[MODERATED] Re: [PATCH 3/4] V8 more sampling fun 3

On Thu, Apr 16, 2020 at 07:44:52PM +0200, speck for Borislav Petkov wrote:
> On Thu, Apr 16, 2020 at 12:17:23PM -0500, speck for Josh Poimboeuf wrote:
> > On Thu, Jan 16, 2020 at 02:16:07PM -0800, speck for mark gross wrote:
> > > From: mark gross <[email protected]>
> > > Subject: [PATCH 3/4] x86/speculation: Special Register Buffer Data Samp=
ling
> > >  (SRBDS) mitigation control.
> >=20
> > Subjects don't need periods.
>=20
> Fixed.
thank you

>=20
> > > +static enum srbds_mitigations srbds_mitigation __ro_after_init =3D SRB=
DS_MITIGATION_FULL;
> > > +static const char * const srbds_strings[] =3D {
> > > +	[SRBDS_MITIGATION_OFF]		=3D "Vulnerable",
> > > +	[SRBDS_MITIGATION_UCODE_NEEDED]	=3D "Vulnerable: No microcode",
> > > +	[SRBDS_MITIGATION_FULL]		=3D "Mitigated: Microcode",
> >=20
> > FWIW, this is at least the third time I've made this comment...
> >=20
> > s/Mitigated/Mitigation/
> >=20
> > > +	[SRBDS_MITIGATION_TSX_OFF]	=3D "Mitigated: TSX disabled",
> >=20
> > s/Mitigated/Mitigation
>=20
> Fixed.
thank you
>=20
> > When nitpicking the whitespace before, I think I completely missed the
> > fact that this goto is extremely ugly.  And there are a lot of
> > unnecessary nested ifs.  And the comment is redundant.
>=20
> I've cleaned up that part a bit more, please have a look. Here's the whole
> thing:
>=20
> ---
> From: Mark Gross <[email protected]>
> Date: Thu, 16 Apr 2020 17:54:04 +0200
> Subject: [PATCH] x86/speculation: Add Special Register Buffer Data Sampling
>  (SRBDS) mitigation controls
>=20
> SRBDS is an MDS-like speculative side channel that can leak bits from
> the RNG across cores and threads. New microcode serializes the processor
> access during the execution of RDRAND and RDSEED. This ensures that the
> shared buffer is overwritten before it is released for reuse.
>=20
> While it is present on all affected CPU models, the microcode mitigation
> is not needed on models that enumerate ARCH_CAPABILITIES[MDS_NO] in the
> cases where TSX is not supported or has been disabled with TSX_CTRL.
>=20
> The mitigation is activated by default on affected processors and it
> increases latency for RDRAND and RDSEED instructions. Among other
> effects this will reduce throughput from /dev/urandom.
>=20
> * Enable administrator to configure the mitigation off when desired using
> either mitigations=3Doff or srbds=3Doff.
>=20
> * Export vulnerability status via sysfs
>=20
> * Rename file-scoped macros to apply for non-whitelist table
> initializations.
>=20
>  [ bp: Massage,
>    - s/VULNBL_INTEL_STEPPING/VULNBL_INTEL_STEPPINGS/g,
>    - do not read arch cap MSR a second time in tsx_fused_off() - just pass =
it in,
>    - flip check in cpu_set_bug_bits() to save an indentation level,
>    - reflow comments.
>    jpoimboe: s/Mitigated/Mitigation/ in user-visible strings ]
>=20
> Signed-off-by: Mark Gross <[email protected]>
> Signed-off-by: Borislav Petkov <[email protected]>
> Reviewed-by: Tony Luck <[email protected]>
> Reviewed-by: Pawan Gupta <[email protected]>
> Reviewed-by: Josh Poimboeuf <[email protected]>
> Tested-by: Neelima Krishnan <[email protected]>
> ---
>  .../ABI/testing/sysfs-devices-system-cpu      |   1 +
>  .../admin-guide/kernel-parameters.txt         |  20 ++++
>  arch/x86/include/asm/cpufeatures.h            |   2 +
>  arch/x86/include/asm/msr-index.h              |   4 +
>  arch/x86/kernel/cpu/bugs.c                    | 107 ++++++++++++++++++
>  arch/x86/kernel/cpu/common.c                  |  54 +++++++++
>  arch/x86/kernel/cpu/cpu.h                     |   2 +
>  drivers/base/cpu.c                            |   8 ++
>  8 files changed, 198 insertions(+)
>=20
> diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documenta=
tion/ABI/testing/sysfs-devices-system-cpu
> index 2e0e3b45d02a..b39531a3c5bc 100644
> --- a/Documentation/ABI/testing/sysfs-devices-system-cpu
> +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
> @@ -492,6 +492,7 @@ What:		/sys/devices/system/cpu/vulnerabilities
>  		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
>  		/sys/devices/system/cpu/vulnerabilities/l1tf
>  		/sys/devices/system/cpu/vulnerabilities/mds
> +		/sys/devices/system/cpu/vulnerabilities/srbds
>  		/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
>  		/sys/devices/system/cpu/vulnerabilities/itlb_multihit
>  Date:		January 2018
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio=
n/admin-guide/kernel-parameters.txt
> index f2a93c8679e8..f720463bd918 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -4757,6 +4757,26 @@
>  			the kernel will oops in either "warn" or "fatal"
>  			mode.
> =20
> +	srbds=3D		[X86,INTEL]
> +			Control the Special Register Buffer Data Sampling
> +			(SRBDS) mitigation.
> +
> +			Certain CPUs are vulnerable to an MDS-like
> +			exploit which can leak bits from the random
> +			number generator.
> +
> +			By default, this issue is mitigated by
> +			microcode.  However, the microcode fix can cause
> +			the RDRAND and RDSEED instructions to become
> +			much slower.  Among other effects, this will
> +			result in reduced throughput from /dev/urandom.
> +
> +			The microcode mitigation can be disabled with
> +			the following option:
> +
> +			off:    Disable mitigation and remove
> +				performance impact to RDRAND and RDSEED
> +
>  	srcutree.counter_wrap_check [KNL]
>  			Specifies how frequently to check for
>  			grace-period sequence counter wrap for the
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpuf=
eatures.h
> index db189945e9b0..02dabc9e77b0 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -362,6 +362,7 @@
>  #define X86_FEATURE_AVX512_4FMAPS	(18*32+ 3) /* AVX-512 Multiply Accumulat=
ion Single precision */
>  #define X86_FEATURE_FSRM		(18*32+ 4) /* Fast Short Rep Mov */
>  #define X86_FEATURE_AVX512_VP2INTERSECT (18*32+ 8) /* AVX-512 Intersect fo=
r D/Q */
> +#define X86_FEATURE_SRBDS_CTRL		(18*32+ 9) /* "" SRBDS mitigation MSR avai=
lable */
>  #define X86_FEATURE_MD_CLEAR		(18*32+10) /* VERW clears CPU buffers */
>  #define X86_FEATURE_TSX_FORCE_ABORT	(18*32+13) /* "" TSX_FORCE_ABORT */
>  #define X86_FEATURE_PCONFIG		(18*32+18) /* Intel PCONFIG */
> @@ -407,5 +408,6 @@
>  #define X86_BUG_SWAPGS			X86_BUG(21) /* CPU is affected by speculation thr=
ough SWAPGS */
>  #define X86_BUG_TAA			X86_BUG(22) /* CPU is affected by TSX Async Abort(TA=
A) */
>  #define X86_BUG_ITLB_MULTIHIT		X86_BUG(23) /* CPU may incur MCE during cer=
tain page attribute changes */
> +#define X86_BUG_SRBDS			X86_BUG(24) /* CPU may leak RNG bits if not mitiga=
ted */
> =20
>  #endif /* _ASM_X86_CPUFEATURES_H */
> diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-in=
dex.h
> index 12c9684d59ba..3efde600a674 100644
> --- a/arch/x86/include/asm/msr-index.h
> +++ b/arch/x86/include/asm/msr-index.h
> @@ -128,6 +128,10 @@
>  #define TSX_CTRL_RTM_DISABLE		BIT(0)	/* Disable RTM feature */
>  #define TSX_CTRL_CPUID_CLEAR		BIT(1)	/* Disable TSX enumeration */
> =20
> +/* SRBDS support */
> +#define MSR_IA32_MCU_OPT_CTRL		0x00000123
> +#define RNGDS_MITG_DIS			BIT(0)
> +
>  #define MSR_IA32_SYSENTER_CS		0x00000174
>  #define MSR_IA32_SYSENTER_ESP		0x00000175
>  #define MSR_IA32_SYSENTER_EIP		0x00000176
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index ed54b3b21c39..95e066c8d45d 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -41,6 +41,7 @@ static void __init l1tf_select_mitigation(void);
>  static void __init mds_select_mitigation(void);
>  static void __init mds_print_mitigation(void);
>  static void __init taa_select_mitigation(void);
> +static void __init srbds_select_mitigation(void);
> =20
>  /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
>  u64 x86_spec_ctrl_base;
> @@ -108,6 +109,7 @@ void __init check_bugs(void)
>  	l1tf_select_mitigation();
>  	mds_select_mitigation();
>  	taa_select_mitigation();
> +	srbds_select_mitigation();
> =20
>  	/*
>  	 * As MDS and TAA mitigations are inter-related, print MDS
> @@ -397,6 +399,98 @@ static int __init tsx_async_abort_parse_cmdline(char *=
str)
>  }
>  early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);
> =20
> +#undef pr_fmt
> +#define pr_fmt(fmt)	"SRBDS: " fmt
> +
> +enum srbds_mitigations {
> +	SRBDS_MITIGATION_OFF,
> +	SRBDS_MITIGATION_UCODE_NEEDED,
> +	SRBDS_MITIGATION_FULL,
> +	SRBDS_MITIGATION_TSX_OFF,
> +	SRBDS_MITIGATION_HYPERVISOR,
> +};
> +
> +static enum srbds_mitigations srbds_mitigation __ro_after_init =3D SRBDS_M=
ITIGATION_FULL;
> +
> +static const char * const srbds_strings[] =3D {
> +	[SRBDS_MITIGATION_OFF]		=3D "Vulnerable",
> +	[SRBDS_MITIGATION_UCODE_NEEDED]	=3D "Vulnerable: No microcode",
> +	[SRBDS_MITIGATION_FULL]		=3D "Mitigation: Microcode",
> +	[SRBDS_MITIGATION_TSX_OFF]	=3D "Mitigation: TSX disabled",
> +	[SRBDS_MITIGATION_HYPERVISOR]	=3D "Unknown: Dependent on hypervisor statu=
s",
> +};
> +
> +static bool srbds_off;
> +
> +void update_srbds_msr(void)
> +{
> +	u64 mcu_ctrl;
> +
> +	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
> +		return;
> +
> +	if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
> +		return;
> +
> +	if (srbds_mitigation =3D=3D SRBDS_MITIGATION_UCODE_NEEDED)
> +		return;
> +
> +	rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
> +
> +	switch (srbds_mitigation) {
> +	case SRBDS_MITIGATION_OFF:
> +	case SRBDS_MITIGATION_TSX_OFF:
> +		mcu_ctrl |=3D RNGDS_MITG_DIS;
> +		break;
> +	case SRBDS_MITIGATION_FULL:
> +		mcu_ctrl &=3D ~RNGDS_MITG_DIS;
> +		break;
> +	default:
> +		break;
> +	}
> +
> +	wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
> +}
> +
> +static void __init srbds_select_mitigation(void)
> +{
> +	u64 ia32_cap;
> +
> +	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
> +		return;
> +
> +	/*
> +	 * Check to see if this is one of the MDS_NO systems supporting
> +	 * TSX that are only exposed to SRBDS when TSX is enabled.
> +	 */
> +	ia32_cap =3D x86_read_arch_cap_msr();
> +	if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM))
> +		srbds_mitigation =3D SRBDS_MITIGATION_TSX_OFF;
> +	else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
> +		srbds_mitigation =3D SRBDS_MITIGATION_HYPERVISOR;
> +	else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL))
> +		srbds_mitigation =3D SRBDS_MITIGATION_UCODE_NEEDED;
> +	else if (cpu_mitigations_off() || srbds_off)
> +		srbds_mitigation =3D SRBDS_MITIGATION_OFF;
> +
> +	update_srbds_msr();
> +	pr_info("%s\n", srbds_strings[srbds_mitigation]);
> +}
> +
> +static int __init srbds_parse_cmdline(char *str)
> +{
> +	if (!str)
> +		return -EINVAL;
> +
> +	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
> +		return 0;
> +
> +	srbds_off =3D !strcmp(str, "off");
> +
> +	return 0;
> +}
> +early_param("srbds", srbds_parse_cmdline);
> +
>  #undef pr_fmt
>  #define pr_fmt(fmt)     "Spectre V1 : " fmt
> =20
> @@ -1528,6 +1622,11 @@ static char *ibpb_state(void)
>  	return "";
>  }
> =20
> +static ssize_t srbds_show_state(char *buf)
> +{
> +	return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
> +}
> +
>  static ssize_t cpu_show_common(struct device *dev, struct device_attribute=
 *attr,
>  			       char *buf, unsigned int bug)
>  {
> @@ -1572,6 +1671,9 @@ static ssize_t cpu_show_common(struct device *dev, st=
ruct device_attribute *attr
>  	case X86_BUG_ITLB_MULTIHIT:
>  		return itlb_multihit_show_state(buf);
> =20
> +	case X86_BUG_SRBDS:
> +		return srbds_show_state(buf);
> +
>  	default:
>  		break;
>  	}
> @@ -1618,4 +1720,9 @@ ssize_t cpu_show_itlb_multihit(struct device *dev, st=
ruct device_attribute *attr
>  {
>  	return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT);
>  }
> +
> +ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, =
char *buf)
> +{
> +	return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS);
> +}
>  #endif
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
> index 1131ae032bf2..dee4d14eb975 100644
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -1075,6 +1075,27 @@ static const __initconst struct x86_cpu_id cpu_vuln_=
whitelist[] =3D {
>  	{}
>  };
> =20
> +#define VULNBL_INTEL_STEPPINGS(model, steppings, issues)		   \
> +	X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6,		   \
> +					    INTEL_FAM6_##model, steppings, \
> +					    X86_FEATURE_ANY, issues)
> +
> +#define SRBDS		BIT(0)
> +
> +static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst =3D {
> +	VULNBL_INTEL_STEPPINGS(IVYBRIDGE,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(HASWELL,		X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(HASWELL_L,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(HASWELL_G,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(BROADWELL_G,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(BROADWELL,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(SKYLAKE_L,	X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(SKYLAKE,		X86_STEPPING_ANY,		SRBDS),
> +	VULNBL_INTEL_STEPPINGS(KABYLAKE_L,	X86_STEPPINGS(0x0, 0xC),	SRBDS),
> +	VULNBL_INTEL_STEPPINGS(KABYLAKE,	X86_STEPPINGS(0x0, 0xD),	SRBDS),
> +	{}
> +};
> +
>  static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned lo=
ng which)
>  {
>  	const struct x86_cpu_id *m =3D x86_match_cpu(table);
> @@ -1092,6 +1113,17 @@ u64 x86_read_arch_cap_msr(void)
>  	return ia32_cap;
>  }
> =20
> +/*
> + * When running with up-to-date microcode TSX_CTRL is only enumerated on p=
arts
> + * where TSX is fused on.  When running with microcode not supporting TSX_=
CTRL,
> + * check for RTM.
> + */
> +static bool tsx_fused_off(struct cpuinfo_x86 *c, u64 ia32_cap)
> +{
> +	return !(ia32_cap & ARCH_CAP_TSX_CTRL_MSR) &&
> +		 !cpu_has(c, X86_FEATURE_RTM);
> +}
> +
>  static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
>  {
>  	u64 ia32_cap =3D x86_read_arch_cap_msr();
> @@ -1142,6 +1174,27 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x=
86 *c)
>  	     (ia32_cap & ARCH_CAP_TSX_CTRL_MSR)))
>  		setup_force_cpu_bug(X86_BUG_TAA);
> =20
> +	/*
> +	 * Some parts on the list don't have RDRAND or RDSEED. Make sure
> +	 * they show as "Not affected".
> +	 */
> +	if (cpu_has(c, X86_FEATURE_RDRAND) || cpu_has(c, X86_FEATURE_RDSEED)) {
> +		if (!cpu_matches(cpu_vuln_blacklist, SRBDS))
> +			goto srbds_not_affected;
> +
> +		/*
> +		 * Parts in the blacklist that enumerate MDS_NO are only
> +		 * vulnerable if TSX can be used.  To handle cases where TSX
> +		 * gets fused off check to see if TSX is fused off and thus not
> +		 * affected.
> +		 */
> +		if ((ia32_cap & ARCH_CAP_MDS_NO) && tsx_fused_off(c, ia32_cap))
> +			goto srbds_not_affected;
> +
> +		setup_force_cpu_bug(X86_BUG_SRBDS);
> +	}
> +
> +srbds_not_affected:
>  	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
>  		return;
> =20
> @@ -1594,6 +1647,7 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c)
>  	mtrr_ap_init();
>  	validate_apic_and_package_id(c);
>  	x86_spec_ctrl_setup_ap();
> +	update_srbds_msr();
>  }
> =20
>  static __init int setup_noclflush(char *arg)
> diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
> index 37fdefd14f28..f3e2fc44dba0 100644
> --- a/arch/x86/kernel/cpu/cpu.h
> +++ b/arch/x86/kernel/cpu/cpu.h
> @@ -44,6 +44,8 @@ struct _tlb_table {
>  extern const struct cpu_dev *const __x86_cpu_dev_start[],
>  			    *const __x86_cpu_dev_end[];
> =20
> +void update_srbds_msr(void);
> +
>  #ifdef CONFIG_CPU_SUP_INTEL
>  enum tsx_ctrl_states {
>  	TSX_CTRL_ENABLE,
> diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
> index 9a1c00fbbaef..d2136ab9b14a 100644
> --- a/drivers/base/cpu.c
> +++ b/drivers/base/cpu.c
> @@ -562,6 +562,12 @@ ssize_t __weak cpu_show_itlb_multihit(struct device *d=
ev,
>  	return sprintf(buf, "Not affected\n");
>  }
> =20
> +ssize_t __weak cpu_show_srbds(struct device *dev,
> +			      struct device_attribute *attr, char *buf)
> +{
> +	return sprintf(buf, "Not affected\n");
> +}
> +
>  static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
>  static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
>  static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
> @@ -570,6 +576,7 @@ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
>  static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
>  static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
>  static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
> +static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
> =20
>  static struct attribute *cpu_root_vulnerabilities_attrs[] =3D {
>  	&dev_attr_meltdown.attr,
> @@ -580,6 +587,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs=
[] =3D {
>  	&dev_attr_mds.attr,
>  	&dev_attr_tsx_async_abort.attr,
>  	&dev_attr_itlb_multihit.attr,
> +	&dev_attr_srbds.attr,
>  	NULL
>  };
> =20
> --=20
> 2.21.0
>=20
> SUSE Software Solutions Germany GmbH, GF: Felix Imend=C3=B6rffer, HRB 36809=
, AG N=C3=BCrnberg
> --=20

ACK
Signed-off-by: Mark Gross <[email protected]>