summaryrefslogtreecommitdiffstats
path: root/debian/patches/bugfix/x86
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-18 18:48:02 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-18 18:48:17 +0000
commitc066c7f39961a7ad5c087c250a868bbfb48c0876 (patch)
tree638255e8fca772f401a1bd09ea8cc48a47582283 /debian/patches/bugfix/x86
parentMerging upstream version 6.7.12. (diff)
downloadlinux-c066c7f39961a7ad5c087c250a868bbfb48c0876.tar.xz
linux-c066c7f39961a7ad5c087c250a868bbfb48c0876.zip
Merging debian version 6.7.12-1.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'debian/patches/bugfix/x86')
-rw-r--r--debian/patches/bugfix/x86/Documentation-hw-vuln-Add-documentation-for-RFDS.patch140
-rw-r--r--debian/patches/bugfix/x86/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch48
-rw-r--r--debian/patches/bugfix/x86/platform-x86-p2sb-On-Goldmont-only-cache-P2SB-and-SP.patch77
-rw-r--r--debian/patches/bugfix/x86/x86-mmio-Disable-KVM-mitigation-when-X86_FEATURE_CLE.patch58
-rw-r--r--debian/patches/bugfix/x86/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch384
5 files changed, 0 insertions, 707 deletions
diff --git a/debian/patches/bugfix/x86/Documentation-hw-vuln-Add-documentation-for-RFDS.patch b/debian/patches/bugfix/x86/Documentation-hw-vuln-Add-documentation-for-RFDS.patch
deleted file mode 100644
index 781be97097..0000000000
--- a/debian/patches/bugfix/x86/Documentation-hw-vuln-Add-documentation-for-RFDS.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Date: Mon, 11 Mar 2024 12:29:43 -0700
-Subject: Documentation/hw-vuln: Add documentation for RFDS
-Origin: https://git.kernel.org/linus/4e42765d1be01111df0c0275bbaf1db1acef346e
-
-Add the documentation for transient execution vulnerability Register
-File Data Sampling (RFDS) that affects Intel Atom CPUs.
-
-Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
-Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
-Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
----
- Documentation/admin-guide/hw-vuln/index.rst | 1 +
- .../hw-vuln/reg-file-data-sampling.rst | 104 ++++++++++++++++++
- 2 files changed, 105 insertions(+)
- create mode 100644 Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
-
-diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
-index de99caabf65a..ff0b440ef2dc 100644
---- a/Documentation/admin-guide/hw-vuln/index.rst
-+++ b/Documentation/admin-guide/hw-vuln/index.rst
-@@ -21,3 +21,4 @@ are configurable at compile, boot or run time.
- cross-thread-rsb
- srso
- gather_data_sampling
-+ reg-file-data-sampling
-diff --git a/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst b/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
-new file mode 100644
-index 000000000000..0585d02b9a6c
---- /dev/null
-+++ b/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
-@@ -0,0 +1,104 @@
-+==================================
-+Register File Data Sampling (RFDS)
-+==================================
-+
-+Register File Data Sampling (RFDS) is a microarchitectural vulnerability that
-+only affects Intel Atom parts(also branded as E-cores). RFDS may allow
-+a malicious actor to infer data values previously used in floating point
-+registers, vector registers, or integer registers. RFDS does not provide the
-+ability to choose which data is inferred. CVE-2023-28746 is assigned to RFDS.
-+
-+Affected Processors
-+===================
-+Below is the list of affected Intel processors [#f1]_:
-+
-+ =================== ============
-+ Common name Family_Model
-+ =================== ============
-+ ATOM_GOLDMONT 06_5CH
-+ ATOM_GOLDMONT_D 06_5FH
-+ ATOM_GOLDMONT_PLUS 06_7AH
-+ ATOM_TREMONT_D 06_86H
-+ ATOM_TREMONT 06_96H
-+ ALDERLAKE 06_97H
-+ ALDERLAKE_L 06_9AH
-+ ATOM_TREMONT_L 06_9CH
-+ RAPTORLAKE 06_B7H
-+ RAPTORLAKE_P 06_BAH
-+ ATOM_GRACEMONT 06_BEH
-+ RAPTORLAKE_S 06_BFH
-+ =================== ============
-+
-+As an exception to this table, Intel Xeon E family parts ALDERLAKE(06_97H) and
-+RAPTORLAKE(06_B7H) codenamed Catlow are not affected. They are reported as
-+vulnerable in Linux because they share the same family/model with an affected
-+part. Unlike their affected counterparts, they do not enumerate RFDS_CLEAR or
-+CPUID.HYBRID. This information could be used to distinguish between the
-+affected and unaffected parts, but it is deemed not worth adding complexity as
-+the reporting is fixed automatically when these parts enumerate RFDS_NO.
-+
-+Mitigation
-+==========
-+Intel released a microcode update that enables software to clear sensitive
-+information using the VERW instruction. Like MDS, RFDS deploys the same
-+mitigation strategy to force the CPU to clear the affected buffers before an
-+attacker can extract the secrets. This is achieved by using the otherwise
-+unused and obsolete VERW instruction in combination with a microcode update.
-+The microcode clears the affected CPU buffers when the VERW instruction is
-+executed.
-+
-+Mitigation points
-+-----------------
-+VERW is executed by the kernel before returning to user space, and by KVM
-+before VMentry. None of the affected cores support SMT, so VERW is not required
-+at C-state transitions.
-+
-+New bits in IA32_ARCH_CAPABILITIES
-+----------------------------------
-+Newer processors and microcode update on existing affected processors added new
-+bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate
-+vulnerability and mitigation capability:
-+
-+- Bit 27 - RFDS_NO - When set, processor is not affected by RFDS.
-+- Bit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the
-+ microcode that clears the affected buffers on VERW execution.
-+
-+Mitigation control on the kernel command line
-+---------------------------------------------
-+The kernel command line allows to control RFDS mitigation at boot time with the
-+parameter "reg_file_data_sampling=". The valid arguments are:
-+
-+ ========== =================================================================
-+ on If the CPU is vulnerable, enable mitigation; CPU buffer clearing
-+ on exit to userspace and before entering a VM.
-+ off Disables mitigation.
-+ ========== =================================================================
-+
-+Mitigation default is selected by CONFIG_MITIGATION_RFDS.
-+
-+Mitigation status information
-+-----------------------------
-+The Linux kernel provides a sysfs interface to enumerate the current
-+vulnerability status of the system: whether the system is vulnerable, and
-+which mitigations are active. The relevant sysfs file is:
-+
-+ /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
-+
-+The possible values in this file are:
-+
-+ .. list-table::
-+
-+ * - 'Not affected'
-+ - The processor is not vulnerable
-+ * - 'Vulnerable'
-+ - The processor is vulnerable, but no mitigation enabled
-+ * - 'Vulnerable: No microcode'
-+ - The processor is vulnerable but microcode is not updated.
-+ * - 'Mitigation: Clear Register File'
-+ - The processor is vulnerable and the CPU buffer clearing mitigation is
-+ enabled.
-+
-+References
-+----------
-+.. [#f1] Affected Processors
-+ https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
---
-2.43.0
-
diff --git a/debian/patches/bugfix/x86/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch b/debian/patches/bugfix/x86/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch
deleted file mode 100644
index 13a5c96a49..0000000000
--- a/debian/patches/bugfix/x86/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Date: Mon, 11 Mar 2024 12:29:43 -0700
-Subject: KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
-Origin: https://git.kernel.org/linus/2a0180129d726a4b953232175857d442651b55a0
-
-Mitigation for RFDS requires RFDS_CLEAR capability which is enumerated
-by MSR_IA32_ARCH_CAPABILITIES bit 27. If the host has it set, export it
-to guests so that they can deploy the mitigation.
-
-RFDS_NO indicates that the system is not vulnerable to RFDS, export it
-to guests so that they don't deploy the mitigation unnecessarily. When
-the host is not affected by X86_BUG_RFDS, but has RFDS_NO=0, synthesize
-RFDS_NO to the guest.
-
-Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
-Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
-Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
----
- arch/x86/kvm/x86.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 48a61d283406..68fdf3ba031a 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -1623,7 +1623,8 @@ static bool kvm_is_immutable_feature_msr(u32 msr)
- ARCH_CAP_SKIP_VMENTRY_L1DFLUSH | ARCH_CAP_SSB_NO | ARCH_CAP_MDS_NO | \
- ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \
- ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \
-- ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO)
-+ ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \
-+ ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR)
-
- static u64 kvm_get_arch_capabilities(void)
- {
-@@ -1655,6 +1656,8 @@ static u64 kvm_get_arch_capabilities(void)
- data |= ARCH_CAP_SSB_NO;
- if (!boot_cpu_has_bug(X86_BUG_MDS))
- data |= ARCH_CAP_MDS_NO;
-+ if (!boot_cpu_has_bug(X86_BUG_RFDS))
-+ data |= ARCH_CAP_RFDS_NO;
-
- if (!boot_cpu_has(X86_FEATURE_RTM)) {
- /*
---
-2.43.0
-
diff --git a/debian/patches/bugfix/x86/platform-x86-p2sb-On-Goldmont-only-cache-P2SB-and-SP.patch b/debian/patches/bugfix/x86/platform-x86-p2sb-On-Goldmont-only-cache-P2SB-and-SP.patch
deleted file mode 100644
index 50e5f8dc5d..0000000000
--- a/debian/patches/bugfix/x86/platform-x86-p2sb-On-Goldmont-only-cache-P2SB-and-SP.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Mon, 4 Mar 2024 14:43:55 +0100
-Subject: platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR
-Origin: https://git.kernel.org/linus/aec7d25b497ce4a8d044e9496de0aa433f7f8f06
-Bug-Debian: https://bugs.debian.org/1065320
-
-On Goldmont p2sb_bar() only ever gets called for 2 devices, the actual P2SB
-devfn 13,0 and the SPI controller which is part of the P2SB, devfn 13,2.
-
-But the current p2sb code tries to cache BAR0 info for all of
-devfn 13,0 to 13,7 . This involves calling pci_scan_single_device()
-for device 13 functions 0-7 and the hw does not seem to like
-pci_scan_single_device() getting called for some of the other hidden
-devices. E.g. on an ASUS VivoBook D540NV-GQ065T this leads to continuous
-ACPI errors leading to high CPU usage.
-
-Fix this by only caching BAR0 info and thus only calling
-pci_scan_single_device() for the P2SB and the SPI controller.
-
-Fixes: 5913320eb0b3 ("platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe")
-Reported-by: Danil Rybakov <danilrybakov249@gmail.com>
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218531
-Tested-by: Danil Rybakov <danilrybakov249@gmail.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Link: https://lore.kernel.org/r/20240304134356.305375-2-hdegoede@redhat.com
----
- drivers/platform/x86/p2sb.c | 25 +++++++++----------------
- 1 file changed, 9 insertions(+), 16 deletions(-)
-
-diff --git a/drivers/platform/x86/p2sb.c b/drivers/platform/x86/p2sb.c
-index 6bd14d0132db..3d66e1d4eb1f 100644
---- a/drivers/platform/x86/p2sb.c
-+++ b/drivers/platform/x86/p2sb.c
-@@ -20,9 +20,11 @@
- #define P2SBC_HIDE BIT(8)
-
- #define P2SB_DEVFN_DEFAULT PCI_DEVFN(31, 1)
-+#define P2SB_DEVFN_GOLDMONT PCI_DEVFN(13, 0)
-+#define SPI_DEVFN_GOLDMONT PCI_DEVFN(13, 2)
-
- static const struct x86_cpu_id p2sb_cpu_ids[] = {
-- X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT, PCI_DEVFN(13, 0)),
-+ X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT, P2SB_DEVFN_GOLDMONT),
- {}
- };
-
-@@ -98,21 +100,12 @@ static void p2sb_scan_and_cache_devfn(struct pci_bus *bus, unsigned int devfn)
-
- static int p2sb_scan_and_cache(struct pci_bus *bus, unsigned int devfn)
- {
-- unsigned int slot, fn;
--
-- if (PCI_FUNC(devfn) == 0) {
-- /*
-- * When function number of the P2SB device is zero, scan it and
-- * other function numbers, and if devices are available, cache
-- * their BAR0s.
-- */
-- slot = PCI_SLOT(devfn);
-- for (fn = 0; fn < NR_P2SB_RES_CACHE; fn++)
-- p2sb_scan_and_cache_devfn(bus, PCI_DEVFN(slot, fn));
-- } else {
-- /* Scan the P2SB device and cache its BAR0 */
-- p2sb_scan_and_cache_devfn(bus, devfn);
-- }
-+ /* Scan the P2SB device and cache its BAR0 */
-+ p2sb_scan_and_cache_devfn(bus, devfn);
-+
-+ /* On Goldmont p2sb_bar() also gets called for the SPI controller */
-+ if (devfn == P2SB_DEVFN_GOLDMONT)
-+ p2sb_scan_and_cache_devfn(bus, SPI_DEVFN_GOLDMONT);
-
- if (!p2sb_valid_resource(&p2sb_resources[PCI_FUNC(devfn)].res))
- return -ENOENT;
---
-2.43.0
-
diff --git a/debian/patches/bugfix/x86/x86-mmio-Disable-KVM-mitigation-when-X86_FEATURE_CLE.patch b/debian/patches/bugfix/x86/x86-mmio-Disable-KVM-mitigation-when-X86_FEATURE_CLE.patch
deleted file mode 100644
index 313064d2bc..0000000000
--- a/debian/patches/bugfix/x86/x86-mmio-Disable-KVM-mitigation-when-X86_FEATURE_CLE.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Date: Mon, 11 Mar 2024 12:29:43 -0700
-Subject: x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is
- set
-Origin: https://git.kernel.org/linus/e95df4ec0c0c9791941f112db699fae794b9862a
-
-Currently MMIO Stale Data mitigation for CPUs not affected by MDS/TAA is
-to only deploy VERW at VMentry by enabling mmio_stale_data_clear static
-branch. No mitigation is needed for kernel->user transitions. If such
-CPUs are also affected by RFDS, its mitigation may set
-X86_FEATURE_CLEAR_CPU_BUF to deploy VERW at kernel->user and VMentry.
-This could result in duplicate VERW at VMentry.
-
-Fix this by disabling mmio_stale_data_clear static branch when
-X86_FEATURE_CLEAR_CPU_BUF is enabled.
-
-Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
-Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
----
- arch/x86/kernel/cpu/bugs.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
-index 48d049cd74e7..cd6ac89c1a0d 100644
---- a/arch/x86/kernel/cpu/bugs.c
-+++ b/arch/x86/kernel/cpu/bugs.c
-@@ -422,6 +422,13 @@ static void __init mmio_select_mitigation(void)
- if (boot_cpu_has_bug(X86_BUG_MDS) || (boot_cpu_has_bug(X86_BUG_TAA) &&
- boot_cpu_has(X86_FEATURE_RTM)))
- setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
-+
-+ /*
-+ * X86_FEATURE_CLEAR_CPU_BUF could be enabled by other VERW based
-+ * mitigations, disable KVM-only mitigation in that case.
-+ */
-+ if (boot_cpu_has(X86_FEATURE_CLEAR_CPU_BUF))
-+ static_branch_disable(&mmio_stale_data_clear);
- else
- static_branch_enable(&mmio_stale_data_clear);
-
-@@ -498,8 +505,11 @@ static void __init md_clear_update_mitigation(void)
- taa_mitigation = TAA_MITIGATION_VERW;
- taa_select_mitigation();
- }
-- if (mmio_mitigation == MMIO_MITIGATION_OFF &&
-- boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
-+ /*
-+ * MMIO_MITIGATION_OFF is not checked here so that mmio_stale_data_clear
-+ * gets updated correctly as per X86_FEATURE_CLEAR_CPU_BUF state.
-+ */
-+ if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
- mmio_mitigation = MMIO_MITIGATION_VERW;
- mmio_select_mitigation();
- }
---
-2.43.0
-
diff --git a/debian/patches/bugfix/x86/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch b/debian/patches/bugfix/x86/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch
deleted file mode 100644
index 21603126c5..0000000000
--- a/debian/patches/bugfix/x86/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch
+++ /dev/null
@@ -1,384 +0,0 @@
-From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Date: Mon, 11 Mar 2024 12:29:43 -0700
-Subject: x86/rfds: Mitigate Register File Data Sampling (RFDS)
-Origin: https://git.kernel.org/linus/8076fcde016c9c0e0660543e67bff86cb48a7c9c
-
-RFDS is a CPU vulnerability that may allow userspace to infer kernel
-stale data previously used in floating point registers, vector registers
-and integer registers. RFDS only affects certain Intel Atom processors.
-
-Intel released a microcode update that uses VERW instruction to clear
-the affected CPU buffers. Unlike MDS, none of the affected cores support
-SMT.
-
-Add RFDS bug infrastructure and enable the VERW based mitigation by
-default, that clears the affected buffers just before exiting to
-userspace. Also add sysfs reporting and cmdline parameter
-"reg_file_data_sampling" to control the mitigation.
-
-For details see:
-Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
-
-Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
-Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
-Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
-Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
----
- .../ABI/testing/sysfs-devices-system-cpu | 1 +
- .../admin-guide/kernel-parameters.txt | 21 +++++
- arch/x86/Kconfig | 11 +++
- arch/x86/include/asm/cpufeatures.h | 1 +
- arch/x86/include/asm/msr-index.h | 8 ++
- arch/x86/kernel/cpu/bugs.c | 78 ++++++++++++++++++-
- arch/x86/kernel/cpu/common.c | 38 ++++++++-
- drivers/base/cpu.c | 3 +
- include/linux/cpu.h | 2 +
- 9 files changed, 157 insertions(+), 6 deletions(-)
-
-diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
-index a1db6db47505..710d47be11e0 100644
---- a/Documentation/ABI/testing/sysfs-devices-system-cpu
-+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
-@@ -516,6 +516,7 @@ What: /sys/devices/system/cpu/vulnerabilities
- /sys/devices/system/cpu/vulnerabilities/mds
- /sys/devices/system/cpu/vulnerabilities/meltdown
- /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
-+ /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
- /sys/devices/system/cpu/vulnerabilities/retbleed
- /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
- /sys/devices/system/cpu/vulnerabilities/spectre_v1
-diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
-index 31b3a25680d0..73062d47a462 100644
---- a/Documentation/admin-guide/kernel-parameters.txt
-+++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -1150,6 +1150,26 @@
- The filter can be disabled or changed to another
- driver later using sysfs.
-
-+ reg_file_data_sampling=
-+ [X86] Controls mitigation for Register File Data
-+ Sampling (RFDS) vulnerability. RFDS is a CPU
-+ vulnerability which may allow userspace to infer
-+ kernel data values previously stored in floating point
-+ registers, vector registers, or integer registers.
-+ RFDS only affects Intel Atom processors.
-+
-+ on: Turns ON the mitigation.
-+ off: Turns OFF the mitigation.
-+
-+ This parameter overrides the compile time default set
-+ by CONFIG_MITIGATION_RFDS. Mitigation cannot be
-+ disabled when other VERW based mitigations (like MDS)
-+ are enabled. In order to disable RFDS mitigation all
-+ VERW based mitigations need to be disabled.
-+
-+ For details see:
-+ Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
-+
- driver_async_probe= [KNL]
- List of driver names to be probed asynchronously. *
- matches with all driver names. If * is specified, the
-@@ -3398,6 +3418,7 @@
- nospectre_bhb [ARM64]
- nospectre_v1 [X86,PPC]
- nospectre_v2 [X86,PPC,S390,ARM64]
-+ reg_file_data_sampling=off [X86]
- retbleed=off [X86]
- spec_store_bypass_disable=off [X86,PPC]
- spectre_v2_user=off [X86]
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5edec175b9bf..637e337c332e 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -2614,6 +2614,17 @@ config GDS_FORCE_MITIGATION
-
- If in doubt, say N.
-
-+config MITIGATION_RFDS
-+ bool "RFDS Mitigation"
-+ depends on CPU_SUP_INTEL
-+ default y
-+ help
-+ Enable mitigation for Register File Data Sampling (RFDS) by default.
-+ RFDS is a hardware vulnerability which affects Intel Atom CPUs. It
-+ allows unprivileged speculative access to stale data previously
-+ stored in floating point, vector and integer registers.
-+ See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
-+
- endif
-
- config ARCH_HAS_ADD_PAGES
-diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
-index 2b62cdd8dd12..8511aad59581 100644
---- a/arch/x86/include/asm/cpufeatures.h
-+++ b/arch/x86/include/asm/cpufeatures.h
-@@ -503,4 +503,5 @@
- /* BUG word 2 */
- #define X86_BUG_SRSO X86_BUG(1*32 + 0) /* AMD SRSO bug */
- #define X86_BUG_DIV0 X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */
-+#define X86_BUG_RFDS X86_BUG(1*32 + 2) /* CPU is vulnerable to Register File Data Sampling */
- #endif /* _ASM_X86_CPUFEATURES_H */
-diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
-index f1bd7b91b3c6..d1b5edaf6c34 100644
---- a/arch/x86/include/asm/msr-index.h
-+++ b/arch/x86/include/asm/msr-index.h
-@@ -165,6 +165,14 @@
- * CPU is not vulnerable to Gather
- * Data Sampling (GDS).
- */
-+#define ARCH_CAP_RFDS_NO BIT(27) /*
-+ * Not susceptible to Register
-+ * File Data Sampling.
-+ */
-+#define ARCH_CAP_RFDS_CLEAR BIT(28) /*
-+ * VERW clears CPU Register
-+ * File.
-+ */
-
- #define ARCH_CAP_XAPIC_DISABLE BIT(21) /*
- * IA32_XAPIC_DISABLE_STATUS MSR
-diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
-index cd6ac89c1a0d..01ac18f56147 100644
---- a/arch/x86/kernel/cpu/bugs.c
-+++ b/arch/x86/kernel/cpu/bugs.c
-@@ -480,6 +480,57 @@ static int __init mmio_stale_data_parse_cmdline(char *str)
- }
- early_param("mmio_stale_data", mmio_stale_data_parse_cmdline);
-
-+#undef pr_fmt
-+#define pr_fmt(fmt) "Register File Data Sampling: " fmt
-+
-+enum rfds_mitigations {
-+ RFDS_MITIGATION_OFF,
-+ RFDS_MITIGATION_VERW,
-+ RFDS_MITIGATION_UCODE_NEEDED,
-+};
-+
-+/* Default mitigation for Register File Data Sampling */
-+static enum rfds_mitigations rfds_mitigation __ro_after_init =
-+ IS_ENABLED(CONFIG_MITIGATION_RFDS) ? RFDS_MITIGATION_VERW : RFDS_MITIGATION_OFF;
-+
-+static const char * const rfds_strings[] = {
-+ [RFDS_MITIGATION_OFF] = "Vulnerable",
-+ [RFDS_MITIGATION_VERW] = "Mitigation: Clear Register File",
-+ [RFDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
-+};
-+
-+static void __init rfds_select_mitigation(void)
-+{
-+ if (!boot_cpu_has_bug(X86_BUG_RFDS) || cpu_mitigations_off()) {
-+ rfds_mitigation = RFDS_MITIGATION_OFF;
-+ return;
-+ }
-+ if (rfds_mitigation == RFDS_MITIGATION_OFF)
-+ return;
-+
-+ if (x86_read_arch_cap_msr() & ARCH_CAP_RFDS_CLEAR)
-+ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
-+ else
-+ rfds_mitigation = RFDS_MITIGATION_UCODE_NEEDED;
-+}
-+
-+static __init int rfds_parse_cmdline(char *str)
-+{
-+ if (!str)
-+ return -EINVAL;
-+
-+ if (!boot_cpu_has_bug(X86_BUG_RFDS))
-+ return 0;
-+
-+ if (!strcmp(str, "off"))
-+ rfds_mitigation = RFDS_MITIGATION_OFF;
-+ else if (!strcmp(str, "on"))
-+ rfds_mitigation = RFDS_MITIGATION_VERW;
-+
-+ return 0;
-+}
-+early_param("reg_file_data_sampling", rfds_parse_cmdline);
-+
- #undef pr_fmt
- #define pr_fmt(fmt) "" fmt
-
-@@ -513,6 +564,11 @@ static void __init md_clear_update_mitigation(void)
- mmio_mitigation = MMIO_MITIGATION_VERW;
- mmio_select_mitigation();
- }
-+ if (rfds_mitigation == RFDS_MITIGATION_OFF &&
-+ boot_cpu_has_bug(X86_BUG_RFDS)) {
-+ rfds_mitigation = RFDS_MITIGATION_VERW;
-+ rfds_select_mitigation();
-+ }
- out:
- if (boot_cpu_has_bug(X86_BUG_MDS))
- pr_info("MDS: %s\n", mds_strings[mds_mitigation]);
-@@ -522,6 +578,8 @@ static void __init md_clear_update_mitigation(void)
- pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
- else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
- pr_info("MMIO Stale Data: Unknown: No mitigations\n");
-+ if (boot_cpu_has_bug(X86_BUG_RFDS))
-+ pr_info("Register File Data Sampling: %s\n", rfds_strings[rfds_mitigation]);
- }
-
- static void __init md_clear_select_mitigation(void)
-@@ -529,11 +587,12 @@ static void __init md_clear_select_mitigation(void)
- mds_select_mitigation();
- taa_select_mitigation();
- mmio_select_mitigation();
-+ rfds_select_mitigation();
-
- /*
-- * As MDS, TAA and MMIO Stale Data mitigations are inter-related, update
-- * and print their mitigation after MDS, TAA and MMIO Stale Data
-- * mitigation selection is done.
-+ * As these mitigations are inter-related and rely on VERW instruction
-+ * to clear the microarchitural buffers, update and print their status
-+ * after mitigation selection is done for each of these vulnerabilities.
- */
- md_clear_update_mitigation();
- }
-@@ -2622,6 +2681,11 @@ static ssize_t mmio_stale_data_show_state(char *buf)
- sched_smt_active() ? "vulnerable" : "disabled");
- }
-
-+static ssize_t rfds_show_state(char *buf)
-+{
-+ return sysfs_emit(buf, "%s\n", rfds_strings[rfds_mitigation]);
-+}
-+
- static char *stibp_state(void)
- {
- if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
-@@ -2781,6 +2845,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
- case X86_BUG_GDS:
- return gds_show_state(buf);
-
-+ case X86_BUG_RFDS:
-+ return rfds_show_state(buf);
-+
- default:
- break;
- }
-@@ -2855,4 +2922,9 @@ ssize_t cpu_show_gds(struct device *dev, struct device_attribute *attr, char *bu
- {
- return cpu_show_common(dev, attr, buf, X86_BUG_GDS);
- }
-+
-+ssize_t cpu_show_reg_file_data_sampling(struct device *dev, struct device_attribute *attr, char *buf)
-+{
-+ return cpu_show_common(dev, attr, buf, X86_BUG_RFDS);
-+}
- #endif
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index fbc4e60d027c..40d8c110bb32 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -1267,6 +1267,8 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
- #define SRSO BIT(5)
- /* CPU is affected by GDS */
- #define GDS BIT(6)
-+/* CPU is affected by Register File Data Sampling */
-+#define RFDS BIT(7)
-
- static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
- VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
-@@ -1294,9 +1296,18 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
- VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS),
- VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
-- VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
-- VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO),
-- VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
-+ VULNBL_INTEL_STEPPINGS(ALDERLAKE, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(ALDERLAKE_L, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE_P, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE_S, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_GRACEMONT, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO | RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_D, X86_STEPPING_ANY, RFDS),
-+ VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_PLUS, X86_STEPPING_ANY, RFDS),
-
- VULNBL_AMD(0x15, RETBLEED),
- VULNBL_AMD(0x16, RETBLEED),
-@@ -1330,6 +1341,24 @@ static bool arch_cap_mmio_immune(u64 ia32_cap)
- ia32_cap & ARCH_CAP_SBDR_SSDP_NO);
- }
-
-+static bool __init vulnerable_to_rfds(u64 ia32_cap)
-+{
-+ /* The "immunity" bit trumps everything else: */
-+ if (ia32_cap & ARCH_CAP_RFDS_NO)
-+ return false;
-+
-+ /*
-+ * VMMs set ARCH_CAP_RFDS_CLEAR for processors not in the blacklist to
-+ * indicate that mitigation is needed because guest is running on a
-+ * vulnerable hardware or may migrate to such hardware:
-+ */
-+ if (ia32_cap & ARCH_CAP_RFDS_CLEAR)
-+ return true;
-+
-+ /* Only consult the blacklist when there is no enumeration: */
-+ return cpu_matches(cpu_vuln_blacklist, RFDS);
-+}
-+
- static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
- {
- u64 ia32_cap = x86_read_arch_cap_msr();
-@@ -1441,6 +1470,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
- boot_cpu_has(X86_FEATURE_AVX))
- setup_force_cpu_bug(X86_BUG_GDS);
-
-+ if (vulnerable_to_rfds(ia32_cap))
-+ setup_force_cpu_bug(X86_BUG_RFDS);
-+
- if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
- return;
-
-diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
-index 47de0f140ba6..0b33e81f9c9b 100644
---- a/drivers/base/cpu.c
-+++ b/drivers/base/cpu.c
-@@ -588,6 +588,7 @@ CPU_SHOW_VULN_FALLBACK(mmio_stale_data);
- CPU_SHOW_VULN_FALLBACK(retbleed);
- CPU_SHOW_VULN_FALLBACK(spec_rstack_overflow);
- CPU_SHOW_VULN_FALLBACK(gds);
-+CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling);
-
- static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
- static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
-@@ -602,6 +603,7 @@ static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
- static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
- static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL);
- static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);
-+static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL);
-
- static struct attribute *cpu_root_vulnerabilities_attrs[] = {
- &dev_attr_meltdown.attr,
-@@ -617,6 +619,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
- &dev_attr_retbleed.attr,
- &dev_attr_spec_rstack_overflow.attr,
- &dev_attr_gather_data_sampling.attr,
-+ &dev_attr_reg_file_data_sampling.attr,
- NULL
- };
-
-diff --git a/include/linux/cpu.h b/include/linux/cpu.h
-index dcb89c987164..8654714421a0 100644
---- a/include/linux/cpu.h
-+++ b/include/linux/cpu.h
-@@ -75,6 +75,8 @@ extern ssize_t cpu_show_spec_rstack_overflow(struct device *dev,
- struct device_attribute *attr, char *buf);
- extern ssize_t cpu_show_gds(struct device *dev,
- struct device_attribute *attr, char *buf);
-+extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,
-+ struct device_attribute *attr, char *buf);
-
- extern __printf(4, 5)
- struct device *cpu_device_create(struct device *parent, void *drvdata,
---
-2.43.0
-