[PATCH] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
From: Jane Malalane
Date: Fri Oct 01 2021 - 09:41:53 EST
Currently, Linux probes for X86_BUG_NULL_SEL unconditionally which
makes it unsafe to migrate in a virtualised environment as the
properties across the migration pool might differ.
Zen3 adds the NullSelectorClearsBase bit to indicate that loading
a NULL segment selector zeroes the base and limit fields, as well as
just attributes. Zen2 also has this behaviour but doesn't have the
NSCB bit.
When virtualised, NSCB might be cleared for migration safety,
therefore we must not probe. Always honour the NSCB bit in this case,
as the hypervisor is expected to synthesize it in the Zen2 case.
Signed-off-by: Jane Malalane <jane.malalane@xxxxxxxxxx>
---
CC: <x86@xxxxxxxxxx>
CC: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
CC: Ingo Molnar <mingo@xxxxxxxxxx>
CC: Borislav Petkov <bp@xxxxxxxxx>
CC: "H. Peter Anvin" <hpa@xxxxxxxxx>
CC: Pu Wen <puwen@xxxxxxxx>
CC: Paolo Bonzini <pbonzini@xxxxxxxxxx>
CC: Sean Christopherson <seanjc@xxxxxxxxxx>
CC: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
CC: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Yazen Ghannam <Yazen.Ghannam@xxxxxxx>
CC: Brijesh Singh <brijesh.singh@xxxxxxx>
CC: Huang Rui <ray.huang@xxxxxxx>
CC: Andy Lutomirski <luto@xxxxxxxxxx>
CC: Kim Phillips <kim.phillips@xxxxxxx>
CC: <stable@xxxxxxxxxxxxxxx>
---
arch/x86/include/asm/cpufeatures.h | 2 +-
arch/x86/kernel/cpu/amd.c | 23 +++++++++++++++++++++++
arch/x86/kernel/cpu/common.c | 6 ++----
arch/x86/kernel/cpu/cpu.h | 1 +
arch/x86/kernel/cpu/hygon.c | 23 +++++++++++++++++++++++
5 files changed, 50 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index d0ce5cfd3ac1..f571e4f6fe83 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -96,7 +96,7 @@
#define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in IA32 userspace */
#define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in IA32 userspace */
#define X86_FEATURE_REP_GOOD ( 3*32+16) /* REP microcode works well */
-/* FREE! ( 3*32+17) */
+#define X86_FEATURE_NSCB ( 3*32+17) /* Null Selector Clears Base */
#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" LFENCE synchronizes RDTSC */
#define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */
#define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 2131af9f2fa2..73c4863fe0f4 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -650,6 +650,29 @@ static void early_init_amd(struct cpuinfo_x86 *c)
if (c->x86_power & BIT(14))
set_cpu_cap(c, X86_FEATURE_RAPL);
+ /*
+ * Zen1 and earlier CPUs don't clear segment base/limits when
+ * loading a NULL selector. This has been designated
+ * X86_BUG_NULL_SEG.
+ *
+ * Zen3 CPUs advertise Null Selector Clears Base in CPUID.
+ * Zen2 CPUs also have this behaviour, but no CPUID bit.
+ *
+ * A hypervisor may sythesize the bit, but may also hide it
+ * for migration safety, so we must not probe for model
+ * specific behaviour when virtualised.
+ */
+ if (c->extended_cpuid_level >= 0x80000021 &&
+ cpuid_eax(0x80000021) & BIT(6))
+ set_cpu_cap(c, X86_FEATURE_NSCB);
+
+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_NSCB) &&
+ c->x86 == 0x17)
+ detect_null_seg_behavior(c);
+
+ if (!cpu_has(c, X86_FEATURE_NSCB))
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+
#ifdef CONFIG_X86_64
set_cpu_cap(c, X86_FEATURE_SYSCALL32);
#else
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0f8885949e8c..690337796e61 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1395,7 +1395,7 @@ void __init early_cpu_init(void)
early_identify_cpu(&boot_cpu_data);
}
-static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
+void detect_null_seg_behavior(struct cpuinfo_x86 *c)
{
#ifdef CONFIG_X86_64
/*
@@ -1419,7 +1419,7 @@ static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
loadsegment(fs, 0);
rdmsrl(MSR_FS_BASE, tmp);
if (tmp != 0)
- set_cpu_bug(c, X86_BUG_NULL_SEG);
+ set_cpu_cap(c, X86_FEATURE_NSCB);
wrmsrl(MSR_FS_BASE, old_base);
#endif
}
@@ -1457,8 +1457,6 @@ static void generic_identify(struct cpuinfo_x86 *c)
get_model_name(c); /* Default name */
- detect_null_seg_behavior(c);
-
/*
* ESPFIX is a strange bug. All real CPUs have it. Paravirt
* systems that run Linux at CPL > 0 may or may not have the
diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
index 95521302630d..642f46e0dd67 100644
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -75,6 +75,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
extern int detect_extended_topology(struct cpuinfo_x86 *c);
extern int detect_ht_early(struct cpuinfo_x86 *c);
extern void detect_ht(struct cpuinfo_x86 *c);
+extern void detect_null_seg_behavior(struct cpuinfo_x86 *c);
unsigned int aperfmperf_get_khz(int cpu);
diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c
index 6d50136f7ab9..765f1556d964 100644
--- a/arch/x86/kernel/cpu/hygon.c
+++ b/arch/x86/kernel/cpu/hygon.c
@@ -264,6 +264,29 @@ static void early_init_hygon(struct cpuinfo_x86 *c)
if (c->x86_power & BIT(14))
set_cpu_cap(c, X86_FEATURE_RAPL);
+ /*
+ * Zen1 and earlier CPUs don't clear segment base/limits when
+ * loading a NULL selector. This has been designated
+ * X86_BUG_NULL_SEG.
+ *
+ * Zen3 CPUs advertise Null Selector Clears Base in CPUID.
+ * Zen2 CPUs also have this behaviour, but no CPUID bit.
+ *
+ * A hypervisor may sythesize the bit, but may also hide it
+ * for migration safety, so we must not probe for model
+ * specific behaviour when virtualised.
+ */
+ if (c->extended_cpuid_level >= 0x80000021 &&
+ cpuid_eax(0x80000021) & BIT(6))
+ set_cpu_cap(c, X86_FEATURE_NSCB);
+
+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_NSCB) &&
+ c->x86 == 0x18)
+ detect_null_seg_behavior(c);
+
+ if (!cpu_has(c, X86_FEATURE_NSCB))
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+
#ifdef CONFIG_X86_64
set_cpu_cap(c, X86_FEATURE_SYSCALL32);
#endif
--
2.11.0