arch/x86/kernel/cpu/bugs.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *  Copyright (C) 1994  Linus Torvalds
   4  *
   5  *  Cyrix stuff, June 1998 by:
   6  *      - Rafael R. Reilova (moved everything from head.S),
   7  *        <rreilova@ececs.uc.edu>
   8  *      - Channing Corn (tests & fixes),
   9  *      - Andrew D. Balsa (code cleanup).
  10  */
  11 #include <linux/init.h>
  12 #include <linux/utsname.h>
  13 #include <linux/cpu.h>
  14 #include <linux/module.h>
  15 #include <linux/nospec.h>
  16 #include <linux/prctl.h>
  17
  18 #include <asm/spec-ctrl.h>
  19 #include <asm/cmdline.h>
  20 #include <asm/bugs.h>
  21 #include <asm/processor.h>
  22 #include <asm/processor-flags.h>
  23 #include <asm/fpu/internal.h>
  24 #include <asm/msr.h>
  25 #include <asm/vmx.h>
  26 #include <asm/paravirt.h>
  27 #include <asm/alternative.h>
  28 #include <asm/pgtable.h>
  29 #include <asm/set_memory.h>
  30 #include <asm/intel-family.h>
  31 #include <asm/e820/api.h>
  32
  33 static void __init spectre_v2_select_mitigation(void);
  34 static void __init ssb_select_mitigation(void);
  35 static void __init l1tf_select_mitigation(void);
  36
  37 /*
  38  * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
  39  * writes to SPEC_CTRL contain whatever reserved bits have been set.
  40  */
  41 u64 __ro_after_init x86_spec_ctrl_base;
  42 EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
  43
  44 /*
  45  * The vendor and possibly platform specific bits which can be modified in
  46  * x86_spec_ctrl_base.
  47  */
  48 static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
  49
  50 /*
  51  * AMD specific MSR info for Speculative Store Bypass control.
  52  * x86_amd_ls_cfg_ssbd_mask is initialized in identify_boot_cpu().
  53  */
  54 u64 __ro_after_init x86_amd_ls_cfg_base;
  55 u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
  56
  57 void __init check_bugs(void)
  58 {
  59         identify_boot_cpu();
  60
  61         /*
  62          * identify_boot_cpu() initialized SMT support information, let the
  63          * core code know.
  64          */
  65         cpu_smt_check_topology_early();
  66
  67         if (!IS_ENABLED(CONFIG_SMP)) {
  68                 pr_info("CPU: ");
  69                 print_cpu_info(&boot_cpu_data);
  70         }
  71
  72         /*
  73          * Read the SPEC_CTRL MSR to account for reserved bits which may
  74          * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
  75          * init code as it is not enumerated and depends on the family.
  76          */
  77         if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
  78                 rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
  79
  80         /* Allow STIBP in MSR_SPEC_CTRL if supported */
  81         if (boot_cpu_has(X86_FEATURE_STIBP))
  82                 x86_spec_ctrl_mask |= SPEC_CTRL_STIBP;
  83
  84         /* Select the proper spectre mitigation before patching alternatives */
  85         spectre_v2_select_mitigation();
  86
  87         /*
  88          * Select proper mitigation for any exposure to the Speculative Store
  89          * Bypass vulnerability.
  90          */
  91         ssb_select_mitigation();
  92
  93         l1tf_select_mitigation();
  94
  95 #ifdef CONFIG_X86_32
  96         /*
  97          * Check whether we are able to run this kernel safely on SMP.
  98          *
  99          * - i386 is no longer supported.
 100          * - In order to run on anything without a TSC, we need to be
 101          *   compiled for a i486.
 102          */
 103         if (boot_cpu_data.x86 < 4)
 104                 panic("Kernel requires i486+ for 'invlpg' and other features");
 105
 106         init_utsname()->machine[1] =
 107                 '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
 108         alternative_instructions();
 109
 110         fpu__init_check_bugs();
 111 #else /* CONFIG_X86_64 */
 112         alternative_instructions();
 113
 114         /*
 115          * Make sure the first 2MB area is not mapped by huge pages
 116          * There are typically fixed size MTRRs in there and overlapping
 117          * MTRRs into large pages causes slow downs.
 118          *
 119          * Right now we don't do that with gbpages because there seems
 120          * very little benefit for that case.
 121          */
 122         if (!direct_gbpages)
 123                 set_memory_4k((unsigned long)__va(0), 1);
 124 #endif
 125 }
 126
 127 /* The kernel command line selection */
 128 enum spectre_v2_mitigation_cmd {
 129         SPECTRE_V2_CMD_NONE,
 130         SPECTRE_V2_CMD_AUTO,
 131         SPECTRE_V2_CMD_FORCE,
 132         SPECTRE_V2_CMD_RETPOLINE,
 133         SPECTRE_V2_CMD_RETPOLINE_GENERIC,
 134         SPECTRE_V2_CMD_RETPOLINE_AMD,
 135 };
 136
 137 static const char *spectre_v2_strings[] = {
 138         [SPECTRE_V2_NONE]                       = "Vulnerable",
 139         [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
 140         [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
 141         [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
 142         [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
 143 };
 144
 145 #undef pr_fmt
 146 #define pr_fmt(fmt)     "Spectre V2 : " fmt
 147
 148 static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
 149         SPECTRE_V2_NONE;
 150
 151 void
 152 x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
 153 {
 154         u64 msrval, guestval, hostval = x86_spec_ctrl_base;
 155         struct thread_info *ti = current_thread_info();
 156
 157         /* Is MSR_SPEC_CTRL implemented ? */
 158         if (static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) {
 159                 /*
 160                  * Restrict guest_spec_ctrl to supported values. Clear the
 161                  * modifiable bits in the host base value and or the
 162                  * modifiable bits from the guest value.
 163                  */
 164                 guestval = hostval & ~x86_spec_ctrl_mask;
 165                 guestval |= guest_spec_ctrl & x86_spec_ctrl_mask;
 166
 167                 /* SSBD controlled in MSR_SPEC_CTRL */
 168                 if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD))
 169                         hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
 170
 171                 if (hostval != guestval) {
 172                         msrval = setguest ? guestval : hostval;
 173                         wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
 174                 }
 175         }
 176
 177         /*
 178          * If SSBD is not handled in MSR_SPEC_CTRL on AMD, update
 179          * MSR_AMD64_L2_CFG or MSR_VIRT_SPEC_CTRL if supported.
 180          */
 181         if (!static_cpu_has(X86_FEATURE_LS_CFG_SSBD) &&
 182             !static_cpu_has(X86_FEATURE_VIRT_SSBD))
 183                 return;
 184
 185         /*
 186          * If the host has SSBD mitigation enabled, force it in the host's
 187          * virtual MSR value. If its not permanently enabled, evaluate
 188          * current's TIF_SSBD thread flag.
 189          */
 190         if (static_cpu_has(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE))
 191                 hostval = SPEC_CTRL_SSBD;
 192         else
 193                 hostval = ssbd_tif_to_spec_ctrl(ti->flags);
 194
 195         /* Sanitize the guest value */
 196         guestval = guest_virt_spec_ctrl & SPEC_CTRL_SSBD;
 197
 198         if (hostval != guestval) {
 199                 unsigned long tif;
 200
 201                 tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
 202                                  ssbd_spec_ctrl_to_tif(hostval);
 203
 204                 speculative_store_bypass_update(tif);
 205         }
 206 }
 207 EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
 208
 209 static void x86_amd_ssb_disable(void)
 210 {
 211         u64 msrval = x86_amd_ls_cfg_base | x86_amd_ls_cfg_ssbd_mask;
 212
 213         if (boot_cpu_has(X86_FEATURE_VIRT_SSBD))
 214                 wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, SPEC_CTRL_SSBD);
 215         else if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD))
 216                 wrmsrl(MSR_AMD64_LS_CFG, msrval);
 217 }
 218
 219 #ifdef RETPOLINE
 220 static bool spectre_v2_bad_module;
 221
 222 bool retpoline_module_ok(bool has_retpoline)
 223 {
 224         if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
 225                 return true;
 226
 227         pr_err("System may be vulnerable to spectre v2\n");
 228         spectre_v2_bad_module = true;
 229         return false;
 230 }
 231
 232 static inline const char *spectre_v2_module_string(void)
 233 {
 234         return spectre_v2_bad_module ? " - vulnerable module loaded" : "";
 235 }
 236 #else
 237 static inline const char *spectre_v2_module_string(void) { return ""; }
 238 #endif
 239
 240 static void __init spec2_print_if_insecure(const char *reason)
 241 {
 242         if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 243                 pr_info("%s selected on command line.\n", reason);
 244 }
 245
 246 static void __init spec2_print_if_secure(const char *reason)
 247 {
 248         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 249                 pr_info("%s selected on command line.\n", reason);
 250 }
 251
 252 static inline bool retp_compiler(void)
 253 {
 254         return __is_defined(RETPOLINE);
 255 }
 256
 257 static inline bool match_option(const char *arg, int arglen, const char *opt)
 258 {
 259         int len = strlen(opt);
 260
 261         return len == arglen && !strncmp(arg, opt, len);
 262 }
 263
 264 static const struct {
 265         const char *option;
 266         enum spectre_v2_mitigation_cmd cmd;
 267         bool secure;
 268 } mitigation_options[] = {
 269         { "off",               SPECTRE_V2_CMD_NONE,              false },
 270         { "on",                SPECTRE_V2_CMD_FORCE,             true },
 271         { "retpoline",         SPECTRE_V2_CMD_RETPOLINE,         false },
 272         { "retpoline,amd",     SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
 273         { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
 274         { "auto",              SPECTRE_V2_CMD_AUTO,              false },
 275 };
 276
 277 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 278 {
 279         char arg[20];
 280         int ret, i;
 281         enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
 282
 283         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
 284                 return SPECTRE_V2_CMD_NONE;
 285         else {
 286                 ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
 287                 if (ret < 0)
 288                         return SPECTRE_V2_CMD_AUTO;
 289
 290                 for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
 291                         if (!match_option(arg, ret, mitigation_options[i].option))
 292                                 continue;
 293                         cmd = mitigation_options[i].cmd;
 294                         break;
 295                 }
 296
 297                 if (i >= ARRAY_SIZE(mitigation_options)) {
 298                         pr_err("unknown option (%s). Switching to AUTO select\n", arg);
 299                         return SPECTRE_V2_CMD_AUTO;
 300                 }
 301         }
 302
 303         if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
 304              cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
 305              cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
 306             !IS_ENABLED(CONFIG_RETPOLINE)) {
 307                 pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
 308                 return SPECTRE_V2_CMD_AUTO;
 309         }
 310
 311         if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD &&
 312             boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
 313                 pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
 314                 return SPECTRE_V2_CMD_AUTO;
 315         }
 316
 317         if (mitigation_options[i].secure)
 318                 spec2_print_if_secure(mitigation_options[i].option);
 319         else
 320                 spec2_print_if_insecure(mitigation_options[i].option);
 321
 322         return cmd;
 323 }
 324
 325 static void __init spectre_v2_select_mitigation(void)
 326 {
 327         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
 328         enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
 329
 330         /*
 331          * If the CPU is not affected and the command line mode is NONE or AUTO
 332          * then nothing to do.
 333          */
 334         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
 335             (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
 336                 return;
 337
 338         switch (cmd) {
 339         case SPECTRE_V2_CMD_NONE:
 340                 return;
 341
 342         case SPECTRE_V2_CMD_FORCE:
 343         case SPECTRE_V2_CMD_AUTO:
 344                 if (IS_ENABLED(CONFIG_RETPOLINE))
 345                         goto retpoline_auto;
 346                 break;
 347         case SPECTRE_V2_CMD_RETPOLINE_AMD:
 348                 if (IS_ENABLED(CONFIG_RETPOLINE))
 349                         goto retpoline_amd;
 350                 break;
 351         case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
 352                 if (IS_ENABLED(CONFIG_RETPOLINE))
 353                         goto retpoline_generic;
 354                 break;
 355         case SPECTRE_V2_CMD_RETPOLINE:
 356                 if (IS_ENABLED(CONFIG_RETPOLINE))
 357                         goto retpoline_auto;
 358                 break;
 359         }
 360         pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
 361         return;
 362
 363 retpoline_auto:
 364         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
 365         retpoline_amd:
 366                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
 367                         pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
 368                         goto retpoline_generic;
 369                 }
 370                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
 371                                          SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
 372                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
 373                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 374         } else {
 375         retpoline_generic:
 376                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
 377                                          SPECTRE_V2_RETPOLINE_MINIMAL;
 378                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 379         }
 380
 381         spectre_v2_enabled = mode;
 382         pr_info("%s\n", spectre_v2_strings[mode]);
 383
 384         /*
 385          * If spectre v2 protection has been enabled, unconditionally fill
 386          * RSB during a context switch; this protects against two independent
 387          * issues:
 388          *
 389          *      - RSB underflow (and switch to BTB) on Skylake+
 390          *      - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
 391          */
 392         setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
 393         pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
 394
 395         /* Initialize Indirect Branch Prediction Barrier if supported */
 396         if (boot_cpu_has(X86_FEATURE_IBPB)) {
 397                 setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
 398                 pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
 399         }
 400
 401         /*
 402          * Retpoline means the kernel is safe because it has no indirect
 403          * branches. But firmware isn't, so use IBRS to protect that.
 404          */
 405         if (boot_cpu_has(X86_FEATURE_IBRS)) {
 406                 setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
 407                 pr_info("Enabling Restricted Speculation for firmware calls\n");
 408         }
 409 }
 410
 411 #undef pr_fmt
 412 #define pr_fmt(fmt)     "Speculative Store Bypass: " fmt
 413
 414 static enum ssb_mitigation ssb_mode __ro_after_init = SPEC_STORE_BYPASS_NONE;
 415
 416 /* The kernel command line selection */
 417 enum ssb_mitigation_cmd {
 418         SPEC_STORE_BYPASS_CMD_NONE,
 419         SPEC_STORE_BYPASS_CMD_AUTO,
 420         SPEC_STORE_BYPASS_CMD_ON,
 421         SPEC_STORE_BYPASS_CMD_PRCTL,
 422         SPEC_STORE_BYPASS_CMD_SECCOMP,
 423 };
 424
 425 static const char *ssb_strings[] = {
 426         [SPEC_STORE_BYPASS_NONE]        = "Vulnerable",
 427         [SPEC_STORE_BYPASS_DISABLE]     = "Mitigation: Speculative Store Bypass disabled",
 428         [SPEC_STORE_BYPASS_PRCTL]       = "Mitigation: Speculative Store Bypass disabled via prctl",
 429         [SPEC_STORE_BYPASS_SECCOMP]     = "Mitigation: Speculative Store Bypass disabled via prctl and seccomp",
 430 };
 431
 432 static const struct {
 433         const char *option;
 434         enum ssb_mitigation_cmd cmd;
 435 } ssb_mitigation_options[] = {
 436         { "auto",       SPEC_STORE_BYPASS_CMD_AUTO },    /* Platform decides */
 437         { "on",         SPEC_STORE_BYPASS_CMD_ON },      /* Disable Speculative Store Bypass */
 438         { "off",        SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
 439         { "prctl",      SPEC_STORE_BYPASS_CMD_PRCTL },   /* Disable Speculative Store Bypass via prctl */
 440         { "seccomp",    SPEC_STORE_BYPASS_CMD_SECCOMP }, /* Disable Speculative Store Bypass via prctl and seccomp */
 441 };
 442
 443 static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)
 444 {
 445         enum ssb_mitigation_cmd cmd = SPEC_STORE_BYPASS_CMD_AUTO;
 446         char arg[20];
 447         int ret, i;
 448
 449         if (cmdline_find_option_bool(boot_command_line, "nospec_store_bypass_disable")) {
 450                 return SPEC_STORE_BYPASS_CMD_NONE;
 451         } else {
 452                 ret = cmdline_find_option(boot_command_line, "spec_store_bypass_disable",
 453                                           arg, sizeof(arg));
 454                 if (ret < 0)
 455                         return SPEC_STORE_BYPASS_CMD_AUTO;
 456
 457                 for (i = 0; i < ARRAY_SIZE(ssb_mitigation_options); i++) {
 458                         if (!match_option(arg, ret, ssb_mitigation_options[i].option))
 459                                 continue;
 460
 461                         cmd = ssb_mitigation_options[i].cmd;
 462                         break;
 463                 }
 464
 465                 if (i >= ARRAY_SIZE(ssb_mitigation_options)) {
 466                         pr_err("unknown option (%s). Switching to AUTO select\n", arg);
 467                         return SPEC_STORE_BYPASS_CMD_AUTO;
 468                 }
 469         }
 470
 471         return cmd;
 472 }
 473
 474 static enum ssb_mitigation __init __ssb_select_mitigation(void)
 475 {
 476         enum ssb_mitigation mode = SPEC_STORE_BYPASS_NONE;
 477         enum ssb_mitigation_cmd cmd;
 478
 479         if (!boot_cpu_has(X86_FEATURE_SSBD))
 480                 return mode;
 481
 482         cmd = ssb_parse_cmdline();
 483         if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS) &&
 484             (cmd == SPEC_STORE_BYPASS_CMD_NONE ||
 485              cmd == SPEC_STORE_BYPASS_CMD_AUTO))
 486                 return mode;
 487
 488         switch (cmd) {
 489         case SPEC_STORE_BYPASS_CMD_AUTO:
 490         case SPEC_STORE_BYPASS_CMD_SECCOMP:
 491                 /*
 492                  * Choose prctl+seccomp as the default mode if seccomp is
 493                  * enabled.
 494                  */
 495                 if (IS_ENABLED(CONFIG_SECCOMP))
 496                         mode = SPEC_STORE_BYPASS_SECCOMP;
 497                 else
 498                         mode = SPEC_STORE_BYPASS_PRCTL;
 499                 break;
 500         case SPEC_STORE_BYPASS_CMD_ON:
 501                 mode = SPEC_STORE_BYPASS_DISABLE;
 502                 break;
 503         case SPEC_STORE_BYPASS_CMD_PRCTL:
 504                 mode = SPEC_STORE_BYPASS_PRCTL;
 505                 break;
 506         case SPEC_STORE_BYPASS_CMD_NONE:
 507                 break;
 508         }
 509
 510         /*
 511          * We have three CPU feature flags that are in play here:
 512          *  - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible.
 513          *  - X86_FEATURE_SSBD - CPU is able to turn off speculative store bypass
 514          *  - X86_FEATURE_SPEC_STORE_BYPASS_DISABLE - engage the mitigation
 515          */
 516         if (mode == SPEC_STORE_BYPASS_DISABLE) {
 517                 setup_force_cpu_cap(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE);
 518                 /*
 519                  * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD uses
 520                  * a completely different MSR and bit dependent on family.
 521                  */
 522                 switch (boot_cpu_data.x86_vendor) {
 523                 case X86_VENDOR_INTEL:
 524                         x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
 525                         x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
 526                         wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
 527                         break;
 528                 case X86_VENDOR_AMD:
 529                         x86_amd_ssb_disable();
 530                         break;
 531                 }
 532         }
 533
 534         return mode;
 535 }
 536
 537 static void ssb_select_mitigation(void)
 538 {
 539         ssb_mode = __ssb_select_mitigation();
 540
 541         if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
 542                 pr_info("%s\n", ssb_strings[ssb_mode]);
 543 }
 544
 545 #undef pr_fmt
 546 #define pr_fmt(fmt)     "Speculation prctl: " fmt
 547
 548 static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
 549 {
 550         bool update;
 551
 552         if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
 553             ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
 554                 return -ENXIO;
 555
 556         switch (ctrl) {
 557         case PR_SPEC_ENABLE:
 558                 /* If speculation is force disabled, enable is not allowed */
 559                 if (task_spec_ssb_force_disable(task))
 560                         return -EPERM;
 561                 task_clear_spec_ssb_disable(task);
 562                 update = test_and_clear_tsk_thread_flag(task, TIF_SSBD);
 563                 break;
 564         case PR_SPEC_DISABLE:
 565                 task_set_spec_ssb_disable(task);
 566                 update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
 567                 break;
 568         case PR_SPEC_FORCE_DISABLE:
 569                 task_set_spec_ssb_disable(task);
 570                 task_set_spec_ssb_force_disable(task);
 571                 update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
 572                 break;
 573         default:
 574                 return -ERANGE;
 575         }
 576
 577         /*
 578          * If being set on non-current task, delay setting the CPU
 579          * mitigation until it is next scheduled.
 580          */
 581         if (task == current && update)
 582                 speculative_store_bypass_update_current();
 583
 584         return 0;
 585 }
 586
 587 int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
 588                              unsigned long ctrl)
 589 {
 590         switch (which) {
 591         case PR_SPEC_STORE_BYPASS:
 592                 return ssb_prctl_set(task, ctrl);
 593         default:
 594                 return -ENODEV;
 595         }
 596 }
 597
 598 #ifdef CONFIG_SECCOMP
 599 void arch_seccomp_spec_mitigate(struct task_struct *task)
 600 {
 601         if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
 602                 ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
 603 }
 604 #endif
 605
 606 static int ssb_prctl_get(struct task_struct *task)
 607 {
 608         switch (ssb_mode) {
 609         case SPEC_STORE_BYPASS_DISABLE:
 610                 return PR_SPEC_DISABLE;
 611         case SPEC_STORE_BYPASS_SECCOMP:
 612         case SPEC_STORE_BYPASS_PRCTL:
 613                 if (task_spec_ssb_force_disable(task))
 614                         return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
 615                 if (task_spec_ssb_disable(task))
 616                         return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
 617                 return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
 618         default:
 619                 if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
 620                         return PR_SPEC_ENABLE;
 621                 return PR_SPEC_NOT_AFFECTED;
 622         }
 623 }
 624
 625 int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
 626 {
 627         switch (which) {
 628         case PR_SPEC_STORE_BYPASS:
 629                 return ssb_prctl_get(task);
 630         default:
 631                 return -ENODEV;
 632         }
 633 }
 634
 635 void x86_spec_ctrl_setup_ap(void)
 636 {
 637         if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
 638                 wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
 639
 640         if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
 641                 x86_amd_ssb_disable();
 642 }
 643
 644 #undef pr_fmt
 645 #define pr_fmt(fmt)     "L1TF: " fmt
 646
 647 /* Default mitigation for L1TF-affected CPUs */
 648 enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_FLUSH;
 649 #if IS_ENABLED(CONFIG_KVM_INTEL)
 650 EXPORT_SYMBOL_GPL(l1tf_mitigation);
 651
 652 enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
 653 EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
 654 #endif
 655
 656 static void __init l1tf_select_mitigation(void)
 657 {
 658         u64 half_pa;
 659
 660         if (!boot_cpu_has_bug(X86_BUG_L1TF))
 661                 return;
 662
 663         switch (l1tf_mitigation) {
 664         case L1TF_MITIGATION_OFF:
 665         case L1TF_MITIGATION_FLUSH_NOWARN:
 666         case L1TF_MITIGATION_FLUSH:
 667                 break;
 668         case L1TF_MITIGATION_FLUSH_NOSMT:
 669         case L1TF_MITIGATION_FULL:
 670                 cpu_smt_disable(false);
 671                 break;
 672         case L1TF_MITIGATION_FULL_FORCE:
 673                 cpu_smt_disable(true);
 674                 break;
 675         }
 676
 677 #if CONFIG_PGTABLE_LEVELS == 2
 678         pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
 679         return;
 680 #endif
 681
 682         /*
 683          * This is extremely unlikely to happen because almost all
 684          * systems have far more MAX_PA/2 than RAM can be fit into
 685          * DIMM slots.
 686          */
 687         half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
 688         if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
 689                 pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
 690                 return;
 691         }
 692
 693         setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
 694 }
 695
 696 static int __init l1tf_cmdline(char *str)
 697 {
 698         if (!boot_cpu_has_bug(X86_BUG_L1TF))
 699                 return 0;
 700
 701         if (!str)
 702                 return -EINVAL;
 703
 704         if (!strcmp(str, "off"))
 705                 l1tf_mitigation = L1TF_MITIGATION_OFF;
 706         else if (!strcmp(str, "flush,nowarn"))
 707                 l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOWARN;
 708         else if (!strcmp(str, "flush"))
 709                 l1tf_mitigation = L1TF_MITIGATION_FLUSH;
 710         else if (!strcmp(str, "flush,nosmt"))
 711                 l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
 712         else if (!strcmp(str, "full"))
 713                 l1tf_mitigation = L1TF_MITIGATION_FULL;
 714         else if (!strcmp(str, "full,force"))
 715                 l1tf_mitigation = L1TF_MITIGATION_FULL_FORCE;
 716
 717         return 0;
 718 }
 719 early_param("l1tf", l1tf_cmdline);
 720
 721 #undef pr_fmt
 722
 723 #ifdef CONFIG_SYSFS
 724
 725 #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
 726
 727 #if IS_ENABLED(CONFIG_KVM_INTEL)
 728 static const char *l1tf_vmx_states[] = {
 729         [VMENTER_L1D_FLUSH_AUTO]                = "auto",
 730         [VMENTER_L1D_FLUSH_NEVER]               = "vulnerable",
 731         [VMENTER_L1D_FLUSH_COND]                = "conditional cache flushes",
 732         [VMENTER_L1D_FLUSH_ALWAYS]              = "cache flushes",
 733         [VMENTER_L1D_FLUSH_EPT_DISABLED]        = "EPT disabled",
 734         [VMENTER_L1D_FLUSH_NOT_REQUIRED]        = "flush not necessary"
 735 };
 736
 737 static ssize_t l1tf_show_state(char *buf)
 738 {
 739         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
 740                 return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
 741
 742         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
 743             (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
 744              cpu_smt_control == CPU_SMT_ENABLED))
 745                 return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
 746                                l1tf_vmx_states[l1tf_vmx_mitigation]);
 747
 748         return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
 749                        l1tf_vmx_states[l1tf_vmx_mitigation],
 750                        cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
 751 }
 752 #else
 753 static ssize_t l1tf_show_state(char *buf)
 754 {
 755         return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
 756 }
 757 #endif
 758
 759 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
 760                                char *buf, unsigned int bug)
 761 {
 762         if (!boot_cpu_has_bug(bug))
 763                 return sprintf(buf, "Not affected\n");
 764
 765         switch (bug) {
 766         case X86_BUG_CPU_MELTDOWN:
 767                 if (boot_cpu_has(X86_FEATURE_PTI))
 768                         return sprintf(buf, "Mitigation: PTI\n");
 769
 770                 break;
 771
 772         case X86_BUG_SPECTRE_V1:
 773                 return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 774
 775         case X86_BUG_SPECTRE_V2:
 776                 return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
 777                                boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
 778                                boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
 779                                spectre_v2_module_string());
 780
 781         case X86_BUG_SPEC_STORE_BYPASS:
 782                 return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
 783
 784         case X86_BUG_L1TF:
 785                 if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
 786                         return l1tf_show_state(buf);
 787                 break;
 788         default:
 789                 break;
 790         }
 791
 792         return sprintf(buf, "Vulnerable\n");
 793 }
 794
 795 ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
 796 {
 797         return cpu_show_common(dev, attr, buf, X86_BUG_CPU_MELTDOWN);
 798 }
 799
 800 ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
 801 {
 802         return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V1);
 803 }
 804
 805 ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
 806 {
 807         return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V2);
 808 }
 809
 810 ssize_t cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf)
 811 {
 812         return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS);
 813 }
 814
 815 ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf)
 816 {
 817         return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
 818 }
 819 #endif