From nobody Fri May 17 08:39:28 2024 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19AE7364 for ; Wed, 17 Apr 2024 00:15:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713312914; cv=none; b=gf5ma6O9dRXaT809uWRcKzsj1XIDxBoWA7sidXANZoCsK1d8lgNWX2yvqPg+0lERtQ4ZL/RQV6e+lLw8B4YFzvTnB0ZsEOmq6Bl+45aESWiVNVQgJ904gBmuCATvT3yGtnbTYl9XSdC58SjInHu/Mp+E0kiNUjbqG1jjSCw/vvo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713312914; c=relaxed/simple; bh=AacvfWgUXUIENBNEnwfPiB1vP9BLM+sOUlSbsxnKkKE=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=IAujqP4xPm9p7hww4SYCNkkoYCPqEh8rRHmpfmufBtRPuLsg0cEGbMI+N6A/QT+M4tA+pafu29Ld81LEaIQQnc2OTBxQDweI+buzSpEunQlHruDEwyOvvhfJTqzR/TV1k6BSEwoCzEDkRG3goO8z3DPmSBKomq/9eDFuD3e2lgg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RNyrZRwk; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RNyrZRwk" Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-ddaf2f115f2so7219211276.3 for ; Tue, 16 Apr 2024 17:15:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1713312912; x=1713917712; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=m9VfputrxLnVngbwQFKyRzwQMY5dHXwAcsvKFnPKLMI=; b=RNyrZRwkUL+bfRFbIaog45oNyBmvXY3r9tAP82PtSnGv1o7cu6uOm1rnyRxlYgCvEw r8mxybDZ+LAEnL2cMMy36DsjgfVCDgZQhihVTamO764/oj3XTHWddAkDNQ4w64h63e2n 4CHjF5NeA3P1t+vfUNY8gTBBlxUxf9MBmgv6n1rYzrfDF74tEw9V/Mz5fIuPLx8Qeyop J4oWITpf1Sr3a2vWqgjvUgu0HVURLPje0W8dQf9I49N0pPExSSPItdF7H2XgmBvjzyg7 5OCahzws77hAgo5IQMOo6Xxdcnm8S+Xaz4XZl9G51ATHhZuuGf4cc6pm8eDMvu+MrvZb T6bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713312912; x=1713917712; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=m9VfputrxLnVngbwQFKyRzwQMY5dHXwAcsvKFnPKLMI=; b=EhlSVdL5tl4GSkpdDfFiHNA8JXIcKnvwNA7N6Nywa9SOoXHr3zZfgkOg3ShI4GSq7g fC6rDMUZQ8P8ilxAW8IGhi9hPHSoQ+N751L0BsCP2tRy2NBydaM/fpzboFdsR7rARyj5 G+1MD3dN6eMBdQ88uzLVIOdFxFstLRfuByV0XAscoLXk/cSDHXjeAoumxXUkATA8vxjU VHQJPxlQDr80I/Cl0aXy8LQLBF+Oe6Iq6BVLMoF0em/NhlYzbF17/eP27OGOmv3DeNAR 9WoVO9JEckFVPwBk6L2L0o0AuzuuTzyO2zxyvrWx4t5CTrKR72Rl2NkYj3DLHzGY8Kgl asGQ== X-Forwarded-Encrypted: i=1; AJvYcCXPQAEtgSbGT0Ntlzjz85QbT63AgI+92v4LuiSxuhOzfjlX+20TLuI85MSB99KVwfvqT5kv0znP7yIOogSCWRZH7SjAYr4Ly5T6go02 X-Gm-Message-State: AOJu0YysTBoKgxVC2rw3kvpZD4HMBW9m9d7mvpopn9TQOnMs+wiP+mQM dymZOD0PH6rqSmBTpE09Q5t2uEvsp/8QDAcO+PisRs+AnjTicpLnUh/Zl4HjmrB/1IMsLpxonf9 6mA== X-Google-Smtp-Source: AGHT+IEsD1OB0gpWHFEKLasEXYUSKqQne4naFc8D53c4PKnQiTM/HxL97vSCDZ0CgKo+9+oF+XItMkUdtiU= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6902:c0c:b0:de1:d49:7ff6 with SMTP id fs12-20020a0569020c0c00b00de10d497ff6mr1198221ybb.7.1713312912168; Tue, 16 Apr 2024 17:15:12 -0700 (PDT) Reply-To: Sean Christopherson Date: Tue, 16 Apr 2024 17:15:06 -0700 In-Reply-To: <20240417001507.2264512-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240417001507.2264512-1-seanjc@google.com> X-Mailer: git-send-email 2.44.0.683.g7961c838ac-goog Message-ID: <20240417001507.2264512-2-seanjc@google.com> Subject: [PATCH 1/2] cpu: Re-enable CPU mitigations by default for !X86 architectures From: Sean Christopherson To: Jonathan Corbet , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, Greg Kroah-Hartman , Peter Zijlstra Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Stephen Rothwell , Michael Ellerman , Geert Uytterhoeven , Sean Christopherson Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a generic Kconfig, CPU_MITIGATIONS, to control whether or not CPU mitigations are enabled by default, and force it on for all architectures except x86. A recent commit to turn mitigations off by default if SPECULATION_MITIGATIONS=3Dn kinda sorta missed that "cpu_mitigations" is completely generic, where as SPECULATION_MITIGATIONS is x86 specific. Alternatively, SPECULATION_MITIGATIONS could simply be defined in common code, but that creates weirdness for x86 because SPECULATION_MITIGATIONS ends up being defined twice, and the default behavior would likely depend on the arbitrary include order (if the two definitions diverged). Ideally, CPU_MITIGATIONS would be unconditionally on by default for all architectures, and manually turned off, but there is no way to unselect a Kconfig. Reported-by: Stephen Rothwell Reported-by: Michael Ellerman Reported-by: Geert Uytterhoeven Closes: https://lkml.kernel.org/r/20240413115324.53303a68%40canb.auug.org.au Fixes: f337a6a21e2f ("x86/cpu: Actually turn off mitigations by default for= SPECULATION_MITIGATIONS=3Dn") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Acked-by: Will Deacon Tested-by: Geert Uytterhoeven Tested-by: Michael Ellerman (powerpc) --- arch/x86/Kconfig | 1 + drivers/base/Kconfig | 3 +++ kernel/cpu.c | 4 ++-- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 4474bf32d0a4..a0eca6313276 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2490,6 +2490,7 @@ config PREFIX_SYMBOLS =20 menuconfig SPECULATION_MITIGATIONS bool "Mitigations for speculative execution vulnerabilities" + select CPU_MITIGATIONS default y help Say Y here to enable options which enable mitigations for diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig index 2b8fd6bb7da0..dab19f15fa57 100644 --- a/drivers/base/Kconfig +++ b/drivers/base/Kconfig @@ -191,6 +191,9 @@ config GENERIC_CPU_AUTOPROBE config GENERIC_CPU_VULNERABILITIES bool =20 +config CPU_MITIGATIONS + def_bool !X86 + config SOC_BUS bool select GLOB diff --git a/kernel/cpu.c b/kernel/cpu.c index 07ad53b7f119..bb0ff275fb46 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -3207,8 +3207,8 @@ enum cpu_mitigations { }; =20 static enum cpu_mitigations cpu_mitigations __ro_after_init =3D - IS_ENABLED(CONFIG_SPECULATION_MITIGATIONS) ? CPU_MITIGATIONS_AUTO : - CPU_MITIGATIONS_OFF; + IS_ENABLED(CONFIG_CPU_MITIGATIONS) ? CPU_MITIGATIONS_AUTO : + CPU_MITIGATIONS_OFF; =20 static int __init mitigations_parse_cmdline(char *arg) { --=20 2.44.0.683.g7961c838ac-goog From nobody Fri May 17 08:39:28 2024 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33AA6184D for ; Wed, 17 Apr 2024 00:15:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713312916; cv=none; b=jgvt5OKkvhFZMTYMiXKp64rTUvk7/0Xv7vWYni8AE71DjToexE+p+0DSlMvhi4diiARyRyDlM59qydjzvkcQJyE7rorTJe0/cWfQLIj0WSmXTLbqfBzfKj28DXfJIi1yLgg5rEhJdtCbVdCeDkQ/k6v73DfwDLkFbJ2+rTsjMcU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713312916; c=relaxed/simple; bh=0UVGRaaY/AaWE2yiYwE1iCIDluyE17+bs6H2PNq1AC8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=tepJV6wrfiKYyNi43sMBZE93UqZ++AwXxNLEpTxd6cSliAwTG3eotvyrLar8CNZSfdIzmGjusLvT+17n6RV2nphtd7SW4h7ty6e34TomJ5+j9txo+mLo5hV0Ouk1uoRG2zfhErmuMpqZ1u3xOd5kGhKPO0LGATdVH6FGAvM6q/E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=WFmPEmy9; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="WFmPEmy9" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-2a4fc4cf54dso5098997a91.1 for ; Tue, 16 Apr 2024 17:15:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1713312914; x=1713917714; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=5ofQ3KH15PkqJ9IroccuDO0HaegnEECNOZCgmKj3yJg=; b=WFmPEmy9VC08Mr25XlxHqie6e1vIwxqgWC2JZy8a1HKzRHV12FPLSq5+kU1b8SvE+r HnBRbGsEq6k10t6olld2vfD2/EhaKY5F+I6cqVxsI9GienONj+iO+w1jzsy0JqoJq81V UT0cDrIrPtaWrjj9GTpnzcCGMFHcLC+/HbcXeWhsrCnNEwAAIfOL7a/GD1Lxkj++jurS A+Tzb5AslvTCmxvHLZfQcQ9P1t3jLBeEH0gedC7oTIoF6fkWw1SSnDyQWLgtEv19F4s4 2niVgkhkan+qLpjwdHPox9XoqVczMVf45kvAbBLu5Iq7uRm7ChXUyanWtNPBU7iLMRK2 IlqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713312914; x=1713917714; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=5ofQ3KH15PkqJ9IroccuDO0HaegnEECNOZCgmKj3yJg=; b=xRaTUGpcwAnaB0bVmhcDrucYwm868Uc1mIGWu/DYGgPTXbal8Q/YGgWNyCAz1ag7Ip hvdkaDLfq9RhfNJOLhjOi74uMkXPEy8pmedLTXMnKu6BWl7yk0ozay+Qp94ap5oVAQGD 4UjjaY7SE9vAhZFo5cQI4/ciugoG4nG7JaPr4rkRbWURE9Iqoaga+guBW/lrvk6zsOu7 WCpon+SfyH6HeiBs+LuUGztEdnjroP/70+9X5ntT+B9RYnhTgHtoMZiYVQrFmWNDSJQ4 zDDpe2nbHFFhazil+oSe6d1SDsOCd1zsLcX/mBvaHsQJiNUgLnTlTlN9O4gfl11dJogt LwJw== X-Forwarded-Encrypted: i=1; AJvYcCXSgQ6+PSdXapV6oPvknQrZxT/y4ALwzxsJykFHQzkiUZhxaTq5ShGRlunU5eHs/m4/Op1U95wPLc8BLLeNzB1BFUQustabb5dhmbU3 X-Gm-Message-State: AOJu0YxsZkckmOk7kD3u3KgGAi/pJNVNQ/4B5RSuJy2m+OTrjXw7lMRA qQ1Zuc7P6w9aDizw/Oe3OBvQJK5wPZigSWw9VBiS1dKnvMHvZAevzqxvQyamd+ZWw5GU36QDeA2 icg== X-Google-Smtp-Source: AGHT+IF2DFS2VtgAyUhW0lsQ8B2jlSVOSsnmicyBH5IXA35vfEPayetT8/ucpiCo2V7UyBChWtpcbZH0q30= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:90b:3108:b0:2a5:c859:f94f with SMTP id gc8-20020a17090b310800b002a5c859f94fmr58452pjb.3.1713312913929; Tue, 16 Apr 2024 17:15:13 -0700 (PDT) Reply-To: Sean Christopherson Date: Tue, 16 Apr 2024 17:15:07 -0700 In-Reply-To: <20240417001507.2264512-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240417001507.2264512-1-seanjc@google.com> X-Mailer: git-send-email 2.44.0.683.g7961c838ac-goog Message-ID: <20240417001507.2264512-3-seanjc@google.com> Subject: [PATCH 2/2] cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n From: Sean Christopherson To: Jonathan Corbet , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, Greg Kroah-Hartman , Peter Zijlstra Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Stephen Rothwell , Michael Ellerman , Geert Uytterhoeven , Sean Christopherson Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly disallow enabling mitigations at runtime for kernels that were built with CONFIG_CPU_MITIGATIONS=3Dn, which currently is possible only on x86 (via x86's SPECULATION_MITIGATIONS menuconfig). On x86, a large pile of Kconfigs are buried behind SPECULATION_MITIGATIONS, and trying to provide sane behavior for retroactively enabling mitigations is extremely difficult, bordering on impossible. E.g. page table isolation and call depth tracking requrie build-time support, BHI mitigations will still be off without additional kernel parameters, etc. Signed-off-by: Sean Christopherson --- Documentation/admin-guide/kernel-parameters.txt | 3 +++ arch/x86/Kconfig | 10 +++++++--- kernel/cpu.c | 2 ++ 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 902ecd92a29f..73cc672de9c3 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3423,6 +3423,9 @@ arch-independent options, each of which is an aggregation of existing arch-specific options. =20 + Note, "mitigations" is supported on x86 if and only if + the kernel was built with SPECULATION_MITIGATIONS=3Dy. + off Disable all optional CPU mitigations. This improves system performance, but it may also diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index a0eca6313276..3021976e34cf 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2494,10 +2494,14 @@ menuconfig SPECULATION_MITIGATIONS default y help Say Y here to enable options which enable mitigations for - speculative execution hardware vulnerabilities. + speculative execution hardware vulnerabilities. Mitigations can + be disabled or restricted to SMT systems at runtime via the + "mitigations" kernel parameter. =20 - If you say N, all mitigations will be disabled. You really - should know what you are doing to say so. + If you say N, all mitigations will be disabled. This CANNOT be + overridden at runtime. + + Say 'Y', unless you really know what you are doing. =20 if SPECULATION_MITIGATIONS =20 diff --git a/kernel/cpu.c b/kernel/cpu.c index bb0ff275fb46..e3f2b34bb378 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -3214,6 +3214,8 @@ static int __init mitigations_parse_cmdline(char *arg) { if (!strcmp(arg, "off")) cpu_mitigations =3D CPU_MITIGATIONS_OFF; + else if (!IS_ENABLED(CONFIG_CPU_MITIGATIONS)) + pr_crit("Kernel compiled without mitigations, ignoring 'mitigations'; sy= stem may still be vulnerable\n"); else if (!strcmp(arg, "auto")) cpu_mitigations =3D CPU_MITIGATIONS_AUTO; else if (!strcmp(arg, "auto,nosmt")) --=20 2.44.0.683.g7961c838ac-goog