Skip to content

Commit 5180218

Browse files
pa1guptasuryasaimadhu
pa1gupta
authored and
suryasaimadhu
committed
x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
Processor MMIO Stale Data is a class of vulnerabilities that may expose data after an MMIO operation. For more details please refer to Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst Add the Processor MMIO Stale Data bug enumeration. A microcode update adds new bits to the MSR IA32_ARCH_CAPABILITIES, define them. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by: Borislav Petkov <bp@suse.de>
1 parent 4419470 commit 5180218

5 files changed

Lines changed: 81 additions & 2 deletions

File tree

‎arch/x86/include/asm/cpufeatures.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,5 +443,6 @@
443443
#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
444444
#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
445445
#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
446+
#define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
446447

447448
#endif /* _ASM_X86_CPUFEATURES_H */

‎arch/x86/include/asm/msr-index.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,25 @@
114114
* Not susceptible to
115115
* TSX Async Abort (TAA) vulnerabilities.
116116
*/
117+
#define ARCH_CAP_SBDR_SSDP_NO BIT(13) /*
118+
* Not susceptible to SBDR and SSDP
119+
* variants of Processor MMIO stale data
120+
* vulnerabilities.
121+
*/
122+
#define ARCH_CAP_FBSDP_NO BIT(14) /*
123+
* Not susceptible to FBSDP variant of
124+
* Processor MMIO stale data
125+
* vulnerabilities.
126+
*/
127+
#define ARCH_CAP_PSDP_NO BIT(15) /*
128+
* Not susceptible to PSDP variant of
129+
* Processor MMIO stale data
130+
* vulnerabilities.
131+
*/
132+
#define ARCH_CAP_FB_CLEAR BIT(17) /*
133+
* VERW clears CPU fill buffer
134+
* even on MDS_NO CPUs.
135+
*/
117136

118137
#define MSR_IA32_FLUSH_CMD 0x0000010b
119138
#define L1D_FLUSH BIT(0) /*

‎arch/x86/kernel/cpu/common.c‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,18 +1237,39 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
12371237
X86_FEATURE_ANY, issues)
12381238

12391239
#define SRBDS BIT(0)
1240+
/* CPU is affected by X86_BUG_MMIO_STALE_DATA */
1241+
#define MMIO BIT(1)
12401242

12411243
static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
12421244
VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
12431245
VULNBL_INTEL_STEPPINGS(HASWELL, X86_STEPPING_ANY, SRBDS),
12441246
VULNBL_INTEL_STEPPINGS(HASWELL_L, X86_STEPPING_ANY, SRBDS),
12451247
VULNBL_INTEL_STEPPINGS(HASWELL_G, X86_STEPPING_ANY, SRBDS),
1248+
VULNBL_INTEL_STEPPINGS(HASWELL_X, BIT(2) | BIT(4), MMIO),
1249+
VULNBL_INTEL_STEPPINGS(BROADWELL_D, X86_STEPPINGS(0x3, 0x5), MMIO),
12461250
VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS),
1251+
VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
12471252
VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS),
1253+
VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
12481254
VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS),
1255+
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, BIT(3) | BIT(4) | BIT(6) |
1256+
BIT(7) | BIT(0xB), MMIO),
1257+
VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
12491258
VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS),
1250-
VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0xC), SRBDS),
1251-
VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0xD), SRBDS),
1259+
VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO),
1260+
VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0x8), SRBDS),
1261+
VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO),
1262+
VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0x8), SRBDS),
1263+
VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPINGS(0x5, 0x5), MMIO),
1264+
VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPINGS(0x1, 0x1), MMIO),
1265+
VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPINGS(0x4, 0x6), MMIO),
1266+
VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO),
1267+
VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x1), MMIO),
1268+
VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO),
1269+
VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO),
1270+
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO),
1271+
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO),
1272+
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO),
12521273
{}
12531274
};
12541275

@@ -1269,6 +1290,13 @@ u64 x86_read_arch_cap_msr(void)
12691290
return ia32_cap;
12701291
}
12711292

1293+
static bool arch_cap_mmio_immune(u64 ia32_cap)
1294+
{
1295+
return (ia32_cap & ARCH_CAP_FBSDP_NO &&
1296+
ia32_cap & ARCH_CAP_PSDP_NO &&
1297+
ia32_cap & ARCH_CAP_SBDR_SSDP_NO);
1298+
}
1299+
12721300
static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
12731301
{
12741302
u64 ia32_cap = x86_read_arch_cap_msr();
@@ -1328,6 +1356,17 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
13281356
cpu_matches(cpu_vuln_blacklist, SRBDS))
13291357
setup_force_cpu_bug(X86_BUG_SRBDS);
13301358

1359+
/*
1360+
* Processor MMIO Stale Data bug enumeration
1361+
*
1362+
* Affected CPU list is generally enough to enumerate the vulnerability,
1363+
* but for virtualization case check for ARCH_CAP MSR bits also, VMM may
1364+
* not want the guest to enumerate the bug.
1365+
*/
1366+
if (cpu_matches(cpu_vuln_blacklist, MMIO) &&
1367+
!arch_cap_mmio_immune(ia32_cap))
1368+
setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
1369+
13311370
if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
13321371
return;
13331372

‎tools/arch/x86/include/asm/cpufeatures.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,5 +443,6 @@
443443
#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
444444
#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
445445
#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
446+
#define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
446447

447448
#endif /* _ASM_X86_CPUFEATURES_H */

‎tools/arch/x86/include/asm/msr-index.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,25 @@
114114
* Not susceptible to
115115
* TSX Async Abort (TAA) vulnerabilities.
116116
*/
117+
#define ARCH_CAP_SBDR_SSDP_NO BIT(13) /*
118+
* Not susceptible to SBDR and SSDP
119+
* variants of Processor MMIO stale data
120+
* vulnerabilities.
121+
*/
122+
#define ARCH_CAP_FBSDP_NO BIT(14) /*
123+
* Not susceptible to FBSDP variant of
124+
* Processor MMIO stale data
125+
* vulnerabilities.
126+
*/
127+
#define ARCH_CAP_PSDP_NO BIT(15) /*
128+
* Not susceptible to PSDP variant of
129+
* Processor MMIO stale data
130+
* vulnerabilities.
131+
*/
132+
#define ARCH_CAP_FB_CLEAR BIT(17) /*
133+
* VERW clears CPU fill buffer
134+
* even on MDS_NO CPUs.
135+
*/
117136

118137
#define MSR_IA32_FLUSH_CMD 0x0000010b
119138
#define L1D_FLUSH BIT(0) /*

0 commit comments

Comments
 (0)