Restructure mds mitigation selection to use select/update/apply
functions to create consistent vulnerability handling.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
---
 arch/x86/kernel/cpu/bugs.c | 70 +++++++++++++++++++++++++++++++++-----
 1 file changed, 62 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 592d40551432..ff2d6f2e01f4 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -34,6 +34,25 @@
 
 #include "cpu.h"
 
+/*
+ * Speculation Vulnerability Handling
+ *
+ * Each vulnerability is handled with the following functions:
+ *   <vuln>_select_mitigation() -- Selects a mitigation to use.  This should
+ *				   take into account all relevant command line
+ *				   options.
+ *   <vuln>_update_mitigation() -- This is called after all vulnerabilities have
+ *				   selected a mitigation, in case the selection
+ *				   may want to change based on other choices
+ *				   made.  This function is optional.
+ *   <vuln>_apply_mitigation() -- Enable the selected mitigation.
+ *
+ * The compile-time mitigation in all cases should be AUTO.  An explicit
+ * command-line option can override AUTO.  If no such option is
+ * provided, <vuln>_select_mitigation() will override AUTO to the best
+ * mitigation option.
+ */
+
 static void __init spectre_v1_select_mitigation(void);
 static void __init spectre_v2_select_mitigation(void);
 static void __init retbleed_select_mitigation(void);
@@ -41,6 +60,8 @@ static void __init spectre_v2_user_select_mitigation(void);
 static void __init ssb_select_mitigation(void);
 static void __init l1tf_select_mitigation(void);
 static void __init mds_select_mitigation(void);
+static void __init mds_update_mitigation(void);
+static void __init mds_apply_mitigation(void);
 static void __init md_clear_update_mitigation(void);
 static void __init md_clear_select_mitigation(void);
 static void __init taa_select_mitigation(void);
@@ -165,6 +186,7 @@ void __init cpu_select_mitigations(void)
 	spectre_v2_user_select_mitigation();
 	ssb_select_mitigation();
 	l1tf_select_mitigation();
+	mds_select_mitigation();
 	md_clear_select_mitigation();
 	srbds_select_mitigation();
 	l1d_flush_select_mitigation();
@@ -175,6 +197,14 @@ void __init cpu_select_mitigations(void)
 	 */
 	srso_select_mitigation();
 	gds_select_mitigation();
+
+	/*
+	 * After mitigations are selected, some may need to update their
+	 * choices.
+	 */
+	mds_update_mitigation();
+
+	mds_apply_mitigation();
 }
 
 /*
@@ -229,9 +259,6 @@ static void x86_amd_ssb_disable(void)
 		wrmsrl(MSR_AMD64_LS_CFG, msrval);
 }
 
-#undef pr_fmt
-#define pr_fmt(fmt)	"MDS: " fmt
-
 /* Default mitigation for MDS-affected CPUs */
 static enum mds_mitigations mds_mitigation __ro_after_init =
 	IS_ENABLED(CONFIG_MITIGATION_MDS) ? MDS_MITIGATION_AUTO : MDS_MITIGATION_OFF;
@@ -277,12 +304,20 @@ enum rfds_mitigations {
 static enum rfds_mitigations rfds_mitigation __ro_after_init =
 	IS_ENABLED(CONFIG_MITIGATION_RFDS) ? RFDS_MITIGATION_AUTO : RFDS_MITIGATION_OFF;
 
+/* Return TRUE if any VERW-based mitigation is enabled. */
+static bool __init verw_mitigation_enabled(void)
+{
+	return (mds_mitigation != MDS_MITIGATION_OFF ||
+		(taa_mitigation != TAA_MITIGATION_OFF &&
+		 taa_mitigation != TAA_MITIGATION_TSX_DISABLED) ||
+		mmio_mitigation != MMIO_MITIGATION_OFF ||
+		rfds_mitigation != RFDS_MITIGATION_OFF);
+}
+
 static void __init mds_select_mitigation(void)
 {
-	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
+	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
 		mds_mitigation = MDS_MITIGATION_OFF;
-		return;
-	}
 
 	if (mds_mitigation == MDS_MITIGATION_AUTO)
 		mds_mitigation = MDS_MITIGATION_FULL;
@@ -290,9 +325,29 @@ static void __init mds_select_mitigation(void)
 	if (mds_mitigation == MDS_MITIGATION_FULL) {
 		if (!boot_cpu_has(X86_FEATURE_MD_CLEAR))
 			mds_mitigation = MDS_MITIGATION_VMWERV;
+	}
+}
 
-		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+static void __init mds_update_mitigation(void)
+{
+	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
+		return;
+
+	/* If TAA, MMIO, or RFDS are being mitigated, MDS gets mitigated too. */
+	if (verw_mitigation_enabled()) {
+		if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
+			mds_mitigation = MDS_MITIGATION_FULL;
+		else
+			mds_mitigation = MDS_MITIGATION_VMWERV;
+	}
+
+	pr_info("MDS: %s\n", mds_strings[mds_mitigation]);
+}
 
+static void __init mds_apply_mitigation(void)
+{
+	if (mds_mitigation == MDS_MITIGATION_FULL) {
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
 		if (!boot_cpu_has(X86_BUG_MSBDS_ONLY) &&
 		    (mds_nosmt || cpu_mitigations_auto_nosmt()))
 			cpu_smt_disable(false);
@@ -595,7 +650,6 @@ static void __init md_clear_update_mitigation(void)
 
 static void __init md_clear_select_mitigation(void)
 {
-	mds_select_mitigation();
 	taa_select_mitigation();
 	mmio_select_mitigation();
 	rfds_select_mitigation();
-- 
2.34.1

On Wed, Jan 08, 2025 at 02:24:44PM -0600, David Kaplan wrote:
> @@ -229,9 +259,6 @@ static void x86_amd_ssb_disable(void)
>  		wrmsrl(MSR_AMD64_LS_CFG, msrval);
>  }
>  
> -#undef pr_fmt
> -#define pr_fmt(fmt)	"MDS: " fmt
> -

Why?  For consistency with the rest of the file it's best to leave the
correct pr_fmt() in place for mds_*(), taa_*(), rfds_*(), etc.

>  static void __init mds_select_mitigation(void)
>  {
> -	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
> +	if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
>  		mds_mitigation = MDS_MITIGATION_OFF;
> -		return;
> -	}

For clarity it should still return here, that makes it obvious none of
the subsequent conditions apply.

> +static void __init mds_apply_mitigation(void)
> +{
> +	if (mds_mitigation == MDS_MITIGATION_FULL) {
> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);

The mitigation still needs to be attempted for the MDS_MITIGATION_VMWERV
case.

-- 
Josh

On Wed, 8 Jan 2025 at 21:27, David Kaplan <david.kaplan@amd.com> wrote:
> +/*
> + * Speculation Vulnerability Handling
> + *
> + * Each vulnerability is handled with the following functions:
> + *   <vuln>_select_mitigation() -- Selects a mitigation to use.  This should
> + *                                take into account all relevant command line
> + *                                options.
> + *   <vuln>_update_mitigation() -- This is called after all vulnerabilities have
> + *                                selected a mitigation, in case the selection
> + *                                may want to change based on other choices
> + *                                made.  This function is optional.
> + *   <vuln>_apply_mitigation() -- Enable the selected mitigation.

Maybe also worth calling out cpu_bugs_smt_update() here?

> +/* Return TRUE if any VERW-based mitigation is enabled. */
> +static bool __init verw_mitigation_enabled(void)
> +{
> +       return (mds_mitigation != MDS_MITIGATION_OFF ||
> +               (taa_mitigation != TAA_MITIGATION_OFF &&
> +                taa_mitigation != TAA_MITIGATION_TSX_DISABLED) ||
> +               mmio_mitigation != MMIO_MITIGATION_OFF ||
> +               rfds_mitigation != RFDS_MITIGATION_OFF);
> +}

Since you defined such nice terminology above, why not use it here and
say verw_mitigation_selected()?

(Obviously if the alternative was a respin for this trivial issue
alone I would prefer to merge with the current name!)

> +static void __init mds_update_mitigation(void)
> +{
> +       if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
> +               return;
> +
> +       /* If TAA, MMIO, or RFDS are being mitigated, MDS gets mitigated too. */
> +       if (verw_mitigation_enabled()) {
> +               if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
> +                       mds_mitigation = MDS_MITIGATION_FULL;
> +               else
> +                       mds_mitigation = MDS_MITIGATION_VMWERV;
> +       }

This is changing what the user will see in sysfs. This seems good to
me, but it would be worth calling it out in the commit log I think.