TAAv5 0

Changes since v4:
- Simplify TSX_CTRL enumeration, set TSX_CTRL default to NOT_SUPPORTED.
- Add new patch "Export MDS_NO=0 to guests when TSX is enabled".
- Add new patch for tsx=auto which enables TSX on unaffected platforms, default stays tsx=off.
- Handle kexec like cases for TAA bug enumeration. Set X86_BUG_TAA when X86_FEATURE_RTM=1 or TSX_CTRL=1.
- TSX control sysfs file rename(s/tsx/hw_tx_mem/) and file creation changes.
- Dropped patch "x86/speculation/mds: Rename MDS buffer clear functions" It doesn't provide enough benefit compared to the amount of changes involved. Added code comment about using MDS mitigation.
- Add helper function read_ia32_arch_cap().
- Reorder mitigation checks in taa_select_mitigation().
- s/MSR_// for TSX_CTRL bit defines.
- Changelog,comments and documentation update.
- Rebase to v5.3.

Changes since v3:
- Disable tsx unconditionally, removed tsx=auto mode.
- Fix verw idle clear.
- Refactor TSX code into new tsx.c
- Use early_param for tsx cmdline parameter.
- Rename sysfs vulnerability file to tsx_async_abort.
- Rename common CPU buffer clear infrastructure (s/mds/verw)
- s/TAA_MITIGATION_VMWERV/TAA_MITIGATION_UCODE_NEEDED
- Rebased to v5.3-rc6
- Split patches.
- Changelog and documentation update.

Changes since v2:
- Rebased to v5.3-rc5
- Fix build for non-x86 targets.
- Commit log, code comments and documentation update.
- Minor code refactoring.

Changes since v1:
- Added TSX command line options added(on|off|auto). "auto" is the default which sets TSX state as below:
- TSX disabled on affected platforms
- TSX enabled on unaffected platforms
- Update commit messages and documentation.
- Add support to control TSX feature from sysfs.

This patchset adds the mitigation for TSX Async Abort (TAA) which is a side channel vulnerability to internal buffers in some Intel processors similar to Microachitectural Data Sampling (MDS). Transactional Synchronization Extensions (TSX) is a feature in Intel processors that speeds up execution of multi-threaded software through lock elision.

During TAA certain loads may speculatively pass invalid data to dependent operations when an asynchronous abort condition is pending in a TSX transaction. An attacker can use TSX as a tool to extract information from the microarchitectural buffers. The victim data may be placed into these buffers during normal execution which is unrelated to any use of TSX.

Mitigation is to either clear the cpu buffers or disable TSX.

Pawan Gupta (11):
x86/tsx: Add enumeration support for IA32_TSX_CTRL MSR
x86: Add helper function read_ia32_arch_cap() x86/tsx: Disable TSX by default
x86/tsx: Add cmdline parameter to control TSX x86/speculation/taa: Add mitigation for TSX Async Abort x86/speculation/taa: Add sysfs reporting for TSX Async Abort
KVM: x86/speculation/taa: Export MDS_NO=0 to guests when TSX is
enabled
x86/tsx: Add "auto" option to TSX cmdline parameter x86/tsx: Add sysfs interface to control TSX x86/speculation/taa: Update TAA on TSX state change x86/speculation/taa: Add documentation for TSX Async Abort

 .../ABI/testing/sysfs-devices-system-cpu      |  24 ++
 Documentation/admin-guide/hw-vuln/index.rst   |   1 +
 .../admin-guide/hw-vuln/tsx_async_abort.rst   | 269 ++++++++++++++++++
 .../admin-guide/kernel-parameters.txt         |  52 ++++
 Documentation/x86/index.rst                   |   1 +
 Documentation/x86/tsx_async_abort.rst         |  54 ++++
 arch/x86/include/asm/cpufeatures.h            |   1 +
 arch/x86/include/asm/msr-index.h              |   9 +
 arch/x86/include/asm/nospec-branch.h          |   4 +-
 arch/x86/include/asm/processor.h              |   7 +
 arch/x86/kernel/cpu/Makefile                  |   2 +-
 arch/x86/kernel/cpu/bugs.c                    | 169 ++++++++++-
 arch/x86/kernel/cpu/common.c                  |  31 +-
 arch/x86/kernel/cpu/cpu.h                     |   6 +
 arch/x86/kernel/cpu/intel.c                   |   2 +
 arch/x86/kernel/cpu/tsx.c                     | 258 +++++++++++++++++
 arch/x86/kvm/x86.c                            |  19 ++
 drivers/base/cpu.c                            |  41 ++-
 include/linux/cpu.h                           |   9 +
 19 files changed, 949 insertions(+), 10 deletions(-)
 create mode 100644 Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
 create mode 100644 Documentation/x86/tsx_async_abort.rst
 create mode 100644 arch/x86/kernel/cpu/tsx.c

2.20.1