From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
To: stable@vger.kernel.org
Cc: x86@kernel.org, kvm@vger.kernel.org, bp@alien8.de,
pbonzini@redhat.com, peterz@infradead.org, jpoimboe@kernel.org
Subject: [PATCH 5.4 16/37] x86/bugs: Report Intel retbleed vulnerability
Date: Mon, 3 Oct 2022 10:10:17 -0300 [thread overview]
Message-ID: <20221003131038.12645-17-cascardo@canonical.com> (raw)
In-Reply-To: <20221003131038.12645-1-cascardo@canonical.com>
From: Peter Zijlstra <peterz@infradead.org>
commit 6ad0ad2bf8a67e27d1f9d006a1dabb0e1c360cc3 upstream.
Skylake suffers from RSB underflow speculation issues; report this
vulnerability and it's mitigation (spectre_v2=ibrs).
[jpoimboe: cleanups, eibrs]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/kernel/cpu/bugs.c | 36 +++++++++++++++++++++++++++-----
arch/x86/kernel/cpu/common.c | 24 ++++++++++-----------
3 files changed, 44 insertions(+), 17 deletions(-)
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index c56042916a7c..973784cfe23a 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -82,6 +82,7 @@
#define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
#define ARCH_CAP_RDCL_NO BIT(0) /* Not susceptible to Meltdown */
#define ARCH_CAP_IBRS_ALL BIT(1) /* Enhanced IBRS support */
+#define ARCH_CAP_RSBA BIT(2) /* RET may use alternative branch predictors */
#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH BIT(3) /* Skip L1D flush on vmentry */
#define ARCH_CAP_SSB_NO BIT(4) /*
* Not susceptible to Speculative Store Bypass
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 74f81db13585..d0baeb89f5ac 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -743,11 +743,16 @@ static int __init nospectre_v1_cmdline(char *str)
}
early_param("nospectre_v1", nospectre_v1_cmdline);
+static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ SPECTRE_V2_NONE;
+
#undef pr_fmt
#define pr_fmt(fmt) "RETBleed: " fmt
enum retbleed_mitigation {
RETBLEED_MITIGATION_NONE,
+ RETBLEED_MITIGATION_IBRS,
+ RETBLEED_MITIGATION_EIBRS,
};
enum retbleed_mitigation_cmd {
@@ -757,6 +762,8 @@ enum retbleed_mitigation_cmd {
const char * const retbleed_strings[] = {
[RETBLEED_MITIGATION_NONE] = "Vulnerable",
+ [RETBLEED_MITIGATION_IBRS] = "Mitigation: IBRS",
+ [RETBLEED_MITIGATION_EIBRS] = "Mitigation: Enhanced IBRS",
};
static enum retbleed_mitigation retbleed_mitigation __ro_after_init =
@@ -782,6 +789,7 @@ early_param("retbleed", retbleed_parse_cmdline);
#define RETBLEED_UNTRAIN_MSG "WARNING: BTB untrained return thunk mitigation is only effective on AMD/Hygon!\n"
#define RETBLEED_COMPILER_MSG "WARNING: kernel not compiled with RETPOLINE or -mfunction-return capable compiler!\n"
+#define RETBLEED_INTEL_MSG "WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!\n"
static void __init retbleed_select_mitigation(void)
{
@@ -794,8 +802,10 @@ static void __init retbleed_select_mitigation(void)
case RETBLEED_CMD_AUTO:
default:
- if (!boot_cpu_has_bug(X86_BUG_RETBLEED))
- break;
+ /*
+ * The Intel mitigation (IBRS) was already selected in
+ * spectre_v2_select_mitigation().
+ */
break;
}
@@ -805,15 +815,31 @@ static void __init retbleed_select_mitigation(void)
break;
}
+ /*
+ * Let IBRS trump all on Intel without affecting the effects of the
+ * retbleed= cmdline option.
+ */
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
+ switch (spectre_v2_enabled) {
+ case SPECTRE_V2_IBRS:
+ retbleed_mitigation = RETBLEED_MITIGATION_IBRS;
+ break;
+ case SPECTRE_V2_EIBRS:
+ case SPECTRE_V2_EIBRS_RETPOLINE:
+ case SPECTRE_V2_EIBRS_LFENCE:
+ retbleed_mitigation = RETBLEED_MITIGATION_EIBRS;
+ break;
+ default:
+ pr_err(RETBLEED_INTEL_MSG);
+ }
+ }
+
pr_info("%s\n", retbleed_strings[retbleed_mitigation]);
}
#undef pr_fmt
#define pr_fmt(fmt) "Spectre V2 : " fmt
-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
- SPECTRE_V2_NONE;
-
static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =
SPECTRE_V2_USER_NONE;
static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0ee6cd7155b0..69345a8a1762 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1131,24 +1131,24 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS),
- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, BIT(3) | BIT(4) | BIT(6) |
- BIT(7) | BIT(0xB), MMIO),
- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ BIT(7) | BIT(0xB), MMIO | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS),
- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0x8), SRBDS),
- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0x8), SRBDS),
- VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS),
+ VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPINGS(0x1, 0x1), MMIO),
VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPINGS(0x4, 0x6), MMIO),
- VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO),
- VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS | RETBLEED),
+ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS),
@@ -1264,7 +1264,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);
}
- if (cpu_matches(cpu_vuln_blacklist, RETBLEED))
+ if ((cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA)))
setup_force_cpu_bug(X86_BUG_RETBLEED);
if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
--
2.34.1
next prev parent reply other threads:[~2022-10-03 13:12 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-03 13:10 [PATCH 5.4 00/37] IBRS support // Retbleed mitigations Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 01/37] Revert "x86/speculation: Add RSB VM Exit protections" Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 02/37] Revert "x86/cpu: Add a steppings field to struct x86_cpu_id" Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 03/37] x86/devicetable: Move x86 specific macro out of generic code Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 04/37] x86/cpu: Add consistent CPU match macros Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 05/37] x86/cpu: Add a steppings field to struct x86_cpu_id Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 06/37] x86/kvm/vmx: Make noinstr clean Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 07/37] x86/cpufeatures: Move RETPOLINE flags to word 11 Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 08/37] x86/bugs: Report AMD retbleed vulnerability Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 09/37] x86/bugs: Add AMD retbleed= boot parameter Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 10/37] x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 11/37] x86/entry: Remove skip_r11rcx Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 12/37] x86/entry: Add kernel IBRS implementation Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 13/37] x86/bugs: Optimize SPEC_CTRL MSR writes Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 14/37] x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 15/37] x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` Thadeu Lima de Souza Cascardo [this message]
2022-10-03 13:10 ` [PATCH 5.4 17/37] intel_idle: Disable IBRS during long idle Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 18/37] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 19/37] x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 20/37] x86/speculation: Fix firmware entry SPEC_CTRL handling Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 21/37] x86/speculation: Fix SPEC_CTRL write on SMT state change Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 22/37] x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 23/37] x86/speculation: Remove x86_spec_ctrl_mask Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 24/37] KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 25/37] KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 26/37] KVM: VMX: Flatten __vmx_vcpu_run() Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 27/37] KVM: VMX: Convert launched argument to flags Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 28/37] KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 29/37] KVM: VMX: Fix IBRS handling after vmexit Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 30/37] x86/speculation: Fill RSB on vmexit for IBRS Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 31/37] x86/common: Stamp out the stepping madness Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 32/37] x86/cpu/amd: Enumerate BTC_NO Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 33/37] x86/bugs: Add Cannon lake to RETBleed affected CPU list Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 34/37] x86/speculation: Disable RRSBA behavior Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 35/37] x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 36/37] x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts Thadeu Lima de Souza Cascardo
2022-10-03 13:10 ` [PATCH 5.4 37/37] x86/speculation: Add RSB VM Exit protections Thadeu Lima de Souza Cascardo
2022-10-05 10:34 ` [PATCH 5.4 00/37] IBRS support // Retbleed mitigations Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221003131038.12645-17-cascardo@canonical.com \
--to=cascardo@canonical.com \
--cc=bp@alien8.de \
--cc=jpoimboe@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).