)
+{
+       if (!boot_cpu_has_bug(X86_BUG_L1TF) || cpu_mitigations_off()) {
+               l1tf_mitigation = L1TF_MITIGATION_OFF;
+               return;
+       }
+
+       if (l1tf_mitigation == L1TF_MITIGATION_AUTO) {
+               if (cpu_mitigations_auto_nosmt())
+                       l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
+               else
+                       l1tf_mitigation = L1TF_MITIGATION_FLUSH;
+       }
+}
+
+static void __init l1tf_apply_mitigation(void)
 {
        u64 half_pa;
 
        if (!boot_cpu_has_bug(X86_BUG_L1TF))
                return;
 
-       if (cpu_mitigations_off())
-               l1tf_mitigation = L1TF_MITIGATION_OFF;
-       else if (cpu_mitigations_auto_nosmt())
-               l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
-
        override_cache_bits(&boot_cpu_data);
 
        switch (l1tf_mitigation) {
        case L1TF_MITIGATION_OFF:
        case L1TF_MITIGATION_FLUSH_NOWARN:
        case L1TF_MITIGATION_FLUSH:
+       case L1TF_MITIGATION_AUTO:
                break;
        case L1TF_MITIGATION_FLUSH_NOSMT:
        case L1TF_MITIGATION_FULL:
index a1754f7ba889853eca919f090794b0dc54229a1a..0aba4719ae0a279e478958507ce43d49ddc0cc20 100644 (file)
@@ -273,6 +273,7 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
                case L1TF_MITIGATION_OFF:
                        l1tf = VMENTER_L1D_FLUSH_NEVER;
                        break;
+               case L1TF_MITIGATION_AUTO:
                case L1TF_MITIGATION_FLUSH_NOWARN:
                case L1TF_MITIGATION_FLUSH:
                case L1TF_MITIGATION_FLUSH_NOSMT:
@@ -7704,6 +7705,7 @@ int vmx_vm_init(struct kvm *kvm)
                case L1TF_MITIGATION_FLUSH_NOWARN:
                        /* 'I explicitly don't care' is set */
                        break;
+               case L1TF_MITIGATION_AUTO:
                case L1TF_MITIGATION_FLUSH:
                case L1TF_MITIGATION_FLUSH_NOSMT:
                case L1TF_MITIGATION_FULL: