arch/x86/kernel/cpu/bugs.c

   1 /*
   2  *  Copyright (C) 1994  Linus Torvalds
   3  *
   4  *  Cyrix stuff, June 1998 by:
   5  *      - Rafael R. Reilova (moved everything from head.S),
   6  *        <rreilova@ececs.uc.edu>
   7  *      - Channing Corn (tests & fixes),
   8  *      - Andrew D. Balsa (code cleanup).
   9  */
  10 #include <linux/init.h>
  11 #include <linux/utsname.h>
  12 #include <linux/cpu.h>
  13
  14 #include <asm/nospec-branch.h>
  15 #include <asm/cmdline.h>
  16 #include <asm/bugs.h>
  17 #include <asm/processor.h>
  18 #include <asm/processor-flags.h>
  19 #include <asm/fpu/internal.h>
  20 #include <asm/msr.h>
  21 #include <asm/paravirt.h>
  22 #include <asm/alternative.h>
  23 #include <asm/pgtable.h>
  24 #include <asm/set_memory.h>
  25 #include <asm/intel-family.h>
  26
  27 static void __init spectre_v2_select_mitigation(void);
  28
  29 void __init check_bugs(void)
  30 {
  31         identify_boot_cpu();
  32
  33         if (!IS_ENABLED(CONFIG_SMP)) {
  34                 pr_info("CPU: ");
  35                 print_cpu_info(&boot_cpu_data);
  36         }
  37
  38         /* Select the proper spectre mitigation before patching alternatives */
  39         spectre_v2_select_mitigation();
  40
  41 #ifdef CONFIG_X86_32
  42         /*
  43          * Check whether we are able to run this kernel safely on SMP.
  44          *
  45          * - i386 is no longer supported.
  46          * - In order to run on anything without a TSC, we need to be
  47          *   compiled for a i486.
  48          */
  49         if (boot_cpu_data.x86 < 4)
  50                 panic("Kernel requires i486+ for 'invlpg' and other features");
  51
  52         init_utsname()->machine[1] =
  53                 '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
  54         alternative_instructions();
  55
  56         fpu__init_check_bugs();
  57 #else /* CONFIG_X86_64 */
  58         alternative_instructions();
  59
  60         /*
  61          * Make sure the first 2MB area is not mapped by huge pages
  62          * There are typically fixed size MTRRs in there and overlapping
  63          * MTRRs into large pages causes slow downs.
  64          *
  65          * Right now we don't do that with gbpages because there seems
  66          * very little benefit for that case.
  67          */
  68         if (!direct_gbpages)
  69                 set_memory_4k((unsigned long)__va(0), 1);
  70 #endif
  71 }
  72
  73 /* The kernel command line selection */
  74 enum spectre_v2_mitigation_cmd {
  75         SPECTRE_V2_CMD_NONE,
  76         SPECTRE_V2_CMD_AUTO,
  77         SPECTRE_V2_CMD_FORCE,
  78         SPECTRE_V2_CMD_RETPOLINE,
  79         SPECTRE_V2_CMD_RETPOLINE_GENERIC,
  80         SPECTRE_V2_CMD_RETPOLINE_AMD,
  81 };
  82
  83 static const char *spectre_v2_strings[] = {
  84         [SPECTRE_V2_NONE]                       = "Vulnerable",
  85         [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
  86         [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
  87         [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
  88         [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
  89 };
  90
  91 #undef pr_fmt
  92 #define pr_fmt(fmt)     "Spectre V2 mitigation: " fmt
  93
  94 static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
  95
  96 static void __init spec2_print_if_insecure(const char *reason)
  97 {
  98         if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
  99                 pr_info("%s\n", reason);
 100 }
 101
 102 static void __init spec2_print_if_secure(const char *reason)
 103 {
 104         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 105                 pr_info("%s\n", reason);
 106 }
 107
 108 static inline bool retp_compiler(void)
 109 {
 110         return __is_defined(RETPOLINE);
 111 }
 112
 113 static inline bool match_option(const char *arg, int arglen, const char *opt)
 114 {
 115         int len = strlen(opt);
 116
 117         return len == arglen && !strncmp(arg, opt, len);
 118 }
 119
 120 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 121 {
 122         char arg[20];
 123         int ret;
 124
 125         ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
 126                                   sizeof(arg));
 127         if (ret > 0)  {
 128                 if (match_option(arg, ret, "off")) {
 129                         goto disable;
 130                 } else if (match_option(arg, ret, "on")) {
 131                         spec2_print_if_secure("force enabled on command line.");
 132                         return SPECTRE_V2_CMD_FORCE;
 133                 } else if (match_option(arg, ret, "retpoline")) {
 134                         spec2_print_if_insecure("retpoline selected on command line.");
 135                         return SPECTRE_V2_CMD_RETPOLINE;
 136                 } else if (match_option(arg, ret, "retpoline,amd")) {
 137                         if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
 138                                 pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
 139                                 return SPECTRE_V2_CMD_AUTO;
 140                         }
 141                         spec2_print_if_insecure("AMD retpoline selected on command line.");
 142                         return SPECTRE_V2_CMD_RETPOLINE_AMD;
 143                 } else if (match_option(arg, ret, "retpoline,generic")) {
 144                         spec2_print_if_insecure("generic retpoline selected on command line.");
 145                         return SPECTRE_V2_CMD_RETPOLINE_GENERIC;
 146                 } else if (match_option(arg, ret, "auto")) {
 147                         return SPECTRE_V2_CMD_AUTO;
 148                 }
 149         }
 150
 151         if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
 152                 return SPECTRE_V2_CMD_AUTO;
 153 disable:
 154         spec2_print_if_insecure("disabled on command line.");
 155         return SPECTRE_V2_CMD_NONE;
 156 }
 157
 158 /* Check for Skylake-like CPUs (for RSB handling) */
 159 static bool __init is_skylake_era(void)
 160 {
 161         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
 162             boot_cpu_data.x86 == 6) {
 163                 switch (boot_cpu_data.x86_model) {
 164                 case INTEL_FAM6_SKYLAKE_MOBILE:
 165                 case INTEL_FAM6_SKYLAKE_DESKTOP:
 166                 case INTEL_FAM6_SKYLAKE_X:
 167                 case INTEL_FAM6_KABYLAKE_MOBILE:
 168                 case INTEL_FAM6_KABYLAKE_DESKTOP:
 169                         return true;
 170                 }
 171         }
 172         return false;
 173 }
 174
 175 static void __init spectre_v2_select_mitigation(void)
 176 {
 177         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
 178         enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
 179
 180         /*
 181          * If the CPU is not affected and the command line mode is NONE or AUTO
 182          * then nothing to do.
 183          */
 184         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
 185             (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
 186                 return;
 187
 188         switch (cmd) {
 189         case SPECTRE_V2_CMD_NONE:
 190                 return;
 191
 192         case SPECTRE_V2_CMD_FORCE:
 193                 /* FALLTRHU */
 194         case SPECTRE_V2_CMD_AUTO:
 195                 goto retpoline_auto;
 196
 197         case SPECTRE_V2_CMD_RETPOLINE_AMD:
 198                 if (IS_ENABLED(CONFIG_RETPOLINE))
 199                         goto retpoline_amd;
 200                 break;
 201         case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
 202                 if (IS_ENABLED(CONFIG_RETPOLINE))
 203                         goto retpoline_generic;
 204                 break;
 205         case SPECTRE_V2_CMD_RETPOLINE:
 206                 if (IS_ENABLED(CONFIG_RETPOLINE))
 207                         goto retpoline_auto;
 208                 break;
 209         }
 210         pr_err("kernel not compiled with retpoline; no mitigation available!");
 211         return;
 212
 213 retpoline_auto:
 214         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
 215         retpoline_amd:
 216                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
 217                         pr_err("LFENCE not serializing. Switching to generic retpoline\n");
 218                         goto retpoline_generic;
 219                 }
 220                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
 221                                          SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
 222                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
 223                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 224         } else {
 225         retpoline_generic:
 226                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
 227                                          SPECTRE_V2_RETPOLINE_MINIMAL;
 228                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 229         }
 230
 231         spectre_v2_enabled = mode;
 232         pr_info("%s\n", spectre_v2_strings[mode]);
 233
 234         /*
 235          * If neither SMEP or KPTI are available, there is a risk of
 236          * hitting userspace addresses in the RSB after a context switch
 237          * from a shallow call stack to a deeper one. To prevent this fill
 238          * the entire RSB, even when using IBRS.
 239          *
 240          * Skylake era CPUs have a separate issue with *underflow* of the
 241          * RSB, when they will predict 'ret' targets from the generic BTB.
 242          * The proper mitigation for this is IBRS. If IBRS is not supported
 243          * or deactivated in favour of retpolines the RSB fill on context
 244          * switch is required.
 245          */
 246         if ((!boot_cpu_has(X86_FEATURE_PTI) &&
 247              !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
 248                 setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
 249                 pr_info("Filling RSB on context switch\n");
 250         }
 251 }
 252
 253 #undef pr_fmt
 254
 255 #ifdef CONFIG_SYSFS
 256 ssize_t cpu_show_meltdown(struct device *dev,
 257                           struct device_attribute *attr, char *buf)
 258 {
 259         if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
 260                 return sprintf(buf, "Not affected\n");
 261         if (boot_cpu_has(X86_FEATURE_PTI))
 262                 return sprintf(buf, "Mitigation: PTI\n");
 263         return sprintf(buf, "Vulnerable\n");
 264 }
 265
 266 ssize_t cpu_show_spectre_v1(struct device *dev,
 267                             struct device_attribute *attr, char *buf)
 268 {
 269         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
 270                 return sprintf(buf, "Not affected\n");
 271         if (osb_is_enabled)
 272                 return sprintf(buf, "Mitigation: OSB (observable speculation barrier, Intel v6)\n");
 273         return sprintf(buf, "Vulnerable\n");
 274 }
 275
 276 ssize_t cpu_show_spectre_v2(struct device *dev,
 277                             struct device_attribute *attr, char *buf)
 278 {
 279         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 280                 return sprintf(buf, "Not affected\n");
 281
 282         return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]);
 283 }
 284 #endif