From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>,
Borislav Petkov <bp@suse.de>,
Josh Poimboeuf <jpoimboe@kernel.org>,
Sasha Levin <sashal@kernel.org>,
tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
dave.hansen@linux.intel.com, x86@kernel.org,
pawan.kumar.gupta@linux.intel.com, adrian.hunter@intel.com,
alexander.shishkin@linux.intel.com, tony.luck@intel.com,
sumeet.r.pawnikar@intel.com, ray.huang@amd.com,
ricardo.neri-calderon@linux.intel.com, sblbir@amazon.com,
alexandre.chartre@oracle.com, kim.phillips@amd.com,
keescook@chromium.org, jane.malalane@citrix.com
Subject: [PATCH AUTOSEL 5.15 15/42] x86/bugs: Report Intel retbleed vulnerability
Date: Tue, 19 Jul 2022 21:13:23 -0400 [thread overview]
Message-ID: <20220720011350.1024134-15-sashal@kernel.org> (raw)
In-Reply-To: <20220720011350.1024134-1-sashal@kernel.org>
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 6ad0ad2bf8a67e27d1f9d006a1dabb0e1c360cc3 ]
Skylake suffers from RSB underflow speculation issues; report this
vulnerability and it's mitigation (spectre_v2=ibrs).
[jpoimboe: cleanups, eibrs]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/kernel/cpu/bugs.c | 39 +++++++++++++++++++++++++++-----
arch/x86/kernel/cpu/common.c | 24 ++++++++++----------
3 files changed, 46 insertions(+), 18 deletions(-)
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 7dc5a3306f37..320826cbfb69 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -91,6 +91,7 @@
#define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
#define ARCH_CAP_RDCL_NO BIT(0) /* Not susceptible to Meltdown */
#define ARCH_CAP_IBRS_ALL BIT(1) /* Enhanced IBRS support */
+#define ARCH_CAP_RSBA BIT(2) /* RET may use alternative branch predictors */
#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH BIT(3) /* Skip L1D flush on vmentry */
#define ARCH_CAP_SSB_NO BIT(4) /*
* Not susceptible to Speculative Store Bypass
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 7637318f3b7e..d4a18649ce9f 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -783,12 +783,17 @@ static int __init nospectre_v1_cmdline(char *str)
}
early_param("nospectre_v1", nospectre_v1_cmdline);
+static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ SPECTRE_V2_NONE;
+
#undef pr_fmt
#define pr_fmt(fmt) "RETBleed: " fmt
enum retbleed_mitigation {
RETBLEED_MITIGATION_NONE,
RETBLEED_MITIGATION_UNRET,
+ RETBLEED_MITIGATION_IBRS,
+ RETBLEED_MITIGATION_EIBRS,
};
enum retbleed_mitigation_cmd {
@@ -800,6 +805,8 @@ enum retbleed_mitigation_cmd {
const char * const retbleed_strings[] = {
[RETBLEED_MITIGATION_NONE] = "Vulnerable",
[RETBLEED_MITIGATION_UNRET] = "Mitigation: untrained return thunk",
+ [RETBLEED_MITIGATION_IBRS] = "Mitigation: IBRS",
+ [RETBLEED_MITIGATION_EIBRS] = "Mitigation: Enhanced IBRS",
};
static enum retbleed_mitigation retbleed_mitigation __ro_after_init =
@@ -842,6 +849,7 @@ early_param("retbleed", retbleed_parse_cmdline);
#define RETBLEED_UNTRAIN_MSG "WARNING: BTB untrained return thunk mitigation is only effective on AMD/Hygon!\n"
#define RETBLEED_COMPILER_MSG "WARNING: kernel not compiled with RETPOLINE or -mfunction-return capable compiler!\n"
+#define RETBLEED_INTEL_MSG "WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!\n"
static void __init retbleed_select_mitigation(void)
{
@@ -858,12 +866,15 @@ static void __init retbleed_select_mitigation(void)
case RETBLEED_CMD_AUTO:
default:
- if (!boot_cpu_has_bug(X86_BUG_RETBLEED))
- break;
-
if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
+
+ /*
+ * The Intel mitigation (IBRS) was already selected in
+ * spectre_v2_select_mitigation().
+ */
+
break;
}
@@ -893,15 +904,31 @@ static void __init retbleed_select_mitigation(void)
break;
}
+ /*
+ * Let IBRS trump all on Intel without affecting the effects of the
+ * retbleed= cmdline option.
+ */
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
+ switch (spectre_v2_enabled) {
+ case SPECTRE_V2_IBRS:
+ retbleed_mitigation = RETBLEED_MITIGATION_IBRS;
+ break;
+ case SPECTRE_V2_EIBRS:
+ case SPECTRE_V2_EIBRS_RETPOLINE:
+ case SPECTRE_V2_EIBRS_LFENCE:
+ retbleed_mitigation = RETBLEED_MITIGATION_EIBRS;
+ break;
+ default:
+ pr_err(RETBLEED_INTEL_MSG);
+ }
+ }
+
pr_info("%s\n", retbleed_strings[retbleed_mitigation]);
}
#undef pr_fmt
#define pr_fmt(fmt) "Spectre V2 : " fmt
-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
- SPECTRE_V2_NONE;
-
static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =
SPECTRE_V2_USER_NONE;
static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d5488cff3e01..39e9e84e75af 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1127,24 +1127,24 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS),
- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, BIT(3) | BIT(4) | BIT(6) |
- BIT(7) | BIT(0xB), MMIO),
- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ BIT(7) | BIT(0xB), MMIO | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS),
- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0x8), SRBDS),
- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0x8), SRBDS),
- VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS),
+ VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPINGS(0x1, 0x1), MMIO),
VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPINGS(0x4, 0x6), MMIO),
- VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO),
- VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS),
@@ -1254,7 +1254,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
!arch_cap_mmio_immune(ia32_cap))
setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
- if (cpu_matches(cpu_vuln_blacklist, RETBLEED))
+ if ((cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA)))
setup_force_cpu_bug(X86_BUG_RETBLEED);
if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
--
2.35.1
next prev parent reply other threads:[~2022-07-20 1:19 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-20 1:13 [PATCH AUTOSEL 5.15 01/42] Revert "evm: Fix memleak in init_desc" Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 02/42] ARM: rockchip: Add missing of_node_put() in rockchip_suspend_init() Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 03/42] x86/kvm/vmx: Make noinstr clean Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 04/42] x86/cpufeatures: Move RETPOLINE flags to word 11 Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 05/42] x86/retpoline: Swizzle retpoline thunk Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 06/42] x86/vsyscall_emu/64: Don't use RET in vsyscall emulation Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 07/42] x86/sev: Avoid using __x86_return_thunk Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 08/42] objtool: Treat .text.__x86.* as noinstr Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 09/42] x86/bugs: Report AMD retbleed vulnerability Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 10/42] x86/bugs: Add AMD retbleed= boot parameter Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 11/42] x86/bugs: Enable STIBP for JMP2RET Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 12/42] x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 13/42] x86/bugs: Optimize SPEC_CTRL MSR writes Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 14/42] x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() Sasha Levin
2022-07-20 1:13 ` Sasha Levin [this message]
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 16/42] x86/xen: Rename SYS* entry points Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 17/42] x86/bugs: Do IBPB fallback check only once Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 18/42] x86/cpu/amd: Add Spectral Chicken Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 19/42] x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 20/42] KVM: VMX: Flatten __vmx_vcpu_run() Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 21/42] KVM: VMX: Convert launched argument to flags Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 22/42] KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 23/42] wifi: mac80211: check skb_shared in ieee80211_8023_xmit() Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 24/42] wifi: mac80211: do not wake queues on a vif that is being stopped Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 25/42] wifi: cfg80211: Allow P2P client interface to indicate port authorization Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 26/42] drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Tablet 2 830 Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 27/42] nilfs2: fix incorrect masking of permission flags for symlinks Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 28/42] ASoC: ti: omap-mcbsp: duplicate sysfs error Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 29/42] ASoC: tlv320adcx140: Fix tx_mask check Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 30/42] ASoC: wm5102: Fix event generation for output compensation Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 31/42] ASoC: wm8998: Fix event generation for input mux Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 32/42] ASoC: cs47l92: Fix event generation for OUT1 demux Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 33/42] ASoC: arizona: Update arizona_aif_cfg_changed to use RX_BCLK_RATE Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 34/42] scsi: target: Fix WRITE_SAME No Data Buffer crash Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 35/42] x86/kexec: Disable RET on kexec Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 36/42] platform/x86: asus-wmi: Add key mappings Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 37/42] platform/x86: intel_atomisp2_led: Also turn off the always-on camera LED on the Asus T100TAF Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 38/42] scsi: ufs: core: Fix missing clk change notification on host reset Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 39/42] scsi: pm80xx: Fix 'Unknown' max/min linkrate Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 40/42] scsi: pm80xx: Set stopped phy's linkrate to Disabled Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 41/42] KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 Sasha Levin
2022-07-20 1:13 ` [PATCH AUTOSEL 5.15 42/42] ubsan: disable UBSAN_DIV_ZERO for clang Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220720011350.1024134-15-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=alexandre.chartre@oracle.com \
--cc=bp@alien8.de \
--cc=bp@suse.de \
--cc=dave.hansen@linux.intel.com \
--cc=jane.malalane@citrix.com \
--cc=jpoimboe@kernel.org \
--cc=keescook@chromium.org \
--cc=kim.phillips@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=peterz@infradead.org \
--cc=ray.huang@amd.com \
--cc=ricardo.neri-calderon@linux.intel.com \
--cc=sblbir@amazon.com \
--cc=stable@vger.kernel.org \
--cc=sumeet.r.pawnikar@intel.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox