Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9dc813c5 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Greg Kroah-Hartman
Browse files

x86/bugs: Report Intel retbleed vulnerability 



commit 6ad0ad2bf8a67e27d1f9d006a1dabb0e1c360cc3 upstream.

Skylake suffers from RSB underflow speculation issues; report this
vulnerability and it's mitigation (spectre_v2=ibrs).

  [jpoimboe: cleanups, eibrs]

Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
[suleiman: different processor names]
Signed-off-by: default avatarSuleiman Souhlal <suleiman@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6cc8bd7d

arch/x86/include/asm/msr-index.h

+1 −0
Original line number Diff line number Diff line
@@ -73,6 +73,7 @@ 
#define MSR_IA32_ARCH_CAPABILITIES	0x0000010a

#define ARCH_CAP_RDCL_NO		BIT(0)	/* Not susceptible to Meltdown */

#define ARCH_CAP_IBRS_ALL		BIT(1)	/* Enhanced IBRS support */

#define ARCH_CAP_RSBA			BIT(2)	/* RET may use alternative branch predictors */

#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH	BIT(3)	/* Skip L1D flush on vmentry */

#define ARCH_CAP_SSB_NO			BIT(4)	/*

						 * Not susceptible to Speculative Store Bypass

arch/x86/kernel/cpu/bugs.c

+31 −5
Original line number Diff line number Diff line
@@ -743,11 +743,16 @@ static int __init nospectre_v1_cmdline(char *str) 
}

early_param("nospectre_v1", nospectre_v1_cmdline);



static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =

	SPECTRE_V2_NONE;



#undef pr_fmt

#define pr_fmt(fmt)     "RETBleed: " fmt



enum retbleed_mitigation {

	RETBLEED_MITIGATION_NONE,

	RETBLEED_MITIGATION_IBRS,

	RETBLEED_MITIGATION_EIBRS,

};



enum retbleed_mitigation_cmd {
@@ -757,6 +762,8 @@ enum retbleed_mitigation_cmd { 


const char * const retbleed_strings[] = {

	[RETBLEED_MITIGATION_NONE]	= "Vulnerable",

	[RETBLEED_MITIGATION_IBRS]	= "Mitigation: IBRS",

	[RETBLEED_MITIGATION_EIBRS]	= "Mitigation: Enhanced IBRS",

};



static enum retbleed_mitigation retbleed_mitigation __ro_after_init =
@@ -782,6 +789,7 @@ early_param("retbleed", retbleed_parse_cmdline); 


#define RETBLEED_UNTRAIN_MSG "WARNING: BTB untrained return thunk mitigation is only effective on AMD/Hygon!\n"

#define RETBLEED_COMPILER_MSG "WARNING: kernel not compiled with RETPOLINE or -mfunction-return capable compiler!\n"

#define RETBLEED_INTEL_MSG "WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!\n"



static void __init retbleed_select_mitigation(void)

{
@@ -794,8 +802,10 @@ static void __init retbleed_select_mitigation(void) 


	case RETBLEED_CMD_AUTO:

	default:

		if (!boot_cpu_has_bug(X86_BUG_RETBLEED))

			break;

		/*

		 * The Intel mitigation (IBRS) was already selected in

		 * spectre_v2_select_mitigation().

		 */



		break;

	}
@@ -805,15 +815,31 @@ static void __init retbleed_select_mitigation(void) 
		break;

	}



	/*

	 * Let IBRS trump all on Intel without affecting the effects of the

	 * retbleed= cmdline option.

	 */

	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {

		switch (spectre_v2_enabled) {

		case SPECTRE_V2_IBRS:

			retbleed_mitigation = RETBLEED_MITIGATION_IBRS;

			break;

		case SPECTRE_V2_EIBRS:

		case SPECTRE_V2_EIBRS_RETPOLINE:

		case SPECTRE_V2_EIBRS_LFENCE:

			retbleed_mitigation = RETBLEED_MITIGATION_EIBRS;

			break;

		default:

			pr_err(RETBLEED_INTEL_MSG);

		}

	}



	pr_info("%s\n", retbleed_strings[retbleed_mitigation]);

}



#undef pr_fmt

#define pr_fmt(fmt)     "Spectre V2 : " fmt



static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =

	SPECTRE_V2_NONE;



static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =

	SPECTRE_V2_USER_NONE;

static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =

arch/x86/kernel/cpu/common.c

+12 −12
Original line number Diff line number Diff line
@@ -1048,24 +1048,24 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { 
	VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E,	X86_STEPPING_ANY,		SRBDS),

	VULNBL_INTEL_STEPPINGS(BROADWELL_X,	X86_STEPPING_ANY,		MMIO),

	VULNBL_INTEL_STEPPINGS(BROADWELL_CORE,	X86_STEPPING_ANY,		SRBDS),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE,	X86_STEPPINGS(0x3, 0x3),	SRBDS | MMIO),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE,	X86_STEPPINGS(0x3, 0x3),	SRBDS | MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE,	X86_STEPPING_ANY,		SRBDS),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_X,	BIT(3) | BIT(4) | BIT(6) |

						BIT(7) | BIT(0xB),              MMIO),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP,	X86_STEPPINGS(0x3, 0x3),	SRBDS | MMIO),

						BIT(7) | BIT(0xB),              MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP,	X86_STEPPINGS(0x3, 0x3),	SRBDS | MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP,	X86_STEPPING_ANY,		SRBDS),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE,	X86_STEPPINGS(0x9, 0xC),	SRBDS | MMIO),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE,	X86_STEPPINGS(0x9, 0xC),	SRBDS | MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE,	X86_STEPPINGS(0x0, 0x8),	SRBDS),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x9, 0xD),	SRBDS | MMIO),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x9, 0xD),	SRBDS | MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0x8),	SRBDS),

	VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE,	X86_STEPPINGS(0x5, 0x5),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE,	X86_STEPPINGS(0x5, 0x5),	MMIO | MMIO_SBDS | RETBLEED),

	VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(ICELAKE_X,	X86_STEPPINGS(0x4, 0x6),	MMIO),

	VULNBL_INTEL_STEPPINGS(COMETLAKE,	BIT(2) | BIT(3) | BIT(5),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x0, 0x0),	MMIO),

	VULNBL_INTEL_STEPPINGS(LAKEFIELD,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ROCKETLAKE,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(COMETLAKE,	BIT(2) | BIT(3) | BIT(5),	MMIO | MMIO_SBDS | RETBLEED),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS | RETBLEED),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x0, 0x0),	MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(LAKEFIELD,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS | RETBLEED),

	VULNBL_INTEL_STEPPINGS(ROCKETLAKE,	X86_STEPPINGS(0x1, 0x1),	MMIO | RETBLEED),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X,	X86_STEPPING_ANY,		MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPINGS(0x0, 0x0),	MMIO | MMIO_SBDS),
@@ -1178,7 +1178,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) 
			setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);

	}



	if (cpu_matches(cpu_vuln_blacklist, RETBLEED))

	if ((cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA)))

		setup_force_cpu_bug(X86_BUG_RETBLEED);



	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))