]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.7-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 12 Mar 2024 17:57:29 +0000 (18:57 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 12 Mar 2024 17:57:29 +0000 (18:57 +0100)
added patches:
documentation-hw-vuln-add-documentation-for-rfds.patch
kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch
x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch
x86-rfds-mitigate-register-file-data-sampling-rfds.patch

queue-6.7/documentation-hw-vuln-add-documentation-for-rfds.patch [new file with mode: 0644]
queue-6.7/kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch [new file with mode: 0644]
queue-6.7/series
queue-6.7/x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch [new file with mode: 0644]
queue-6.7/x86-rfds-mitigate-register-file-data-sampling-rfds.patch [new file with mode: 0644]

diff --git a/queue-6.7/documentation-hw-vuln-add-documentation-for-rfds.patch b/queue-6.7/documentation-hw-vuln-add-documentation-for-rfds.patch
new file mode 100644 (file)
index 0000000..ec9a048
--- /dev/null
@@ -0,0 +1,137 @@
+From 168e79b5f35d934ba11d97213ff1195a65941c6d Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Mon, 11 Mar 2024 12:29:43 -0700
+Subject: Documentation/hw-vuln: Add documentation for RFDS
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+commit 4e42765d1be01111df0c0275bbaf1db1acef346e upstream.
+
+Add the documentation for transient execution vulnerability Register
+File Data Sampling (RFDS) that affects Intel Atom CPUs.
+
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/admin-guide/hw-vuln/index.rst                  |    1 
+ Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst |  104 +++++++++++
+ 2 files changed, 105 insertions(+)
+ create mode 100644 Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
+
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -21,3 +21,4 @@ are configurable at compile, boot or run
+    cross-thread-rsb
+    srso
+    gather_data_sampling
++   reg-file-data-sampling
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
+@@ -0,0 +1,104 @@
++==================================
++Register File Data Sampling (RFDS)
++==================================
++
++Register File Data Sampling (RFDS) is a microarchitectural vulnerability that
++only affects Intel Atom parts(also branded as E-cores). RFDS may allow
++a malicious actor to infer data values previously used in floating point
++registers, vector registers, or integer registers. RFDS does not provide the
++ability to choose which data is inferred. CVE-2023-28746 is assigned to RFDS.
++
++Affected Processors
++===================
++Below is the list of affected Intel processors [#f1]_:
++
++   ===================  ============
++   Common name          Family_Model
++   ===================  ============
++   ATOM_GOLDMONT           06_5CH
++   ATOM_GOLDMONT_D         06_5FH
++   ATOM_GOLDMONT_PLUS      06_7AH
++   ATOM_TREMONT_D          06_86H
++   ATOM_TREMONT            06_96H
++   ALDERLAKE               06_97H
++   ALDERLAKE_L             06_9AH
++   ATOM_TREMONT_L          06_9CH
++   RAPTORLAKE              06_B7H
++   RAPTORLAKE_P            06_BAH
++   ATOM_GRACEMONT          06_BEH
++   RAPTORLAKE_S            06_BFH
++   ===================  ============
++
++As an exception to this table, Intel Xeon E family parts ALDERLAKE(06_97H) and
++RAPTORLAKE(06_B7H) codenamed Catlow are not affected. They are reported as
++vulnerable in Linux because they share the same family/model with an affected
++part. Unlike their affected counterparts, they do not enumerate RFDS_CLEAR or
++CPUID.HYBRID. This information could be used to distinguish between the
++affected and unaffected parts, but it is deemed not worth adding complexity as
++the reporting is fixed automatically when these parts enumerate RFDS_NO.
++
++Mitigation
++==========
++Intel released a microcode update that enables software to clear sensitive
++information using the VERW instruction. Like MDS, RFDS deploys the same
++mitigation strategy to force the CPU to clear the affected buffers before an
++attacker can extract the secrets. This is achieved by using the otherwise
++unused and obsolete VERW instruction in combination with a microcode update.
++The microcode clears the affected CPU buffers when the VERW instruction is
++executed.
++
++Mitigation points
++-----------------
++VERW is executed by the kernel before returning to user space, and by KVM
++before VMentry. None of the affected cores support SMT, so VERW is not required
++at C-state transitions.
++
++New bits in IA32_ARCH_CAPABILITIES
++----------------------------------
++Newer processors and microcode update on existing affected processors added new
++bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate
++vulnerability and mitigation capability:
++
++- Bit 27 - RFDS_NO - When set, processor is not affected by RFDS.
++- Bit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the
++  microcode that clears the affected buffers on VERW execution.
++
++Mitigation control on the kernel command line
++---------------------------------------------
++The kernel command line allows to control RFDS mitigation at boot time with the
++parameter "reg_file_data_sampling=". The valid arguments are:
++
++  ==========  =================================================================
++  on          If the CPU is vulnerable, enable mitigation; CPU buffer clearing
++              on exit to userspace and before entering a VM.
++  off         Disables mitigation.
++  ==========  =================================================================
++
++Mitigation default is selected by CONFIG_MITIGATION_RFDS.
++
++Mitigation status information
++-----------------------------
++The Linux kernel provides a sysfs interface to enumerate the current
++vulnerability status of the system: whether the system is vulnerable, and
++which mitigations are active. The relevant sysfs file is:
++
++      /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
++
++The possible values in this file are:
++
++  .. list-table::
++
++     * - 'Not affected'
++       - The processor is not vulnerable
++     * - 'Vulnerable'
++       - The processor is vulnerable, but no mitigation enabled
++     * - 'Vulnerable: No microcode'
++       - The processor is vulnerable but microcode is not updated.
++     * - 'Mitigation: Clear Register File'
++       - The processor is vulnerable and the CPU buffer clearing mitigation is
++       enabled.
++
++References
++----------
++.. [#f1] Affected Processors
++   https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
diff --git a/queue-6.7/kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch b/queue-6.7/kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch
new file mode 100644 (file)
index 0000000..c27ea42
--- /dev/null
@@ -0,0 +1,48 @@
+From 6385ce0a7d0058494cb802d1189403676684597d Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Mon, 11 Mar 2024 12:29:43 -0700
+Subject: KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+commit 2a0180129d726a4b953232175857d442651b55a0 upstream.
+
+Mitigation for RFDS requires RFDS_CLEAR capability which is enumerated
+by MSR_IA32_ARCH_CAPABILITIES bit 27. If the host has it set, export it
+to guests so that they can deploy the mitigation.
+
+RFDS_NO indicates that the system is not vulnerable to RFDS, export it
+to guests so that they don't deploy the mitigation unnecessarily. When
+the host is not affected by X86_BUG_RFDS, but has RFDS_NO=0, synthesize
+RFDS_NO to the guest.
+
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/x86.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1620,7 +1620,8 @@ static bool kvm_is_immutable_feature_msr
+        ARCH_CAP_SKIP_VMENTRY_L1DFLUSH | ARCH_CAP_SSB_NO | ARCH_CAP_MDS_NO | \
+        ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \
+        ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \
+-       ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO)
++       ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \
++       ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR)
+ static u64 kvm_get_arch_capabilities(void)
+ {
+@@ -1652,6 +1653,8 @@ static u64 kvm_get_arch_capabilities(voi
+               data |= ARCH_CAP_SSB_NO;
+       if (!boot_cpu_has_bug(X86_BUG_MDS))
+               data |= ARCH_CAP_MDS_NO;
++      if (!boot_cpu_has_bug(X86_BUG_RFDS))
++              data |= ARCH_CAP_RFDS_NO;
+       if (!boot_cpu_has(X86_FEATURE_RTM)) {
+               /*
index 4d73fa435afe8c299119b23aca97b92b24745804..7464df47d1ab9750aeae890f172fdea346070a76 100644 (file)
@@ -1,3 +1,7 @@
+x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch
+documentation-hw-vuln-add-documentation-for-rfds.patch
+x86-rfds-mitigate-register-file-data-sampling-rfds.patch
+kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch
 dt-bindings-dma-fsl-edma-add-fsl-edma.h-to-prevent-h.patch
 dmaengine-fsl-edma-utilize-common-dt-binding-header-.patch
 dmaengine-fsl-edma-correct-max_segment_size-setting.patch
diff --git a/queue-6.7/x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch b/queue-6.7/x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch
new file mode 100644 (file)
index 0000000..d070e46
--- /dev/null
@@ -0,0 +1,57 @@
+From fed1155c7ec680060beb22f085764d786ec58b56 Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Mon, 11 Mar 2024 12:29:43 -0700
+Subject: x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+commit e95df4ec0c0c9791941f112db699fae794b9862a upstream.
+
+Currently MMIO Stale Data mitigation for CPUs not affected by MDS/TAA is
+to only deploy VERW at VMentry by enabling mmio_stale_data_clear static
+branch. No mitigation is needed for kernel->user transitions. If such
+CPUs are also affected by RFDS, its mitigation may set
+X86_FEATURE_CLEAR_CPU_BUF to deploy VERW at kernel->user and VMentry.
+This could result in duplicate VERW at VMentry.
+
+Fix this by disabling mmio_stale_data_clear static branch when
+X86_FEATURE_CLEAR_CPU_BUF is enabled.
+
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/bugs.c |   14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -422,6 +422,13 @@ static void __init mmio_select_mitigatio
+       if (boot_cpu_has_bug(X86_BUG_MDS) || (boot_cpu_has_bug(X86_BUG_TAA) &&
+                                             boot_cpu_has(X86_FEATURE_RTM)))
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
++
++      /*
++       * X86_FEATURE_CLEAR_CPU_BUF could be enabled by other VERW based
++       * mitigations, disable KVM-only mitigation in that case.
++       */
++      if (boot_cpu_has(X86_FEATURE_CLEAR_CPU_BUF))
++              static_branch_disable(&mmio_stale_data_clear);
+       else
+               static_branch_enable(&mmio_stale_data_clear);
+@@ -498,8 +505,11 @@ static void __init md_clear_update_mitig
+               taa_mitigation = TAA_MITIGATION_VERW;
+               taa_select_mitigation();
+       }
+-      if (mmio_mitigation == MMIO_MITIGATION_OFF &&
+-          boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
++      /*
++       * MMIO_MITIGATION_OFF is not checked here so that mmio_stale_data_clear
++       * gets updated correctly as per X86_FEATURE_CLEAR_CPU_BUF state.
++       */
++      if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
+               mmio_mitigation = MMIO_MITIGATION_VERW;
+               mmio_select_mitigation();
+       }
diff --git a/queue-6.7/x86-rfds-mitigate-register-file-data-sampling-rfds.patch b/queue-6.7/x86-rfds-mitigate-register-file-data-sampling-rfds.patch
new file mode 100644 (file)
index 0000000..8acb27e
--- /dev/null
@@ -0,0 +1,368 @@
+From 0ec4792a33d74dc1389a46c401a026b794dd296a Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Mon, 11 Mar 2024 12:29:43 -0700
+Subject: x86/rfds: Mitigate Register File Data Sampling (RFDS)
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+commit 8076fcde016c9c0e0660543e67bff86cb48a7c9c upstream.
+
+RFDS is a CPU vulnerability that may allow userspace to infer kernel
+stale data previously used in floating point registers, vector registers
+and integer registers. RFDS only affects certain Intel Atom processors.
+
+Intel released a microcode update that uses VERW instruction to clear
+the affected CPU buffers. Unlike MDS, none of the affected cores support
+SMT.
+
+Add RFDS bug infrastructure and enable the VERW based mitigation by
+default, that clears the affected buffers just before exiting to
+userspace. Also add sysfs reporting and cmdline parameter
+"reg_file_data_sampling" to control the mitigation.
+
+For details see:
+Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
+
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/ABI/testing/sysfs-devices-system-cpu |    1 
+ Documentation/admin-guide/kernel-parameters.txt    |   21 +++++
+ arch/x86/Kconfig                                   |   11 ++
+ arch/x86/include/asm/cpufeatures.h                 |    1 
+ arch/x86/include/asm/msr-index.h                   |    8 ++
+ arch/x86/kernel/cpu/bugs.c                         |   78 ++++++++++++++++++++-
+ arch/x86/kernel/cpu/common.c                       |   38 +++++++++-
+ drivers/base/cpu.c                                 |    3 
+ include/linux/cpu.h                                |    2 
+ 9 files changed, 157 insertions(+), 6 deletions(-)
+
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -516,6 +516,7 @@ What:              /sys/devices/system/cpu/vulnerabi
+               /sys/devices/system/cpu/vulnerabilities/mds
+               /sys/devices/system/cpu/vulnerabilities/meltdown
+               /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
++              /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
+               /sys/devices/system/cpu/vulnerabilities/retbleed
+               /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+               /sys/devices/system/cpu/vulnerabilities/spectre_v1
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1137,6 +1137,26 @@
+                       The filter can be disabled or changed to another
+                       driver later using sysfs.
++      reg_file_data_sampling=
++                      [X86] Controls mitigation for Register File Data
++                      Sampling (RFDS) vulnerability. RFDS is a CPU
++                      vulnerability which may allow userspace to infer
++                      kernel data values previously stored in floating point
++                      registers, vector registers, or integer registers.
++                      RFDS only affects Intel Atom processors.
++
++                      on:     Turns ON the mitigation.
++                      off:    Turns OFF the mitigation.
++
++                      This parameter overrides the compile time default set
++                      by CONFIG_MITIGATION_RFDS. Mitigation cannot be
++                      disabled when other VERW based mitigations (like MDS)
++                      are enabled. In order to disable RFDS mitigation all
++                      VERW based mitigations need to be disabled.
++
++                      For details see:
++                      Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
++
+       driver_async_probe=  [KNL]
+                       List of driver names to be probed asynchronously. *
+                       matches with all driver names. If * is specified, the
+@@ -3385,6 +3405,7 @@
+                                              nospectre_bhb [ARM64]
+                                              nospectre_v1 [X86,PPC]
+                                              nospectre_v2 [X86,PPC,S390,ARM64]
++                                             reg_file_data_sampling=off [X86]
+                                              retbleed=off [X86]
+                                              spec_store_bypass_disable=off [X86,PPC]
+                                              spectre_v2_user=off [X86]
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2609,6 +2609,17 @@ config GDS_FORCE_MITIGATION
+         If in doubt, say N.
++config MITIGATION_RFDS
++      bool "RFDS Mitigation"
++      depends on CPU_SUP_INTEL
++      default y
++      help
++        Enable mitigation for Register File Data Sampling (RFDS) by default.
++        RFDS is a hardware vulnerability which affects Intel Atom CPUs. It
++        allows unprivileged speculative access to stale data previously
++        stored in floating point, vector and integer registers.
++        See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
++
+ endif
+ config ARCH_HAS_ADD_PAGES
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -499,4 +499,5 @@
+ /* BUG word 2 */
+ #define X86_BUG_SRSO                  X86_BUG(1*32 + 0) /* AMD SRSO bug */
+ #define X86_BUG_DIV0                  X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */
++#define X86_BUG_RFDS                  X86_BUG(1*32 + 2) /* CPU is vulnerable to Register File Data Sampling */
+ #endif /* _ASM_X86_CPUFEATURES_H */
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -165,6 +165,14 @@
+                                                * CPU is not vulnerable to Gather
+                                                * Data Sampling (GDS).
+                                                */
++#define ARCH_CAP_RFDS_NO              BIT(27) /*
++                                               * Not susceptible to Register
++                                               * File Data Sampling.
++                                               */
++#define ARCH_CAP_RFDS_CLEAR           BIT(28) /*
++                                               * VERW clears CPU Register
++                                               * File.
++                                               */
+ #define ARCH_CAP_XAPIC_DISABLE                BIT(21) /*
+                                                * IA32_XAPIC_DISABLE_STATUS MSR
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -481,6 +481,57 @@ static int __init mmio_stale_data_parse_
+ early_param("mmio_stale_data", mmio_stale_data_parse_cmdline);
+ #undef pr_fmt
++#define pr_fmt(fmt)   "Register File Data Sampling: " fmt
++
++enum rfds_mitigations {
++      RFDS_MITIGATION_OFF,
++      RFDS_MITIGATION_VERW,
++      RFDS_MITIGATION_UCODE_NEEDED,
++};
++
++/* Default mitigation for Register File Data Sampling */
++static enum rfds_mitigations rfds_mitigation __ro_after_init =
++      IS_ENABLED(CONFIG_MITIGATION_RFDS) ? RFDS_MITIGATION_VERW : RFDS_MITIGATION_OFF;
++
++static const char * const rfds_strings[] = {
++      [RFDS_MITIGATION_OFF]                   = "Vulnerable",
++      [RFDS_MITIGATION_VERW]                  = "Mitigation: Clear Register File",
++      [RFDS_MITIGATION_UCODE_NEEDED]          = "Vulnerable: No microcode",
++};
++
++static void __init rfds_select_mitigation(void)
++{
++      if (!boot_cpu_has_bug(X86_BUG_RFDS) || cpu_mitigations_off()) {
++              rfds_mitigation = RFDS_MITIGATION_OFF;
++              return;
++      }
++      if (rfds_mitigation == RFDS_MITIGATION_OFF)
++              return;
++
++      if (x86_read_arch_cap_msr() & ARCH_CAP_RFDS_CLEAR)
++              setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
++      else
++              rfds_mitigation = RFDS_MITIGATION_UCODE_NEEDED;
++}
++
++static __init int rfds_parse_cmdline(char *str)
++{
++      if (!str)
++              return -EINVAL;
++
++      if (!boot_cpu_has_bug(X86_BUG_RFDS))
++              return 0;
++
++      if (!strcmp(str, "off"))
++              rfds_mitigation = RFDS_MITIGATION_OFF;
++      else if (!strcmp(str, "on"))
++              rfds_mitigation = RFDS_MITIGATION_VERW;
++
++      return 0;
++}
++early_param("reg_file_data_sampling", rfds_parse_cmdline);
++
++#undef pr_fmt
+ #define pr_fmt(fmt)     "" fmt
+ static void __init md_clear_update_mitigation(void)
+@@ -513,6 +564,11 @@ static void __init md_clear_update_mitig
+               mmio_mitigation = MMIO_MITIGATION_VERW;
+               mmio_select_mitigation();
+       }
++      if (rfds_mitigation == RFDS_MITIGATION_OFF &&
++          boot_cpu_has_bug(X86_BUG_RFDS)) {
++              rfds_mitigation = RFDS_MITIGATION_VERW;
++              rfds_select_mitigation();
++      }
+ out:
+       if (boot_cpu_has_bug(X86_BUG_MDS))
+               pr_info("MDS: %s\n", mds_strings[mds_mitigation]);
+@@ -522,6 +578,8 @@ out:
+               pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
+       else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
+               pr_info("MMIO Stale Data: Unknown: No mitigations\n");
++      if (boot_cpu_has_bug(X86_BUG_RFDS))
++              pr_info("Register File Data Sampling: %s\n", rfds_strings[rfds_mitigation]);
+ }
+ static void __init md_clear_select_mitigation(void)
+@@ -529,11 +587,12 @@ static void __init md_clear_select_mitig
+       mds_select_mitigation();
+       taa_select_mitigation();
+       mmio_select_mitigation();
++      rfds_select_mitigation();
+       /*
+-       * As MDS, TAA and MMIO Stale Data mitigations are inter-related, update
+-       * and print their mitigation after MDS, TAA and MMIO Stale Data
+-       * mitigation selection is done.
++       * As these mitigations are inter-related and rely on VERW instruction
++       * to clear the microarchitural buffers, update and print their status
++       * after mitigation selection is done for each of these vulnerabilities.
+        */
+       md_clear_update_mitigation();
+ }
+@@ -2622,6 +2681,11 @@ static ssize_t mmio_stale_data_show_stat
+                         sched_smt_active() ? "vulnerable" : "disabled");
+ }
++static ssize_t rfds_show_state(char *buf)
++{
++      return sysfs_emit(buf, "%s\n", rfds_strings[rfds_mitigation]);
++}
++
+ static char *stibp_state(void)
+ {
+       if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
+@@ -2781,6 +2845,9 @@ static ssize_t cpu_show_common(struct de
+       case X86_BUG_GDS:
+               return gds_show_state(buf);
++      case X86_BUG_RFDS:
++              return rfds_show_state(buf);
++
+       default:
+               break;
+       }
+@@ -2855,4 +2922,9 @@ ssize_t cpu_show_gds(struct device *dev,
+ {
+       return cpu_show_common(dev, attr, buf, X86_BUG_GDS);
+ }
++
++ssize_t cpu_show_reg_file_data_sampling(struct device *dev, struct device_attribute *attr, char *buf)
++{
++      return cpu_show_common(dev, attr, buf, X86_BUG_RFDS);
++}
+ #endif
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1274,6 +1274,8 @@ static const __initconst struct x86_cpu_
+ #define SRSO          BIT(5)
+ /* CPU is affected by GDS */
+ #define GDS           BIT(6)
++/* CPU is affected by Register File Data Sampling */
++#define RFDS          BIT(7)
+ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
+       VULNBL_INTEL_STEPPINGS(IVYBRIDGE,       X86_STEPPING_ANY,               SRBDS),
+@@ -1301,9 +1303,18 @@ static const struct x86_cpu_id cpu_vuln_
+       VULNBL_INTEL_STEPPINGS(TIGERLAKE,       X86_STEPPING_ANY,               GDS),
+       VULNBL_INTEL_STEPPINGS(LAKEFIELD,       X86_STEPPING_ANY,               MMIO | MMIO_SBDS | RETBLEED),
+       VULNBL_INTEL_STEPPINGS(ROCKETLAKE,      X86_STEPPING_ANY,               MMIO | RETBLEED | GDS),
+-      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,    X86_STEPPING_ANY,               MMIO | MMIO_SBDS),
+-      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D,  X86_STEPPING_ANY,               MMIO),
+-      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,  X86_STEPPING_ANY,               MMIO | MMIO_SBDS),
++      VULNBL_INTEL_STEPPINGS(ALDERLAKE,       X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(ALDERLAKE_L,     X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(RAPTORLAKE,      X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(RAPTORLAKE_P,    X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(RAPTORLAKE_S,    X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_GRACEMONT,  X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,    X86_STEPPING_ANY,               MMIO | MMIO_SBDS | RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D,  X86_STEPPING_ANY,               MMIO | RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,  X86_STEPPING_ANY,               MMIO | MMIO_SBDS | RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT,   X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_D, X86_STEPPING_ANY,               RFDS),
++      VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_PLUS, X86_STEPPING_ANY,            RFDS),
+       VULNBL_AMD(0x15, RETBLEED),
+       VULNBL_AMD(0x16, RETBLEED),
+@@ -1337,6 +1348,24 @@ static bool arch_cap_mmio_immune(u64 ia3
+               ia32_cap & ARCH_CAP_SBDR_SSDP_NO);
+ }
++static bool __init vulnerable_to_rfds(u64 ia32_cap)
++{
++      /* The "immunity" bit trumps everything else: */
++      if (ia32_cap & ARCH_CAP_RFDS_NO)
++              return false;
++
++      /*
++       * VMMs set ARCH_CAP_RFDS_CLEAR for processors not in the blacklist to
++       * indicate that mitigation is needed because guest is running on a
++       * vulnerable hardware or may migrate to such hardware:
++       */
++      if (ia32_cap & ARCH_CAP_RFDS_CLEAR)
++              return true;
++
++      /* Only consult the blacklist when there is no enumeration: */
++      return cpu_matches(cpu_vuln_blacklist, RFDS);
++}
++
+ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ {
+       u64 ia32_cap = x86_read_arch_cap_msr();
+@@ -1448,6 +1477,9 @@ static void __init cpu_set_bug_bits(stru
+           boot_cpu_has(X86_FEATURE_AVX))
+               setup_force_cpu_bug(X86_BUG_GDS);
++      if (vulnerable_to_rfds(ia32_cap))
++              setup_force_cpu_bug(X86_BUG_RFDS);
++
+       if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
+               return;
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -565,6 +565,7 @@ CPU_SHOW_VULN_FALLBACK(mmio_stale_data);
+ CPU_SHOW_VULN_FALLBACK(retbleed);
+ CPU_SHOW_VULN_FALLBACK(spec_rstack_overflow);
+ CPU_SHOW_VULN_FALLBACK(gds);
++CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling);
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+@@ -579,6 +580,7 @@ static DEVICE_ATTR(mmio_stale_data, 0444
+ static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
+ static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL);
+ static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);
++static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL);
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+       &dev_attr_meltdown.attr,
+@@ -594,6 +596,7 @@ static struct attribute *cpu_root_vulner
+       &dev_attr_retbleed.attr,
+       &dev_attr_spec_rstack_overflow.attr,
+       &dev_attr_gather_data_sampling.attr,
++      &dev_attr_reg_file_data_sampling.attr,
+       NULL
+ };
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -75,6 +75,8 @@ extern ssize_t cpu_show_spec_rstack_over
+                                            struct device_attribute *attr, char *buf);
+ extern ssize_t cpu_show_gds(struct device *dev,
+                           struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,
++                                             struct device_attribute *attr, char *buf);
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,