Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 063b7f98 authored by Alexandre Chartre's avatar Alexandre Chartre Committed by Greg Kroah-Hartman
Browse files

x86/bugs: Report AMD retbleed vulnerability 



commit 6b80b59b3555706508008f1f127b5412c89c7fd8 upstream.

Report that AMD x86 CPUs are vulnerable to the RETBleed (Arbitrary
Speculative Code Execution with Return Instructions) attack.

  [peterz: add hygon]
  [kim: invert parity; fam15h]

Co-developed-by: default avatarKim Phillips <kim.phillips@amd.com>
Signed-off-by: default avatarKim Phillips <kim.phillips@amd.com>
Signed-off-by: default avatarAlexandre Chartre <alexandre.chartre@oracle.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
[cascardo: adjusted BUG numbers to match upstream]
Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 954d591a

arch/x86/include/asm/cpufeatures.h

+2 −1
Original line number Diff line number Diff line
@@ -408,6 +408,7 @@ 
#define X86_BUG_ITLB_MULTIHIT		X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */

#define X86_BUG_SRBDS			X86_BUG(24) /* CPU may leak RNG bits if not mitigated */

#define X86_BUG_MMIO_STALE_DATA		X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */

#define X86_BUG_MMIO_UNKNOWN		X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */

#define X86_BUG_RETBLEED		X86_BUG(26) /* CPU is affected by RETBleed */

#define X86_BUG_MMIO_UNKNOWN		X86_BUG(28) /* CPU is too old and its MMIO Stale Data status is unknown */



#endif /* _ASM_X86_CPUFEATURES_H */

arch/x86/kernel/cpu/bugs.c

+13 −0
Original line number Diff line number Diff line
@@ -1911,6 +1911,11 @@ static ssize_t srbds_show_state(char *buf) 
	return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);

}



static ssize_t retbleed_show_state(char *buf)

{

	return sprintf(buf, "Vulnerable\n");

}



static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,

			       char *buf, unsigned int bug)

{
@@ -1957,6 +1962,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr 
	case X86_BUG_MMIO_UNKNOWN:

		return mmio_stale_data_show_state(buf);



	case X86_BUG_RETBLEED:

		return retbleed_show_state(buf);



	default:

		break;

	}
@@ -2016,4 +2024,9 @@ ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *at 
	else

		return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);

}



ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf)

{

	return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED);

}

#endif

arch/x86/kernel/cpu/common.c

+19 −0
Original line number Diff line number Diff line
@@ -1099,16 +1099,27 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { 
	{}

};



#define VULNBL(vendor, family, model, blacklist)	\

	X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, blacklist)



#define VULNBL_INTEL_STEPPINGS(model, steppings, issues)		   \

	X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6,		   \

					    INTEL_FAM6_##model, steppings, \

					    X86_FEATURE_ANY, issues)



#define VULNBL_AMD(family, blacklist)		\

	VULNBL(AMD, family, X86_MODEL_ANY, blacklist)



#define VULNBL_HYGON(family, blacklist)		\

	VULNBL(HYGON, family, X86_MODEL_ANY, blacklist)



#define SRBDS		BIT(0)

/* CPU is affected by X86_BUG_MMIO_STALE_DATA */

#define MMIO		BIT(1)

/* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */

#define MMIO_SBDS	BIT(2)

/* CPU is affected by RETbleed, speculating where you would not expect it */

#define RETBLEED	BIT(3)



static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {

	VULNBL_INTEL_STEPPINGS(IVYBRIDGE,	X86_STEPPING_ANY,		SRBDS),
@@ -1141,6 +1152,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { 
	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D,	X86_STEPPING_ANY,		MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPINGS(0x0, 0x0),	MMIO | MMIO_SBDS),



	VULNBL_AMD(0x15, RETBLEED),

	VULNBL_AMD(0x16, RETBLEED),

	VULNBL_AMD(0x17, RETBLEED),

	VULNBL_HYGON(0x18, RETBLEED),

	{}

};
@@ -1248,6 +1264,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) 
			setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);

	}



	if (cpu_matches(cpu_vuln_blacklist, RETBLEED))

		setup_force_cpu_bug(X86_BUG_RETBLEED);



	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))

		return;

drivers/base/cpu.c

+8 −0
Original line number Diff line number Diff line
@@ -574,6 +574,12 @@ ssize_t __weak cpu_show_mmio_stale_data(struct device *dev, 
	return sysfs_emit(buf, "Not affected\n");

}



ssize_t __weak cpu_show_retbleed(struct device *dev,

				 struct device_attribute *attr, char *buf)

{

	return sysfs_emit(buf, "Not affected\n");

}



static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);

static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);

static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
@@ -584,6 +590,7 @@ static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); 
static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);

static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);

static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);

static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);



static struct attribute *cpu_root_vulnerabilities_attrs[] = {

	&dev_attr_meltdown.attr,
@@ -596,6 +603,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { 
	&dev_attr_itlb_multihit.attr,

	&dev_attr_srbds.attr,

	&dev_attr_mmio_stale_data.attr,

	&dev_attr_retbleed.attr,

	NULL

};

include/linux/cpu.h

+2 −0
Original line number Diff line number Diff line
@@ -68,6 +68,8 @@ extern ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, 
extern ssize_t cpu_show_mmio_stale_data(struct device *dev,

					struct device_attribute *attr,

					char *buf);

extern ssize_t cpu_show_retbleed(struct device *dev,

				 struct device_attribute *attr, char *buf);



extern __printf(4, 5)

struct device *cpu_device_create(struct device *parent, void *drvdata,