From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linutronix.de (146.0.238.70:993) by crypto-ml.lab.linutronix.de with IMAP4-SSL for ; 24 Feb 2019 15:12:47 -0000 Received: from mga02.intel.com ([134.134.136.20]) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1gxvNx-0001RU-Tz for speck@linutronix.de; Sun, 24 Feb 2019 16:08:10 +0100 From: Andi Kleen Subject: [MODERATED] [PATCH v6 04/43] MDSv6 Date: Sun, 24 Feb 2019 07:07:10 -0800 Message-Id: In-Reply-To: References: In-Reply-To: References: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de Cc: Andi Kleen List-ID: Parse mds=off / mds=auto / mds=full on the kernel command line. Only mds=off has an effect, mds=auto is equal to mds=full and is default currently. Signed-off-by: Andi Kleen --- .../admin-guide/kernel-parameters.txt | 11 +++++++ arch/x86/include/asm/clearcpu.h | 2 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/kernel/cpu/bugs.c | 31 +++++++++++++++++++ 4 files changed, 44 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 858b6c0b9a15..753b8982770e 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2356,6 +2356,17 @@ Format: , Specifies range of consoles to be captured by the MDA. + mds=off [X86, Intel] + Disable workarounds for Micro-architectural Data Sampling. + + mds=auto [X86, Intel] + Automatically select default for MDS mitigation. + Currently this always flushes on kernel exit. + + mds=full [X86, Intel] + Always flush cpu buffers when exiting kernel for MDS + without any heuristics. + mem=nn[KMG] [KNL,BOOT] Force usage of a specific amount of memory Amount of memory to be used when the kernel is not able to see the whole system memory or for test. diff --git a/arch/x86/include/asm/clearcpu.h b/arch/x86/include/asm/clearcpu.h index d4a5e43311a8..88ab27694aa6 100644 --- a/arch/x86/include/asm/clearcpu.h +++ b/arch/x86/include/asm/clearcpu.h @@ -16,7 +16,7 @@ static inline void clear_cpu(void) { unsigned kernel_ds = __KERNEL_DS; /* Has to be memory form, don't modify to use an register */ - alternative_input("", "verw %[kernelds]", X86_BUG_MDS, + alternative_input("", "verw %[kernelds]", X86_FEATURE_VERW, [kernelds] "m" (kernel_ds)); } diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 233ca598826f..27735ae3c3a2 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -221,6 +221,7 @@ #define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ #define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */ #define X86_FEATURE_IBRS_ENHANCED ( 7*32+30) /* Enhanced IBRS */ +#define X86_FEATURE_VERW ( 7*32+31) /* "" VERW for MDS on kernel exit */ /* Virtualization flags: Linux defined, word 8 */ #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 01874d54f4fd..b93565ab20b3 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -37,6 +37,7 @@ static void __init spectre_v2_select_mitigation(void); static void __init ssb_select_mitigation(void); static void __init l1tf_select_mitigation(void); +static void __init mds_select_mitigation(void); /* The base value of the SPEC_CTRL MSR that always has to be preserved. */ u64 x86_spec_ctrl_base; @@ -101,6 +102,8 @@ void __init check_bugs(void) l1tf_select_mitigation(); + mds_select_mitigation(); + #ifdef CONFIG_X86_32 /* * Check whether we are able to run this kernel safely on SMP. @@ -1058,6 +1061,34 @@ early_param("l1tf", l1tf_cmdline); #undef pr_fmt +static void mds_select_mitigation(void) +{ + if (!boot_cpu_has(X86_BUG_MDS)) + return; + + /* + * Use VERW even if the CPUID does not report MD_CLEAR, + * in case we're running in a legacy hypervisor that + * doesn't pass through CPUID properly. + * + * This causes some extra overhead on CPUs that don't need + * VERW. + * + * This is supposed to handle the slow release cycle + * of VMware who doesn't update CPUIDs timely in 2019. + * If the year is 2020 and you still see this please + * guard this with + * if (boot_cpu_has(X86_FEATURE_MD_CLEAR)) setup_force ... VERW + */ + setup_force_cpu_cap(X86_FEATURE_VERW); + if (cmdline_find_option_bool(boot_command_line, "mds=off")) + setup_clear_cpu_cap(X86_FEATURE_VERW); + /* Nop currently because this is default for now. */ + if (cmdline_find_option_bool(boot_command_line, "mds=full") || + cmdline_find_option_bool(boot_command_line, "mds=auto")) + setup_force_cpu_cap(X86_FEATURE_VERW); +} + #ifdef CONFIG_SYSFS #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion" -- 2.17.2