/* * Testing the presence of the MSR is not enough. Need to check * that the PPIN_CTL allows reading of the PPIN.
*/
info = (struct ppin_info *)id->driver_data;
if (rdmsrq_safe(info->msr_ppin_ctl, &val)) goto clear_ppin;
if ((val & 3UL) == 1UL) { /* PPIN locked in disabled mode */ goto clear_ppin;
}
/* If PPIN is disabled, try to enable */ if (!(val & 2UL)) {
wrmsrq_safe(info->msr_ppin_ctl, val | 2UL);
rdmsrq_safe(info->msr_ppin_ctl, &val);
}
/* Is the enable bit set? */ if (val & 2UL) {
c->ppin = native_rdmsrq(info->msr_ppin);
set_cpu_cap(c, info->feature); return;
}
clear_ppin:
setup_clear_cpu_cap(info->feature);
}
staticvoid default_init(struct cpuinfo_x86 *c)
{ #ifdef CONFIG_X86_64
cpu_detect_cache_sizes(c); #else /* Not much we can do here... */ /* Check if at least it has cpuid */ if (c->cpuid_level == -1) { /* No cpuid. It must be an ancient CPU */ if (c->x86 == 4)
strcpy(c->x86_model_id, "486"); elseif (c->x86 == 3)
strcpy(c->x86_model_id, "386");
} #endif
}
DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = { #ifdef CONFIG_X86_64 /* * We need valid kernel segments for data and code in long mode too * IRET will check the segment types kkeil 2000/10/28 * Also sysret mandates a special GDT layout * * TLS descriptors are currently at a different place compared to i386. * Hopefully nobody expects them at a fixed place (Wine?)
*/
[GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(DESC_CODE32, 0, 0xfffff),
[GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(DESC_CODE64, 0, 0xfffff),
[GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(DESC_DATA64, 0, 0xfffff),
[GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(DESC_CODE32 | DESC_USER, 0, 0xfffff),
[GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(DESC_DATA64 | DESC_USER, 0, 0xfffff),
[GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(DESC_CODE64 | DESC_USER, 0, 0xfffff), #else
[GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(DESC_CODE32, 0, 0xfffff),
[GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(DESC_DATA32, 0, 0xfffff),
[GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(DESC_CODE32 | DESC_USER, 0, 0xfffff),
[GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(DESC_DATA32 | DESC_USER, 0, 0xfffff), /* * Segments used for calling PnP BIOS have byte granularity. * They code segments and data segments have fixed 64k limits, * the transfer segment sizes are set at run time.
*/
[GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(DESC_CODE32_BIOS, 0, 0xffff),
[GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(DESC_CODE16, 0, 0xffff),
[GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(DESC_DATA16, 0, 0xffff),
[GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(DESC_DATA16, 0, 0),
[GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(DESC_DATA16, 0, 0), /* * The APM segments have byte granularity and their bases * are set at run time. All have 64k limits.
*/
[GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(DESC_CODE32_BIOS, 0, 0xffff),
[GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(DESC_CODE16, 0, 0xffff),
[GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(DESC_DATA32_BIOS, 0, 0xffff),
/* Standard macro to see if a specific flag is changeable */ staticinlinebool flag_is_changeable_p(unsignedlong flag)
{ unsignedlong f1, f2;
if (!IS_ENABLED(CONFIG_X86_32)) returntrue;
/* * Cyrix and IDT cpus allow disabling of CPUID * so the code below may return different results * when it is executed before and after enabling * the CPUID. Add "volatile" to not allow gcc to * optimize the subsequent calls to this function.
*/ asmvolatile ("pushfl \n\t" "pushfl \n\t" "popl %0 \n\t" "movl %0, %1 \n\t" "xorl %2, %0 \n\t" "pushl %0 \n\t" "popfl \n\t" "pushfl \n\t" "popl %0 \n\t" "popfl \n\t"
/* This should have been cleared long ago */
BUG_ON(eflags & X86_EFLAGS_AC);
if (cpu_has(c, X86_FEATURE_SMAP))
cr4_set_bits(X86_CR4_SMAP);
}
static __always_inline void setup_umip(struct cpuinfo_x86 *c)
{ /* Check the boot processor, plus build option for UMIP. */ if (!cpu_feature_enabled(X86_FEATURE_UMIP)) goto out;
/* Check the current processor's cpuid bits. */ if (!cpu_has(c, X86_FEATURE_UMIP)) goto out;
cr4_set_bits(X86_CR4_UMIP);
pr_info_once("x86/cpu: User Mode Instruction Prevention (UMIP) activated\n");
return;
out: /* * Make sure UMIP is disabled in case it was enabled in a * previous boot (e.g., via kexec).
*/
cr4_clear_bits(X86_CR4_UMIP);
}
/* These bits should not change their value after CPU init is finished. */ staticconstunsignedlong cr4_pinned_mask = X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP |
X86_CR4_FSGSBASE | X86_CR4_CET | X86_CR4_FRED; static DEFINE_STATIC_KEY_FALSE_RO(cr_pinning); staticunsignedlong cr4_pinned_bits __ro_after_init;
if (static_branch_likely(&cr_pinning)) { if (unlikely((val & X86_CR0_WP) != X86_CR0_WP)) {
bits_missing = X86_CR0_WP;
val |= bits_missing; goto set_register;
} /* Warn after we've set the missing bits. */
WARN_ONCE(bits_missing, "CR0 WP bit went missing!?\n");
}
}
EXPORT_SYMBOL(native_write_cr0);
if (boot_cpu_has(X86_FEATURE_PCID))
cr4 |= X86_CR4_PCIDE; if (static_branch_likely(&cr_pinning))
cr4 = (cr4 & ~cr4_pinned_mask) | cr4_pinned_bits;
__write_cr4(cr4);
/* Initialize cr4 shadow for this CPU. */
this_cpu_write(cpu_tlbstate.cr4, cr4);
}
/* * Once CPU feature detection is finished (and boot params have been * parsed), record any of the sensitive CR bits that are set, and * enable CR pinning.
*/ staticvoid __init setup_cr_pinning(void)
{
cr4_pinned_bits = this_cpu_read(cpu_tlbstate.cr4) & cr4_pinned_mask;
static_key_enable(&cr_pinning.key);
}
static __init int x86_nofsgsbase_setup(char *arg)
{ /* Require an exact match without trailing characters. */ if (strlen(arg)) return 0;
/* Do not emit a message if the feature is not present. */ if (!boot_cpu_has(X86_FEATURE_FSGSBASE)) return 1;
/* * Protection Keys are not available in 32-bit mode.
*/ staticbool pku_disabled;
static __always_inline void setup_pku(struct cpuinfo_x86 *c)
{ if (c == &boot_cpu_data) { if (pku_disabled || !cpu_feature_enabled(X86_FEATURE_PKU)) return; /* * Setting CR4.PKE will cause the X86_FEATURE_OSPKE cpuid * bit to be set. Enforce it.
*/
setup_force_cpu_cap(X86_FEATURE_OSPKE);
cr4_set_bits(X86_CR4_PKE); /* Load the default PKRU value */
pkru_write_default();
}
#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS static __init int setup_disable_pku(char *arg)
{ /* * Do not clear the X86_FEATURE_PKU bit. All of the * runtime checks are against OSPKE so clearing the * bit does nothing. * * This way, we will see "pku" in cpuinfo, but not * "ospke", which is exactly what we want. It shows * that the CPU has PKU, but the OS has not enabled it. * This happens to be exactly how a system would look * if we disabled the config option.
*/
pr_info("x86: 'nopku' specified, disabling Memory Protection Keys\n");
pku_disabled = true; return 1;
}
__setup("nopku", setup_disable_pku); #endif
/* * Some CPU features depend on higher CPUID levels, which may not always * be available due to CPUID level capping or broken virtualization * software. Add those features to this table to auto-disable them.
*/ struct cpuid_dependent_feature {
u32 feature;
u32 level;
};
for (df = cpuid_dependent_features; df->feature; df++) {
if (!cpu_has(c, df->feature)) continue; /* * Note: cpuid_level is set to -1 if unavailable, but * extended_extended_level is set to 0 if unavailable * and the legitimate extended levels are all negative * when signed; hence the weird messing around with * signs here...
*/ if (!((s32)df->level < 0 ?
(u32)df->level > (u32)c->extended_cpuid_level :
(s32)df->level > (s32)c->cpuid_level)) continue;
clear_cpu_cap(c, df->feature); if (!warn) continue;
pr_warn("CPU: CPU feature %s disabled, no CPUID level 0x%x\n",
x86_cap_flags[df->feature], df->level);
}
}
/* * Naming convention should be: <Name> [(<Codename>)] * This table only is used unless init_<vendor>() below doesn't set it; * in particular, if CPUID levels 0x80000002..4 are supported, this * isn't used
*/
/* Look up CPU names by table lookup. */ staticconstchar *table_lookup_model(struct cpuinfo_x86 *c)
{ #ifdef CONFIG_X86_32 conststruct legacy_cpu_model_info *info;
if (c->x86_model >= 16) return NULL; /* Range check */
if (!this_cpu) return NULL;
info = this_cpu->legacy_models;
while (info->family) { if (info->family == c->x86) return info->model_names[c->x86_model];
info++;
} #endif return NULL; /* Not found */
}
/* Aligned to unsigned long to avoid split lock in atomic bitmap ops */
__u32 cpu_caps_cleared[NCAPINTS + NBUGINTS] __aligned(sizeof(unsignedlong));
__u32 cpu_caps_set[NCAPINTS + NBUGINTS] __aligned(sizeof(unsignedlong));
#ifdef CONFIG_X86_32 /* The 32-bit entry code needs to find cpu_entry_area. */
DEFINE_PER_CPU(struct cpu_entry_area *, cpu_entry_area); #endif
/* Load the original GDT from the per-cpu structure */ void load_direct_gdt(int cpu)
{ struct desc_ptr gdt_descr;
/** * switch_gdt_and_percpu_base - Switch to direct GDT and runtime per CPU base * @cpu: The CPU number for which this is invoked * * Invoked during early boot to switch from early GDT and early per CPU to * the direct GDT and the runtime per CPU area. On 32-bit the percpu base * switch is implicit by loading the direct GDT. On 64bit this requires * to update GSBASE.
*/ void __init switch_gdt_and_percpu_base(int cpu)
{
load_direct_gdt(cpu);
#ifdef CONFIG_X86_64 /* * No need to load %gs. It is already correct. * * Writing %gs on 64bit would zero GSBASE which would make any per * CPU operation up to the point of the wrmsrq() fault. * * Set GSBASE to the new offset. Until the wrmsrq() happens the * early mapping is still valid. That means the GSBASE update will * lose any prior per CPU data which was not copied over in * setup_per_cpu_areas(). * * This works even with stackprotector enabled because the * per CPU stack canary is 0 in both per CPU areas.
*/
wrmsrq(MSR_GS_BASE, cpu_kernelmode_gs_base(cpu)); #else /* * %fs is already set to __KERNEL_PERCPU, but after switching GDT * it is required to load FS again so that the 'hidden' part is * updated from the new GDT. Up to this point the early per CPU * translation is active. Any content of the early per CPU data * which was not copied over in setup_per_cpu_areas() is lost.
*/
loadsegment(fs, __KERNEL_PERCPU); #endif
}
staticvoid apply_forced_caps(struct cpuinfo_x86 *c)
{ int i;
for (i = 0; i < NCAPINTS + NBUGINTS; i++) {
c->x86_capability[i] &= ~cpu_caps_cleared[i];
c->x86_capability[i] |= cpu_caps_set[i];
}
}
staticvoid init_speculation_control(struct cpuinfo_x86 *c)
{ /* * The Intel SPEC_CTRL CPUID bit implies IBRS and IBPB support, * and they also have a different bit for STIBP support. Also, * a hypervisor might have set the individual AMD bits even on * Intel CPUs, for finer-grained selection of what's available.
*/ if (cpu_has(c, X86_FEATURE_SPEC_CTRL)) {
set_cpu_cap(c, X86_FEATURE_IBRS);
set_cpu_cap(c, X86_FEATURE_IBPB);
set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL);
}
if (cpu_has(c, X86_FEATURE_INTEL_STIBP))
set_cpu_cap(c, X86_FEATURE_STIBP);
if (cpu_has(c, X86_FEATURE_SPEC_CTRL_SSBD) ||
cpu_has(c, X86_FEATURE_VIRT_SSBD))
set_cpu_cap(c, X86_FEATURE_SSBD);
if (cpu_has(c, X86_FEATURE_AMD_IBRS)) {
set_cpu_cap(c, X86_FEATURE_IBRS);
set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL);
}
if (cpu_has(c, X86_FEATURE_AMD_IBPB))
set_cpu_cap(c, X86_FEATURE_IBPB);
if (cpu_has(c, X86_FEATURE_AMD_STIBP)) {
set_cpu_cap(c, X86_FEATURE_STIBP);
set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL);
}
/* Check valid sub-leaf index before accessing it */ if (eax >= 1) {
cpuid_count(0x00000007, 1, &eax, &ebx, &ecx, &edx);
c->x86_capability[CPUID_7_1_EAX] = eax;
}
}
/* Extended state features: level 0x0000000d */ if (c->cpuid_level >= 0x0000000d) {
cpuid_count(0x0000000d, 1, &eax, &ebx, &ecx, &edx);
c->x86_capability[CPUID_D_1_EAX] = eax;
}
/* * Check if extended CPUID leaves are implemented: Max extended * CPUID leaf must be in the 0x80000001-0x8000ffff range.
*/
eax = cpuid_eax(0x80000000);
c->extended_cpuid_level = ((eax & 0xffff0000) == 0x80000000) ? eax : 0;
if (c->extended_cpuid_level >= 0x80000001) {
cpuid(0x80000001, &eax, &ebx, &ecx, &edx);
/* * Clear/Set all flags overridden by options, after probe. * This needs to happen each time we re-probe, which may happen * several times during CPU initialization.
*/
apply_forced_caps(c);
}
staticvoid identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
{ int i;
/* * First of all, decide if this is a 486 or higher * It's a 486 if we can modify the AC flag
*/ if (flag_is_changeable_p(X86_EFLAGS_AC))
c->x86 = 4; else
c->x86 = 3;
for (i = 0; i < X86_VENDOR_NUM; i++) if (cpu_devs[i] && cpu_devs[i]->c_identify) {
c->x86_vendor_id[0] = 0;
cpu_devs[i]->c_identify(c); if (c->x86_vendor_id[0]) {
get_cpu_vendor(c); break;
}
}
}
/* * Technically, swapgs isn't serializing on AMD (despite it previously * being documented as such in the APM). But according to AMD, %gs is * updated non-speculatively, and the issuing of %gs-relative memory * operands will be blocked until the %gs update completes, which is * good enough for our purposes.
*/
#define SRBDS BIT(0) /* CPU is affected by X86_BUG_MMIO_STALE_DATA */ #define MMIO BIT(1) /* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */ #define MMIO_SBDS BIT(2) /* CPU is affected by RETbleed, speculating where you would not expect it */ #define RETBLEED BIT(3) /* CPU is affected by SMT (cross-thread) return predictions */ #define SMT_RSB BIT(4) /* CPU is affected by SRSO */ #define SRSO BIT(5) /* CPU is affected by GDS */ #define GDS BIT(6) /* CPU is affected by Register File Data Sampling */ #define RFDS BIT(7) /* CPU is affected by Indirect Target Selection */ #define ITS BIT(8) /* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */ #define ITS_NATIVE_ONLY BIT(9) /* CPU is affected by Transient Scheduler Attacks */ #define TSA BIT(10) /* CPU is affected by VMSCAPE */ #define VMSCAPE BIT(11)
staticbool __init vulnerable_to_rfds(u64 x86_arch_cap_msr)
{ /* The "immunity" bit trumps everything else: */ if (x86_arch_cap_msr & ARCH_CAP_RFDS_NO) returnfalse;
/* * VMMs set ARCH_CAP_RFDS_CLEAR for processors not in the blacklist to * indicate that mitigation is needed because guest is running on a * vulnerable hardware or may migrate to such hardware:
*/ if (x86_arch_cap_msr & ARCH_CAP_RFDS_CLEAR) returntrue;
/* Only consult the blacklist when there is no enumeration: */ return cpu_matches(cpu_vuln_blacklist, RFDS);
}
staticbool __init vulnerable_to_its(u64 x86_arch_cap_msr)
{ /* The "immunity" bit trumps everything else: */ if (x86_arch_cap_msr & ARCH_CAP_ITS_NO) returnfalse; if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) returnfalse;
/* None of the affected CPUs have BHI_CTRL */ if (boot_cpu_has(X86_FEATURE_BHI_CTRL)) returnfalse;
/* * If a VMM did not expose ITS_NO, assume that a guest could * be running on a vulnerable hardware or may migrate to such * hardware.
*/ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) returntrue;
if (cpu_matches(cpu_vuln_blacklist, ITS)) returntrue;
/* Give unknown CPUs a pass: */ if (!m) { /* Intel CPUs should be in the list. Warn if not: */ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
pr_info("x86/CPU: Model not found in latest microcode list\n"); returnfalse;
}
/* * Hosts usually lie to guests with a super high microcode * version. Just ignore what hosts tell guests:
*/ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) returnfalse;
/* Consider all debug microcode to be old: */ if (boot_cpu_data.microcode & BIT(31)) returntrue;
/* Give new microcode a pass: */ if (boot_cpu_data.microcode >= m->driver_data) returnfalse;
if (cpu_has_old_microcode()) {
pr_warn("x86/CPU: Running old microcode\n");
setup_force_cpu_bug(X86_BUG_OLD_MICROCODE);
add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
}
/* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */ if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) &&
!(x86_arch_cap_msr & ARCH_CAP_PSCHANGE_MC_NO))
setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT);
if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION)) return;
setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
if (!cpu_matches(cpu_vuln_whitelist, NO_SPECTRE_V2)) {
setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
setup_force_cpu_bug(X86_BUG_SPECTRE_V2_USER);
}
/* * AMD's AutoIBRS is equivalent to Intel's eIBRS - use the Intel feature * flag and protect from vendor-specific bugs via the whitelist. * * Don't use AutoIBRS when SNP is enabled because it degrades host * userspace indirect branch performance.
*/ if ((x86_arch_cap_msr & ARCH_CAP_IBRS_ALL) ||
(cpu_has(c, X86_FEATURE_AUTOIBRS) &&
!cpu_feature_enabled(X86_FEATURE_SEV_SNP))) {
setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED); if (!cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
!(x86_arch_cap_msr & ARCH_CAP_PBRSB_NO))
setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
}
if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
!(x86_arch_cap_msr & ARCH_CAP_MDS_NO)) {
setup_force_cpu_bug(X86_BUG_MDS); if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY))
setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
}
if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS))
setup_force_cpu_bug(X86_BUG_SWAPGS);
/* * When the CPU is not mitigated for TAA (TAA_NO=0) set TAA bug when: * - TSX is supported or * - TSX_CTRL is present * * TSX_CTRL check is needed for cases when TSX could be disabled before * the kernel boot e.g. kexec. * TSX_CTRL check alone is not sufficient for cases when the microcode * update is not present or running as guest that don't get TSX_CTRL.
*/ if (!(x86_arch_cap_msr & ARCH_CAP_TAA_NO) &&
(cpu_has(c, X86_FEATURE_RTM) ||
(x86_arch_cap_msr & ARCH_CAP_TSX_CTRL_MSR)))
setup_force_cpu_bug(X86_BUG_TAA);
/* * SRBDS affects CPUs which support RDRAND or RDSEED and are listed * in the vulnerability blacklist. * * Some of the implications and mitigation of Shared Buffers Data * Sampling (SBDS) are similar to SRBDS. Give SBDS same treatment as * SRBDS.
*/ if ((cpu_has(c, X86_FEATURE_RDRAND) ||
cpu_has(c, X86_FEATURE_RDSEED)) &&
cpu_matches(cpu_vuln_blacklist, SRBDS | MMIO_SBDS))
setup_force_cpu_bug(X86_BUG_SRBDS);
/* * Processor MMIO Stale Data bug enumeration * * Affected CPU list is generally enough to enumerate the vulnerability, * but for virtualization case check for ARCH_CAP MSR bits also, VMM may * not want the guest to enumerate the bug.
*/ if (!arch_cap_mmio_immune(x86_arch_cap_msr)) { if (cpu_matches(cpu_vuln_blacklist, MMIO))
setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
}
if (!cpu_has(c, X86_FEATURE_BTC_NO)) { if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (x86_arch_cap_msr & ARCH_CAP_RSBA))
setup_force_cpu_bug(X86_BUG_RETBLEED);
}
if (cpu_matches(cpu_vuln_blacklist, SMT_RSB))
setup_force_cpu_bug(X86_BUG_SMT_RSB);
if (!cpu_has(c, X86_FEATURE_SRSO_NO)) { if (cpu_matches(cpu_vuln_blacklist, SRSO))
setup_force_cpu_bug(X86_BUG_SRSO);
}
/* * Check if CPU is vulnerable to GDS. If running in a virtual machine on * an affected processor, the VMM may have disabled the use of GATHER by * disabling AVX2. The only way to do this in HW is to clear XCR0[2], * which means that AVX will be disabled.
*/ if (cpu_matches(cpu_vuln_blacklist, GDS) && !(x86_arch_cap_msr & ARCH_CAP_GDS_NO) &&
boot_cpu_has(X86_FEATURE_AVX))
setup_force_cpu_bug(X86_BUG_GDS);
if (vulnerable_to_rfds(x86_arch_cap_msr))
setup_force_cpu_bug(X86_BUG_RFDS);
/* * Intel parts with eIBRS are vulnerable to BHI attacks. Parts with * BHI_NO still need to use the BHI mitigation to prevent Intra-mode * attacks. When virtualized, eIBRS could be hidden, assume vulnerable.
*/ if (!cpu_matches(cpu_vuln_whitelist, NO_BHI) &&
(boot_cpu_has(X86_FEATURE_IBRS_ENHANCED) ||
boot_cpu_has(X86_FEATURE_HYPERVISOR)))
setup_force_cpu_bug(X86_BUG_BHI);
if (cpu_has(c, X86_FEATURE_AMD_IBPB) && !cpu_has(c, X86_FEATURE_AMD_IBPB_RET))
setup_force_cpu_bug(X86_BUG_IBPB_NO_RET);
if (vulnerable_to_its(x86_arch_cap_msr)) {
setup_force_cpu_bug(X86_BUG_ITS); if (cpu_matches(cpu_vuln_blacklist, ITS_NATIVE_ONLY))
setup_force_cpu_bug(X86_BUG_ITS_NATIVE_ONLY);
}
if (c->x86_vendor == X86_VENDOR_AMD) { if (!cpu_has(c, X86_FEATURE_TSA_SQ_NO) ||
!cpu_has(c, X86_FEATURE_TSA_L1_NO)) { if (cpu_matches(cpu_vuln_blacklist, TSA) || /* Enable bug on Zen guests to allow for live migration. */
(cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_ZEN)))
setup_force_cpu_bug(X86_BUG_TSA);
}
}
/* * Set the bug only on bare-metal. A nested hypervisor should already be * deploying IBPB to isolate itself from nested guests.
*/ if (cpu_matches(cpu_vuln_blacklist, VMSCAPE) &&
!boot_cpu_has(X86_FEATURE_HYPERVISOR))
setup_force_cpu_bug(X86_BUG_VMSCAPE);
if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return;
/* Rogue Data Cache Load? No! */ if (x86_arch_cap_msr & ARCH_CAP_RDCL_NO) return;
setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
if (cpu_matches(cpu_vuln_whitelist, NO_L1TF)) return;
setup_force_cpu_bug(X86_BUG_L1TF);
}
/* * The NOPL instruction is supposed to exist on all CPUs of family >= 6; * unfortunately, that's not true in practice because of early VIA * chips and (more importantly) broken virtualizers that are not easy * to detect. In the latter case it doesn't even *fail* reliably, so * probing for it doesn't even work. Disable it completely on 32-bit * unless we can find a reliable way to detect all the broken cases. * Enable it explicitly on 64-bit for non-constant inputs of cpu_has().
*/ staticvoid detect_nopl(void)
{ #ifdef CONFIG_X86_32
setup_clear_cpu_cap(X86_FEATURE_NOPL); #else
setup_force_cpu_cap(X86_FEATURE_NOPL); #endif
}
while (arg) { bool found __maybe_unused = false; unsignedint bit;
opt = strsep(&arg, ",");
/* * Handle naked numbers first for feature flags which don't * have names. It doesn't make sense for a bug not to have a * name so don't handle bug flags here.
*/ if (!kstrtouint(opt, 10, &bit)) { if (bit < NCAPINTS * 32) {
if (set) {
pr_warn("setcpuid: force-enabling CPU feature flag:");
setup_force_cpu_cap(bit);
} else {
pr_warn("clearcpuid: force-disabling CPU feature flag:");
setup_clear_cpu_cap(bit);
} /* empty-string, i.e., ""-defined feature flags */ if (!x86_cap_flags[bit])
pr_cont(" %d:%d\n", bit >> 5, bit & 31); else
pr_cont(" %s\n", x86_cap_flags[bit]);
taint++;
} /* * The assumption is that there are no feature names with only * numbers in the name thus go to the next argument.
*/ continue;
}
for (bit = 0; bit < 32 * (NCAPINTS + NBUGINTS); bit++) { constchar *flag; constchar *kind;
if (bit < 32 * NCAPINTS) {
flag = x86_cap_flags[bit];
kind = "feature";
} else {
kind = "bug";
flag = x86_bug_flags[bit - (32 * NCAPINTS)];
}
if (!flag) continue;
if (strcmp(flag, opt)) continue;
if (set) {
pr_warn("setcpuid: force-enabling CPU %s flag: %s\n",
kind, flag);
setup_force_cpu_cap(bit);
} else {
pr_warn("clearcpuid: force-disabling CPU %s flag: %s\n",
kind, flag);
setup_clear_cpu_cap(bit);
}
taint++;
found = true; break;
}
if (!found)
pr_warn("%s: unknown CPU flag: %s", set ? "setcpuid" : "clearcpuid", opt);
}
return taint;
}
/* * We parse cpu parameters early because fpu__init_system() is executed * before parse_early_param().
*/ staticvoid __init cpu_parse_early_param(void)
{ bool cpuid_taint = false; char arg[128]; int arglen;
if (cmdline_find_option_bool(boot_command_line, "nofxsr"))
setup_clear_cpu_cap(X86_FEATURE_FXSR); #endif
if (cmdline_find_option_bool(boot_command_line, "noxsave"))
setup_clear_cpu_cap(X86_FEATURE_XSAVE);
if (cmdline_find_option_bool(boot_command_line, "noxsaveopt"))
setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
if (cmdline_find_option_bool(boot_command_line, "noxsaves"))
setup_clear_cpu_cap(X86_FEATURE_XSAVES);
if (cmdline_find_option_bool(boot_command_line, "nousershstk"))
setup_clear_cpu_cap(X86_FEATURE_USER_SHSTK);
/* Minimize the gap between FRED is available and available but disabled. */
arglen = cmdline_find_option(boot_command_line, "fred", arg, sizeof(arg)); if (arglen != 2 || strncmp(arg, "on", 2))
setup_clear_cpu_cap(X86_FEATURE_FRED);
if (cpuid_taint) {
pr_warn("!!! setcpuid=/clearcpuid= in use, this is for TESTING ONLY, may break things horribly. Tainting kernel.\n");
add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
}
}
/* * Do minimum CPU detection early. * Fields really needed: vendor, cpuid_level, family, model, mask, * cache alignment. * The others are not touched to avoid unwanted side effects. * * WARNING: this function is only called on the boot CPU. Don't add code * here that is supposed to run on all CPUs.
*/ staticvoid __init early_identify_cpu(struct cpuinfo_x86 *c)
{
memset(&c->x86_capability, 0, sizeof(c->x86_capability));
c->extended_cpuid_level = 0;
if (!cpuid_feature())
identify_cpu_without_cpuid(c);
/* cyrix could have cpuid enabled via c_identify()*/ if (cpuid_feature()) {
cpu_detect(c);
get_cpu_vendor(c);
intel_unlock_cpuid_leafs(c);
get_cpu_cap(c);
setup_force_cpu_cap(X86_FEATURE_CPUID);
get_cpu_address_sizes(c);
cpu_parse_early_param();
cpu_init_topology(c);
if (this_cpu->c_early_init)
this_cpu->c_early_init(c);
if (this_cpu->c_bsp_init)
this_cpu->c_bsp_init(c);
} else {
setup_clear_cpu_cap(X86_FEATURE_CPUID);
get_cpu_address_sizes(c);
cpu_init_topology(c);
}
setup_force_cpu_cap(X86_FEATURE_ALWAYS);
cpu_set_bug_bits(c);
sld_setup(c);
#ifdef CONFIG_X86_32 /* * Regardless of whether PCID is enumerated, the SDM says * that it can't be enabled in 32-bit mode.
*/
setup_clear_cpu_cap(X86_FEATURE_PCID); #endif
/* * Later in the boot process pgtable_l5_enabled() relies on * cpu_feature_enabled(X86_FEATURE_LA57). If 5-level paging is not * enabled by this point we need to clear the feature bit to avoid * false-positives at the later stage. * * pgtable_l5_enabled() can be false here for several reasons: * - 5-level paging is disabled compile-time; * - it's 32-bit kernel; * - machine doesn't support 5-level paging; * - user specified 'no5lvl' in kernel command line.
*/ if (!pgtable_l5_enabled())
setup_clear_cpu_cap(X86_FEATURE_LA57);
void __init early_cpu_init(void)
{ #ifdef CONFIG_PROCESSOR_SELECT unsignedint i, j;
pr_info("KERNEL supported cpus:\n"); #endif
init_cpu_devs();
#ifdef CONFIG_PROCESSOR_SELECT for (i = 0; i < X86_VENDOR_NUM && cpu_devs[i]; i++) { for (j = 0; j < 2; j++) { if (!cpu_devs[i]->c_ident[j]) continue;
pr_info(" %s %s\n", cpu_devs[i]->c_vendor,
cpu_devs[i]->c_ident[j]);
}
} #endif
early_identify_cpu(&boot_cpu_data);
}
staticbool detect_null_seg_behavior(void)
{ /* * Empirically, writing zero to a segment selector on AMD does * not clear the base, whereas writing zero to a segment * selector on Intel does clear the base. Intel's behavior * allows slightly faster context switches in the common case * where GS is unused by the prev and next threads. * * Since neither vendor documents this anywhere that I can see, * detect it directly instead of hard-coding the choice by * vendor. * * I've designated AMD's behavior as the "bug" because it's * counterintuitive and less friendly.
*/
void check_null_seg_clears_base(struct cpuinfo_x86 *c)
{ /* BUG_NULL_SEG is only relevant with 64bit userspace */ if (!IS_ENABLED(CONFIG_X86_64)) return;
if (cpu_has(c, X86_FEATURE_NULL_SEL_CLR_BASE)) return;
/* * CPUID bit above wasn't set. If this kernel is still running * as a HV guest, then the HV has decided not to advertize * that CPUID bit for whatever reason. For example, one * member of the migration pool might be vulnerable. Which * means, the bug is present: set the BUG flag and return.
*/ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) {
set_cpu_bug(c, X86_BUG_NULL_SEG); return;
}
/* * Zen2 CPUs also have this behaviour, but no CPUID bit. * 0x18 is the respective family for Hygon.
*/ if ((c->x86 == 0x17 || c->x86 == 0x18) &&
detect_null_seg_behavior()) return;
/* All the remaining ones are affected */
set_cpu_bug(c, X86_BUG_NULL_SEG);
}
/* * ESPFIX is a strange bug. All real CPUs have it. Paravirt * systems that run Linux at CPL > 0 may or may not have the * issue, but, even if they have the issue, there's absolutely * nothing we can do about it because we can't use the real IRET * instruction. * * NB: For the time being, only 32-bit kernels support * X86_BUG_ESPFIX as such. 64-bit kernels directly choose * whether to apply espfix using paravirt hooks. If any * non-paravirt system ever shows up that does *not* have the * ESPFIX issue, we can change this.
*/ #ifdef CONFIG_X86_32
set_cpu_bug(c, X86_BUG_ESPFIX); #endif
}
/* * This does the hard work of actually picking apart the CPU stuff...
*/ staticvoid identify_cpu(struct cpuinfo_x86 *c)
{ int i;
if (this_cpu->c_identify)
this_cpu->c_identify(c);
/* Clear/Set all flags overridden by options, after probe */
apply_forced_caps(c);
/* * Set default APIC and TSC_DEADLINE MSR fencing flag. AMD and * Hygon will clear it in ->c_init() below.
*/
set_cpu_cap(c, X86_FEATURE_APIC_MSRS_FENCE);
/* * Vendor-specific initialization. In this section we * canonicalize the feature flags, meaning if there are * features a certain CPU supports which CPUID doesn't * tell us, CPUID claiming incorrect flags, or other bugs, * we handle them here. * * At the end of this section, c->x86_capability better * indicate the features this CPU genuinely supports!
*/ if (this_cpu->c_init)
this_cpu->c_init(c);
bus_lock_init();
/* Disable the PN if appropriate */
squash_the_stupid_serial_number(c);
/* Set up SMEP/SMAP/UMIP */
setup_smep(c);
setup_smap(c);
setup_umip(c);
/* Enable FSGSBASE instructions if available. */ if (cpu_has(c, X86_FEATURE_FSGSBASE)) {
cr4_set_bits(X86_CR4_FSGSBASE);
elf_hwcap2 |= HWCAP2_FSGSBASE;
}
/* * The vendor-specific functions might have changed features. * Now we do "generic changes."
*/
/* Filter out anything that depends on CPUID levels we don't have */
filter_cpuid_features(c, true);
/* Check for unmet dependencies based on the CPUID dependency table */
check_cpufeature_deps(c);
/* If the model name is still unset, do table lookup. */ if (!c->x86_model_id[0]) { constchar *p;
p = table_lookup_model(c); if (p)
strcpy(c->x86_model_id, p); else /* Last resort... */
sprintf(c->x86_model_id, "%02x/%02x",
c->x86, c->x86_model);
}
x86_init_rdrand(c);
setup_pku(c);
setup_cet(c);
/* * Clear/Set all flags overridden by options, need do it * before following smp all cpus cap AND.
*/
apply_forced_caps(c);
/* * On SMP, boot_cpu_data holds the common feature set between * all CPUs; so make sure that we indicate which features are * common between the CPUs. The first time this routine gets * executed, c == &boot_cpu_data.
*/ if (c != &boot_cpu_data) { /* AND the already accumulated flags with these */ for (i = 0; i < NCAPINTS; i++)
boot_cpu_data.x86_capability[i] &= c->x86_capability[i];
/* OR, i.e. replicate the bug flags */ for (i = NCAPINTS; i < NCAPINTS + NBUGINTS; i++)
c->x86_capability[i] |= boot_cpu_data.x86_capability[i];
}
ppin_init(c);
/* Init Machine Check Exception if available. */
mcheck_cpu_init(c);
numa_add_cpu(smp_processor_id());
}
/* * Set up the CPU state needed to execute SYSENTER/SYSEXIT instructions * on 32-bit kernels:
*/ #ifdef CONFIG_X86_32 void enable_sep_cpu(void)
{ struct tss_struct *tss; int cpu;
if (!boot_cpu_has(X86_FEATURE_SEP)) return;
cpu = get_cpu();
tss = &per_cpu(cpu_tss_rw, cpu);
/* * We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field -- * see the big comment in struct x86_hw_tss's definition.
*/
/* * clearcpuid= and setcpuid= were already parsed in cpu_parse_early_param(). * These dummy functions prevent them from becoming an environment variable for * init.
*/
#ifdef CONFIG_X86_64 /* * Note: Do not make this dependant on CONFIG_MITIGATION_CALL_DEPTH_TRACKING * so that this space is reserved in the hot cache section even when the * mitigation is disabled.
*/
DEFINE_PER_CPU_CACHE_HOT(u64, __x86_call_depth);
EXPORT_PER_CPU_SYMBOL(__x86_call_depth);
staticvoid wrmsrq_cstar(unsignedlong val)
{ /* * Intel CPUs do not support 32-bit SYSCALL. Writing to MSR_CSTAR * is so far ignored by the CPU, but raises a #VE trap in a TDX * guest. Avoid the pointless write on all Intel CPUs.
*/ if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
wrmsrq(MSR_CSTAR, val);
}
if (ia32_enabled()) {
wrmsrq_cstar((unsignedlong)entry_SYSCALL_compat); /* * This only works on Intel CPUs. * On AMD CPUs these MSRs are 32-bit, CPU truncates MSR_IA32_SYSENTER_EIP. * This does not cause SYSENTER to jump to the wrong location, because * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit).
*/
wrmsrq_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS);
wrmsrq_safe(MSR_IA32_SYSENTER_ESP,
(unsignedlong)(cpu_entry_stack(smp_processor_id()) + 1));
wrmsrq_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat);
} else {
wrmsrq_cstar((unsignedlong)entry_SYSCALL32_ignore);
wrmsrq_safe(MSR_IA32_SYSENTER_CS, (u64)GDT_ENTRY_INVALID_SEG);
wrmsrq_safe(MSR_IA32_SYSENTER_ESP, 0ULL);
wrmsrq_safe(MSR_IA32_SYSENTER_EIP, 0ULL);
}
/* * Flags to clear on syscall; clear as much as possible * to minimize user space-kernel interference.
*/
--> --------------------
--> maximum size reached
--> --------------------
Messung V0.5
¤ Dauer der Verarbeitung: 0.21 Sekunden
(vorverarbeitet)
¤
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.
