linux.git/arch/x86/kernel/cpu/bugs.c, branch v5.1

x86/cpu/bugs: Use __initconst for 'const' init data

2019-04-19T15:11:39+00:00

Some of the recently added const tables use __initdata which causes section
attribute conflicts.

Use __initconst instead.

Fixes: fa1202ef2243 ("x86/speculation: Add command line control")
Signed-off-by: Andi Kleen 
Signed-off-by: Thomas Gleixner 
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190330004743.29541-9-andi@firstfloor.org

Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2019-03-05T20:50:34+00:00

Pull x86/pti update from Thomas Gleixner:
 "Just a single change from the anti-performance departement:

   - Add a new PR_SPEC_DISABLE_NOEXEC option which allows to apply the
     speculation protections on a process without inheriting the state
     on exec.

     This remedies a situation where a Java-launcher has speculation
     protections enabled because that's the default for JVMs which
     causes the launched regular harmless processes to inherit the
     protection state which results in unintended performance
     degradation"

* 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/speculation: Add PR_SPEC_DISABLE_NOEXEC

cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM

2019-01-30T18:27:00+00:00

With the following commit:

  73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")

... the hotplug code attempted to detect when SMT was disabled by BIOS,
in which case it reported SMT as permanently disabled.  However, that
code broke a virt hotplug scenario, where the guest is booted with only
primary CPU threads, and a sibling is brought online later.

The problem is that there doesn't seem to be a way to reliably
distinguish between the HW "SMT disabled by BIOS" case and the virt
"sibling not yet brought online" case.  So the above-mentioned commit
was a bit misguided, as it permanently disabled SMT for both cases,
preventing future virt sibling hotplugs.

Going back and reviewing the original problems which were attempted to
be solved by that commit, when SMT was disabled in BIOS:

  1) /sys/devices/system/cpu/smt/control showed "on" instead of
     "notsupported"; and

  2) vmx_vm_init() was incorrectly showing the L1TF_MSG_SMT warning.

I'd propose that we instead consider #1 above to not actually be a
problem.  Because, at least in the virt case, it's possible that SMT
wasn't disabled by BIOS and a sibling thread could be brought online
later.  So it makes sense to just always default the smt control to "on"
to allow for that possibility (assuming cpuid indicates that the CPU
supports SMT).

The real problem is #2, which has a simple fix: change vmx_vm_init() to
query the actual current SMT state -- i.e., whether any siblings are
currently online -- instead of looking at the SMT "control" sysfs value.

So fix it by:

  a) reverting the original "fix" and its followup fix:

     73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")
     bc2d8d262cba ("cpu/hotplug: Fix SMT supported evaluation")

     and

  b) changing vmx_vm_init() to query the actual current SMT state --
     instead of the sysfs control value -- to determine whether the L1TF
     warning is needed.  This also requires the 'sched_smt_present'
     variable to exported, instead of 'cpu_smt_control'.

Fixes: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")
Reported-by: Igor Mammedov 
Signed-off-by: Josh Poimboeuf 
Signed-off-by: Thomas Gleixner 
Cc: Joe Mario 
Cc: Jiri Kosina 
Cc: Peter Zijlstra 
Cc: kvm@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/e3a85d585da28cc333ecbc1e78ee9216e6da9396.1548794349.git.jpoimboe@redhat.com

x86/speculation: Add PR_SPEC_DISABLE_NOEXEC

2019-01-29T21:11:49+00:00

With the default SPEC_STORE_BYPASS_SECCOMP/SPEC_STORE_BYPASS_PRCTL mode,
the TIF_SSBD bit will be inherited when a new task is fork'ed or cloned.
It will also remain when a new program is execve'ed.

Only certain class of applications (like Java) that can run on behalf of
multiple users on a single thread will require disabling speculative store
bypass for security purposes. Those applications will call prctl(2) at
startup time to disable SSB. They won't rely on the fact the SSB might have
been disabled. Other applications that don't need SSBD will just move on
without checking if SSBD has been turned on or not.

The fact that the TIF_SSBD is inherited across execve(2) boundary will
cause performance of applications that don't need SSBD but their
predecessors have SSBD on to be unwittingly impacted especially if they
write to memory a lot.

To remedy this problem, a new PR_SPEC_DISABLE_NOEXEC argument for the
PR_SET_SPECULATION_CTRL option of prctl(2) is added to allow applications
to specify that the SSBD feature bit on the task structure should be
cleared whenever a new program is being execve'ed.

Suggested-by: Thomas Gleixner 
Signed-off-by: Waiman Long 
Signed-off-by: Thomas Gleixner 
Cc: Borislav Petkov 
Cc: Jonathan Corbet 
Cc: linux-doc@vger.kernel.org
Cc: "H. Peter Anvin" 
Cc: Andi Kleen 
Cc: David Woodhouse 
Cc: Jiri Kosina 
Cc: Josh Poimboeuf 
Cc: Tim Chen 
Cc: KarimAllah Ahmed 
Cc: Peter Zijlstra 
Cc: Konrad Rzeszutek Wilk 
Link: https://lkml.kernel.org/r/1547676096-3281-1-git-send-email-longman@redhat.com

x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE

2019-01-09T09:35:56+00:00

Commit

  4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support")

replaced the RETPOLINE define with CONFIG_RETPOLINE checks. Remove the
remaining pieces.

 [ bp: Massage commit message. ]

Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support")
Signed-off-by: WANG Chao 
Signed-off-by: Borislav Petkov 
Reviewed-by: Zhenzhong Duan 
Reviewed-by: Masahiro Yamada 
Cc: "H. Peter Anvin" 
Cc: Andi Kleen 
Cc: Andrew Morton 
Cc: Andy Lutomirski 
Cc: Arnd Bergmann 
Cc: Daniel Borkmann 
Cc: David Woodhouse 
Cc: Geert Uytterhoeven 
Cc: Jessica Yu 
Cc: Jiri Kosina 
Cc: Kees Cook 
Cc: Konrad Rzeszutek Wilk 
Cc: Luc Van Oostenryck 
Cc: Michal Marek 
Cc: Miguel Ojeda 
Cc: Peter Zijlstra 
Cc: Tim Chen 
Cc: Vasily Gorbik 
Cc: linux-kbuild@vger.kernel.org
Cc: srinivas.eeda@oracle.com
Cc: stable 
Cc: x86-ml 
Link: https://lkml.kernel.org/r/20181210163725.95977-1-chao.wang@ucloud.cn

Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2018-12-27T01:03:51+00:00

Pull x86 cleanups from Ingo Molnar:
 "Misc cleanups"

* 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/kprobes: Remove trampoline_handler() prototype
  x86/kernel: Fix more -Wmissing-prototypes warnings
  x86: Fix various typos in comments
  x86/headers: Fix -Wmissing-prototypes warning
  x86/process: Avoid unnecessary NULL check in get_wchan()
  x86/traps: Complete prototype declarations
  x86/mce: Fix -Wmissing-prototypes warnings
  x86/gart: Rewrite early_gart_iommu_check() comment

x86/speculation: Add support for STIBP always-on preferred mode

2018-12-18T13:13:33+00:00

Different AMD processors may have different implementations of STIBP.
When STIBP is conditionally enabled, some implementations would benefit
from having STIBP always on instead of toggling the STIBP bit through MSR
writes. This preference is advertised through a CPUID feature bit.

When conditional STIBP support is requested at boot and the CPU advertises
STIBP always-on mode as preferred, switch to STIBP "on" support. To show
that this transition has occurred, create a new spectre_v2_user_mitigation
value and a new spectre_v2_user_strings message. The new mitigation value
is used in spectre_v2_user_select_mitigation() to print the new mitigation
message as well as to return a new string from stibp_state().

Signed-off-by: Tom Lendacky 
Signed-off-by: Thomas Gleixner 
Cc: Andrea Arcangeli 
Cc: Konrad Rzeszutek Wilk 
Cc: Jiri Kosina 
Cc: Borislav Petkov 
Cc: Tim Chen 
Cc: David Woodhouse 
Link: https://lkml.kernel.org/r/20181213230352.6937.74943.stgit@tlendack-t1.amdoffice.net

x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off

2018-12-11T10:46:13+00:00

Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.

We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.

Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.

[ tglx: Folded the documentation delta change ]

Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko 
Signed-off-by: Thomas Gleixner 
Reviewed-by: Pavel Tatashin 
Reviewed-by: Andi Kleen 
Acked-by: Jiri Kosina 
Cc: Linus Torvalds 
Cc: Dave Hansen 
Cc: Andi Kleen 
Cc: Borislav Petkov 
Cc: 
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org

x86/kernel: Fix more -Wmissing-prototypes warnings

2018-12-08T11:24:35+00:00

... with the goal of eventually enabling -Wmissing-prototypes by
default. At least on x86.

Make functions static where possible, otherwise add prototypes or make
them visible through includes.

asm/trace/ changes courtesy of Steven Rostedt .

Signed-off-by: Borislav Petkov 
Reviewed-by: Masami Hiramatsu 
Reviewed-by: Ingo Molnar 
Acked-by: Rafael J. Wysocki  # ACPI + cpufreq bits
Cc: Andrew Banman 
Cc: Dimitri Sivanich 
Cc: "H. Peter Anvin" 
Cc: Ingo Molnar 
Cc: Masami Hiramatsu 
Cc: Mike Travis 
Cc: "Steven Rostedt (VMware)" 
Cc: Thomas Gleixner 
Cc: Yi Wang 
Cc: linux-acpi@vger.kernel.org

x86/speculation: Change misspelled STIPB to STIBP

2018-12-06T10:49:15+00:00

STIBP stands for Single Thread Indirect Branch Predictors. The acronym,
however, can be easily mis-spelled as STIPB. It is perhaps due to the
presence of another related term - IBPB (Indirect Branch Predictor
Barrier).

Fix the mis-spelling in the code.

Signed-off-by: Waiman Long 
Signed-off-by: Borislav Petkov 
Cc: "H. Peter Anvin" 
Cc: Andi Kleen 
Cc: David Woodhouse 
Cc: Ingo Molnar 
Cc: Jiri Kosina 
Cc: Josh Poimboeuf 
Cc: KarimAllah Ahmed 
Cc: Konrad Rzeszutek Wilk 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Tim Chen 
Cc: x86-ml 
Link: https://lkml.kernel.org/r/1544039368-9009-1-git-send-email-longman@redhat.com