bugs.c 53.8 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
2 3 4 5 6 7 8 9 10 11 12
/*
 *  Copyright (C) 1994  Linus Torvalds
 *
 *  Cyrix stuff, June 1998 by:
 *	- Rafael R. Reilova (moved everything from head.S),
 *        <rreilova@ececs.uc.edu>
 *	- Channing Corn (tests & fixes),
 *	- Andrew D. Balsa (code cleanup).
 */
#include <linux/init.h>
#include <linux/utsname.h>
13
#include <linux/cpu.h>
14
#include <linux/module.h>
15 16
#include <linux/nospec.h>
#include <linux/prctl.h>
17
#include <linux/sched/smt.h>
18
#include <linux/pgtable.h>
19
#include <linux/bpf.h>
20

21
#include <asm/spec-ctrl.h>
22
#include <asm/cmdline.h>
23
#include <asm/bugs.h>
24
#include <asm/processor.h>
Dave Jones's avatar
Dave Jones committed
25
#include <asm/processor-flags.h>
26
#include <asm/fpu/api.h>
27
#include <asm/msr.h>
28
#include <asm/vmx.h>
29 30
#include <asm/paravirt.h>
#include <asm/alternative.h>
31
#include <asm/set_memory.h>
32
#include <asm/intel-family.h>
33
#include <asm/e820/api.h>
34
#include <asm/hypervisor.h>
35
#include <asm/tlbflush.h>
36

37 38
#include "cpu.h"

39
static void __init spectre_v1_select_mitigation(void);
40
static void __init spectre_v2_select_mitigation(void);
41
static void __init ssb_select_mitigation(void);
42
static void __init l1tf_select_mitigation(void);
43
static void __init mds_select_mitigation(void);
44
static void __init mds_print_mitigation(void);
45
static void __init taa_select_mitigation(void);
46
static void __init srbds_select_mitigation(void);
47
static void __init l1d_flush_select_mitigation(void);
48

49 50
/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
u64 x86_spec_ctrl_base;
51
EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
52
static DEFINE_MUTEX(spec_ctrl_mutex);
53

54 55 56 57
/*
 * The vendor and possibly platform specific bits which can be modified in
 * x86_spec_ctrl_base.
 */
58
static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
59

60 61
/*
 * AMD specific MSR info for Speculative Store Bypass control.
62
 * x86_amd_ls_cfg_ssbd_mask is initialized in identify_boot_cpu().
63 64
 */
u64 __ro_after_init x86_amd_ls_cfg_base;
65
u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
66

67
/* Control conditional STIBP in switch_to() */
68
DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
69 70 71 72
/* Control conditional IBPB in switch_mm() */
DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
/* Control unconditional IBPB in switch_mm() */
DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
73

74 75
/* Control MDS CPU buffer clear before returning to user space */
DEFINE_STATIC_KEY_FALSE(mds_user_clear);
76
EXPORT_SYMBOL_GPL(mds_user_clear);
77 78 79
/* Control MDS CPU buffer clear before idling (halt, mwait) */
DEFINE_STATIC_KEY_FALSE(mds_idle_clear);
EXPORT_SYMBOL_GPL(mds_idle_clear);
80

81 82 83 84 85 86 87
/*
 * Controls whether l1d flush based mitigations are enabled,
 * based on hw features and admin setting via boot parameter
 * defaults to false
 */
DEFINE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);

88 89 90
void __init check_bugs(void)
{
	identify_boot_cpu();
91

92 93 94 95
	/*
	 * identify_boot_cpu() initialized SMT support information, let the
	 * core code know.
	 */
96
	cpu_smt_check_topology();
97

98 99 100 101 102
	if (!IS_ENABLED(CONFIG_SMP)) {
		pr_info("CPU: ");
		print_cpu_info(&boot_cpu_data);
	}

103 104
	/*
	 * Read the SPEC_CTRL MSR to account for reserved bits which may
105 106
	 * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
	 * init code as it is not enumerated and depends on the family.
107
	 */
108
	if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
109 110
		rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);

111 112 113 114
	/* Allow STIBP in MSR_SPEC_CTRL if supported */
	if (boot_cpu_has(X86_FEATURE_STIBP))
		x86_spec_ctrl_mask |= SPEC_CTRL_STIBP;

115 116
	/* Select the proper CPU mitigations before patching alternatives: */
	spectre_v1_select_mitigation();
117
	spectre_v2_select_mitigation();
118
	ssb_select_mitigation();
119
	l1tf_select_mitigation();
120
	mds_select_mitigation();
121
	taa_select_mitigation();
122
	srbds_select_mitigation();
123
	l1d_flush_select_mitigation();
124

125 126 127 128 129 130
	/*
	 * As MDS and TAA mitigations are inter-related, print MDS
	 * mitigation until after TAA mitigation selection is done.
	 */
	mds_print_mitigation();

131 132
	arch_smt_update();

133
#ifdef CONFIG_X86_32
134 135 136 137 138 139 140 141 142 143
	/*
	 * Check whether we are able to run this kernel safely on SMP.
	 *
	 * - i386 is no longer supported.
	 * - In order to run on anything without a TSC, we need to be
	 *   compiled for a i486.
	 */
	if (boot_cpu_data.x86 < 4)
		panic("Kernel requires i486+ for 'invlpg' and other features");

Miklos Vajna's avatar
Miklos Vajna committed
144 145
	init_utsname()->machine[1] =
		'0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
146
	alternative_instructions();
147

148
	fpu__init_check_bugs();
149 150 151 152 153 154 155 156 157 158 159 160 161 162
#else /* CONFIG_X86_64 */
	alternative_instructions();

	/*
	 * Make sure the first 2MB area is not mapped by huge pages
	 * There are typically fixed size MTRRs in there and overlapping
	 * MTRRs into large pages causes slow downs.
	 *
	 * Right now we don't do that with gbpages because there seems
	 * very little benefit for that case.
	 */
	if (!direct_gbpages)
		set_memory_4k((unsigned long)__va(0), 1);
#endif
163
}
164

165 166
void
x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
167
{
168
	u64 msrval, guestval, hostval = x86_spec_ctrl_base;
169
	struct thread_info *ti = current_thread_info();
170

171
	/* Is MSR_SPEC_CTRL implemented ? */
172
	if (static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) {
173 174 175 176 177 178 179 180
		/*
		 * Restrict guest_spec_ctrl to supported values. Clear the
		 * modifiable bits in the host base value and or the
		 * modifiable bits from the guest value.
		 */
		guestval = hostval & ~x86_spec_ctrl_mask;
		guestval |= guest_spec_ctrl & x86_spec_ctrl_mask;

181
		/* SSBD controlled in MSR_SPEC_CTRL */
182 183
		if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
		    static_cpu_has(X86_FEATURE_AMD_SSBD))
184
			hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
185

186 187 188 189
		/* Conditional STIBP enabled? */
		if (static_branch_unlikely(&switch_to_cond_stibp))
			hostval |= stibp_tif_to_spec_ctrl(ti->flags);

190 191 192
		if (hostval != guestval) {
			msrval = setguest ? guestval : hostval;
			wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
193 194
		}
	}
195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222

	/*
	 * If SSBD is not handled in MSR_SPEC_CTRL on AMD, update
	 * MSR_AMD64_L2_CFG or MSR_VIRT_SPEC_CTRL if supported.
	 */
	if (!static_cpu_has(X86_FEATURE_LS_CFG_SSBD) &&
	    !static_cpu_has(X86_FEATURE_VIRT_SSBD))
		return;

	/*
	 * If the host has SSBD mitigation enabled, force it in the host's
	 * virtual MSR value. If its not permanently enabled, evaluate
	 * current's TIF_SSBD thread flag.
	 */
	if (static_cpu_has(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE))
		hostval = SPEC_CTRL_SSBD;
	else
		hostval = ssbd_tif_to_spec_ctrl(ti->flags);

	/* Sanitize the guest value */
	guestval = guest_virt_spec_ctrl & SPEC_CTRL_SSBD;

	if (hostval != guestval) {
		unsigned long tif;

		tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
				 ssbd_spec_ctrl_to_tif(hostval);

223
		speculation_ctrl_update(tif);
224
	}
225
}
226
EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
227

228
static void x86_amd_ssb_disable(void)
229
{
230
	u64 msrval = x86_amd_ls_cfg_base | x86_amd_ls_cfg_ssbd_mask;
231

232 233 234
	if (boot_cpu_has(X86_FEATURE_VIRT_SSBD))
		wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, SPEC_CTRL_SSBD);
	else if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD))
235 236 237
		wrmsrl(MSR_AMD64_LS_CFG, msrval);
}

238 239 240
#undef pr_fmt
#define pr_fmt(fmt)	"MDS: " fmt

241
/* Default mitigation for MDS-affected CPUs */
242
static enum mds_mitigations mds_mitigation __ro_after_init = MDS_MITIGATION_FULL;
243
static bool mds_nosmt __ro_after_init = false;
244 245 246

static const char * const mds_strings[] = {
	[MDS_MITIGATION_OFF]	= "Vulnerable",
247 248
	[MDS_MITIGATION_FULL]	= "Mitigation: Clear CPU buffers",
	[MDS_MITIGATION_VMWERV]	= "Vulnerable: Clear CPU buffers attempted, no microcode",
249 250 251 252
};

static void __init mds_select_mitigation(void)
{
253
	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
254 255 256 257 258
		mds_mitigation = MDS_MITIGATION_OFF;
		return;
	}

	if (mds_mitigation == MDS_MITIGATION_FULL) {
259 260
		if (!boot_cpu_has(X86_FEATURE_MD_CLEAR))
			mds_mitigation = MDS_MITIGATION_VMWERV;
261

262
		static_branch_enable(&mds_user_clear);
263

264 265
		if (!boot_cpu_has(X86_BUG_MSBDS_ONLY) &&
		    (mds_nosmt || cpu_mitigations_auto_nosmt()))
266
			cpu_smt_disable(false);
267
	}
268 269 270 271 272 273
}

static void __init mds_print_mitigation(void)
{
	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
		return;
274

275 276 277 278 279 280 281 282 283 284 285 286 287 288 289
	pr_info("%s\n", mds_strings[mds_mitigation]);
}

static int __init mds_cmdline(char *str)
{
	if (!boot_cpu_has_bug(X86_BUG_MDS))
		return 0;

	if (!str)
		return -EINVAL;

	if (!strcmp(str, "off"))
		mds_mitigation = MDS_MITIGATION_OFF;
	else if (!strcmp(str, "full"))
		mds_mitigation = MDS_MITIGATION_FULL;
290 291 292 293
	else if (!strcmp(str, "full,nosmt")) {
		mds_mitigation = MDS_MITIGATION_FULL;
		mds_nosmt = true;
	}
294 295 296 297 298

	return 0;
}
early_param("mds", mds_cmdline);

299 300 301
#undef pr_fmt
#define pr_fmt(fmt)	"TAA: " fmt

302 303 304 305 306 307 308
enum taa_mitigations {
	TAA_MITIGATION_OFF,
	TAA_MITIGATION_UCODE_NEEDED,
	TAA_MITIGATION_VERW,
	TAA_MITIGATION_TSX_DISABLED,
};

309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
/* Default mitigation for TAA-affected CPUs */
static enum taa_mitigations taa_mitigation __ro_after_init = TAA_MITIGATION_VERW;
static bool taa_nosmt __ro_after_init;

static const char * const taa_strings[] = {
	[TAA_MITIGATION_OFF]		= "Vulnerable",
	[TAA_MITIGATION_UCODE_NEEDED]	= "Vulnerable: Clear CPU buffers attempted, no microcode",
	[TAA_MITIGATION_VERW]		= "Mitigation: Clear CPU buffers",
	[TAA_MITIGATION_TSX_DISABLED]	= "Mitigation: TSX disabled",
};

static void __init taa_select_mitigation(void)
{
	u64 ia32_cap;

	if (!boot_cpu_has_bug(X86_BUG_TAA)) {
		taa_mitigation = TAA_MITIGATION_OFF;
		return;
	}

	/* TSX previously disabled by tsx=off */
	if (!boot_cpu_has(X86_FEATURE_RTM)) {
		taa_mitigation = TAA_MITIGATION_TSX_DISABLED;
		goto out;
	}

	if (cpu_mitigations_off()) {
		taa_mitigation = TAA_MITIGATION_OFF;
		return;
	}

340 341 342 343 344 345
	/*
	 * TAA mitigation via VERW is turned off if both
	 * tsx_async_abort=off and mds=off are specified.
	 */
	if (taa_mitigation == TAA_MITIGATION_OFF &&
	    mds_mitigation == MDS_MITIGATION_OFF)
346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378
		goto out;

	if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
		taa_mitigation = TAA_MITIGATION_VERW;
	else
		taa_mitigation = TAA_MITIGATION_UCODE_NEEDED;

	/*
	 * VERW doesn't clear the CPU buffers when MD_CLEAR=1 and MDS_NO=1.
	 * A microcode update fixes this behavior to clear CPU buffers. It also
	 * adds support for MSR_IA32_TSX_CTRL which is enumerated by the
	 * ARCH_CAP_TSX_CTRL_MSR bit.
	 *
	 * On MDS_NO=1 CPUs if ARCH_CAP_TSX_CTRL_MSR is not set, microcode
	 * update is required.
	 */
	ia32_cap = x86_read_arch_cap_msr();
	if ( (ia32_cap & ARCH_CAP_MDS_NO) &&
	    !(ia32_cap & ARCH_CAP_TSX_CTRL_MSR))
		taa_mitigation = TAA_MITIGATION_UCODE_NEEDED;

	/*
	 * TSX is enabled, select alternate mitigation for TAA which is
	 * the same as MDS. Enable MDS static branch to clear CPU buffers.
	 *
	 * For guests that can't determine whether the correct microcode is
	 * present on host, enable the mitigation for UCODE_NEEDED as well.
	 */
	static_branch_enable(&mds_user_clear);

	if (taa_nosmt || cpu_mitigations_auto_nosmt())
		cpu_smt_disable(false);

379 380 381 382 383 384 385 386 387
	/*
	 * Update MDS mitigation, if necessary, as the mds_user_clear is
	 * now enabled for TAA mitigation.
	 */
	if (mds_mitigation == MDS_MITIGATION_OFF &&
	    boot_cpu_has_bug(X86_BUG_MDS)) {
		mds_mitigation = MDS_MITIGATION_FULL;
		mds_select_mitigation();
	}
388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
out:
	pr_info("%s\n", taa_strings[taa_mitigation]);
}

static int __init tsx_async_abort_parse_cmdline(char *str)
{
	if (!boot_cpu_has_bug(X86_BUG_TAA))
		return 0;

	if (!str)
		return -EINVAL;

	if (!strcmp(str, "off")) {
		taa_mitigation = TAA_MITIGATION_OFF;
	} else if (!strcmp(str, "full")) {
		taa_mitigation = TAA_MITIGATION_VERW;
	} else if (!strcmp(str, "full,nosmt")) {
		taa_mitigation = TAA_MITIGATION_VERW;
		taa_nosmt = true;
	}

	return 0;
}
early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);

413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
#undef pr_fmt
#define pr_fmt(fmt)	"SRBDS: " fmt

enum srbds_mitigations {
	SRBDS_MITIGATION_OFF,
	SRBDS_MITIGATION_UCODE_NEEDED,
	SRBDS_MITIGATION_FULL,
	SRBDS_MITIGATION_TSX_OFF,
	SRBDS_MITIGATION_HYPERVISOR,
};

static enum srbds_mitigations srbds_mitigation __ro_after_init = SRBDS_MITIGATION_FULL;

static const char * const srbds_strings[] = {
	[SRBDS_MITIGATION_OFF]		= "Vulnerable",
	[SRBDS_MITIGATION_UCODE_NEEDED]	= "Vulnerable: No microcode",
	[SRBDS_MITIGATION_FULL]		= "Mitigation: Microcode",
	[SRBDS_MITIGATION_TSX_OFF]	= "Mitigation: TSX disabled",
	[SRBDS_MITIGATION_HYPERVISOR]	= "Unknown: Dependent on hypervisor status",
};

static bool srbds_off;

void update_srbds_msr(void)
{
	u64 mcu_ctrl;

	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
		return;

	if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
		return;

	if (srbds_mitigation == SRBDS_MITIGATION_UCODE_NEEDED)
		return;

449 450 451 452 453 454 455
	/*
	 * A MDS_NO CPU for which SRBDS mitigation is not needed due to TSX
	 * being disabled and it hasn't received the SRBDS MSR microcode.
	 */
	if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL))
		return;

456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510
	rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);

	switch (srbds_mitigation) {
	case SRBDS_MITIGATION_OFF:
	case SRBDS_MITIGATION_TSX_OFF:
		mcu_ctrl |= RNGDS_MITG_DIS;
		break;
	case SRBDS_MITIGATION_FULL:
		mcu_ctrl &= ~RNGDS_MITG_DIS;
		break;
	default:
		break;
	}

	wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
}

static void __init srbds_select_mitigation(void)
{
	u64 ia32_cap;

	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
		return;

	/*
	 * Check to see if this is one of the MDS_NO systems supporting
	 * TSX that are only exposed to SRBDS when TSX is enabled.
	 */
	ia32_cap = x86_read_arch_cap_msr();
	if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM))
		srbds_mitigation = SRBDS_MITIGATION_TSX_OFF;
	else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
		srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR;
	else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL))
		srbds_mitigation = SRBDS_MITIGATION_UCODE_NEEDED;
	else if (cpu_mitigations_off() || srbds_off)
		srbds_mitigation = SRBDS_MITIGATION_OFF;

	update_srbds_msr();
	pr_info("%s\n", srbds_strings[srbds_mitigation]);
}

static int __init srbds_parse_cmdline(char *str)
{
	if (!str)
		return -EINVAL;

	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
		return 0;

	srbds_off = !strcmp(str, "off");
	return 0;
}
early_param("srbds", srbds_parse_cmdline);

511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538
#undef pr_fmt
#define pr_fmt(fmt)     "L1D Flush : " fmt

enum l1d_flush_mitigations {
	L1D_FLUSH_OFF = 0,
	L1D_FLUSH_ON,
};

static enum l1d_flush_mitigations l1d_flush_mitigation __initdata = L1D_FLUSH_OFF;

static void __init l1d_flush_select_mitigation(void)
{
	if (!l1d_flush_mitigation || !boot_cpu_has(X86_FEATURE_FLUSH_L1D))
		return;

	static_branch_enable(&switch_mm_cond_l1d_flush);
	pr_info("Conditional flush on switch_mm() enabled\n");
}

static int __init l1d_flush_parse_cmdline(char *str)
{
	if (!strcmp(str, "on"))
		l1d_flush_mitigation = L1D_FLUSH_ON;

	return 0;
}
early_param("l1d_flush", l1d_flush_parse_cmdline);

539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595
#undef pr_fmt
#define pr_fmt(fmt)     "Spectre V1 : " fmt

enum spectre_v1_mitigation {
	SPECTRE_V1_MITIGATION_NONE,
	SPECTRE_V1_MITIGATION_AUTO,
};

static enum spectre_v1_mitigation spectre_v1_mitigation __ro_after_init =
	SPECTRE_V1_MITIGATION_AUTO;

static const char * const spectre_v1_strings[] = {
	[SPECTRE_V1_MITIGATION_NONE] = "Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers",
	[SPECTRE_V1_MITIGATION_AUTO] = "Mitigation: usercopy/swapgs barriers and __user pointer sanitization",
};

/*
 * Does SMAP provide full mitigation against speculative kernel access to
 * userspace?
 */
static bool smap_works_speculatively(void)
{
	if (!boot_cpu_has(X86_FEATURE_SMAP))
		return false;

	/*
	 * On CPUs which are vulnerable to Meltdown, SMAP does not
	 * prevent speculative access to user data in the L1 cache.
	 * Consider SMAP to be non-functional as a mitigation on these
	 * CPUs.
	 */
	if (boot_cpu_has(X86_BUG_CPU_MELTDOWN))
		return false;

	return true;
}

static void __init spectre_v1_select_mitigation(void)
{
	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1) || cpu_mitigations_off()) {
		spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
		return;
	}

	if (spectre_v1_mitigation == SPECTRE_V1_MITIGATION_AUTO) {
		/*
		 * With Spectre v1, a user can speculatively control either
		 * path of a conditional swapgs with a user-controlled GS
		 * value.  The mitigation is to add lfences to both code paths.
		 *
		 * If FSGSBASE is enabled, the user can put a kernel address in
		 * GS, in which case SMAP provides no protection.
		 *
		 * If FSGSBASE is disabled, the user can only put a user space
		 * address in GS.  That makes an attack harder, but still
		 * possible if there's no SMAP protection.
		 */
596 597
		if (boot_cpu_has(X86_FEATURE_FSGSBASE) ||
		    !smap_works_speculatively()) {
598 599 600 601 602
			/*
			 * Mitigation can be provided from SWAPGS itself or
			 * PTI as the CR3 write in the Meltdown mitigation
			 * is serializing.
			 *
603 604
			 * If neither is there, mitigate with an LFENCE to
			 * stop speculation through swapgs.
605
			 */
606 607
			if (boot_cpu_has_bug(X86_BUG_SWAPGS) &&
			    !boot_cpu_has(X86_FEATURE_PTI))
608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628
				setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_USER);

			/*
			 * Enable lfences in the kernel entry (non-swapgs)
			 * paths, to prevent user entry from speculatively
			 * skipping swapgs.
			 */
			setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_KERNEL);
		}
	}

	pr_info("%s\n", spectre_v1_strings[spectre_v1_mitigation]);
}

static int __init nospectre_v1_cmdline(char *str)
{
	spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
	return 0;
}
early_param("nospectre_v1", nospectre_v1_cmdline);

629 630 631 632 633 634
#undef pr_fmt
#define pr_fmt(fmt)     "Spectre V2 : " fmt

static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
	SPECTRE_V2_NONE;

635 636 637
static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =
	SPECTRE_V2_USER_NONE;
static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =
638 639
	SPECTRE_V2_USER_NONE;

640
#ifdef CONFIG_RETPOLINE
641 642
static bool spectre_v2_bad_module;

643 644 645 646 647
bool retpoline_module_ok(bool has_retpoline)
{
	if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
		return true;

648
	pr_err("System may be vulnerable to spectre v2\n");
649 650 651
	spectre_v2_bad_module = true;
	return false;
}
652 653 654 655 656 657 658

static inline const char *spectre_v2_module_string(void)
{
	return spectre_v2_bad_module ? " - vulnerable module loaded" : "";
}
#else
static inline const char *spectre_v2_module_string(void) { return ""; }
659
#endif
660

661
#define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n"
662
#define SPECTRE_V2_EIBRS_EBPF_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!\n"
663
#define SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS+LFENCE mitigation and SMT, data leaks possible via Spectre v2 BHB attacks!\n"
664 665 666 667

#ifdef CONFIG_BPF_SYSCALL
void unpriv_ebpf_notify(int new_state)
{
668 669 670 671 672 673 674
	if (new_state)
		return;

	/* Unprivileged eBPF is enabled */

	switch (spectre_v2_enabled) {
	case SPECTRE_V2_EIBRS:
675
		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
676 677 678 679 680 681 682 683
		break;
	case SPECTRE_V2_EIBRS_LFENCE:
		if (sched_smt_active())
			pr_err(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);
		break;
	default:
		break;
	}
684 685 686
}
#endif

687 688 689 690 691 692 693
static inline bool match_option(const char *arg, int arglen, const char *opt)
{
	int len = strlen(opt);

	return len == arglen && !strncmp(arg, opt, len);
}

694 695 696 697 698 699 700
/* The kernel command line selection for spectre v2 */
enum spectre_v2_mitigation_cmd {
	SPECTRE_V2_CMD_NONE,
	SPECTRE_V2_CMD_AUTO,
	SPECTRE_V2_CMD_FORCE,
	SPECTRE_V2_CMD_RETPOLINE,
	SPECTRE_V2_CMD_RETPOLINE_GENERIC,
701
	SPECTRE_V2_CMD_RETPOLINE_LFENCE,
702 703 704
	SPECTRE_V2_CMD_EIBRS,
	SPECTRE_V2_CMD_EIBRS_RETPOLINE,
	SPECTRE_V2_CMD_EIBRS_LFENCE,
705 706
};

707 708 709 710
enum spectre_v2_user_cmd {
	SPECTRE_V2_USER_CMD_NONE,
	SPECTRE_V2_USER_CMD_AUTO,
	SPECTRE_V2_USER_CMD_FORCE,
711
	SPECTRE_V2_USER_CMD_PRCTL,
712
	SPECTRE_V2_USER_CMD_PRCTL_IBPB,
713
	SPECTRE_V2_USER_CMD_SECCOMP,
714
	SPECTRE_V2_USER_CMD_SECCOMP_IBPB,
715 716 717
};

static const char * const spectre_v2_user_strings[] = {
718 719 720 721 722
	[SPECTRE_V2_USER_NONE]			= "User space: Vulnerable",
	[SPECTRE_V2_USER_STRICT]		= "User space: Mitigation: STIBP protection",
	[SPECTRE_V2_USER_STRICT_PREFERRED]	= "User space: Mitigation: STIBP always-on protection",
	[SPECTRE_V2_USER_PRCTL]			= "User space: Mitigation: STIBP via prctl",
	[SPECTRE_V2_USER_SECCOMP]		= "User space: Mitigation: STIBP via seccomp and prctl",
723 724 725 726 727 728
};

static const struct {
	const char			*option;
	enum spectre_v2_user_cmd	cmd;
	bool				secure;
729
} v2_user_options[] __initconst = {
730 731 732 733 734 735 736
	{ "auto",		SPECTRE_V2_USER_CMD_AUTO,		false },
	{ "off",		SPECTRE_V2_USER_CMD_NONE,		false },
	{ "on",			SPECTRE_V2_USER_CMD_FORCE,		true  },
	{ "prctl",		SPECTRE_V2_USER_CMD_PRCTL,		false },
	{ "prctl,ibpb",		SPECTRE_V2_USER_CMD_PRCTL_IBPB,		false },
	{ "seccomp",		SPECTRE_V2_USER_CMD_SECCOMP,		false },
	{ "seccomp,ibpb",	SPECTRE_V2_USER_CMD_SECCOMP_IBPB,	false },
737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776
};

static void __init spec_v2_user_print_cond(const char *reason, bool secure)
{
	if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
		pr_info("spectre_v2_user=%s forced on command line.\n", reason);
}

static enum spectre_v2_user_cmd __init
spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
{
	char arg[20];
	int ret, i;

	switch (v2_cmd) {
	case SPECTRE_V2_CMD_NONE:
		return SPECTRE_V2_USER_CMD_NONE;
	case SPECTRE_V2_CMD_FORCE:
		return SPECTRE_V2_USER_CMD_FORCE;
	default:
		break;
	}

	ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
				  arg, sizeof(arg));
	if (ret < 0)
		return SPECTRE_V2_USER_CMD_AUTO;

	for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
		if (match_option(arg, ret, v2_user_options[i].option)) {
			spec_v2_user_print_cond(v2_user_options[i].option,
						v2_user_options[i].secure);
			return v2_user_options[i].cmd;
		}
	}

	pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
	return SPECTRE_V2_USER_CMD_AUTO;
}

777 778 779 780 781 782 783
static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
{
	return (mode == SPECTRE_V2_EIBRS ||
		mode == SPECTRE_V2_EIBRS_RETPOLINE ||
		mode == SPECTRE_V2_EIBRS_LFENCE);
}

784 785 786 787 788
static void __init
spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
{
	enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
	bool smt_possible = IS_ENABLED(CONFIG_SMP);
789
	enum spectre_v2_user_cmd cmd;
790 791 792 793 794 795 796 797

	if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
		return;

	if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
	    cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
		smt_possible = false;

798 799
	cmd = spectre_v2_parse_user_cmdline(v2_cmd);
	switch (cmd) {
800 801 802 803 804
	case SPECTRE_V2_USER_CMD_NONE:
		goto set_mode;
	case SPECTRE_V2_USER_CMD_FORCE:
		mode = SPECTRE_V2_USER_STRICT;
		break;
805
	case SPECTRE_V2_USER_CMD_AUTO:
806
	case SPECTRE_V2_USER_CMD_PRCTL:
807
	case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
808 809
		mode = SPECTRE_V2_USER_PRCTL;
		break;
810
	case SPECTRE_V2_USER_CMD_SECCOMP:
811
	case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
812 813 814 815 816
		if (IS_ENABLED(CONFIG_SECCOMP))
			mode = SPECTRE_V2_USER_SECCOMP;
		else
			mode = SPECTRE_V2_USER_PRCTL;
		break;
817 818 819 820 821
	}

	/* Initialize Indirect Branch Prediction Barrier */
	if (boot_cpu_has(X86_FEATURE_IBPB)) {
		setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
822

823
		spectre_v2_user_ibpb = mode;
824 825 826 827
		switch (cmd) {
		case SPECTRE_V2_USER_CMD_FORCE:
		case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
		case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
828
			static_branch_enable(&switch_mm_always_ibpb);
829
			spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
830
			break;
831 832 833
		case SPECTRE_V2_USER_CMD_PRCTL:
		case SPECTRE_V2_USER_CMD_AUTO:
		case SPECTRE_V2_USER_CMD_SECCOMP:
834 835
			static_branch_enable(&switch_mm_cond_ibpb);
			break;
836 837 838 839 840
		default:
			break;
		}

		pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
841 842
			static_key_enabled(&switch_mm_always_ibpb) ?
			"always-on" : "conditional");
843 844
	}

845
	/*
846
	 * If no STIBP, enhanced IBRS is enabled or SMT impossible, STIBP is not
847 848
	 * required.
	 */
849 850
	if (!boot_cpu_has(X86_FEATURE_STIBP) ||
	    !smt_possible ||
851
	    spectre_v2_in_eibrs_mode(spectre_v2_enabled))
852 853
		return;

854
	/*
855 856 857
	 * At this point, an STIBP mode other than "off" has been set.
	 * If STIBP support is not being forced, check if STIBP always-on
	 * is preferred.
858
	 */
859 860 861 862 863 864
	if (mode != SPECTRE_V2_USER_STRICT &&
	    boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
		mode = SPECTRE_V2_USER_STRICT_PREFERRED;

	spectre_v2_user_stibp = mode;

865
set_mode:
866
	pr_info("%s\n", spectre_v2_user_strings[mode]);
867 868
}

869
static const char * const spectre_v2_strings[] = {
870
	[SPECTRE_V2_NONE]			= "Vulnerable",
871 872
	[SPECTRE_V2_RETPOLINE]			= "Mitigation: Retpolines",
	[SPECTRE_V2_LFENCE]			= "Mitigation: LFENCE",
873 874 875
	[SPECTRE_V2_EIBRS]			= "Mitigation: Enhanced IBRS",
	[SPECTRE_V2_EIBRS_LFENCE]		= "Mitigation: Enhanced IBRS + LFENCE",
	[SPECTRE_V2_EIBRS_RETPOLINE]		= "Mitigation: Enhanced IBRS + Retpolines",
876 877
};

878 879 880 881
static const struct {
	const char *option;
	enum spectre_v2_mitigation_cmd cmd;
	bool secure;
882
} mitigation_options[] __initconst = {
883 884 885
	{ "off",		SPECTRE_V2_CMD_NONE,		  false },
	{ "on",			SPECTRE_V2_CMD_FORCE,		  true  },
	{ "retpoline",		SPECTRE_V2_CMD_RETPOLINE,	  false },
886 887
	{ "retpoline,amd",	SPECTRE_V2_CMD_RETPOLINE_LFENCE,  false },
	{ "retpoline,lfence",	SPECTRE_V2_CMD_RETPOLINE_LFENCE,  false },
888
	{ "retpoline,generic",	SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
889 890 891
	{ "eibrs",		SPECTRE_V2_CMD_EIBRS,		  false },
	{ "eibrs,lfence",	SPECTRE_V2_CMD_EIBRS_LFENCE,	  false },
	{ "eibrs,retpoline",	SPECTRE_V2_CMD_EIBRS_RETPOLINE,	  false },
892
	{ "auto",		SPECTRE_V2_CMD_AUTO,		  false },
893 894
};

895
static void __init spec_v2_print_cond(const char *reason, bool secure)
896
{
897
	if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
898 899 900
		pr_info("%s selected on command line.\n", reason);
}

901 902
static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
{
903
	enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
904
	char arg[20];
905 906
	int ret, i;

907 908
	if (cmdline_find_option_bool(boot_command_line, "nospectre_v2") ||
	    cpu_mitigations_off())
909 910
		return SPECTRE_V2_CMD_NONE;

911 912 913 914 915 916 917 918 919 920 921 922 923 924
	ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
	if (ret < 0)
		return SPECTRE_V2_CMD_AUTO;

	for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
		if (!match_option(arg, ret, mitigation_options[i].option))
			continue;
		cmd = mitigation_options[i].cmd;
		break;
	}

	if (i >= ARRAY_SIZE(mitigation_options)) {
		pr_err("unknown option (%s). Switching to AUTO select\n", arg);
		return SPECTRE_V2_CMD_AUTO;
925 926
	}

927
	if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
928
	     cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE ||
929 930 931
	     cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC ||
	     cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
	     cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
932
	    !IS_ENABLED(CONFIG_RETPOLINE)) {
933 934 935 936 937 938 939 940 941 942 943
		pr_err("%s selected but not compiled in. Switching to AUTO select\n",
		       mitigation_options[i].option);
		return SPECTRE_V2_CMD_AUTO;
	}

	if ((cmd == SPECTRE_V2_CMD_EIBRS ||
	     cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
	     cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
	    !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
		pr_err("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n",
		       mitigation_options[i].option);
944
		return SPECTRE_V2_CMD_AUTO;
945 946
	}

947 948
	if ((cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE ||
	     cmd == SPECTRE_V2_CMD_EIBRS_LFENCE) &&
949
	    !boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
950 951
		pr_err("%s selected, but CPU doesn't have a serializing LFENCE. Switching to AUTO select\n",
		       mitigation_options[i].option);
952 953 954
		return SPECTRE_V2_CMD_AUTO;
	}

955 956
	spec_v2_print_cond(mitigation_options[i].option,
			   mitigation_options[i].secure);
957
	return cmd;
958 959
}

960 961 962 963 964 965 966 967 968 969
static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
{
	if (!IS_ENABLED(CONFIG_RETPOLINE)) {
		pr_err("Kernel not compiled with retpoline; no mitigation available!");
		return SPECTRE_V2_NONE;
	}

	return SPECTRE_V2_RETPOLINE;
}

970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988
static void __init spectre_v2_select_mitigation(void)
{
	enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
	enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;

	/*
	 * If the CPU is not affected and the command line mode is NONE or AUTO
	 * then nothing to do.
	 */
	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
	    (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
		return;

	switch (cmd) {
	case SPECTRE_V2_CMD_NONE:
		return;

	case SPECTRE_V2_CMD_FORCE:
	case SPECTRE_V2_CMD_AUTO:
989
		if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
990 991
			mode = SPECTRE_V2_EIBRS;
			break;
992
		}
993 994

		mode = spectre_v2_select_retpoline();
995
		break;
996

997
	case SPECTRE_V2_CMD_RETPOLINE_LFENCE:
998
		pr_err(SPECTRE_V2_LFENCE_MSG);
999
		mode = SPECTRE_V2_LFENCE;
1000
		break;
1001

1002
	case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
1003
		mode = SPECTRE_V2_RETPOLINE;
1004
		break;
1005

1006
	case SPECTRE_V2_CMD_RETPOLINE:
1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019
		mode = spectre_v2_select_retpoline();
		break;

	case SPECTRE_V2_CMD_EIBRS:
		mode = SPECTRE_V2_EIBRS;
		break;

	case SPECTRE_V2_CMD_EIBRS_LFENCE:
		mode = SPECTRE_V2_EIBRS_LFENCE;
		break;

	case SPECTRE_V2_CMD_EIBRS_RETPOLINE:
		mode = SPECTRE_V2_EIBRS_RETPOLINE;
1020 1021 1022
		break;
	}

1023 1024 1025
	if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);

1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038
	if (spectre_v2_in_eibrs_mode(mode)) {
		/* Force it so VMEXIT will restore correctly */
		x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
		wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
	}

	switch (mode) {
	case SPECTRE_V2_NONE:
	case SPECTRE_V2_EIBRS:
		break;

	case SPECTRE_V2_LFENCE:
	case SPECTRE_V2_EIBRS_LFENCE:
1039
		setup_force_cpu_cap(X86_FEATURE_RETPOLINE_LFENCE);
1040 1041 1042 1043
		fallthrough;

	case SPECTRE_V2_RETPOLINE:
	case SPECTRE_V2_EIBRS_RETPOLINE:
1044
		setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
1045
		break;
1046 1047 1048 1049
	}

	spectre_v2_enabled = mode;
	pr_info("%s\n", spectre_v2_strings[mode]);
1050 1051

	/*
1052 1053 1054
	 * If spectre v2 protection has been enabled, unconditionally fill
	 * RSB during a context switch; this protects against two independent
	 * issues:
1055
	 *
1056 1057
	 *	- RSB underflow (and switch to BTB) on Skylake+
	 *	- SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
1058
	 */
1059 1060
	setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
	pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
1061

1062 1063
	/*
	 * Retpoline means the kernel is safe because it has no indirect
1064 1065 1066 1067 1068 1069 1070 1071
	 * branches. Enhanced IBRS protects firmware too, so, enable restricted
	 * speculation around firmware calls only when Enhanced IBRS isn't
	 * supported.
	 *
	 * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
	 * the user might select retpoline on the kernel command line and if
	 * the CPU supports Enhanced IBRS, kernel might un-intentionally not
	 * enable IBRS around firmware calls.
1072
	 */
1073
	if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_eibrs_mode(mode)) {
1074 1075 1076
		setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
		pr_info("Enabling Restricted Speculation for firmware calls\n");
	}
1077

1078 1079
	/* Set up IBPB and STIBP depending on the general spectre V2 command */
	spectre_v2_user_select_mitigation(cmd);
1080 1081
}

1082
static void update_stibp_msr(void * __unused)
1083
{
1084
	wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
1085 1086
}

1087 1088
/* Update x86_spec_ctrl_base in case SMT state changed. */
static void update_stibp_strict(void)
1089
{
1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101
	u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;

	if (sched_smt_active())
		mask |= SPEC_CTRL_STIBP;

	if (mask == x86_spec_ctrl_base)
		return;

	pr_info("Update user space SMT mitigation: STIBP %s\n",
		mask & SPEC_CTRL_STIBP ? "always-on" : "off");
	x86_spec_ctrl_base = mask;
	on_each_cpu(update_stibp_msr, NULL, 1);
1102 1103
}

1104 1105 1106 1107 1108 1109 1110 1111 1112
/* Update the static key controlling the evaluation of TIF_SPEC_IB */
static void update_indir_branch_cond(void)
{
	if (sched_smt_active())
		static_branch_enable(&switch_to_cond_stibp);
	else
		static_branch_disable(&switch_to_cond_stibp);
}

1113 1114 1115
#undef pr_fmt
#define pr_fmt(fmt) fmt

1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
/* Update the static key controlling the MDS CPU buffer clear in idle */
static void update_mds_branch_idle(void)
{
	/*
	 * Enable the idle clearing if SMT is active on CPUs which are
	 * affected only by MSBDS and not any other MDS variant.
	 *
	 * The other variants cannot be mitigated when SMT is enabled, so
	 * clearing the buffers on idle just to prevent the Store Buffer
	 * repartitioning leak would be a window dressing exercise.
	 */
	if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
		return;

	if (sched_smt_active())
		static_branch_enable(&mds_idle_clear);
	else
		static_branch_disable(&mds_idle_clear);
}

1136
#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
1137
#define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
1138

1139
void cpu_bugs_smt_update(void)
1140 1141 1142
{
	mutex_lock(&spec_ctrl_mutex);

1143 1144 1145 1146
	if (sched_smt_active() && unprivileged_ebpf_enabled() &&
	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
		pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);

1147
	switch (spectre_v2_user_stibp) {
1148 1149 1150
	case SPECTRE_V2_USER_NONE:
		break;
	case SPECTRE_V2_USER_STRICT:
1151
	case SPECTRE_V2_USER_STRICT_PREFERRED:
1152 1153
		update_stibp_strict();
		break;
1154
	case SPECTRE_V2_USER_PRCTL:
1155
	case SPECTRE_V2_USER_SECCOMP:
1156
		update_indir_branch_cond();
1157
		break;
1158
	}
1159

1160 1161 1162
	switch (mds_mitigation) {
	case MDS_MITIGATION_FULL:
	case MDS_MITIGATION_VMWERV:
1163 1164
		if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
			pr_warn_once(MDS_MSG_SMT);
1165
		update_mds_branch_idle();
1166 1167 1168 1169
		break;
	case MDS_MITIGATION_OFF:
		break;
	}
1170

1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181
	switch (taa_mitigation) {
	case TAA_MITIGATION_VERW:
	case TAA_MITIGATION_UCODE_NEEDED:
		if (sched_smt_active())
			pr_warn_once(TAA_MSG_SMT);
		break;
	case TAA_MITIGATION_TSX_DISABLED:
	case TAA_MITIGATION_OFF:
		break;
	}

1182 1183 1184
	mutex_unlock(&spec_ctrl_mutex);
}

1185 1186 1187
#undef pr_fmt
#define pr_fmt(fmt)	"Speculative Store Bypass: " fmt

1188
static enum ssb_mitigation ssb_mode __ro_after_init = SPEC_STORE_BYPASS_NONE;
1189 1190 1191 1192 1193 1194

/* The kernel command line selection */
enum ssb_mitigation_cmd {
	SPEC_STORE_BYPASS_CMD_NONE,
	SPEC_STORE_BYPASS_CMD_AUTO,
	SPEC_STORE_BYPASS_CMD_ON,
1195
	SPEC_STORE_BYPASS_CMD_PRCTL,
1196
	SPEC_STORE_BYPASS_CMD_SECCOMP,
1197 1198
};

1199
static const char * const ssb_strings[] = {
1200
	[SPEC_STORE_BYPASS_NONE]	= "Vulnerable",
1201
	[SPEC_STORE_BYPASS_DISABLE]	= "Mitigation: Speculative Store Bypass disabled",
1202 1203
	[SPEC_STORE_BYPASS_PRCTL]	= "Mitigation: Speculative Store Bypass disabled via prctl",
	[SPEC_STORE_BYPASS_SECCOMP]	= "Mitigation: Speculative Store Bypass disabled via prctl and seccomp",
1204 1205 1206 1207 1208
};

static const struct {
	const char *option;
	enum ssb_mitigation_cmd cmd;
1209
} ssb_mitigation_options[]  __initconst = {
1210 1211 1212 1213 1214
	{ "auto",	SPEC_STORE_BYPASS_CMD_AUTO },    /* Platform decides */
	{ "on",		SPEC_STORE_BYPASS_CMD_ON },      /* Disable Speculative Store Bypass */
	{ "off",	SPEC_STORE_BYPASS_CMD_NONE },    /* Don't touch Speculative Store Bypass */
	{ "prctl",	SPEC_STORE_BYPASS_CMD_PRCTL },   /* Disable Speculative Store Bypass via prctl */
	{ "seccomp",	SPEC_STORE_BYPASS_CMD_SECCOMP }, /* Disable Speculative Store Bypass via prctl and seccomp */
1215 1216 1217 1218 1219 1220 1221 1222
};

static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)
{
	enum ssb_mitigation_cmd cmd = SPEC_STORE_BYPASS_CMD_AUTO;
	char arg[20];
	int ret, i;

1223 1224
	if (cmdline_find_option_bool(boot_command_line, "nospec_store_bypass_disable") ||
	    cpu_mitigations_off()) {
1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248
		return SPEC_STORE_BYPASS_CMD_NONE;
	} else {
		ret = cmdline_find_option(boot_command_line, "spec_store_bypass_disable",
					  arg, sizeof(arg));
		if (ret < 0)
			return SPEC_STORE_BYPASS_CMD_AUTO;

		for (i = 0; i < ARRAY_SIZE(ssb_mitigation_options); i++) {
			if (!match_option(arg, ret, ssb_mitigation_options[i].option))
				continue;

			cmd = ssb_mitigation_options[i].cmd;
			break;
		}

		if (i >= ARRAY_SIZE(ssb_mitigation_options)) {
			pr_err("unknown option (%s). Switching to AUTO select\n", arg);
			return SPEC_STORE_BYPASS_CMD_AUTO;
		}
	}

	return cmd;
}

1249
static enum ssb_mitigation __init __ssb_select_mitigation(void)
1250 1251 1252 1253
{
	enum ssb_mitigation mode = SPEC_STORE_BYPASS_NONE;
	enum ssb_mitigation_cmd cmd;

1254
	if (!boot_cpu_has(X86_FEATURE_SSBD))
1255 1256 1257 1258 1259 1260 1261 1262 1263
		return mode;

	cmd = ssb_parse_cmdline();
	if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS) &&
	    (cmd == SPEC_STORE_BYPASS_CMD_NONE ||
	     cmd == SPEC_STORE_BYPASS_CMD_AUTO))
		return mode;

	switch (cmd) {
1264 1265 1266 1267 1268 1269 1270 1271 1272
	case SPEC_STORE_BYPASS_CMD_SECCOMP:
		/*
		 * Choose prctl+seccomp as the default mode if seccomp is
		 * enabled.
		 */
		if (IS_ENABLED(CONFIG_SECCOMP))
			mode = SPEC_STORE_BYPASS_SECCOMP;
		else
			mode = SPEC_STORE_BYPASS_PRCTL;
1273
		break;
1274 1275 1276
	case SPEC_STORE_BYPASS_CMD_ON:
		mode = SPEC_STORE_BYPASS_DISABLE;
		break;
1277
	case SPEC_STORE_BYPASS_CMD_AUTO:
1278 1279 1280
	case SPEC_STORE_BYPASS_CMD_PRCTL:
		mode = SPEC_STORE_BYPASS_PRCTL;
		break;
1281 1282 1283 1284
	case SPEC_STORE_BYPASS_CMD_NONE:
		break;
	}

1285 1286 1287 1288 1289 1290 1291 1292 1293 1294
	/*
	 * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper
	 * bit in the mask to allow guests to use the mitigation even in the
	 * case where the host does not enable it.
	 */
	if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
	    static_cpu_has(X86_FEATURE_AMD_SSBD)) {
		x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
	}

1295 1296 1297
	/*
	 * We have three CPU feature flags that are in play here:
	 *  - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible.
1298
	 *  - X86_FEATURE_SSBD - CPU is able to turn off speculative store bypass
1299 1300
	 *  - X86_FEATURE_SPEC_STORE_BYPASS_DISABLE - engage the mitigation
	 */
1301
	if (mode == SPEC_STORE_BYPASS_DISABLE) {
1302
		setup_force_cpu_cap(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE);
1303
		/*
1304 1305
		 * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD may
		 * use a completely different MSR and bit dependent on family.
1306
		 */
1307 1308
		if (!static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) &&
		    !static_cpu_has(X86_FEATURE_AMD_SSBD)) {
1309
			x86_amd_ssb_disable();
1310
		} else {
1311
			x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
1312
			wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
1313 1314 1315
		}
	}

1316 1317 1318
	return mode;
}

1319
static void ssb_select_mitigation(void)
1320 1321 1322 1323 1324 1325 1326
{
	ssb_mode = __ssb_select_mitigation();

	if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
		pr_info("%s\n", ssb_strings[ssb_mode]);
}

1327
#undef pr_fmt
1328
#define pr_fmt(fmt)     "Speculation prctl: " fmt
1329

1330
static void task_update_spec_tif(struct task_struct *tsk)
1331
{
1332 1333
	/* Force the update of the real TIF bits */
	set_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE);
1334 1335 1336 1337 1338 1339 1340 1341 1342

	/*
	 * Immediately update the speculation control MSRs for the current
	 * task, but for a non-current task delay setting the CPU
	 * mitigation until it is scheduled next.
	 *
	 * This can only happen for SECCOMP mitigation. For PRCTL it's
	 * always the current task.
	 */
1343
	if (tsk == current)
1344 1345 1346
		speculation_ctrl_update_current();
}

1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
static int l1d_flush_prctl_set(struct task_struct *task, unsigned long ctrl)
{

	if (!static_branch_unlikely(&switch_mm_cond_l1d_flush))
		return -EPERM;

	switch (ctrl) {
	case PR_SPEC_ENABLE:
		set_ti_thread_flag(&task->thread_info, TIF_SPEC_L1D_FLUSH);
		return 0;
	case PR_SPEC_DISABLE:
		clear_ti_thread_flag(&task->thread_info, TIF_SPEC_L1D_FLUSH);
		return 0;
	default:
		return -ERANGE;
	}
}

1365 1366
static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
{
1367 1368
	if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
	    ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
1369 1370
		return -ENXIO;

1371 1372 1373 1374 1375 1376
	switch (ctrl) {
	case PR_SPEC_ENABLE:
		/* If speculation is force disabled, enable is not allowed */
		if (task_spec_ssb_force_disable(task))
			return -EPERM;
		task_clear_spec_ssb_disable(task);
1377
		task_clear_spec_ssb_noexec(task);
1378
		task_update_spec_tif(task);
1379 1380 1381
		break;
	case PR_SPEC_DISABLE:
		task_set_spec_ssb_disable(task);
1382
		task_clear_spec_ssb_noexec(task);
1383
		task_update_spec_tif(task);
1384 1385 1386 1387
		break;
	case PR_SPEC_FORCE_DISABLE:
		task_set_spec_ssb_disable(task);
		task_set_spec_ssb_force_disable(task);
1388 1389 1390 1391 1392 1393 1394 1395
		task_clear_spec_ssb_noexec(task);
		task_update_spec_tif(task);
		break;
	case PR_SPEC_DISABLE_NOEXEC:
		if (task_spec_ssb_force_disable(task))
			return -EPERM;
		task_set_spec_ssb_disable(task);
		task_set_spec_ssb_noexec(task);
1396
		task_update_spec_tif(task);
1397 1398 1399 1400
		break;
	default:
		return -ERANGE;
	}
1401 1402 1403
	return 0;
}

1404 1405 1406 1407 1408 1409 1410 1411
static bool is_spec_ib_user_controlled(void)
{
	return spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
		spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
		spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
		spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP;
}

1412 1413 1414 1415
static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
{
	switch (ctrl) {
	case PR_SPEC_ENABLE:
1416 1417
		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
		    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
1418
			return 0;
1419

1420
		/*
1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433
		 * With strict mode for both IBPB and STIBP, the instruction
		 * code paths avoid checking this task flag and instead,
		 * unconditionally run the instruction. However, STIBP and IBPB
		 * are independent and either can be set to conditionally
		 * enabled regardless of the mode of the other.
		 *
		 * If either is set to conditional, allow the task flag to be
		 * updated, unless it was force-disabled by a previous prctl
		 * call. Currently, this is possible on an AMD CPU which has the
		 * feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the
		 * kernel is booted with 'spectre_v2_user=seccomp', then
		 * spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and
		 * spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED.
1434
		 */
1435
		if (!is_spec_ib_user_controlled() ||
1436
		    task_spec_ib_force_disable(task))
1437
			return -EPERM;
1438

1439 1440 1441 1442 1443 1444 1445 1446 1447
		task_clear_spec_ib_disable(task);
		task_update_spec_tif(task);
		break;
	case PR_SPEC_DISABLE:
	case PR_SPEC_FORCE_DISABLE:
		/*
		 * Indirect branch speculation is always allowed when
		 * mitigation is force disabled.
		 */
1448 1449
		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
		    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
1450
			return -EPERM;
1451 1452

		if (!is_spec_ib_user_controlled())
1453
			return 0;
1454

1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465
		task_set_spec_ib_disable(task);
		if (ctrl == PR_SPEC_FORCE_DISABLE)
			task_set_spec_ib_force_disable(task);
		task_update_spec_tif(task);
		break;
	default:
		return -ERANGE;
	}
	return 0;
}

1466 1467 1468 1469 1470 1471
int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
			     unsigned long ctrl)
{
	switch (which) {
	case PR_SPEC_STORE_BYPASS:
		return ssb_prctl_set(task, ctrl);
1472 1473
	case PR_SPEC_INDIRECT_BRANCH:
		return ib_prctl_set(task, ctrl);
1474 1475
	case PR_SPEC_L1D_FLUSH:
		return l1d_flush_prctl_set(task, ctrl);
1476 1477 1478 1479 1480 1481 1482 1483
	default:
		return -ENODEV;
	}
}

#ifdef CONFIG_SECCOMP
void arch_seccomp_spec_mitigate(struct task_struct *task)
{
1484 1485
	if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
		ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
1486 1487
	if (spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
	    spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP)
1488
		ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
1489 1490 1491
}
#endif

1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502
static int l1d_flush_prctl_get(struct task_struct *task)
{
	if (!static_branch_unlikely(&switch_mm_cond_l1d_flush))
		return PR_SPEC_FORCE_DISABLE;

	if (test_ti_thread_flag(&task->thread_info, TIF_SPEC_L1D_FLUSH))
		return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
	else
		return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
}

1503
static int ssb_prctl_get(struct task_struct *task)
1504 1505 1506 1507
{
	switch (ssb_mode) {
	case SPEC_STORE_BYPASS_DISABLE:
		return PR_SPEC_DISABLE;
1508
	case SPEC_STORE_BYPASS_SECCOMP:
1509
	case SPEC_STORE_BYPASS_PRCTL:
1510 1511
		if (task_spec_ssb_force_disable(task))
			return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
1512 1513
		if (task_spec_ssb_noexec(task))
			return PR_SPEC_PRCTL | PR_SPEC_DISABLE_NOEXEC;
1514
		if (task_spec_ssb_disable(task))
1515 1516 1517 1518 1519 1520 1521 1522 1523
			return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
		return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
	default:
		if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
			return PR_SPEC_ENABLE;
		return PR_SPEC_NOT_AFFECTED;
	}
}

1524 1525 1526 1527 1528
static int ib_prctl_get(struct task_struct *task)
{
	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
		return PR_SPEC_NOT_AFFECTED;

1529 1530
	if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
	    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
1531
		return PR_SPEC_ENABLE;
1532
	else if (is_spec_ib_user_controlled()) {
1533 1534 1535 1536 1537
		if (task_spec_ib_force_disable(task))
			return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
		if (task_spec_ib_disable(task))
			return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
		return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
1538 1539 1540 1541 1542
	} else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
		return PR_SPEC_DISABLE;
	else
1543 1544 1545
		return PR_SPEC_NOT_AFFECTED;
}

1546
int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
1547 1548 1549
{
	switch (which) {
	case PR_SPEC_STORE_BYPASS:
1550
		return ssb_prctl_get(task);
1551 1552
	case PR_SPEC_INDIRECT_BRANCH:
		return ib_prctl_get(task);
1553 1554
	case PR_SPEC_L1D_FLUSH:
		return l1d_flush_prctl_get(task);
1555 1556 1557 1558 1559
	default:
		return -ENODEV;
	}
}

1560 1561
void x86_spec_ctrl_setup_ap(void)
{
1562
	if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
1563
		wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
1564 1565

	if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
1566
		x86_amd_ssb_disable();
1567 1568
}

1569 1570 1571
bool itlb_multihit_kvm_mitigation;
EXPORT_SYMBOL_GPL(itlb_multihit_kvm_mitigation);

1572 1573
#undef pr_fmt
#define pr_fmt(fmt)	"L1TF: " fmt
1574

1575 1576
/* Default mitigation for L1TF-affected CPUs */
enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_FLUSH;
1577
#if IS_ENABLED(CONFIG_KVM_INTEL)
1578
EXPORT_SYMBOL_GPL(l1tf_mitigation);
1579
#endif
1580
enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
1581 1582
EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);

1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606
/*
 * These CPUs all support 44bits physical address space internally in the
 * cache but CPUID can report a smaller number of physical address bits.
 *
 * The L1TF mitigation uses the top most address bit for the inversion of
 * non present PTEs. When the installed memory reaches into the top most
 * address bit due to memory holes, which has been observed on machines
 * which report 36bits physical address bits and have 32G RAM installed,
 * then the mitigation range check in l1tf_select_mitigation() triggers.
 * This is a false positive because the mitigation is still possible due to
 * the fact that the cache uses 44bit internally. Use the cache bits
 * instead of the reported physical bits and adjust them on the affected
 * machines to 44bit if the reported bits are less than 44.
 */
static void override_cache_bits(struct cpuinfo_x86 *c)
{
	if (c->x86 != 6)
		return;

	switch (c->x86_model) {
	case INTEL_FAM6_NEHALEM:
	case INTEL_FAM6_WESTMERE:
	case INTEL_FAM6_SANDYBRIDGE:
	case INTEL_FAM6_IVYBRIDGE:
1607
	case INTEL_FAM6_HASWELL:
1608
	case INTEL_FAM6_HASWELL_L:
1609
	case INTEL_FAM6_HASWELL_G:
1610
	case INTEL_FAM6_BROADWELL:
1611
	case INTEL_FAM6_BROADWELL_G:
1612
	case INTEL_FAM6_SKYLAKE_L:
1613
	case INTEL_FAM6_SKYLAKE:
1614
	case INTEL_FAM6_KABYLAKE_L:
1615
	case INTEL_FAM6_KABYLAKE:
1616 1617 1618 1619 1620 1621
		if (c->x86_cache_bits < 44)
			c->x86_cache_bits = 44;
		break;
	}
}

1622 1623 1624 1625 1626 1627 1628
static void __init l1tf_select_mitigation(void)
{
	u64 half_pa;

	if (!boot_cpu_has_bug(X86_BUG_L1TF))
		return;

1629 1630 1631 1632 1633
	if (cpu_mitigations_off())
		l1tf_mitigation = L1TF_MITIGATION_OFF;
	else if (cpu_mitigations_auto_nosmt())
		l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;

1634 1635
	override_cache_bits(&boot_cpu_data);

1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649
	switch (l1tf_mitigation) {
	case L1TF_MITIGATION_OFF:
	case L1TF_MITIGATION_FLUSH_NOWARN:
	case L1TF_MITIGATION_FLUSH:
		break;
	case L1TF_MITIGATION_FLUSH_NOSMT:
	case L1TF_MITIGATION_FULL:
		cpu_smt_disable(false);
		break;
	case L1TF_MITIGATION_FULL_FORCE:
		cpu_smt_disable(true);
		break;
	}

1650 1651 1652 1653 1654 1655
#if CONFIG_PGTABLE_LEVELS == 2
	pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
	return;
#endif

	half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
1656 1657
	if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
			e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
1658
		pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
1659 1660 1661
		pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
				half_pa);
		pr_info("However, doing so will make a part of your RAM unusable.\n");
1662
		pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html might help you decide.\n");
1663 1664 1665 1666 1667
		return;
	}

	setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
}
1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693

static int __init l1tf_cmdline(char *str)
{
	if (!boot_cpu_has_bug(X86_BUG_L1TF))
		return 0;

	if (!str)
		return -EINVAL;

	if (!strcmp(str, "off"))
		l1tf_mitigation = L1TF_MITIGATION_OFF;
	else if (!strcmp(str, "flush,nowarn"))
		l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOWARN;
	else if (!strcmp(str, "flush"))
		l1tf_mitigation = L1TF_MITIGATION_FLUSH;
	else if (!strcmp(str, "flush,nosmt"))
		l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
	else if (!strcmp(str, "full"))
		l1tf_mitigation = L1TF_MITIGATION_FULL;
	else if (!strcmp(str, "full,force"))
		l1tf_mitigation = L1TF_MITIGATION_FULL_FORCE;

	return 0;
}
early_param("l1tf", l1tf_cmdline);

1694
#undef pr_fmt
1695
#define pr_fmt(fmt) fmt
1696

1697
#ifdef CONFIG_SYSFS
1698

1699 1700 1701
#define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"

#if IS_ENABLED(CONFIG_KVM_INTEL)
1702
static const char * const l1tf_vmx_states[] = {
1703 1704 1705 1706 1707
	[VMENTER_L1D_FLUSH_AUTO]		= "auto",
	[VMENTER_L1D_FLUSH_NEVER]		= "vulnerable",
	[VMENTER_L1D_FLUSH_COND]		= "conditional cache flushes",
	[VMENTER_L1D_FLUSH_ALWAYS]		= "cache flushes",
	[VMENTER_L1D_FLUSH_EPT_DISABLED]	= "EPT disabled",
1708
	[VMENTER_L1D_FLUSH_NOT_REQUIRED]	= "flush not necessary"
1709 1710 1711 1712 1713 1714 1715
};

static ssize_t l1tf_show_state(char *buf)
{
	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
		return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);

1716 1717
	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
	    (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
1718
	     sched_smt_active())) {
1719 1720
		return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
			       l1tf_vmx_states[l1tf_vmx_mitigation]);
1721
	}
1722 1723 1724

	return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
		       l1tf_vmx_states[l1tf_vmx_mitigation],
1725
		       sched_smt_active() ? "vulnerable" : "disabled");
1726
}
1727 1728 1729

static ssize_t itlb_multihit_show_state(char *buf)
{
1730 1731 1732 1733 1734 1735
	if (!boot_cpu_has(X86_FEATURE_MSR_IA32_FEAT_CTL) ||
	    !boot_cpu_has(X86_FEATURE_VMX))
		return sprintf(buf, "KVM: Mitigation: VMX unsupported\n");
	else if (!(cr4_read_shadow() & X86_CR4_VMXE))
		return sprintf(buf, "KVM: Mitigation: VMX disabled\n");
	else if (itlb_multihit_kvm_mitigation)
1736 1737 1738 1739
		return sprintf(buf, "KVM: Mitigation: Split huge pages\n");
	else
		return sprintf(buf, "KVM: Vulnerable\n");
}
1740 1741 1742 1743 1744 1745
#else
static ssize_t l1tf_show_state(char *buf)
{
	return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
}

1746 1747 1748 1749
static ssize_t itlb_multihit_show_state(char *buf)
{
	return sprintf(buf, "Processor vulnerable\n");
}
1750
#endif
1751

1752 1753
static ssize_t mds_show_state(char *buf)
{
1754
	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
1755 1756 1757 1758 1759 1760
		return sprintf(buf, "%s; SMT Host state unknown\n",
			       mds_strings[mds_mitigation]);
	}

	if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
		return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
1761 1762
			       (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
			        sched_smt_active() ? "mitigated" : "disabled"));
1763 1764 1765 1766 1767 1768
	}

	return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
		       sched_smt_active() ? "vulnerable" : "disabled");
}

1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783
static ssize_t tsx_async_abort_show_state(char *buf)
{
	if ((taa_mitigation == TAA_MITIGATION_TSX_DISABLED) ||
	    (taa_mitigation == TAA_MITIGATION_OFF))
		return sprintf(buf, "%s\n", taa_strings[taa_mitigation]);

	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
		return sprintf(buf, "%s; SMT Host state unknown\n",
			       taa_strings[taa_mitigation]);
	}

	return sprintf(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
		       sched_smt_active() ? "vulnerable" : "disabled");
}

1784 1785
static char *stibp_state(void)
{
1786
	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
1787 1788
		return "";

1789
	switch (spectre_v2_user_stibp) {
1790 1791 1792 1793
	case SPECTRE_V2_USER_NONE:
		return ", STIBP: disabled";
	case SPECTRE_V2_USER_STRICT:
		return ", STIBP: forced";
1794 1795
	case SPECTRE_V2_USER_STRICT_PREFERRED:
		return ", STIBP: always-on";
1796
	case SPECTRE_V2_USER_PRCTL:
1797
	case SPECTRE_V2_USER_SECCOMP:
1798 1799
		if (static_key_enabled(&switch_to_cond_stibp))
			return ", STIBP: conditional";
1800 1801
	}
	return "";
1802 1803 1804 1805
}

static char *ibpb_state(void)
{
1806
	if (boot_cpu_has(X86_FEATURE_IBPB)) {
1807
		if (static_key_enabled(&switch_mm_always_ibpb))
1808
			return ", IBPB: always-on";
1809 1810 1811
		if (static_key_enabled(&switch_mm_cond_ibpb))
			return ", IBPB: conditional";
		return ", IBPB: disabled";
1812 1813
	}
	return "";
1814 1815
}

1816 1817
static ssize_t spectre_v2_show_state(char *buf)
{
1818 1819 1820
	if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
		return sprintf(buf, "Vulnerable: LFENCE\n");

1821
	if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
1822 1823 1824 1825 1826
		return sprintf(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");

	if (sched_smt_active() && unprivileged_ebpf_enabled() &&
	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
		return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
1827 1828 1829 1830 1831 1832 1833 1834 1835 1836

	return sprintf(buf, "%s%s%s%s%s%s\n",
		       spectre_v2_strings[spectre_v2_enabled],
		       ibpb_state(),
		       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
		       stibp_state(),
		       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
		       spectre_v2_module_string());
}

1837 1838 1839 1840 1841
static ssize_t srbds_show_state(char *buf)
{
	return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
}

1842
static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
1843
			       char *buf, unsigned int bug)
1844
{
1845
	if (!boot_cpu_has_bug(bug))
1846
		return sprintf(buf, "Not affected\n");
1847 1848 1849 1850 1851 1852

	switch (bug) {
	case X86_BUG_CPU_MELTDOWN:
		if (boot_cpu_has(X86_FEATURE_PTI))
			return sprintf(buf, "Mitigation: PTI\n");

1853 1854 1855
		if (hypervisor_is_type(X86_HYPER_XEN_PV))
			return sprintf(buf, "Unknown (XEN PV detected, hypervisor mitigation required)\n");

1856 1857 1858
		break;

	case X86_BUG_SPECTRE_V1:
1859
		return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
1860 1861

	case X86_BUG_SPECTRE_V2:
1862
		return spectre_v2_show_state(buf);
1863

1864 1865 1866
	case X86_BUG_SPEC_STORE_BYPASS:
		return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);

1867 1868
	case X86_BUG_L1TF:
		if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
1869
			return l1tf_show_state(buf);
1870
		break;
1871 1872 1873 1874

	case X86_BUG_MDS:
		return mds_show_state(buf);

1875 1876 1877
	case X86_BUG_TAA:
		return tsx_async_abort_show_state(buf);

1878 1879 1880
	case X86_BUG_ITLB_MULTIHIT:
		return itlb_multihit_show_state(buf);

1881 1882 1883
	case X86_BUG_SRBDS:
		return srbds_show_state(buf);

1884 1885 1886 1887
	default:
		break;
	}

1888 1889 1890
	return sprintf(buf, "Vulnerable\n");
}

1891 1892 1893 1894 1895
ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_CPU_MELTDOWN);
}

1896
ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
1897
{
1898
	return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V1);
1899 1900
}

1901
ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
1902
{
1903
	return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V2);
1904
}
1905 1906 1907 1908 1909

ssize_t cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS);
}
1910 1911 1912 1913 1914

ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
}
1915 1916 1917 1918 1919

ssize_t cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_MDS);
}
1920 1921 1922 1923 1924

ssize_t cpu_show_tsx_async_abort(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_TAA);
}
1925 1926 1927 1928 1929

ssize_t cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT);
}
1930 1931 1932 1933 1934

ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf)
{
	return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS);
}
1935
#endif