Skip to content

Commit 2f23a7c

Browse files
torvaldstorvalds
committed
Merge tag 'x86-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc x86 fixes from Ingo Molnar: - Fix PAT on Xen, which caused i915 driver failures - Fix compat INT 80 entry crash on Xen PV guests - Fix 'MMIO Stale Data' mitigation status reporting on older Intel CPUs - Fix RSB stuffing regressions - Fix ORC unwinding on ftrace trampolines - Add Intel Raptor Lake CPU model number - Fix (work around) a SEV-SNP bootloader bug providing bogus values in boot_params->cc_blob_address, by ignoring the value on !SEV-SNP bootups. - Fix SEV-SNP early boot failure - Fix the objtool list of noreturn functions and annotate snp_abort(), which bug confused objtool on gcc-12. - Fix the documentation for retbleed * tag 'x86-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/ABI: Mention retbleed vulnerability info file for sysfs x86/sev: Mark snp_abort() noreturn x86/sev: Don't use cc_platform_has() for early SEV-SNP calls x86/boot: Don't propagate uninitialized boot_params->cc_blob_address x86/cpu: Add new Raptor Lake CPU model number x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/nospec: Fix i386 RSB stuffing x86/nospec: Unwreck the RSB stuffing x86/bugs: Add "unknown" reporting for MMIO Stale Data x86/entry: Fix entry_INT80_compat for Xen PV guests x86/PAT: Have pat_enabled() properly reflect state when running on Xen
2 parents 4459d80 + 00da0cb commit 2f23a7c

File tree

15 files changed

+183
-88
lines changed

15 files changed

+183
-88
lines changed

‎Documentation/ABI/testing/sysfs-devices-system-cpu

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -523,6 +523,7 @@ What: /sys/devices/system/cpu/vulnerabilities
523523
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
524524
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
525525
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
526+
/sys/devices/system/cpu/vulnerabilities/retbleed
526527
Date: January 2018
527528
Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
528529
Description: Information about CPU vulnerabilities

‎Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,20 @@ The possible values in this file are:
230230
* - 'Mitigation: Clear CPU buffers'
231231
- The processor is vulnerable and the CPU buffer clearing mitigation is
232232
enabled.
233+
* - 'Unknown: No mitigations'
234+
- The processor vulnerability status is unknown because it is
235+
out of Servicing period. Mitigation is not attempted.
236+
237+
Definitions:
238+
------------
239+
240+
Servicing period: The process of providing functional and security updates to
241+
Intel processors or platforms, utilizing the Intel Platform Update (IPU)
242+
process or other similar mechanisms.
243+
244+
End of Servicing Updates (ESU): ESU is the date at which Intel will no
245+
longer provide Servicing, such as through IPU or other similar update
246+
processes. ESU dates will typically be aligned to end of quarter.
233247

234248
If the processor is vulnerable then the following information is appended to
235249
the above information:

‎arch/x86/boot/compressed/misc.h

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,17 @@ void snp_set_page_private(unsigned long paddr);
132132
void snp_set_page_shared(unsigned long paddr);
133133
void sev_prep_identity_maps(unsigned long top_level_pgt);
134134
#else
135-
static inline void sev_enable(struct boot_params *bp) { }
135+
static inline void sev_enable(struct boot_params *bp)
136+
{
137+
/*
138+
* bp->cc_blob_address should only be set by boot/compressed kernel.
139+
* Initialize it to 0 unconditionally (thus here in this stub too) to
140+
* ensure that uninitialized values from buggy bootloaders aren't
141+
* propagated.
142+
*/
143+
if (bp)
144+
bp->cc_blob_address = 0;
145+
}
136146
static inline void sev_es_shutdown_ghcb(void) { }
137147
static inline bool sev_es_check_ghcb_fault(unsigned long address)
138148
{

‎arch/x86/boot/compressed/sev.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,14 @@ void sev_enable(struct boot_params *bp)
276276
struct msr m;
277277
bool snp;
278278

279+
/*
280+
* bp->cc_blob_address should only be set by boot/compressed kernel.
281+
* Initialize it to 0 to ensure that uninitialized values from
282+
* buggy bootloaders aren't propagated.
283+
*/
284+
if (bp)
285+
bp->cc_blob_address = 0;
286+
279287
/*
280288
* Setup/preliminary detection of SNP. This will be sanity-checked
281289
* against CPUID/MSR values later.

‎arch/x86/entry/entry_64_compat.S

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ SYM_CODE_START(entry_INT80_compat)
311311
* Interrupts are off on entry.
312312
*/
313313
ASM_CLAC /* Do this early to minimize exposure */
314-
SWAPGS
314+
ALTERNATIVE "swapgs", "", X86_FEATURE_XENPV
315315

316316
/*
317317
* User tracing code (ptrace or signal handlers) might assume that

‎arch/x86/include/asm/cpufeatures.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -457,7 +457,8 @@
457457
#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
458458
#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
459459
#define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
460-
#define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */
461-
#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
460+
#define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */
461+
#define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */
462+
#define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
462463

463464
#endif /* _ASM_X86_CPUFEATURES_H */

‎arch/x86/include/asm/intel-family.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
* _X - regular server parts
2828
* _D - micro server parts
2929
* _N,_P - other mobile parts
30+
* _S - other client parts
3031
*
3132
* Historical OPTDIFFs:
3233
*
@@ -112,6 +113,7 @@
112113

113114
#define INTEL_FAM6_RAPTORLAKE 0xB7
114115
#define INTEL_FAM6_RAPTORLAKE_P 0xBA
116+
#define INTEL_FAM6_RAPTORLAKE_S 0xBF
115117

116118
/* "Small Core" Processors (Atom) */
117119

‎arch/x86/include/asm/nospec-branch.h

Lines changed: 51 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -35,33 +35,56 @@
3535
#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */
3636

3737
/*
38+
* Common helper for __FILL_RETURN_BUFFER and __FILL_ONE_RETURN.
39+
*/
40+
#define __FILL_RETURN_SLOT \
41+
ANNOTATE_INTRA_FUNCTION_CALL; \
42+
call 772f; \
43+
int3; \
44+
772:
45+
46+
/*
47+
* Stuff the entire RSB.
48+
*
3849
* Google experimented with loop-unrolling and this turned out to be
3950
* the optimal version - two calls, each with their own speculation
4051
* trap should their return address end up getting used, in a loop.
4152
*/
42-
#define __FILL_RETURN_BUFFER(reg, nr, sp) \
43-
mov $(nr/2), reg; \
44-
771: \
45-
ANNOTATE_INTRA_FUNCTION_CALL; \
46-
call 772f; \
47-
773: /* speculation trap */ \
48-
UNWIND_HINT_EMPTY; \
49-
pause; \
50-
lfence; \
51-
jmp 773b; \
52-
772: \
53-
ANNOTATE_INTRA_FUNCTION_CALL; \
54-
call 774f; \
55-
775: /* speculation trap */ \
56-
UNWIND_HINT_EMPTY; \
57-
pause; \
58-
lfence; \
59-
jmp 775b; \
60-
774: \
61-
add $(BITS_PER_LONG/8) * 2, sp; \
62-
dec reg; \
63-
jnz 771b; \
64-
/* barrier for jnz misprediction */ \
53+
#ifdef CONFIG_X86_64
54+
#define __FILL_RETURN_BUFFER(reg, nr) \
55+
mov $(nr/2), reg; \
56+
771: \
57+
__FILL_RETURN_SLOT \
58+
__FILL_RETURN_SLOT \
59+
add $(BITS_PER_LONG/8) * 2, %_ASM_SP; \
60+
dec reg; \
61+
jnz 771b; \
62+
/* barrier for jnz misprediction */ \
63+
lfence;
64+
#else
65+
/*
66+
* i386 doesn't unconditionally have LFENCE, as such it can't
67+
* do a loop.
68+
*/
69+
#define __FILL_RETURN_BUFFER(reg, nr) \
70+
.rept nr; \
71+
__FILL_RETURN_SLOT; \
72+
.endr; \
73+
add $(BITS_PER_LONG/8) * nr, %_ASM_SP;
74+
#endif
75+
76+
/*
77+
* Stuff a single RSB slot.
78+
*
79+
* To mitigate Post-Barrier RSB speculation, one CALL instruction must be
80+
* forced to retire before letting a RET instruction execute.
81+
*
82+
* On PBRSB-vulnerable CPUs, it is not safe for a RET to be executed
83+
* before this point.
84+
*/
85+
#define __FILL_ONE_RETURN \
86+
__FILL_RETURN_SLOT \
87+
add $(BITS_PER_LONG/8), %_ASM_SP; \
6588
lfence;
6689

6790
#ifdef __ASSEMBLY__
@@ -132,28 +155,15 @@
132155
#endif
133156
.endm
134157

135-
.macro ISSUE_UNBALANCED_RET_GUARD
136-
ANNOTATE_INTRA_FUNCTION_CALL
137-
call .Lunbalanced_ret_guard_\@
138-
int3
139-
.Lunbalanced_ret_guard_\@:
140-
add $(BITS_PER_LONG/8), %_ASM_SP
141-
lfence
142-
.endm
143-
144158
/*
145159
* A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP
146160
* monstrosity above, manually.
147161
*/
148-
.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req ftr2
149-
.ifb \ftr2
150-
ALTERNATIVE "jmp .Lskip_rsb_\@", "", \ftr
151-
.else
152-
ALTERNATIVE_2 "jmp .Lskip_rsb_\@", "", \ftr, "jmp .Lunbalanced_\@", \ftr2
153-
.endif
154-
__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)
155-
.Lunbalanced_\@:
156-
ISSUE_UNBALANCED_RET_GUARD
162+
.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req ftr2=ALT_NOT(X86_FEATURE_ALWAYS)
163+
ALTERNATIVE_2 "jmp .Lskip_rsb_\@", \
164+
__stringify(__FILL_RETURN_BUFFER(\reg,\nr)), \ftr, \
165+
__stringify(__FILL_ONE_RETURN), \ftr2
166+
157167
.Lskip_rsb_\@:
158168
.endm
159169

‎arch/x86/include/asm/sev.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ void snp_set_memory_shared(unsigned long vaddr, unsigned int npages);
195195
void snp_set_memory_private(unsigned long vaddr, unsigned int npages);
196196
void snp_set_wakeup_secondary_cpu(void);
197197
bool snp_init(struct boot_params *bp);
198-
void snp_abort(void);
198+
void __init __noreturn snp_abort(void);
199199
int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned long *fw_err);
200200
#else
201201
static inline void sev_es_ist_enter(struct pt_regs *regs) { }

‎arch/x86/kernel/cpu/bugs.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,8 @@ static void __init mmio_select_mitigation(void)
433433
u64 ia32_cap;
434434

435435
if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) ||
436-
cpu_mitigations_off()) {
436+
boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN) ||
437+
cpu_mitigations_off()) {
437438
mmio_mitigation = MMIO_MITIGATION_OFF;
438439
return;
439440
}
@@ -538,6 +539,8 @@ static void __init md_clear_update_mitigation(void)
538539
pr_info("TAA: %s\n", taa_strings[taa_mitigation]);
539540
if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
540541
pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
542+
else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
543+
pr_info("MMIO Stale Data: Unknown: No mitigations\n");
541544
}
542545

543546
static void __init md_clear_select_mitigation(void)
@@ -2275,6 +2278,9 @@ static ssize_t tsx_async_abort_show_state(char *buf)
22752278

22762279
static ssize_t mmio_stale_data_show_state(char *buf)
22772280
{
2281+
if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
2282+
return sysfs_emit(buf, "Unknown: No mitigations\n");
2283+
22782284
if (mmio_mitigation == MMIO_MITIGATION_OFF)
22792285
return sysfs_emit(buf, "%s\n", mmio_strings[mmio_mitigation]);
22802286

@@ -2421,6 +2427,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
24212427
return srbds_show_state(buf);
24222428

24232429
case X86_BUG_MMIO_STALE_DATA:
2430+
case X86_BUG_MMIO_UNKNOWN:
24242431
return mmio_stale_data_show_state(buf);
24252432

24262433
case X86_BUG_RETBLEED:
@@ -2480,7 +2487,10 @@ ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *
24802487

24812488
ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *attr, char *buf)
24822489
{
2483-
return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
2490+
if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
2491+
return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_UNKNOWN);
2492+
else
2493+
return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
24842494
}
24852495

24862496
ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf)

0 commit comments

Comments
 (0)