Commit d43ba2dc authored by David Kaplan's avatar David Kaplan Committed by Borislav Petkov (AMD)
Browse files

x86/bugs: Restructure L1TF mitigation 



Restructure L1TF to use select/apply functions to create consistent
vulnerability handling.

Define new AUTO mitigation for L1TF.

Signed-off-by: default avatarDavid Kaplan <david.kaplan@amd.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/20250418161721.1855190-16-david.kaplan@amd.com
parent 5ece59a2

arch/x86/include/asm/processor.h

+1 −0
Original line number Diff line number Diff line
@@ -734,6 +734,7 @@ void store_cpu_caps(struct cpuinfo_x86 *info); 


enum l1tf_mitigations {

	L1TF_MITIGATION_OFF,

	L1TF_MITIGATION_AUTO,

	L1TF_MITIGATION_FLUSH_NOWARN,

	L1TF_MITIGATION_FLUSH,

	L1TF_MITIGATION_FLUSH_NOSMT,

arch/x86/kernel/cpu/bugs.c

+19 −6
Original line number Diff line number Diff line
@@ -67,6 +67,7 @@ static void __init spectre_v2_user_apply_mitigation(void); 
static void __init ssb_select_mitigation(void);

static void __init ssb_apply_mitigation(void);

static void __init l1tf_select_mitigation(void);

static void __init l1tf_apply_mitigation(void);

static void __init mds_select_mitigation(void);

static void __init mds_update_mitigation(void);

static void __init mds_apply_mitigation(void);
@@ -245,6 +246,7 @@ void __init cpu_select_mitigations(void) 
	retbleed_apply_mitigation();

	spectre_v2_user_apply_mitigation();

	ssb_apply_mitigation();

	l1tf_apply_mitigation();

	mds_apply_mitigation();

	taa_apply_mitigation();

	mmio_apply_mitigation();
@@ -2538,7 +2540,7 @@ EXPORT_SYMBOL_GPL(itlb_multihit_kvm_mitigation); 


/* Default mitigation for L1TF-affected CPUs */

enum l1tf_mitigations l1tf_mitigation __ro_after_init =

	IS_ENABLED(CONFIG_MITIGATION_L1TF) ? L1TF_MITIGATION_FLUSH : L1TF_MITIGATION_OFF;

	IS_ENABLED(CONFIG_MITIGATION_L1TF) ? L1TF_MITIGATION_AUTO : L1TF_MITIGATION_OFF;

#if IS_ENABLED(CONFIG_KVM_INTEL)

EXPORT_SYMBOL_GPL(l1tf_mitigation);

#endif
@@ -2585,23 +2587,34 @@ static void override_cache_bits(struct cpuinfo_x86 *c) 
}



static void __init l1tf_select_mitigation(void)

{

	if (!boot_cpu_has_bug(X86_BUG_L1TF) || cpu_mitigations_off()) {

		l1tf_mitigation = L1TF_MITIGATION_OFF;

		return;

	}



	if (l1tf_mitigation == L1TF_MITIGATION_AUTO) {

		if (cpu_mitigations_auto_nosmt())

			l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;

		else

			l1tf_mitigation = L1TF_MITIGATION_FLUSH;

	}

}



static void __init l1tf_apply_mitigation(void)

{

	u64 half_pa;



	if (!boot_cpu_has_bug(X86_BUG_L1TF))

		return;



	if (cpu_mitigations_off())

		l1tf_mitigation = L1TF_MITIGATION_OFF;

	else if (cpu_mitigations_auto_nosmt())

		l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;



	override_cache_bits(&boot_cpu_data);



	switch (l1tf_mitigation) {

	case L1TF_MITIGATION_OFF:

	case L1TF_MITIGATION_FLUSH_NOWARN:

	case L1TF_MITIGATION_FLUSH:

	case L1TF_MITIGATION_AUTO:

		break;

	case L1TF_MITIGATION_FLUSH_NOSMT:

	case L1TF_MITIGATION_FULL:

arch/x86/kvm/vmx/vmx.c

+2 −0
Original line number Diff line number Diff line
@@ -273,6 +273,7 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf) 
		case L1TF_MITIGATION_OFF:

			l1tf = VMENTER_L1D_FLUSH_NEVER;

			break;

		case L1TF_MITIGATION_AUTO:

		case L1TF_MITIGATION_FLUSH_NOWARN:

		case L1TF_MITIGATION_FLUSH:

		case L1TF_MITIGATION_FLUSH_NOSMT:
@@ -7704,6 +7705,7 @@ int vmx_vm_init(struct kvm *kvm) 
		case L1TF_MITIGATION_FLUSH_NOWARN:

			/* 'I explicitly don't care' is set */

			break;

		case L1TF_MITIGATION_AUTO:

		case L1TF_MITIGATION_FLUSH:

		case L1TF_MITIGATION_FLUSH_NOSMT:

		case L1TF_MITIGATION_FULL: