lkml.org 
[lkml]   [2022]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 096/130] x86/bugs: Report AMD retbleed vulnerability
    Date
    From: Alexandre Chartre <alexandre.chartre@oracle.com>

    commit 6b80b59b3555706508008f1f127b5412c89c7fd8 upstream.

    Report that AMD x86 CPUs are vulnerable to the RETBleed (Arbitrary
    Speculative Code Execution with Return Instructions) attack.

    [peterz: add hygon]
    [kim: invert parity; fam15h]

    Co-developed-by: Kim Phillips <kim.phillips@amd.com>
    Signed-off-by: Kim Phillips <kim.phillips@amd.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/include/asm/cpufeatures.h | 1 +
    arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++
    arch/x86/kernel/cpu/common.c | 19 +++++++++++++++++++
    drivers/base/cpu.c | 8 ++++++++
    include/linux/cpu.h | 2 ++
    5 files changed, 43 insertions(+)

    --- a/arch/x86/include/asm/cpufeatures.h
    +++ b/arch/x86/include/asm/cpufeatures.h
    @@ -426,5 +426,6 @@
    #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
    #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
    #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
    +#define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */

    #endif /* _ASM_X86_CPUFEATURES_H */
    --- a/arch/x86/kernel/cpu/bugs.c
    +++ b/arch/x86/kernel/cpu/bugs.c
    @@ -1917,6 +1917,11 @@ static ssize_t srbds_show_state(char *bu
    return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
    }

    +static ssize_t retbleed_show_state(char *buf)
    +{
    + return sprintf(buf, "Vulnerable\n");
    +}
    +
    static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
    char *buf, unsigned int bug)
    {
    @@ -1962,6 +1967,9 @@ static ssize_t cpu_show_common(struct de
    case X86_BUG_MMIO_STALE_DATA:
    return mmio_stale_data_show_state(buf);

    + case X86_BUG_RETBLEED:
    + return retbleed_show_state(buf);
    +
    default:
    break;
    }
    @@ -2018,4 +2026,9 @@ ssize_t cpu_show_mmio_stale_data(struct
    {
    return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
    }
    +
    +ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf)
    +{
    + return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED);
    +}
    #endif
    --- a/arch/x86/kernel/cpu/common.c
    +++ b/arch/x86/kernel/cpu/common.c
    @@ -1092,16 +1092,27 @@ static const __initconst struct x86_cpu_
    {}
    };

    +#define VULNBL(vendor, family, model, blacklist) \
    + X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, blacklist)
    +
    #define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \
    X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \
    INTEL_FAM6_##model, steppings, \
    X86_FEATURE_ANY, issues)

    +#define VULNBL_AMD(family, blacklist) \
    + VULNBL(AMD, family, X86_MODEL_ANY, blacklist)
    +
    +#define VULNBL_HYGON(family, blacklist) \
    + VULNBL(HYGON, family, X86_MODEL_ANY, blacklist)
    +
    #define SRBDS BIT(0)
    /* CPU is affected by X86_BUG_MMIO_STALE_DATA */
    #define MMIO BIT(1)
    /* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */
    #define MMIO_SBDS BIT(2)
    +/* CPU is affected by RETbleed, speculating where you would not expect it */
    +#define RETBLEED BIT(3)

    static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
    VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
    @@ -1134,6 +1145,11 @@ static const struct x86_cpu_id cpu_vuln_
    VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
    VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO),
    VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS),
    +
    + VULNBL_AMD(0x15, RETBLEED),
    + VULNBL_AMD(0x16, RETBLEED),
    + VULNBL_AMD(0x17, RETBLEED),
    + VULNBL_HYGON(0x18, RETBLEED),
    {}
    };

    @@ -1235,6 +1251,9 @@ static void __init cpu_set_bug_bits(stru
    !arch_cap_mmio_immune(ia32_cap))
    setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);

    + if (cpu_matches(cpu_vuln_blacklist, RETBLEED))
    + setup_force_cpu_bug(X86_BUG_RETBLEED);
    +
    if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
    return;

    --- a/drivers/base/cpu.c
    +++ b/drivers/base/cpu.c
    @@ -572,6 +572,12 @@ ssize_t __weak cpu_show_mmio_stale_data(
    return sysfs_emit(buf, "Not affected\n");
    }

    +ssize_t __weak cpu_show_retbleed(struct device *dev,
    + struct device_attribute *attr, char *buf)
    +{
    + return sysfs_emit(buf, "Not affected\n");
    +}
    +
    static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
    static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
    static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
    @@ -582,6 +588,7 @@ static DEVICE_ATTR(tsx_async_abort, 0444
    static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
    static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
    static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
    +static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);

    static struct attribute *cpu_root_vulnerabilities_attrs[] = {
    &dev_attr_meltdown.attr,
    @@ -594,6 +601,7 @@ static struct attribute *cpu_root_vulner
    &dev_attr_itlb_multihit.attr,
    &dev_attr_srbds.attr,
    &dev_attr_mmio_stale_data.attr,
    + &dev_attr_retbleed.attr,
    NULL
    };

    --- a/include/linux/cpu.h
    +++ b/include/linux/cpu.h
    @@ -68,6 +68,8 @@ extern ssize_t cpu_show_srbds(struct dev
    extern ssize_t cpu_show_mmio_stale_data(struct device *dev,
    struct device_attribute *attr,
    char *buf);
    +extern ssize_t cpu_show_retbleed(struct device *dev,
    + struct device_attribute *attr, char *buf);

    extern __printf(4, 5)
    struct device *cpu_device_create(struct device *parent, void *drvdata,

    \
     
     \ /
      Last update: 2022-07-12 20:53    [W:4.182 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site