Commit a7b8a41c authored by Pawan Gupta's avatar Pawan Gupta Committed by Yongqiang Liu
Browse files

x86/speculation/mmio: Reuse SRBDS mitigation for SBDS 

stable inclusion
from stable-v4.19.248
commit 0e94464009ee37217a7e450c96ea1f8d42d3a6b5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS


CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166

--------------------------------

commit a992b8a4 upstream

The Shared Buffers Data Sampling (SBDS) variant of Processor MMIO Stale
Data vulnerabilities may expose RDRAND, RDSEED and SGX EGETKEY data.
Mitigation for this is added by a microcode update.

As some of the implications of SBDS are similar to SRBDS, SRBDS mitigation
infrastructure can be leveraged by SBDS. Set X86_BUG_SRBDS and use SRBDS
mitigation.

Mitigation is enabled by default; use srbds=off to opt-out. Mitigation
status can be checked from below file:

  /sys/devices/system/cpu/vulnerabilities/srbds

Signed-off-by: default avatarPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
[cascardo: adjust for processor model names]
Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYipeng Zou <zouyipeng@huawei.com>
Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarLiao Chang <liaochang1@huawei.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 42d1c023

arch/x86/kernel/cpu/common.c

+14 −7
Original line number Diff line number Diff line
@@ -1107,6 +1107,8 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { 
#define SRBDS		BIT(0)

/* CPU is affected by X86_BUG_MMIO_STALE_DATA */

#define MMIO		BIT(1)

/* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */

#define MMIO_SBDS	BIT(2)



static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {

	VULNBL_INTEL_STEPPINGS(IVYBRIDGE,	X86_STEPPING_ANY,		SRBDS),
@@ -1128,16 +1130,17 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { 
	VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE,	X86_STEPPINGS(0x0, 0x8),	SRBDS),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x9, 0xD),	SRBDS | MMIO),

	VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0x8),	SRBDS),

	VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE,	X86_STEPPINGS(0x5, 0x5),	MMIO),

	VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE,	X86_STEPPINGS(0x5, 0x5),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(ICELAKE_X,	X86_STEPPINGS(0x4, 0x6),	MMIO),

	VULNBL_INTEL_STEPPINGS(COMETLAKE,	BIT(2) | BIT(3) | BIT(5),	MMIO),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x0, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(LAKEFIELD,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(COMETLAKE,	BIT(2) | BIT(3) | BIT(5),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x0, 0x0),	MMIO),

	VULNBL_INTEL_STEPPINGS(LAKEFIELD,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ROCKETLAKE,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPINGS(0x1, 0x1),	MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPINGS(0x1, 0x1),	MMIO | MMIO_SBDS),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X,	X86_STEPPING_ANY,		MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPINGS(0x0, 0x0),	MMIO),

	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPINGS(0x0, 0x0),	MMIO | MMIO_SBDS),

	{}

};
@@ -1218,10 +1221,14 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) 
	/*

	 * SRBDS affects CPUs which support RDRAND or RDSEED and are listed

	 * in the vulnerability blacklist.

	 *

	 * Some of the implications and mitigation of Shared Buffers Data

	 * Sampling (SBDS) are similar to SRBDS. Give SBDS same treatment as

	 * SRBDS.

	 */

	if ((cpu_has(c, X86_FEATURE_RDRAND) ||

	     cpu_has(c, X86_FEATURE_RDSEED)) &&

	    cpu_matches(cpu_vuln_blacklist, SRBDS))

	    cpu_matches(cpu_vuln_blacklist, SRBDS | MMIO_SBDS))

		    setup_force_cpu_bug(X86_BUG_SRBDS);



	/*