linux-kernel - [PATCH 1/2] x86/alternative: Add per-vendor patching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Oct 2023 17:34:18 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     X86 ML <x86@...nel.org>,
        Kishon VijayAbraham <Kishon.VijayAbraham@....com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/2] x86/alternative: Add per-vendor patching

From: "Borislav Petkov (AMD)" <bp@...en8.de>
Date: Fri, 27 Oct 2023 13:34:12 +0200

Add the capability to apply alternatives not based on a CPU feature but
on the current vendor the machine is running on.

Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>
---
 arch/x86/include/asm/alternative.h |  7 ++++++-
 arch/x86/kernel/alternative.c      | 14 +++++++++-----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index 65f79092c9d9..76750f8b5aba 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -8,8 +8,13 @@
 
 #define ALT_FLAGS_SHIFT		16
 
-#define ALT_FLAG_NOT		(1 << 0)
+/* Negate the tested feature flag */
+#define ALT_FLAG_NOT		BIT(0)
+/* Check X86_VENDOR_* instead of a feature flag */
+#define	ALT_FLAG_VENDOR		BIT(1)
+
 #define ALT_NOT(feature)	((ALT_FLAG_NOT << ALT_FLAGS_SHIFT) | (feature))
+#define ALT_VENDOR(x86_vendor)	((ALT_FLAG_VENDOR << ALT_FLAGS_SHIFT) | (x86_vendor))
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 73be3931e4f0..8b67b5c6090e 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -433,19 +433,23 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
 
 		/*
 		 * Patch if either:
+		 * - running on the respective x86 vendor
 		 * - feature is present
 		 * - feature not present but ALT_FLAG_NOT is set to mean,
 		 *   patch if feature is *NOT* present.
 		 */
-		if (!boot_cpu_has(a->cpuid) == !(a->flags & ALT_FLAG_NOT)) {
+		if (a->flags & ALT_FLAG_VENDOR) {
+			if (boot_cpu_data.x86_vendor != a->cpuid) {
+				optimize_nops(instr, a->instrlen);
+				continue;
+			}
+		} else if (!boot_cpu_has(a->cpuid) == !(a->flags & ALT_FLAG_NOT)) {
 			optimize_nops(instr, a->instrlen);
 			continue;
 		}
 
-		DPRINTK(ALT, "feat: %s%d*32+%d, old: (%pS (%px) len: %d), repl: (%px, len: %d)",
-			(a->flags & ALT_FLAG_NOT) ? "!" : "",
-			a->cpuid >> 5,
-			a->cpuid & 0x1f,
+		DPRINTK(ALT, "feat: 0x%x, flags: 0x%x, old: (%pS (%px) len: %d), repl: (%px, len: %d)",
+			a->cpuid, a->flags,
 			instr, instr, a->instrlen,
 			replacement, a->replacementlen);
 
-- 
2.42.0.rc0.25.ga82fb66fed25


-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette