- 12 Jan, 2018 40 commits
-
-
Nicholas Piggin authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 Add a data dependency on loads for the fallback flush. This reduces or eliminates instances of incomplete flushing on P8 and P9. Signed-off-by:
Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 We use the x86 'nopti' option because all the documenation on earth is going to refer to that, and we can guess what users mean when they specify that - they want to avoid any overhead due to Meltdown mitigations. Signed-off-by:
Michael Ellerman <mpe@ellerman.id.au> Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 To avoid a bug like the previous commit ever happening again, put the nops in a single place. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 We forgot to expand the number of nops in HRFI_TO_UNKNOWN when we expanded the number of nops. The result is we actually overwrite the rfid with a nop, which is not good. Luckily this is only used in denorm_done, which is not hit often. Spotted by Ram. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 Since we now have three nops, we need to branch further to get over the nops to the branch to the fallback flush. Instead of putting the branch in slot 1 and branching by 8, put it in 0 and branch all the way to keep it simple. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 Rather than assuming a successful return from the hcall will tell us a valid flush type, if the hcall doesn't select one of the known flush types use the fallback. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 Assume we need to do the fallback flush, unless firmware tells us explicitly not to, by having the two needs-l1d-flush properties set to disabled. The previous logic assumed that the existence of a "fw-features" node with no further properties was sufficient to indicate the flush wasn't needed. This should make no difference in practice with current firmwares, because the "fw-features" node has only just been introduced, so there are no machines in the wild which have an empty "fw-features" node. Signed-off-by:
-
Balbir Singh authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 Add a hwsync after DCBT_STOP_ALL_STREAM_IDS to order loads/ stores prior to stopping prefetch with loads and stores as a part of the flushing. A lwsync is needed to ensure that after we don't mix the flushing of one congruence class with another Signed-off-by:
Balbir Singh <bsingharora@gmail.com> Signed-off-by:
-
Aneesh Kumar K.V authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Aneesh Kumar K.V authored
UBUNTU: SAUCE: Remove setup.h include file otherwise compilation complains about missing header file. CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 There's no reason to #error if we include ppc_asm.h in asm files, the ifdef already prevents any problems. Signed-off-by:
-
Nicholas Piggin authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 add an ori 31,31,0 speculation barrier ahead of the ori 30,30,0 flush type, which was found necessary to completely flush out all lines. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 To enable migration between machines with different flush types enabled, allow the hypervisor to advertise more than one flush type, and if we see that we patch both in. On any given machine only one will be active (due to firmware configuration), but a kernel will be able to migrate between machines with different flush instructions enabled without modification. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 So we can select more than one. Signed-off-by:
-
Nicholas Piggin authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 This patch chnages the fallback flush to load all ways of a set, then move to the next set. This is the best way to flush the cache, accoring to HW people. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 After discussions this needs to be in Qemu, to deal with migration and other complications. Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Michael Ellerman authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by:
-
Nicholas Piggin authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742772 This puts a nop before each rfid/hrfid and patches in an L1-D cache flush instruction where possible. It provides /sys/devices/system/cpu/rfi_flush which can report and can patch the rfi flushes at runtime. This has some debug checking in the rfi instructions to make sure we're returning to the context we think we are, so we can avoid some flushes. Includes support for querying the device tree, or hypervisor, to determine the platform's capabilities and requirements. Also includes an implementation of the hcall for KVM guests. Signed-off-by:
Nicholas Piggin <npiggin@gmail.com> Signed-off-by:
Michael Neuling <mikey@neuling.org> Signed-off-by:
Oliver O'Halloran <oohall@gmail.com> Signed-off-by:
Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com> Signed-off-by:
-
Martin Schwidefsky authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742771Signed-off-by:
Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by:
Andy Whitcroft <apw@canonical.com>
-
Vasily Gorbik authored
CVE-2017-5754 BugLink: http://bugs.launchpad.net/bugs/1742771 Implement CPU alternatives, which allows to optionally patch newer instructions at runtime, based on CPU facilities availability. A new kernel boot parameter "noaltinstr" disables patching. Current implementation is derived from x86 alternatives. Although ideal instructions padding (when altinstr is longer then oldinstr) is added at compile time, and no oldinstr nops optimization has to be done at runtime. Also couple of compile time sanity checks are done: 1. oldinstr and altinstr must be <= 254 bytes long, 2. oldinstr and altinstr must not have an odd length. alternative(oldinstr, altinstr, facility); alternative_2(oldinstr, altinstr1, facility1, altinstr2, facility2); Both compile time and runtime padding consists of either 6/4/2 bytes nop or a jump (brcl) + 2 bytes nop filler if padding is longer then 6 bytes. .altinstructions and .altinstr_replacement sections are part of __init_begin : __init_end region and are freed after initialization. Signed-off-by:
Vasily Gorbik <gor@linux.vnet.ibm.com> Signed-off-by:
-
William Grant authored
CVE-2017-5753 CVE-2017-5715 Signed-off-by:
William Grant <wgrant@ubuntu.com> Acked-by:
Kamal Mostafa <kamal@canonical.com> Signed-off-by:
Seth Forshee <seth.forshee@canonical.com> Signed-off-by:
-
Martin Schwidefsky authored
CVE-2017-5753 CVE-2017-5715 Signed-off-by:
Kleber Sacilotto de Souza <kleber.souza@canonical.com> Signed-off-by:
-
Andy Whitcroft authored
CVE-2017-5753 CVE-2017-5715 Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 With the switch to using LFENCE_RDTSC on AMD platforms there is no longer a need for the MFENCE_RDTSC feature. Remove it usage and definition. Signed-off-by:
Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 In order to reduce the impact of using MFENCE, make the execution of the LFENCE instruction serialized. This is done by setting bit 1 of MSR 0xc0011029 (DE_CFG). Some families that support LFENCE do not have this MSR. For these families, the LFENCE instruction is already serialized. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Clear registers on VM exit to prevent speculative use of them. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add code to overwrite the local CPU RSB entries from the previous less privileged mode. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Provide the guest with the speculative control CPUID related values. Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com> Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Set IBPB (Indirect Branch Prediction Barrier) when the current CPU is going to run a VCPU different from what was previously run. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Set/restore the guests IBRS value on VM entry. On VM exit back to the kernel save the guest IBRS value and then set IBRS to 1. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Allow guest access to the speculative control MSRs without being intercepted. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add an IBPB feature check to the speculative control update check after a microcode reload. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add speculative control support for AMD processors. For AMD, speculative control is indicated as follows: CPUID EAX=0x00000007, ECX=0x00 return EDX[26] indicates support for both IBRS and IBPB. CPUID EAX=0x80000008, ECX=0x00 return EBX[12] indicates support for just IBPB. On AMD family 0x10, 0x12 and 0x16 processors where either of the above features are not supported, IBPB can be achieved by disabling indirect branch predictor support in MSR 0xc0011021[14] at boot. Signed-off-by:
-
