x86/tsx: Add config options to set tsx=on|off|auto

commit db616173d787395787ecc93eef075fa975227b10 upstream.

There is a general consensus that TSX usage is not largely spread while
the history shows there is a non trivial space for side channel attacks
possible. Therefore the tsx is disabled by default even on platforms
that might have a safe implementation of TSX according to the current
knowledge. This is a fair trade off to make.

There are, however, workloads that really do benefit from using TSX and
updating to a newer kernel with TSX disabled might introduce a
noticeable regressions. This would be especially a problem for Linux
distributions which will provide TAA mitigations.

Introduce config options X86_INTEL_TSX_MODE_OFF, X86_INTEL_TSX_MODE_ON
and X86_INTEL_TSX_MODE_AUTO to control the TSX feature. The config
setting can be overridden by the tsx cmdline options.

 [ bp: Text cleanups from Josh. ]

Suggested-by: Borislav Petkov <bpetkov@suse.de>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
[bwh: Backported to 4.4: adjust doc filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 4d1262c..53b4298 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1695,6 +1695,51 @@ config X86_INTEL_MPX
 
          If unsure, say N.
 
+choice
+       prompt "TSX enable mode"
+       depends on CPU_SUP_INTEL
+       default X86_INTEL_TSX_MODE_OFF
+       help
+         Intel's TSX (Transactional Synchronization Extensions) feature
+         allows to optimize locking protocols through lock elision which
+         can lead to a noticeable performance boost.
+
+         On the other hand it has been shown that TSX can be exploited
+         to form side channel attacks (e.g. TAA) and chances are there
+         will be more of those attacks discovered in the future.
+
+         Therefore TSX is not enabled by default (aka tsx=off). An admin
+         might override this decision by tsx=on the command line parameter.
+         Even with TSX enabled, the kernel will attempt to enable the best
+         possible TAA mitigation setting depending on the microcode available
+         for the particular machine.
+
+         This option allows to set the default tsx mode between tsx=on, =off
+         and =auto. See Documentation/kernel-parameters.txt for more
+         details.
+
+         Say off if not sure, auto if TSX is in use but it should be used on safe
+         platforms or on if TSX is in use and the security aspect of tsx is not
+         relevant.
+
+config X86_INTEL_TSX_MODE_OFF
+       bool "off"
+       help
+         TSX is disabled if possible - equals to tsx=off command line parameter.
+
+config X86_INTEL_TSX_MODE_ON
+       bool "on"
+       help
+         TSX is always enabled on TSX capable HW - equals the tsx=on command
+         line parameter.
+
+config X86_INTEL_TSX_MODE_AUTO
+       bool "auto"
+       help
+         TSX is enabled on TSX capable HW that is believed to be safe against
+         side channel attacks- equals the tsx=auto command line parameter.
+endchoice
+
 config EFI
        bool "EFI runtime service support"
        depends on ACPI

diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
index d73bc1a..c2a9dd8 100644 (file)
--- a/arch/x86/kernel/cpu/tsx.c
+++ b/arch/x86/kernel/cpu/tsx.c
@@ -73,6 +73,14 @@ static bool __init tsx_ctrl_is_supported(void)
        return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
 }
 
+static enum tsx_ctrl_states x86_get_tsx_auto_mode(void)
+{
+       if (boot_cpu_has_bug(X86_BUG_TAA))
+               return TSX_CTRL_DISABLE;
+
+       return TSX_CTRL_ENABLE;
+}
+
 void __init tsx_init(void)
 {
        char arg[5] = {};
@@ -88,17 +96,19 @@ void __init tsx_init(void)
                } else if (!strcmp(arg, "off")) {
                        tsx_ctrl_state = TSX_CTRL_DISABLE;
                } else if (!strcmp(arg, "auto")) {
-                       if (boot_cpu_has_bug(X86_BUG_TAA))
-                               tsx_ctrl_state = TSX_CTRL_DISABLE;
-                       else
-                               tsx_ctrl_state = TSX_CTRL_ENABLE;
+                       tsx_ctrl_state = x86_get_tsx_auto_mode();
                } else {
                        tsx_ctrl_state = TSX_CTRL_DISABLE;
                        pr_err("tsx: invalid option, defaulting to off\n");
                }
        } else {
-               /* tsx= not provided, defaulting to off */
-               tsx_ctrl_state = TSX_CTRL_DISABLE;
+               /* tsx= not provided */
+               if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_AUTO))
+                       tsx_ctrl_state = x86_get_tsx_auto_mode();
+               else if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_OFF))
+                       tsx_ctrl_state = TSX_CTRL_DISABLE;
+               else
+                       tsx_ctrl_state = TSX_CTRL_ENABLE;
        }
 
        if (tsx_ctrl_state == TSX_CTRL_DISABLE) {