1. 05 7月, 2018 1 次提交
    • K
      x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present · 26acfb66
      Konrad Rzeszutek Wilk 提交于
      If the L1TF CPU bug is present we allow the KVM module to be loaded as the
      major of users that use Linux and KVM have trusted guests and do not want a
      broken setup.
      
      Cloud vendors are the ones that are uncomfortable with CVE 2018-3620 and as
      such they are the ones that should set nosmt to one.
      
      Setting 'nosmt' means that the system administrator also needs to disable
      SMT (Hyper-threading) in the BIOS, or via the 'nosmt' command line
      parameter, or via the /sys/devices/system/cpu/smt/control. See commit
      05736e4a ("cpu/hotplug: Provide knobs to control SMT").
      
      Other mitigations are to use task affinity, cpu sets, interrupt binding,
      etc - anything to make sure that _only_ the same guests vCPUs are running
      on sibling threads.
      Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      26acfb66
  2. 02 7月, 2018 1 次提交
    • T
      Revert "x86/apic: Ignore secondary threads if nosmt=force" · 506a66f3
      Thomas Gleixner 提交于
      Dave Hansen reported, that it's outright dangerous to keep SMT siblings
      disabled completely so they are stuck in the BIOS and wait for SIPI.
      
      The reason is that Machine Check Exceptions are broadcasted to siblings and
      the soft disabled sibling has CR4.MCE = 0. If a MCE is delivered to a
      logical core with CR4.MCE = 0, it asserts IERR#, which shuts down or
      reboots the machine. The MCE chapter in the SDM contains the following
      blurb:
      
          Because the logical processors within a physical package are tightly
          coupled with respect to shared hardware resources, both logical
          processors are notified of machine check errors that occur within a
          given physical processor. If machine-check exceptions are enabled when
          a fatal error is reported, all the logical processors within a physical
          package are dispatched to the machine-check exception handler. If
          machine-check exceptions are disabled, the logical processors enter the
          shutdown state and assert the IERR# signal. When enabling machine-check
          exceptions, the MCE flag in control register CR4 should be set for each
          logical processor.
      
      Reverting the commit which ignores siblings at enumeration time solves only
      half of the problem. The core cpuhotplug logic needs to be adjusted as
      well.
      
      This thoughtful engineered mechanism also turns the boot process on all
      Intel HT enabled systems into a MCE lottery. MCE is enabled on the boot CPU
      before the secondary CPUs are brought up. Depending on the number of
      physical cores the window in which this situation can happen is smaller or
      larger. On a HSW-EX it's about 750ms:
      
      MCE is enabled on the boot CPU:
      
      [    0.244017] mce: CPU supports 22 MCE banks
      
      The corresponding sibling #72 boots:
      
      [    1.008005] .... node  #0, CPUs:    #72
      
      That means if an MCE hits on physical core 0 (logical CPUs 0 and 72)
      between these two points the machine is going to shutdown. At least it's a
      known safe state.
      
      It's obvious that the early boot can be hit by an MCE as well and then runs
      into the same situation because MCEs are not yet enabled on the boot CPU.
      But after enabling them on the boot CPU, it does not make any sense to
      prevent the kernel from recovering.
      
      Adjust the nosmt kernel parameter documentation as well.
      
      Reverts: 2207def7 ("x86/apic: Ignore secondary threads if nosmt=force")
      Reported-by: NDave Hansen <dave.hansen@intel.com>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Tested-by: NTony Luck <tony.luck@intel.com>
      506a66f3
  3. 21 6月, 2018 1 次提交
    • T
      cpu/hotplug: Provide knobs to control SMT · 05736e4a
      Thomas Gleixner 提交于
      Provide a command line and a sysfs knob to control SMT.
      
      The command line options are:
      
       'nosmt':	Enumerate secondary threads, but do not online them
       		
       'nosmt=force': Ignore secondary threads completely during enumeration
       		via MP table and ACPI/MADT.
      
      The sysfs control file has the following states (read/write):
      
       'on':		 SMT is enabled. Secondary threads can be freely onlined
       'off':		 SMT is disabled. Secondary threads, even if enumerated
       		 cannot be onlined
       'forceoff':	 SMT is permanentely disabled. Writes to the control
       		 file are rejected.
       'notsupported': SMT is not supported by the CPU
      
      The command line option 'nosmt' sets the sysfs control to 'off'. This
      can be changed to 'on' to reenable SMT during runtime.
      
      The command line option 'nosmt=force' sets the sysfs control to
      'forceoff'. This cannot be changed during runtime.
      
      When SMT is 'on' and the control file is changed to 'off' then all online
      secondary threads are offlined and attempts to online a secondary thread
      later on are rejected.
      
      When SMT is 'off' and the control file is changed to 'on' then secondary
      threads can be onlined again. The 'off' -> 'on' transition does not
      automatically online the secondary threads.
      
      When the control file is set to 'forceoff', the behaviour is the same as
      setting it to 'off', but the operation is irreversible and later writes to
      the control file are rejected.
      
      When the control status is 'notsupported' then writes to the control file
      are rejected.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Acked-by: NIngo Molnar <mingo@kernel.org>
      05736e4a
  4. 16 6月, 2018 2 次提交
  5. 08 6月, 2018 4 次提交
  6. 07 6月, 2018 1 次提交
  7. 01 6月, 2018 1 次提交
  8. 29 5月, 2018 2 次提交
  9. 28 5月, 2018 1 次提交
  10. 21 5月, 2018 1 次提交
  11. 19 5月, 2018 1 次提交
  12. 14 5月, 2018 1 次提交
  13. 11 5月, 2018 3 次提交
  14. 09 5月, 2018 4 次提交
  15. 08 5月, 2018 1 次提交
  16. 05 5月, 2018 1 次提交
  17. 03 5月, 2018 2 次提交
    • T
      x86/speculation: Add prctl for Speculative Store Bypass mitigation · a73ec77e
      Thomas Gleixner 提交于
      Add prctl based control for Speculative Store Bypass mitigation and make it
      the default mitigation for Intel and AMD.
      
      Andi Kleen provided the following rationale (slightly redacted):
      
       There are multiple levels of impact of Speculative Store Bypass:
      
       1) JITed sandbox.
          It cannot invoke system calls, but can do PRIME+PROBE and may have call
          interfaces to other code
      
       2) Native code process.
          No protection inside the process at this level.
      
       3) Kernel.
      
       4) Between processes. 
      
       The prctl tries to protect against case (1) doing attacks.
      
       If the untrusted code can do random system calls then control is already
       lost in a much worse way. So there needs to be system call protection in
       some way (using a JIT not allowing them or seccomp). Or rather if the
       process can subvert its environment somehow to do the prctl it can already
       execute arbitrary code, which is much worse than SSB.
      
       To put it differently, the point of the prctl is to not allow JITed code
       to read data it shouldn't read from its JITed sandbox. If it already has
       escaped its sandbox then it can already read everything it wants in its
       address space, and do much worse.
      
       The ability to control Speculative Store Bypass allows to enable the
       protection selectively without affecting overall system performance.
      
      Based on an initial patch from Tim Chen. Completely rewritten.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      a73ec77e
    • K
      x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation · 24f7fc83
      Konrad Rzeszutek Wilk 提交于
      Contemporary high performance processors use a common industry-wide
      optimization known as "Speculative Store Bypass" in which loads from
      addresses to which a recent store has occurred may (speculatively) see an
      older value. Intel refers to this feature as "Memory Disambiguation" which
      is part of their "Smart Memory Access" capability.
      
      Memory Disambiguation can expose a cache side-channel attack against such
      speculatively read values. An attacker can create exploit code that allows
      them to read memory outside of a sandbox environment (for example,
      malicious JavaScript in a web page), or to perform more complex attacks
      against code running within the same privilege level, e.g. via the stack.
      
      As a first step to mitigate against such attacks, provide two boot command
      line control knobs:
      
       nospec_store_bypass_disable
       spec_store_bypass_disable=[off,auto,on]
      
      By default affected x86 processors will power on with Speculative
      Store Bypass enabled. Hence the provided kernel parameters are written
      from the point of view of whether to enable a mitigation or not.
      The parameters are as follows:
      
       - auto - Kernel detects whether your CPU model contains an implementation
      	  of Speculative Store Bypass and picks the most appropriate
      	  mitigation.
      
       - on   - disable Speculative Store Bypass
       - off  - enable Speculative Store Bypass
      
      [ tglx: Reordered the checks so that the whole evaluation is not done
        	when the CPU does not support RDS ]
      Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: NBorislav Petkov <bp@suse.de>
      Reviewed-by: NIngo Molnar <mingo@kernel.org>
      24f7fc83
  18. 28 4月, 2018 5 次提交
  19. 26 4月, 2018 1 次提交
  20. 17 4月, 2018 1 次提交
  21. 06 4月, 2018 1 次提交
  22. 31 3月, 2018 2 次提交
    • B
      PCI/portdrv: Remove unnecessary "pcie_ports=auto" parameter · 4c0fd764
      Bjorn Helgaas 提交于
      The "pcie_ports=auto" parameter set pcie_ports_disabled and pcie_ports_auto
      to their compiled-in defaults, so specifying the parameter is the same as
      not using it at all.
      
      Remove the "pcie_ports=auto" parameter and update the documentation.
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      4c0fd764
    • B
      PCI/portdrv: Remove "pcie_hp=nomsi" kernel parameter · 1e447c57
      Bjorn Helgaas 提交于
      7570a333 ("PCI: Add pcie_hp=nomsi to disable MSI/MSI-X for pciehp
      driver") added the "pcie_hp=nomsi" kernel parameter to work around this
      error on shutdown:
      
        irq 16: nobody cared (try booting with the "irqpoll" option)
        Pid: 1081, comm: reboot Not tainted 3.2.0 #1
        ...
        Disabling IRQ #16
      
      This happened on an unspecified system (possibly involving the Integrated
      Device Technology, Inc. Device 807f bridge) where "an un-wanted interrupt
      is generated when PCI driver switches from MSI/MSI-X to INTx while shutting
      down the device."
      
      The implication was that the device was buggy, but it is normal for a
      device to use INTx after MSI/MSI-X have been disabled.  The only problem
      was that the driver was still attached and it wasn't prepared for INTx
      interrupts.  Prarit Bhargava fixed this issue with fda78d7a ("PCI/MSI:
      Stop disabling MSI/MSI-X in pci_device_shutdown()").
      
      There is no automated way to set this parameter, so it's not very useful
      for distributions or end users.  It's really only useful for debugging, and
      we have "pci=nomsi" for that purpose.
      
      Revert 7570a333 to remove the "pcie_hp=nomsi" parameter.
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      CC: MUNEDA Takahiro <muneda.takahiro@jp.fujitsu.com>
      CC: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
      CC: Prarit Bhargava <prarit@redhat.com>
      1e447c57
  23. 26 3月, 2018 2 次提交
    • M
      Documentation: admin-guide: add kvmconfig, xenconfig and tinyconfig commands · 52c37d41
      Martin Kepplinger 提交于
      Add kvmconfig, xenconfig and tinyconfig to the list of alternative
      configuration commands. Descriptions are directly taken from the Makefile.
      Signed-off-by: NMartin Kepplinger <martink@posteo.de>
      Signed-off-by: NJonathan Corbet <corbet@lwn.net>
      52c37d41
    • A
      Documentation: arch-support: remove obsolete architectures · 1ea5afd4
      Arnd Bergmann 提交于
      A number of architecture ports are obsolete and getting dropped,
      so we no longer want to track the respective features.
      
      We already removed the lines for metag and mn10300, this does
      the same edits for all the others.
      
      For the remaining 21 architectures, this shows how many are known
      to implement each given feature:
      
      19 time/modern-timekeeping/arch-support.txt
      19 time/clockevents/arch-support.txt
      15 core/tracehook/arch-support.txt
      14 core/generic-idle-thread/arch-support.txt
      13 locking/lockdep/arch-support.txt
      12 io/dma-api-debug/arch-support.txt
      11 debug/kgdb/arch-support.txt
      10 time/virt-cpuacct/arch-support.txt
       9 debug/kretprobes/arch-support.txt
       9 debug/kprobes/arch-support.txt
       8 vm/THP/arch-support.txt
       8 vm/pte_special/arch-support.txt
       8 vm/numa-memblock/arch-support.txt
       8 io/sg-chain/arch-support.txt
       7 perf/kprobes-event/arch-support.txt
       7 locking/rwsem-optimized/arch-support.txt
       7 debug/gcov-profile-all/arch-support.txt
       7 core/jump-labels/arch-support.txt
       7 core/BPF-JIT/arch-support.txt
       6 vm/ELF-ASLR/arch-support.txt
       6 time/context-tracking/arch-support.txt
       6 seccomp/seccomp-filter/arch-support.txt
       6 debug/stackprotector/arch-support.txt
       5 time/irq-time-acct/arch-support.txt
       5 io/dma-contiguous/arch-support.txt
       5 debug/uprobes/arch-support.txt
       4 vm/ioremap_prot/arch-support.txt
       4 time/arch-tick-broadcast/arch-support.txt
       4 perf/perf-stackdump/arch-support.txt
       4 perf/perf-regs/arch-support.txt
       3 debug/KASAN/arch-support.txt
       2 vm/PG_uncached/arch-support.txt
       2 vm/huge-vmap/arch-support.txt
       2 sched/numa-balancing/arch-support.txt
       2 sched/membarrier-sync-core/arch-support.txt
       2 locking/cmpxchg-local/arch-support.txt
       2 debug/optprobes/arch-support.txt
       2 debug/kprobes-on-ftrace/arch-support.txt
       1 vm/TLB/arch-support.txt
       1 locking/queued-spinlocks/arch-support.txt
       1 locking/queued-rwlocks/arch-support.txt
       1 debug/user-ret-profiler/arch-support.txt
       0 lib/strncasecmp/arch-support.txt
      
      Note that the list does not include riscv or nds32 yet, these still
      need to be added.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      1ea5afd4