x86/kvm: Allow runtime control of L1D flush

All mitigation modes can be switched at run time with a static key now:

 - Use sysfs_streq() instead of strcmp() to handle the trailing new line
   from sysfs writes correctly.
 - Make the static key management handle multiple invocations properly.
 - Set the module parameter file to RW

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.954525119@linutronix.de
Orabug: 28220674
CVE: CVE-2018-3646

(cherry picked from commit 895ae47f9918833c3a880fbccd41e0692b37e7d9)

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Conflicts:
	arch/x86/kernel/cpu/bugs.c
	arch/x86/kvm/vmx.c
Contextual: different content; bugs_64.cwas modified instead of bugs.c

diff --git a/arch/x86/kernel/cpu/bugs_64.c b/arch/x86/kernel/cpu/bugs_64.c
index 468b5fd046ff330f0fd1677d82bb5909ad45a3b7..efe1c602827837a0359896aef389ae248ede19f0 100644 (file)
--- a/arch/x86/kernel/cpu/bugs_64.c
+++ b/arch/x86/kernel/cpu/bugs_64.c
@@ -957,7 +957,7 @@ void x86_spec_ctrl_setup_ap(void)
 #define pr_fmt(fmt)    "L1TF: " fmt
 
 #if IS_ENABLED(CONFIG_KVM_INTEL)
-enum vmx_l1d_flush_state l1tf_vmx_mitigation __read_mostly = VMENTER_L1D_FLUSH_AUTO;
+enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
 EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
 #endif
 

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bf23f9f4866b985878d816dcf0796df6e8a9d880..646a846529caec2d19fdeed5e4c7ba1a4306c820 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -209,12 +209,15 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
 
        l1tf_vmx_mitigation = l1tf;
 
-       if (l1tf == VMENTER_L1D_FLUSH_NEVER)
-               return 0;
+       if (l1tf != VMENTER_L1D_FLUSH_NEVER)
+               static_key_enable(&vmx_l1d_should_flush);
+       else
+               static_key_disable(&vmx_l1d_should_flush);
 
-       static_key_enable(&vmx_l1d_should_flush);
        if (l1tf == VMENTER_L1D_FLUSH_ALWAYS)
                static_key_enable(&vmx_l1d_flush_always);
+       else
+               static_key_disable(&vmx_l1d_flush_always);
        return 0;
 }
 
@@ -224,7 +227,7 @@ static int vmentry_l1d_flush_parse(const char *s)
 
        if (s) {
                for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
-                       if (!strcmp(s, vmentry_l1d_param[i].option))
+                       if (sysfs_streq(s, vmentry_l1d_param[i].option))
                                return vmentry_l1d_param[i].cmd;
                }
        }
@@ -268,7 +271,7 @@ static const struct kernel_param_ops vmentry_l1d_flush_ops = {
        .set = vmentry_l1d_flush_set,
        .get = vmentry_l1d_flush_get,
 };
-module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, S_IRUGO);
+module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
 
 #define NR_AUTOLOAD_MSRS 8
 #define VMCS02_POOL_SIZE 1