From: Greg Kroah-Hartman Date: Mon, 1 Apr 2024 13:12:50 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.7.12~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=54c2d67f7994ff123ae50effd897461b8cfe0c50;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: x86-cpu-enable-stibp-on-amd-if-automatic-ibrs-is-enabled.patch --- diff --git a/queue-5.15/series b/queue-5.15/series index 3e38ddfd1c1..5589084fbb1 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -600,3 +600,4 @@ scsi-qla2xxx-fix-command-flush-on-cable-pull.patch scsi-qla2xxx-fix-double-free-of-fcport.patch scsi-qla2xxx-change-debug-message-during-driver-unload.patch scsi-qla2xxx-delay-i-o-abort-on-pci-error.patch +x86-cpu-enable-stibp-on-amd-if-automatic-ibrs-is-enabled.patch diff --git a/queue-5.15/x86-cpu-enable-stibp-on-amd-if-automatic-ibrs-is-enabled.patch b/queue-5.15/x86-cpu-enable-stibp-on-amd-if-automatic-ibrs-is-enabled.patch new file mode 100644 index 00000000000..e259019ab47 --- /dev/null +++ b/queue-5.15/x86-cpu-enable-stibp-on-amd-if-automatic-ibrs-is-enabled.patch @@ -0,0 +1,91 @@ +From fd470a8beed88440b160d690344fbae05a0b9b1b Mon Sep 17 00:00:00 2001 +From: Kim Phillips +Date: Thu, 20 Jul 2023 14:47:27 -0500 +Subject: x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled + +From: Kim Phillips + +commit fd470a8beed88440b160d690344fbae05a0b9b1b upstream. + +Unlike Intel's Enhanced IBRS feature, AMD's Automatic IBRS does not +provide protection to processes running at CPL3/user mode, see section +"Extended Feature Enable Register (EFER)" in the APM v2 at +https://bugzilla.kernel.org/attachment.cgi?id=304652 + +Explicitly enable STIBP to protect against cross-thread CPL3 +branch target injections on systems with Automatic IBRS enabled. + +Also update the relevant documentation. + +Fixes: e7862eda309e ("x86/cpu: Support AMD Automatic IBRS") +Reported-by: Tom Lendacky +Signed-off-by: Kim Phillips +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230720194727.67022-1-kim.phillips@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/hw-vuln/spectre.rst | 11 +++++++---- + arch/x86/kernel/cpu/bugs.c | 15 +++++++++------ + 2 files changed, 16 insertions(+), 10 deletions(-) + +--- a/Documentation/admin-guide/hw-vuln/spectre.rst ++++ b/Documentation/admin-guide/hw-vuln/spectre.rst +@@ -484,11 +484,14 @@ Spectre variant 2 + + Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at + boot, by setting the IBRS bit, and they're automatically protected against +- Spectre v2 variant attacks, including cross-thread branch target injections +- on SMT systems (STIBP). In other words, eIBRS enables STIBP too. ++ Spectre v2 variant attacks. + +- Legacy IBRS systems clear the IBRS bit on exit to userspace and +- therefore explicitly enable STIBP for that ++ On Intel's enhanced IBRS systems, this includes cross-thread branch target ++ injections on SMT systems (STIBP). In other words, Intel eIBRS enables ++ STIBP, too. ++ ++ AMD Automatic IBRS does not protect userspace, and Legacy IBRS systems clear ++ the IBRS bit on exit to userspace, therefore both explicitly enable STIBP. + + The retpoline mitigation is turned on by default on vulnerable + CPUs. It can be forced on or off by the administrator +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -1354,19 +1354,21 @@ spectre_v2_user_select_mitigation(void) + } + + /* +- * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP ++ * If no STIBP, Intel enhanced IBRS is enabled, or SMT impossible, STIBP + * is not required. + * +- * Enhanced IBRS also protects against cross-thread branch target ++ * Intel's Enhanced IBRS also protects against cross-thread branch target + * injection in user-mode as the IBRS bit remains always set which + * implicitly enables cross-thread protections. However, in legacy IBRS + * mode, the IBRS bit is set only on kernel entry and cleared on return +- * to userspace. This disables the implicit cross-thread protection, +- * so allow for STIBP to be selected in that case. ++ * to userspace. AMD Automatic IBRS also does not protect userspace. ++ * These modes therefore disable the implicit cross-thread protection, ++ * so allow for STIBP to be selected in those cases. + */ + if (!boot_cpu_has(X86_FEATURE_STIBP) || + !smt_possible || +- spectre_v2_in_eibrs_mode(spectre_v2_enabled)) ++ (spectre_v2_in_eibrs_mode(spectre_v2_enabled) && ++ !boot_cpu_has(X86_FEATURE_AUTOIBRS))) + return; + + /* +@@ -2666,7 +2668,8 @@ static ssize_t rfds_show_state(char *buf + + static char *stibp_state(void) + { +- if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) ++ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) && ++ !boot_cpu_has(X86_FEATURE_AUTOIBRS)) + return ""; + + switch (spectre_v2_user_stibp) {