UBUNTU: SAUCE: Synchronize MDS mitigations with upstream

Bring the Ubuntu MDS mitigations in sync with the upstream mitigations.
The initial Ubuntu backport was based on the next to last revision of
the base patch series from upstream.

There is no functional change except for adjusting L1TF warning messages
to use the new URL for the L1TF admin guide.

The Atom Silvermont and Airmont changes in the cpu_vuln_whitelist[]
cause no functional changes because Silvermont and Airmont do not
support Intel Hyper-Threading. Therefore, even without this change, the
CPU buffers would be properly flushed as the CPU thread goes into sleep
state and MDS would be reported as being mitigated.

This commit contains changes from the following upstream commits:

 5999bbe7a6ea ("Documentation: Add MDS vulnerability documentation")
 65fd4cb65b2d ("Documentation: Move L1TF to separate directory")
 bc1241700acd ("x86/speculation/mds: Add mitigation control for MDS")
 22dd8365088b ("x86/speculation/mds: Add mitigation mode VMWERV")
 e261f209c366 ("x86/speculation/mds: Add BUG_MSBDS_ONLY")

CVE-2018-12126
CVE-2018-12127
CVE-2018-12130
CVE-2019-11091

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Connor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index 5a25dce38b4e913a32ecee8aa91657314b4dff01..a1fefb604c7f66d9763e77c2293def57b5d0d8d6 100644 (file)
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -395,8 +395,7 @@ Description:        Information about CPU vulnerabilities
                "Vulnerable"      CPU is affected and no mitigation in effect
                "Mitigation: $M"  CPU is affected and mitigation $M is in effect
 
-               Details about the l1tf file can be found in
-               Documentation/admin-guide/l1tf.rst
+               See also: Documentation/admin-guide/hw-vuln/index.rst
 
 What:          /sys/devices/system/cpu/smt
                /sys/devices/system/cpu/smt/active

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 2970a6bcf85898aa7e440cda6ecb6aa78a23436a..11bf7af493e18130da1a8d00da7e4d36e111d54e 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2008,7 +2008,7 @@
 
                        Default is 'flush'.
 
-                       For details see: Documentation/admin-guide/l1tf.rst
+                       For details see: Documentation/admin-guide/hw-vuln/l1tf.rst
 
        l2cr=           [PPC]
 
@@ -2275,6 +2275,8 @@
                        Not specifying this option is equivalent to
                        mds=full.
 
+                       For details see: Documentation/admin-guide/hw-vuln/mds.rst
+
        mem=nn[KMG]     [KNL,BOOT] Force usage of a specific amount of memory
                        Amount of memory to be used when the kernel is not able
                        to see the whole system memory or for test.

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 0229f3fb43333b14c6edf3b99743ad274f5a53a8..9ad7faa33c587c7b3c3e879a500f035aad874412 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -229,7 +229,7 @@ static const char * const mds_strings[] = {
        [MDS_MITIGATION_VMWERV] = "Vulnerable: Clear CPU buffers attempted, no microcode",
 };
 
-static void mds_select_mitigation(void)
+static void __init mds_select_mitigation(void)
 {
        if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
                mds_mitigation = MDS_MITIGATION_OFF;
@@ -678,12 +678,14 @@ static void update_indir_branch_cond(void)
 static void update_mds_branch_idle(void)
 {
        /*
-        * Enable the idle clearing on CPUs which are affected only by
-        * MDBDS and not any other MDS variant. The other variants cannot
-        * be mitigated when SMT is enabled, so clearing the buffers on
-        * idle would be a window dressing exercise.
+        * Enable the idle clearing if SMT is active on CPUs which are
+        * affected only by MSBDS and not any other MDS variant.
+        *
+        * The other variants cannot be mitigated when SMT is enabled, so
+        * clearing the buffers on idle just to prevent the Store Buffer
+        * repartitioning leak would be a window dressing exercise.
         */
-       if (!boot_cpu_has(X86_BUG_MSBDS_ONLY))
+       if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
                return;
 
        if (sched_smt_active())
@@ -715,7 +717,7 @@ void arch_smt_update(void)
                break;
        }
 
-       switch(mds_mitigation) {
+       switch (mds_mitigation) {
        case MDS_MITIGATION_FULL:
        case MDS_MITIGATION_VMWERV:
                if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
@@ -1125,7 +1127,7 @@ static void __init l1tf_select_mitigation(void)
                pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
                                half_pa);
                pr_info("However, doing so will make a part of your RAM unusable.\n");
-               pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html might help you decide.\n");
+               pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html might help you decide.\n");
                return;
        }
 

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 02878a517a18c65f180f86396ed9f9acce2ee617..408680e36e3195f374f38ff69d2cb2f7fc7ae829 100644 (file)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -964,16 +964,16 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
        VULNWL_INTEL(ATOM_BONNELL,              NO_SPECULATION),
        VULNWL_INTEL(ATOM_BONNELL_MID,          NO_SPECULATION),
 
-       VULNWL_INTEL(ATOM_SILVERMONT,           NO_SSB | NO_L1TF),
-       VULNWL_INTEL(ATOM_SILVERMONT_X,         NO_SSB | NO_L1TF),
-       VULNWL_INTEL(ATOM_SILVERMONT_MID,       NO_SSB | NO_L1TF),
-       VULNWL_INTEL(ATOM_AIRMONT,              NO_SSB | NO_L1TF),
+       VULNWL_INTEL(ATOM_SILVERMONT,           NO_SSB | NO_L1TF | MSBDS_ONLY),
+       VULNWL_INTEL(ATOM_SILVERMONT_X,         NO_SSB | NO_L1TF | MSBDS_ONLY),
+       VULNWL_INTEL(ATOM_SILVERMONT_MID,       NO_SSB | NO_L1TF | MSBDS_ONLY),
+       VULNWL_INTEL(ATOM_AIRMONT,              NO_SSB | NO_L1TF | MSBDS_ONLY),
        VULNWL_INTEL(XEON_PHI_KNL,              NO_SSB | NO_L1TF | MSBDS_ONLY),
        VULNWL_INTEL(XEON_PHI_KNM,              NO_SSB | NO_L1TF | MSBDS_ONLY),
 
        VULNWL_INTEL(CORE_YONAH,                NO_SSB),
 
-       VULNWL_INTEL(ATOM_AIRMONT_MID,          NO_L1TF),
+       VULNWL_INTEL(ATOM_AIRMONT_MID,          NO_L1TF | MSBDS_ONLY),
 
        VULNWL_INTEL(ATOM_GOLDMONT,             NO_MDS | NO_L1TF),
        VULNWL_INTEL(ATOM_GOLDMONT_X,           NO_MDS | NO_L1TF),

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 4a88a9ec04a81af6d4b4f3298c23ef3e58da6638..20542b1a788a9a7e5f07758a852ba9e13991a6a0 100644 (file)
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -58,6 +58,7 @@
 #include <asm/alternative.h>
 #include <asm/fpu/xstate.h>
 #include <asm/trace/mpx.h>
+#include <asm/nospec-branch.h>
 #include <asm/mpx.h>
 #include <asm/vm86.h>
 #include <asm/umip.h>

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bf348fee4bd5783d0bb8b543d41847788dff4192..35a21216904320d8542471f926f23b0082c0264d 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -9732,6 +9732,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
 
        vmx->__launched = vmx->loaded_vmcs->launched;
 
+       /* L1D Flush includes CPU buffer clear to mitigate MDS */
        if (static_branch_unlikely(&vmx_l1d_should_flush))
                vmx_l1d_flush(vcpu);
        else if (static_branch_unlikely(&mds_user_clear))
@@ -10086,8 +10087,8 @@ free_vcpu:
        return ERR_PTR(err);
 }
 
-#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
-#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
+#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
 
 static int vmx_vm_init(struct kvm *kvm)
 {