This is a note to let you know that I've just added the patch titled x86/bugs: Report AMD retbleed vulnerability to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: x86-bugs-report-amd-retbleed-vulnerability.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Wed Oct 5 12:28:43 PM CEST 2022 From: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx> Date: Mon, 3 Oct 2022 10:10:09 -0300 Subject: x86/bugs: Report AMD retbleed vulnerability To: stable@xxxxxxxxxxxxxxx Cc: x86@xxxxxxxxxx, kvm@xxxxxxxxxxxxxxx, bp@xxxxxxxxx, pbonzini@xxxxxxxxxx, peterz@xxxxxxxxxxxxx, jpoimboe@xxxxxxxxxx Message-ID: <20221003131038.12645-9-cascardo@xxxxxxxxxxxxx> From: Alexandre Chartre <alexandre.chartre@xxxxxxxxxx> commit 6b80b59b3555706508008f1f127b5412c89c7fd8 upstream. Report that AMD x86 CPUs are vulnerable to the RETBleed (Arbitrary Speculative Code Execution with Return Instructions) attack. [peterz: add hygon] [kim: invert parity; fam15h] Co-developed-by: Kim Phillips <kim.phillips@xxxxxxx> Signed-off-by: Kim Phillips <kim.phillips@xxxxxxx> Signed-off-by: Alexandre Chartre <alexandre.chartre@xxxxxxxxxx> Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx> Signed-off-by: Borislav Petkov <bp@xxxxxxx> Reviewed-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx> Signed-off-by: Borislav Petkov <bp@xxxxxxx> [cascardo: adjusted BUG numbers to match upstream] Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/include/asm/cpufeatures.h | 3 ++- arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++ arch/x86/kernel/cpu/common.c | 19 +++++++++++++++++++ drivers/base/cpu.c | 8 ++++++++ include/linux/cpu.h | 2 ++ 5 files changed, 44 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -408,6 +408,7 @@ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ -#define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */ +#define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */ +#define X86_BUG_MMIO_UNKNOWN X86_BUG(28) /* CPU is too old and its MMIO Stale Data status is unknown */ #endif /* _ASM_X86_CPUFEATURES_H */ --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1911,6 +1911,11 @@ static ssize_t srbds_show_state(char *bu return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]); } +static ssize_t retbleed_show_state(char *buf) +{ + return sprintf(buf, "Vulnerable\n"); +} + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, char *buf, unsigned int bug) { @@ -1957,6 +1962,9 @@ static ssize_t cpu_show_common(struct de case X86_BUG_MMIO_UNKNOWN: return mmio_stale_data_show_state(buf); + case X86_BUG_RETBLEED: + return retbleed_show_state(buf); + default: break; } @@ -2016,4 +2024,9 @@ ssize_t cpu_show_mmio_stale_data(struct else return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA); } + +ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf) +{ + return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED); +} #endif --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1099,16 +1099,27 @@ static const __initconst struct x86_cpu_ {} }; +#define VULNBL(vendor, family, model, blacklist) \ + X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, blacklist) + #define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \ INTEL_FAM6_##model, steppings, \ X86_FEATURE_ANY, issues) +#define VULNBL_AMD(family, blacklist) \ + VULNBL(AMD, family, X86_MODEL_ANY, blacklist) + +#define VULNBL_HYGON(family, blacklist) \ + VULNBL(HYGON, family, X86_MODEL_ANY, blacklist) + #define SRBDS BIT(0) /* CPU is affected by X86_BUG_MMIO_STALE_DATA */ #define MMIO BIT(1) /* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */ #define MMIO_SBDS BIT(2) +/* CPU is affected by RETbleed, speculating where you would not expect it */ +#define RETBLEED BIT(3) static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), @@ -1141,6 +1152,11 @@ static const struct x86_cpu_id cpu_vuln_ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS), VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO), VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS), + + VULNBL_AMD(0x15, RETBLEED), + VULNBL_AMD(0x16, RETBLEED), + VULNBL_AMD(0x17, RETBLEED), + VULNBL_HYGON(0x18, RETBLEED), {} }; @@ -1248,6 +1264,9 @@ static void __init cpu_set_bug_bits(stru setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN); } + if (cpu_matches(cpu_vuln_blacklist, RETBLEED)) + setup_force_cpu_bug(X86_BUG_RETBLEED); + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -574,6 +574,12 @@ ssize_t __weak cpu_show_mmio_stale_data( return sysfs_emit(buf, "Not affected\n"); } +ssize_t __weak cpu_show_retbleed(struct device *dev, + struct device_attribute *attr, char *buf) +{ + return sysfs_emit(buf, "Not affected\n"); +} + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); @@ -584,6 +590,7 @@ static DEVICE_ATTR(tsx_async_abort, 0444 static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL); +static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL); static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr, @@ -596,6 +603,7 @@ static struct attribute *cpu_root_vulner &dev_attr_itlb_multihit.attr, &dev_attr_srbds.attr, &dev_attr_mmio_stale_data.attr, + &dev_attr_retbleed.attr, NULL }; --- a/include/linux/cpu.h +++ b/include/linux/cpu.h @@ -68,6 +68,8 @@ extern ssize_t cpu_show_srbds(struct dev extern ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *attr, char *buf); +extern ssize_t cpu_show_retbleed(struct device *dev, + struct device_attribute *attr, char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata, Patches currently in stable-queue which might be from cascardo@xxxxxxxxxxxxx are queue-5.4/x86-speculation-disable-rrsba-behavior.patch queue-5.4/kvm-vmx-flatten-__vmx_vcpu_run.patch queue-5.4/x86-kvm-vmx-make-noinstr-clean.patch queue-5.4/revert-x86-speculation-add-rsb-vm-exit-protections.patch queue-5.4/kvm-vmx-fix-ibrs-handling-after-vmexit.patch queue-5.4/kvm-vmx-prevent-guest-rsb-poisoning-attacks-with-eibrs.patch queue-5.4/kvm-nvmx-use-__vmx_vcpu_run-in-nested_vmx_check_vmentry_hw.patch queue-5.4/x86-bugs-keep-a-per-cpu-ia32_spec_ctrl-value.patch queue-5.4/x86-cpu-amd-enumerate-btc_no.patch queue-5.4/x86-speculation-fix-firmware-entry-spec_ctrl-handling.patch queue-5.4/x86-speculation-add-spectre_v2-ibrs-option-to-support-kernel-ibrs.patch queue-5.4/x86-cpu-add-consistent-cpu-match-macros.patch queue-5.4/x86-speculation-remove-x86_spec_ctrl_mask.patch queue-5.4/x86-bugs-add-cannon-lake-to-retbleed-affected-cpu-list.patch queue-5.4/x86-bugs-warn-when-ibrs-mitigation-is-selected-on-enhanced-ibrs-parts.patch queue-5.4/x86-speculation-fill-rsb-on-vmexit-for-ibrs.patch queue-5.4/x86-cpu-add-a-steppings-field-to-struct-x86_cpu_id.patch queue-5.4/kvm-vmx-convert-launched-argument-to-flags.patch queue-5.4/x86-common-stamp-out-the-stepping-madness.patch queue-5.4/x86-bugs-split-spectre_v2_select_mitigation-and-spectre_v2_user_select_mitigation.patch queue-5.4/x86-bugs-report-intel-retbleed-vulnerability.patch queue-5.4/x86-speculation-change-fill_return_buffer-to-work-with-objtool.patch queue-5.4/x86-cpufeatures-move-retpoline-flags-to-word-11.patch queue-5.4/x86-speculation-fix-spec_ctrl-write-on-smt-state-change.patch queue-5.4/kvm-vmx-use-test-reg-reg-instead-of-cmp-0-reg-in-vmenter.s.patch queue-5.4/x86-bugs-optimize-spec_ctrl-msr-writes.patch queue-5.4/x86-bugs-report-amd-retbleed-vulnerability.patch queue-5.4/x86-speculation-fix-rsb-filling-with-config_retpoline-n.patch queue-5.4/intel_idle-disable-ibrs-during-long-idle.patch queue-5.4/x86-speculation-use-declare_per_cpu-for-x86_spec_ctrl_current.patch queue-5.4/x86-entry-remove-skip_r11rcx.patch queue-5.4/x86-speculation-use-cached-host-spec_ctrl-value-for-guest-entry-exit.patch queue-5.4/x86-devicetable-move-x86-specific-macro-out-of-generic-code.patch queue-5.4/x86-bugs-add-amd-retbleed-boot-parameter.patch queue-5.4/x86-entry-add-kernel-ibrs-implementation.patch queue-5.4/revert-x86-cpu-add-a-steppings-field-to-struct-x86_cpu_id.patch queue-5.4/x86-speculation-add-rsb-vm-exit-protections.patch