1 files changed, 41 insertions, 5 deletions

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 4c2313d0b9ca..40bdaea97fe7 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -668,6 +668,45 @@ EXPORT_SYMBOL_GPL(l1tf_mitigation);
 enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
 EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
 
+/*
+ * These CPUs all support 44bits physical address space internally in the
+ * cache but CPUID can report a smaller number of physical address bits.
+ *
+ * The L1TF mitigation uses the top most address bit for the inversion of
+ * non present PTEs. When the installed memory reaches into the top most
+ * address bit due to memory holes, which has been observed on machines
+ * which report 36bits physical address bits and have 32G RAM installed,
+ * then the mitigation range check in l1tf_select_mitigation() triggers.
+ * This is a false positive because the mitigation is still possible due to
+ * the fact that the cache uses 44bit internally. Use the cache bits
+ * instead of the reported physical bits and adjust them on the affected
+ * machines to 44bit if the reported bits are less than 44.
+ */
+static void override_cache_bits(struct cpuinfo_x86 *c)
+{
+        if (c->x86 != 6)
+                return;
+
+        switch (c->x86_model) {
+        case INTEL_FAM6_NEHALEM:
+        case INTEL_FAM6_WESTMERE:
+        case INTEL_FAM6_SANDYBRIDGE:
+        case INTEL_FAM6_IVYBRIDGE:
+        case INTEL_FAM6_HASWELL_CORE:
+        case INTEL_FAM6_HASWELL_ULT:
+        case INTEL_FAM6_HASWELL_GT3E:
+        case INTEL_FAM6_BROADWELL_CORE:
+        case INTEL_FAM6_BROADWELL_GT3E:
+        case INTEL_FAM6_SKYLAKE_MOBILE:
+        case INTEL_FAM6_SKYLAKE_DESKTOP:
+        case INTEL_FAM6_KABYLAKE_MOBILE:
+        case INTEL_FAM6_KABYLAKE_DESKTOP:
+                if (c->x86_cache_bits < 44)
+                        c->x86_cache_bits = 44;
+                break;
+        }
+}
+
 static void __init l1tf_select_mitigation(void)
 {
         u64 half_pa;
@@ -675,6 +714,8 @@ static void __init l1tf_select_mitigation(void)
         if (!boot_cpu_has_bug(X86_BUG_L1TF))
                 return;
 
+        override_cache_bits(&boot_cpu_data);
+
         switch (l1tf_mitigation) {
         case L1TF_MITIGATION_OFF:
         case L1TF_MITIGATION_FLUSH_NOWARN:
@@ -694,11 +735,6 @@ static void __init l1tf_select_mitigation(void)
         return;
 #endif
 
-        /*
-         * This is extremely unlikely to happen because almost all
-         * systems have far more MAX_PA/2 than RAM can be fit into
-         * DIMM slots.
-         */
         half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
         if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
                 pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");