FAILED: patch "[PATCH] x86/speculation: Enable cross-hyperthread spectre v2 STIBP" failed to apply to 4.4-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From
53c613fe6349994f023245519265999eed75957fMon Sep 17 00:00:00 2001
From: Jiri Kosina <[email protected]>
Date: Tue, 25 Sep 2018 14:38:55 +0200
Subject: [PATCH] x86/speculation: Enable cross-hyperthread spectre v2 STIBP
mitigation
STIBP is a feature provided by certain Intel ucodes / CPUs. This feature (once enabled) prevents cross-hyperthread control of decisions made by indirect branch predictors.
Enable this feature if
- the CPU is vulnerable to spectre v2
- the CPU supports SMT and has SMT siblings online
- spectre_v2 mitigation autoselection is enabled (default)
After some previous discussion, this leaves STIBP on all the time, as wrmsr on crossing kernel boundary is a no-no. This could perhaps later be a bit more optimized (like disabling it in NOHZ, experiment with disabling it in idle, etc) if needed.
Note that the synchronization of the mask manipulation via newly added spec_ctrl_mutex is currently not strictly needed, as the only updater is already being serialized by cpu_add_remove_lock, but let's make this a little bit more future-proof.
arch/x86/kernel/cpu/bugs.c +51 -6
@@ -35,12 +35,10 @@ static void __init spectre_v2_select_mitigation(void);static void __init ssb_select_mitigation (void );static void __init l1tf_select_mitigation (void ); -/* -* Our boot-time value of the SPEC_CTRL MSR. We read it once so that any -* writes to SPEC_CTRL contain whatever reserved bits have been set. -*/ -u64 __ro_after_init x86_spec_ctrl_base; +/* The base value of the SPEC_CTRL MSR that always has to be preserved. */ +u64 x86_spec_ctrl_base;EXPORT_SYMBOL_GPL (x86_spec_ctrl_base); +static DEFINE_MUTEX (spec_ctrl_mutex);/* * The vendor and possibly platform specific bits which can be modified in
@@ -325,6 +323,46 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)return cmd; } +static bool stibp_needed (void ) +{ +if (spectre_v2_enabled ==SPECTRE_V2_NONE ) +return false; + +if (!boot_cpu_has (X86_FEATURE_STIBP )) +return false; + +return true; +} + +static void update_stibp_msr (void *info) +{ +wrmsrl (MSR_IA32_SPEC_CTRL , x86_spec_ctrl_base); +} + +void arch_smt_update (void ) +{ +u64 mask; + +if (!stibp_needed ()) +return ; + +mutex_lock (&spec_ctrl_mutex); + mask = x86_spec_ctrl_base; +if (cpu_smt_control ==CPU_SMT_ENABLED ) + mask |=SPEC_CTRL_STIBP ; +else + mask &= ~SPEC_CTRL_STIBP ; + +if (mask != x86_spec_ctrl_base) { +pr_info ("Spectre v2 cross-process SMT mitigation: %s STIBP\n" , + cpu_smt_control ==CPU_SMT_ENABLED ? +"Enabling" :"Disabling" ); + x86_spec_ctrl_base = mask; +on_each_cpu (update_stibp_msr,NULL ,1 ); + } +mutex_unlock (&spec_ctrl_mutex); +} +static void __init spectre_v2_select_mitigation (void ) {enum spectre_v2_mitigation_cmd cmd =spectre_v2_parse_cmdline ();
@@ -424,6 +462,9 @@ static void __init spectre_v2_select_mitigation(void)setup_force_cpu_cap (X86_FEATURE_USE_IBRS_FW );pr_info ("Enabling Restricted Speculation for firmware calls\n" ); } + +/* Enable STIBP if appropriate */ +arch_smt_update (); }#undef pr_fmt
@@ -814,6 +855,8 @@ static ssize_t l1tf_show_state(char *buf)static ssize_t cpu_show_common (struct device *dev,struct device_attribute *attr,char *buf,unsigned int bug) { +int ret; +if (!boot_cpu_has_bug (bug))return sprintf (buf,"Not affected\n" );
@@ -831,10 +874,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attrreturn sprintf (buf,"Mitigation: __user pointer sanitization\n" );case X86_BUG_SPECTRE_V2 : -return sprintf (buf,"%s%s%s%s\n" , spectre_v2_strings[spectre_v2_enabled], + ret =sprintf (buf,"%s%s%s%s%s\n" , spectre_v2_strings[spectre_v2_enabled],boot_cpu_has (X86_FEATURE_USE_IBPB ) ?", IBPB" :"" ,boot_cpu_has (X86_FEATURE_USE_IBRS_FW ) ?", IBRS_FW" :"" , + (x86_spec_ctrl_base &SPEC_CTRL_STIBP ) ?", STIBP" :"" ,spectre_v2_module_string ()); +return ret;case X86_BUG_SPEC_STORE_BYPASS :return sprintf (buf,"%s\n" , ssb_strings[ssb_mode]);
kernel/cpu.c +10 -1
@@ -2025,6 +2025,12 @@ static void cpuhp_online_cpu_device(unsigned int cpu)kobject_uevent (&dev->kobj,KOBJ_ONLINE ); } +/* +* Architectures that need SMT-specific errata handling during SMT hotplug +* should override this. +*/ +void __weak arch_smt_update (void ) { }; +static int cpuhp_smt_disable (enum cpuhp_smt_control ctrlval) {int cpu, ret =0 ;
@@ -2051,8 +2057,10 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)*/ cpuhp_offline_cpu_device (cpu); } -if (!ret) +if (!ret) { cpu_smt_control = ctrlval; +arch_smt_update (); + }cpu_maps_update_done ();return ret; }
@@ -2063,6 +2071,7 @@ static int cpuhp_smt_enable(void)cpu_maps_update_begin (); cpu_smt_control =CPU_SMT_ENABLED ; +arch_smt_update ();for_each_present_cpu (cpu) {/* Skip online CPUs and CPUs on offline nodes */ if (cpu_online (cpu) || !node_online (cpu_to_node (cpu)))
Quoted 4 lines · On Sat, 10 Nov 2018, [email protected] wrote:
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Boris backported all my three patches in that series (dbfe2953f, 53c613fe6 and bb4b3b776 in Linus' tree) to our 4.4-based SLE12-SP3 kernel, so those ports might come handy to whoever will be doing the 4.4-stable backport:
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f0d6957cb012ef72c9628511a75be40083865dd9
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=8b222bcb27ae6a628aa2dad5050e1d5dcbbbcecb
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f04ca7131a830e8be2cf0742bed0a15533c35a93
Signature · 2 lines
Jiri Kosina SUSE Labs
Sasha Levin
maintainerQuoted 7 lines · Jiri Kosina
Quoted 4 lines · On Sat, 10 Nov 2018, [email protected] wrote:
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Quoted 7 lines
Boris backported all my three patches in that series (
dbfe2953f,53c613fe6andbb4b3b776in Linus' tree) to our 4.4-based SLE12-SP3 kernel, so those ports might come handy to whoever will be doing the 4.4-stable backport:http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f0d6957cb012ef72c9628511a75be40083865dd9
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=8b222bcb27ae6a628aa2dad5050e1d5dcbbbcecb
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f04ca7131a830e8be2cf0742bed0a15533c35a93
Boris,
Can I get your Signed-off-by on these 3 backported commits?
--
Thanks,
Sasha
Quoted 7 lines · Sasha Levin
Quoted 3 lines
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f0d6957cb012ef72c9628511a75be40083865dd9
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=8b222bcb27ae6a628aa2dad5050e1d5dcbbbcecb
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f04ca7131a830e8be2cf0742bed0a15533c35a93Boris,
Can I get your Signed-off-by on these 3 backported commits?
If you click on the respective suse-commit link, for example:
suse-commit: a0dce2e59b0edd366a0d7f1ece099d94496385ba
for the first one, you'll see my Acked-by:
You probably should use those anyway as they have header and commit message and so on...
HTH.
Signature · 4 lines
Regards/Gruss,
Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)Quoted 9 lines · Borislav Petkov
Quoted 7 lines · Sasha Levin
Quoted 3 lines
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f0d6957cb012ef72c9628511a75be40083865dd9
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=8b222bcb27ae6a628aa2dad5050e1d5dcbbbcecb
http://kernel.suse.com/cgit/kernel/commit/?h=SLE12-SP3&id=f04ca7131a830e8be2cf0742bed0a15533c35a93Boris,
Can I get your Signed-off-by on these 3 backported commits?
Quoted 8 lines
If you click on the respective suse-commit link, for example:
suse-commit:
a0dce2e59b0edd366a0d7f1ece099d94496385bafor the first one, you'll see my Acked-by:
You probably should use those anyway as they have header and commit message and so on...
Heads up: you might wanna hold off on that backporting - see
https://lkml.kernel.org/r/CAHk-=wg-9FUGU=grF4gKDq1sm1m39Jbs3A_iyLbSSntU47ncwg@mail.gmail.com
Signature · 4 lines
Regards/Gruss,
Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)