Commit Graph

34 Commits

Author SHA1 Message Date
Konstantin Belousov
2dec2b4a34 amd64: flush L1 data cache on syscall return with an error.
The knob allows to select the flushing mode or turn it off/on.  The
idea, as well as the list of the ignored syscall errors, were taken
from https://www.openwall.com/lists/kernel-hardening/2018/10/11/10 .

I was not able to measure statistically significant difference between
flush enabled vs disabled using syscall_timing getuid.

Reviewed by:	bwidawsk
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D17536
2018-10-20 23:17:24 +00:00
Mark Johnston
d5089b3aed Log a message after a successful boot-time microcode update.
Reviewed by:	kib
Approved by:	re (delphij)
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17135
2018-09-14 17:04:36 +00:00
Mark Johnston
97edfc1b45 Implement kernel support for early loading of Intel microcode updates.
Updates in the format described in section 9.11 of the Intel SDM can
now be applied as one of the first steps in booting the kernel.  Updates
that are loaded this way are automatically re-applied upon exit from
ACPI sleep states, in contrast with the existing cpucontrol(8)-based
method.  For the time being only Intel updates are supported.

Microcode update files are passed to the kernel via loader(8).  The
file type must be "cpu_microcode" in order for the file to be recognized
as a candidate microcode update.  Updates for multiple CPU types may be
concatenated together into a single file, in which case the kernel
will select and apply a matching update.  Memory used to store the
update file will be freed back to the system once the update is applied,
so this approach will not consume more memory than required.

Reviewed by:	kib
MFC after:	6 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D16370
2018-08-13 17:13:09 +00:00
Mark Johnston
be9292a8c9 Typo.
Reported by:	rgrimes, vangyzen
X-MFC with:	r334050
2018-05-22 15:49:23 +00:00
Mark Johnston
6030b0c672 Flush caches before initiating a microcode update on Intel CPUs.
This apparently works around issues with updates of certain Broadwell
CPUs.

Reviewed by:	emaste, kib, sbruno
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D15520
2018-05-22 15:38:51 +00:00
Konstantin Belousov
3621ba1ede Add Intel Spec Store Bypass Disable control.
Speculative Store Bypass (SSB) is a speculative execution side channel
vulnerability identified by Jann Horn of Google Project Zero (GPZ) and
Ken Johnson of the Microsoft Security Response Center (MSRC)
https://bugs.chromium.org/p/project-zero/issues/detail?id=1528.
Updated Intel microcode introduces a MSR bit to disable SSB as a
mitigation for the vulnerability.

Introduce a sysctl hw.spec_store_bypass_disable to provide global
control over the SSBD bit, akin to the existing sysctl that controls
IBRS. The sysctl can be set to one of three values:
0: off
1: on
2: auto

Future work will enable applications to control SSBD on a per-process
basis (when it is not enabled globally).

SSBD bit detection and control was verified with prerelease microcode.

Security:	CVE-2018-3639
Tested by:	emaste (previous version, without updated microcode)
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
2018-05-21 21:08:19 +00:00
Konstantin Belousov
319117fd57 IBRS support, AKA Spectre hardware mitigation.
It is coded according to the Intel document 336996-001, reading of the
patches posted on lkml, and some additional consultations with Intel.

For existing processors, you need a microcode update which adds IBRS
CPU features, and to manually enable it by setting the tunable/sysctl
hw.ibrs_disable to 0.  Current status can be checked in sysctl
hw.ibrs_active.  The mitigation might be inactive if the CPU feature
is not patched in, or if CPU reports that IBRS use is not required, by
IA32_ARCH_CAP_IBRS_ALL bit.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D14029
2018-01-31 14:36:27 +00:00
Konstantin Belousov
99801b12f9 When re-evaluating cpu_features, also re-print CPU identification.
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2018-01-14 12:33:05 +00:00
Konstantin Belousov
0530a9360f Make it possible to re-evaluate cpu_features.
Add cpuctl(4) ioctl CPUCTL_EVAL_CPU_FEATURES which forces re-read of
cpu_features, cpu_features2, cpu_stdext_features, and
std_stdext_features2.

The intent is to allow the kernel to see the changes in the CPU
features after micocode update.  Of course, the update is not atomic
across variables and not synchronized with readers.  See the man page
warning as well.

Reviewed by:	imp (previous version), jilles
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D13770
2018-01-05 21:06:19 +00:00
Pedro F. Giffuni
718cf2ccb9 sys/dev: further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.
2017-11-27 14:52:40 +00:00
Konstantin Belousov
133cbe3b59 Update the list of cpudev ioctls which require write access.
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2017-03-19 21:25:27 +00:00
Konstantin Belousov
3966c3803f Style.
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2017-03-19 21:24:07 +00:00
Konstantin Belousov
836055542f Increase the max allowed size of the microcode update blob for x86.
Newer CPUs (SkyLakes) have updates of 100K size, which is bigger than
current limit 32K. Increase it to 4M but leave the check around to
prevent kernel memory allocator abuse.  Some time ago, the memory for
update was allocated by contigmalloc(9), and it was reasonable to be
conservative as much as possible.  Since all uses of contigmalloc(9)
appear to be either misunderstanding or too cautious, and were
removed, provide more slack than strictly neccessary.

Submitted by:	Oliver Pinter
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D8486
2016-11-11 18:57:41 +00:00
Andriy Gapon
d8aeed01eb dev/cpuctl: put debug output under CPUCTL_DEBUG rather than DEBUG
DEBUG is a well-known flag.
It doesn't imply that there is a particular interest in cpuctl.

MFC after:	1 week
2016-11-02 17:47:19 +00:00
Andriy Gapon
0112b52b61 Add support for microcode update on newer AMD CPUs (10h+)
This includes new code for parsing microcode files as well as
the kernel-side change to apply the update on all processors
at the same time.

Developed with help from Borislav Petkov, formerly bp@amd64.org.

Tested using Athlon II X2 processor on a system where BIOS does
not have the latest microcode version:
/boot/firmware/microcode_amd.bin: updating cpu /dev/cpuctl0 to revision 0x10000c7... done.

The microcode file is taken from here:
https://web.archive.org/web/20160528230514/http://www.amd64.org/microcode.html
(note that the original site seems to be down at the moment)
It can also be found here:
https://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode

Reviewed by:	kib, stas
MFC after:	2 weeks
Relnotes:	maybe
Differential Revision: https://reviews.freebsd.org/D8384
2016-11-02 16:15:49 +00:00
Nathan Whitehorn
96c85efb4b Replace a number of conflations of mp_ncpus and mp_maxid with either
mp_maxid or CPU_FOREACH() as appropriate. This fixes a number of places in
the kernel that assumed CPU IDs are dense in [0, mp_ncpus) and would try,
for example, to run tasks on CPUs that did not exist or to allocate too
few buffers on systems with sparse CPU IDs in which there are holes in the
range and mp_maxid > mp_ncpus. Such circumstances generally occur on
systems with SMT, but on which SMT is disabled. This patch restores system
operation at least on POWER8 systems configured in this way.

There are a number of other places in the kernel with potential problems
in these situations, but where sparse CPU IDs are not currently known
to occur, mostly in the ARM machine-dependent code. These will be fixed
in a follow-up commit after the stable/11 branch.

PR:		kern/210106
Reviewed by:	jhb
Approved by:	re (glebius)
2016-07-06 14:09:49 +00:00
Konstantin Belousov
f1143962a5 Always allow loading of cpuctl(4). When a CPU feature is not
supported, e.g. CPUID or MSR, return ENODEV from the ioctl which needs
that feature.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Approved by:	re (hrs)
2016-06-16 12:07:40 +00:00
Andrey A. Chernov
23b26e530d Improve panic message by specifying on which cpu it really is. 2016-05-22 15:22:45 +00:00
Konstantin Belousov
77b14d8df1 Increase allowed size of the microcode blob to 32KB. Some Intel CPU's
updates weight 28KB.

PR:	179523
MFC after:	1 week
2014-12-20 16:40:49 +00:00
Konstantin Belousov
4af58157b6 Make cpuctl_do_cpuid() and cpuctl_do_cpuid_count() return void.
There is no error to report.

Requested by:	attilio
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2014-06-24 06:52:32 +00:00
Konstantin Belousov
cef789cd61 Restore the ABI of the cpuctl(4) ioctl request CPUCTL_CPUID, use
separate argument structure with added level_type field for
CPUID_CPUID_COUNT request.

Reviewed by:	attilio (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
2014-06-20 13:13:38 +00:00
Attilio Rao
aa1cb7501f Following comments in r242565 add the possibility to specify ecx when
performing cpuid calls.
Add also a new way to specify the level type to cpucontrol(8) as
reported in the manpage.

Sponsored by:	EMC / Isilon storage division
Reviewed by:	bdrewery, gcooper
Testerd by:	bdrewery
2014-06-19 21:54:41 +00:00
Konstantin Belousov
cee9542d51 Use correct types for sizeof() in the calculations for the malloc(9) sizes [1].
While there, remove unneeded checks for failed allocations with M_WAITOK flag.

Submitted by:	Conrad Meyer <cemeyer@uw.edu> [1]
MFC after:	1 week
2014-03-12 10:25:26 +00:00
Konstantin Belousov
f79abb0476 Call free() on the pointer returned from malloc().
Reported and tested by:	Oliver Pinter <oliver.pntr@gmail.com>
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
Approved by:	re (delphij)
2013-09-10 05:17:53 +00:00
Konstantin Belousov
1f039bded4 Match malloc(9) calls with free(9), not contigfree(9). Also remove
unneeded checks for NULL, free(9) can handle NULL pointers on its own,
and the regions were allocated with M_WAITOK flag as well.

Reported and tested by:	Larry Rosenman <ler@lerctr.org>
MFC after:	1 week
2013-08-10 20:54:15 +00:00
Rui Paulo
8606701fc4 Increase the microcode max size to 16K to accomodate more recent Intel
firmware.
2013-07-03 20:29:15 +00:00
Rui Paulo
ecf28f6d07 Typos in comments. 2013-07-03 20:19:23 +00:00
Andriy Gapon
e21e29d716 cpuctl_do_cpuid: explicitly use ecx=0 for cpuid call
... instead of whatever random value may happen to be in the register.
ecx is important to some cpuid leaves.

To do: extend cpuctl interface to provide for ecx value parameter.

MFC after:	5 days
2012-11-04 13:46:28 +00:00
Fabien Thomas
96ff3b75d4 Add VIA microde update support to cpuctl(4) and cpucontrol(8).
Support have been tested with X2 CPU and QuadCore CPU.

MFC after:	1 month
2011-12-12 12:30:44 +00:00
Stanislav Sedov
b2d758545b - Add support to atomically set/clear individual bits of a MSR register
via cpuctl(4) driver.  Two new CPUCTL_MSRSBIT and CPUCTL_MSRCBIT ioctl(2)
  calls treat the data field of the argument struct passed as a mask
  and set/clear bits of the MSR register according to the mask value.
- Allow user to perform atomic bitwise AND and OR operaions on MSR registers
  via cpucontrol(8) utility.  Two new operations ("&=" and "|=") have been
  added.  The first one applies bitwise AND operaion between the current
  contents of the MSR register and the mask, and the second performs bitwise
  OR.  The argument can be optionally prefixed with "~" inversion operator.
  This allows one to mimic the "clear bit" behavior by using the command
  like this:
      cpucontrol -m 0x10&=~0x02		# clear the second bit of TSC MSR

  Inversion operator support in all modes (assignment, OR, AND).

Approved by:	re (kib)
MFC after:	1 month
2009-06-30 12:35:47 +00:00
Stanislav Sedov
b0f642ad44 - Don't zero data field in case of MSR write operation. Before this change
the value written to MSR register was always 0 regardless of value passed
  by user.
- Use proper data pointer when performing AMD microcode update.  Previously,
  the pointer to user-space data has been provided instead, which is totally
  incorrect.

Approved by:	re (kib)
MFC after:	1 week
2009-06-26 22:13:15 +00:00
Ed Schouten
6bfa9a2d66 Replace all calls to minor() with dev2unit().
After I removed all the unit2minor()/minor2unit() calls from the kernel
yesterday, I realised calling minor() everywhere is quite confusing.
Character devices now only have the ability to store a unit number, not
a minor number. Remove the confusion by using dev2unit() everywhere.

This commit could also be considered as a bug fix. A lot of drivers call
minor(), while they should actually be calling dev2unit(). In -CURRENT
this isn't a problem, but it turns out we never had any problem reports
related to that issue in the past. I suspect not many people connect
more than 256 pieces of the same hardware.

Reviewed by:	kib
2008-09-27 08:51:18 +00:00
Ed Schouten
da378661c0 Remove unneeded D_NEEDMINOR from cpuctl(4).
The D_NEEDMINOR flag was introduced for drivers that do not actually
depend on storing a device unit/minor number, but require the ability to
address the cdevs by this number, which is used by clone_create().

The cpuctl(4) driver sets D_NEEDMINOR, even though it doesn't use the
clone_create() API. Remove the flag, because maybe we want to get rid of
it somewhere in the far future.
2008-09-01 18:56:01 +00:00
Stanislav Sedov
e085f869d5 - Add cpuctl(4) pseudo-device driver to provide access to some low-level
features of CPUs like reading/writing machine-specific registers,
  retrieving cpuid data, and updating microcode.
- Add cpucontrol(8) utility, that provides userland access to
  the features of cpuctl(4).
- Add subsequent manpages.

The cpuctl(4) device operates as follows. The pseudo-device node cpuctlX
is created for each cpu present in the systems. The pseudo-device minor
number corresponds to the cpu number in the system. The cpuctl(4) pseudo-
device allows a number of ioctl to be preformed, namely RDMSR/WRMSR/CPUID
and UPDATE. The first pair alows the caller to read/write machine-specific
registers from the correspondent CPU. cpuid data could be retrieved using
the CPUID call, and microcode updates are applied via UPDATE.

The permissions are inforced based on the pseudo-device file permissions.
RDMSR/CPUID will be allowed when the caller has read access to the device
node, while WRMSR/UPDATE will be granted only when the node is opened
for writing. There're also a number of priv(9) checks.

The cpucontrol(8) utility is intened to provide userland access to
the cpuctl(4) device features. The utility also allows one to apply
cpu microcode updates.

Currently only Intel and AMD cpus are supported and were tested.

Approved by:	kib
Reviewed by:	rpaulo, cokane, Peter Jeremy
MFC after:	1 month
2008-08-08 16:26:53 +00:00