arch/x86/kernel/cpu/bugs.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *  Copyright (C) 1994  Linus Torvalds
   4  *
   5  *  Cyrix stuff, June 1998 by:
   6  *      - Rafael R. Reilova (moved everything from head.S),
   7  *        <rreilova@ececs.uc.edu>
   8  *      - Channing Corn (tests & fixes),
   9  *      - Andrew D. Balsa (code cleanup).
  10  */
  11 #include <linux/init.h>
  12 #include <linux/utsname.h>
  13 #include <linux/cpu.h>
  14 #include <linux/module.h>
  15
  16 #include <asm/nospec-branch.h>
  17 #include <asm/cmdline.h>
  18 #include <asm/bugs.h>
  19 #include <asm/processor.h>
  20 #include <asm/processor-flags.h>
  21 #include <asm/fpu/internal.h>
  22 #include <asm/msr.h>
  23 #include <asm/paravirt.h>
  24 #include <asm/alternative.h>
  25 #include <asm/pgtable.h>
  26 #include <asm/set_memory.h>
  27 #include <asm/intel-family.h>
  28
  29 static void __init spectre_v2_select_mitigation(void);
  30
  31 void __init check_bugs(void)
  32 {
  33         identify_boot_cpu();
  34
  35         if (!IS_ENABLED(CONFIG_SMP)) {
  36                 pr_info("CPU: ");
  37                 print_cpu_info(&boot_cpu_data);
  38         }
  39
  40         /* Select the proper spectre mitigation before patching alternatives */
  41         spectre_v2_select_mitigation();
  42
  43 #ifdef CONFIG_X86_32
  44         /*
  45          * Check whether we are able to run this kernel safely on SMP.
  46          *
  47          * - i386 is no longer supported.
  48          * - In order to run on anything without a TSC, we need to be
  49          *   compiled for a i486.
  50          */
  51         if (boot_cpu_data.x86 < 4)
  52                 panic("Kernel requires i486+ for 'invlpg' and other features");
  53
  54         init_utsname()->machine[1] =
  55                 '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
  56         alternative_instructions();
  57
  58         fpu__init_check_bugs();
  59 #else /* CONFIG_X86_64 */
  60         alternative_instructions();
  61
  62         /*
  63          * Make sure the first 2MB area is not mapped by huge pages
  64          * There are typically fixed size MTRRs in there and overlapping
  65          * MTRRs into large pages causes slow downs.
  66          *
  67          * Right now we don't do that with gbpages because there seems
  68          * very little benefit for that case.
  69          */
  70         if (!direct_gbpages)
  71                 set_memory_4k((unsigned long)__va(0), 1);
  72 #endif
  73 }
  74
  75 /* The kernel command line selection */
  76 enum spectre_v2_mitigation_cmd {
  77         SPECTRE_V2_CMD_NONE,
  78         SPECTRE_V2_CMD_AUTO,
  79         SPECTRE_V2_CMD_FORCE,
  80         SPECTRE_V2_CMD_RETPOLINE,
  81         SPECTRE_V2_CMD_RETPOLINE_GENERIC,
  82         SPECTRE_V2_CMD_RETPOLINE_AMD,
  83 };
  84
  85 static const char *spectre_v2_strings[] = {
  86         [SPECTRE_V2_NONE]                       = "Vulnerable",
  87         [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
  88         [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
  89         [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
  90         [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
  91 };
  92
  93 #undef pr_fmt
  94 #define pr_fmt(fmt)     "Spectre V2 mitigation: " fmt
  95
  96 static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
  97 static bool spectre_v2_bad_module;
  98
  99 #ifdef RETPOLINE
 100 bool retpoline_module_ok(bool has_retpoline)
 101 {
 102         if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
 103                 return true;
 104
 105         pr_err("System may be vunerable to spectre v2\n");
 106         spectre_v2_bad_module = true;
 107         return false;
 108 }
 109 #endif
 110
 111 static void __init spec2_print_if_insecure(const char *reason)
 112 {
 113         if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 114                 pr_info("%s\n", reason);
 115 }
 116
 117 static void __init spec2_print_if_secure(const char *reason)
 118 {
 119         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 120                 pr_info("%s\n", reason);
 121 }
 122
 123 static inline bool retp_compiler(void)
 124 {
 125         return __is_defined(RETPOLINE);
 126 }
 127
 128 static inline bool match_option(const char *arg, int arglen, const char *opt)
 129 {
 130         int len = strlen(opt);
 131
 132         return len == arglen && !strncmp(arg, opt, len);
 133 }
 134
 135 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 136 {
 137         char arg[20];
 138         int ret;
 139
 140         ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
 141                                   sizeof(arg));
 142         if (ret > 0)  {
 143                 if (match_option(arg, ret, "off")) {
 144                         goto disable;
 145                 } else if (match_option(arg, ret, "on")) {
 146                         spec2_print_if_secure("force enabled on command line.");
 147                         return SPECTRE_V2_CMD_FORCE;
 148                 } else if (match_option(arg, ret, "retpoline")) {
 149                         spec2_print_if_insecure("retpoline selected on command line.");
 150                         return SPECTRE_V2_CMD_RETPOLINE;
 151                 } else if (match_option(arg, ret, "retpoline,amd")) {
 152                         if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
 153                                 pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
 154                                 return SPECTRE_V2_CMD_AUTO;
 155                         }
 156                         spec2_print_if_insecure("AMD retpoline selected on command line.");
 157                         return SPECTRE_V2_CMD_RETPOLINE_AMD;
 158                 } else if (match_option(arg, ret, "retpoline,generic")) {
 159                         spec2_print_if_insecure("generic retpoline selected on command line.");
 160                         return SPECTRE_V2_CMD_RETPOLINE_GENERIC;
 161                 } else if (match_option(arg, ret, "auto")) {
 162                         return SPECTRE_V2_CMD_AUTO;
 163                 }
 164         }
 165
 166         if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
 167                 return SPECTRE_V2_CMD_AUTO;
 168 disable:
 169         spec2_print_if_insecure("disabled on command line.");
 170         return SPECTRE_V2_CMD_NONE;
 171 }
 172
 173 /* Check for Skylake-like CPUs (for RSB handling) */
 174 static bool __init is_skylake_era(void)
 175 {
 176         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
 177             boot_cpu_data.x86 == 6) {
 178                 switch (boot_cpu_data.x86_model) {
 179                 case INTEL_FAM6_SKYLAKE_MOBILE:
 180                 case INTEL_FAM6_SKYLAKE_DESKTOP:
 181                 case INTEL_FAM6_SKYLAKE_X:
 182                 case INTEL_FAM6_KABYLAKE_MOBILE:
 183                 case INTEL_FAM6_KABYLAKE_DESKTOP:
 184                         return true;
 185                 }
 186         }
 187         return false;
 188 }
 189
 190 static void __init spectre_v2_select_mitigation(void)
 191 {
 192         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
 193         enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
 194
 195         /*
 196          * If the CPU is not affected and the command line mode is NONE or AUTO
 197          * then nothing to do.
 198          */
 199         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
 200             (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
 201                 return;
 202
 203         switch (cmd) {
 204         case SPECTRE_V2_CMD_NONE:
 205                 return;
 206
 207         case SPECTRE_V2_CMD_FORCE:
 208                 /* FALLTRHU */
 209         case SPECTRE_V2_CMD_AUTO:
 210                 goto retpoline_auto;
 211
 212         case SPECTRE_V2_CMD_RETPOLINE_AMD:
 213                 if (IS_ENABLED(CONFIG_RETPOLINE))
 214                         goto retpoline_amd;
 215                 break;
 216         case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
 217                 if (IS_ENABLED(CONFIG_RETPOLINE))
 218                         goto retpoline_generic;
 219                 break;
 220         case SPECTRE_V2_CMD_RETPOLINE:
 221                 if (IS_ENABLED(CONFIG_RETPOLINE))
 222                         goto retpoline_auto;
 223                 break;
 224         }
 225         pr_err("kernel not compiled with retpoline; no mitigation available!");
 226         return;
 227
 228 retpoline_auto:
 229         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
 230         retpoline_amd:
 231                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
 232                         pr_err("LFENCE not serializing. Switching to generic retpoline\n");
 233                         goto retpoline_generic;
 234                 }
 235                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
 236                                          SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
 237                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
 238                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 239         } else {
 240         retpoline_generic:
 241                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
 242                                          SPECTRE_V2_RETPOLINE_MINIMAL;
 243                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 244         }
 245
 246         spectre_v2_enabled = mode;
 247         pr_info("%s\n", spectre_v2_strings[mode]);
 248
 249         /*
 250          * If neither SMEP or KPTI are available, there is a risk of
 251          * hitting userspace addresses in the RSB after a context switch
 252          * from a shallow call stack to a deeper one. To prevent this fill
 253          * the entire RSB, even when using IBRS.
 254          *
 255          * Skylake era CPUs have a separate issue with *underflow* of the
 256          * RSB, when they will predict 'ret' targets from the generic BTB.
 257          * The proper mitigation for this is IBRS. If IBRS is not supported
 258          * or deactivated in favour of retpolines the RSB fill on context
 259          * switch is required.
 260          */
 261         if ((!boot_cpu_has(X86_FEATURE_PTI) &&
 262              !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
 263                 setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
 264                 pr_info("Filling RSB on context switch\n");
 265         }
 266 }
 267
 268 #undef pr_fmt
 269
 270 #ifdef CONFIG_SYSFS
 271 ssize_t cpu_show_meltdown(struct device *dev,
 272                           struct device_attribute *attr, char *buf)
 273 {
 274         if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
 275                 return sprintf(buf, "Not affected\n");
 276         if (boot_cpu_has(X86_FEATURE_PTI))
 277                 return sprintf(buf, "Mitigation: PTI\n");
 278         return sprintf(buf, "Vulnerable\n");
 279 }
 280
 281 ssize_t cpu_show_spectre_v1(struct device *dev,
 282                             struct device_attribute *attr, char *buf)
 283 {
 284         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
 285                 return sprintf(buf, "Not affected\n");
 286         return sprintf(buf, "Vulnerable\n");
 287 }
 288
 289 ssize_t cpu_show_spectre_v2(struct device *dev,
 290                             struct device_attribute *attr, char *buf)
 291 {
 292         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 293                 return sprintf(buf, "Not affected\n");
 294
 295         return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled],
 296                        spectre_v2_bad_module ? " - vulnerable module loaded" : "");
 297 }
 298 #endif