Skip to content

Commit 5376418

Browse files
otaviootavio
authored
Merge pull request #84 from zandrey/5.4-1.0.0-imx
Update 5.4-1.0.0-imx to v5.4.46 from stable
2 parents cc60630 + c986767 commit 5376418

File tree

42 files changed

+626
-134
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+626
-134
lines changed

‎Documentation/ABI/testing/sysfs-devices-system-cpu‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -486,6 +486,7 @@ What: /sys/devices/system/cpu/vulnerabilities
486486
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
487487
/sys/devices/system/cpu/vulnerabilities/l1tf
488488
/sys/devices/system/cpu/vulnerabilities/mds
489+
/sys/devices/system/cpu/vulnerabilities/srbds
489490
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
490491
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
491492
Date: January 2018

‎Documentation/admin-guide/hw-vuln/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,4 @@ are configurable at compile, boot or run time.
1414
mds
1515
tsx_async_abort
1616
multihit.rst
17+
special-register-buffer-data-sampling.rst

‎Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
SRBDS - Special Register Buffer Data Sampling
4+
=============================================
5+
6+
SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to
7+
infer values returned from special register accesses. Special register
8+
accesses are accesses to off core registers. According to Intel's evaluation,
9+
the special register reads that have a security expectation of privacy are
10+
RDRAND, RDSEED and SGX EGETKEY.
11+
12+
When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved
13+
to the core through the special register mechanism that is susceptible
14+
to MDS attacks.
15+
16+
Affected processors
17+
--------------------
18+
Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may
19+
be affected.
20+
21+
A processor is affected by SRBDS if its Family_Model and stepping is
22+
in the following list, with the exception of the listed processors
23+
exporting MDS_NO while Intel TSX is available yet not enabled. The
24+
latter class of processors are only affected when Intel TSX is enabled
25+
by software using TSX_CTRL_MSR otherwise they are not affected.
26+
27+
============= ============ ========
28+
common name Family_Model Stepping
29+
============= ============ ========
30+
IvyBridge 06_3AH All
31+
32+
Haswell 06_3CH All
33+
Haswell_L 06_45H All
34+
Haswell_G 06_46H All
35+
36+
Broadwell_G 06_47H All
37+
Broadwell 06_3DH All
38+
39+
Skylake_L 06_4EH All
40+
Skylake 06_5EH All
41+
42+
Kabylake_L 06_8EH <= 0xC
43+
Kabylake 06_9EH <= 0xD
44+
============= ============ ========
45+
46+
Related CVEs
47+
------------
48+
49+
The following CVE entry is related to this SRBDS issue:
50+
51+
============== ===== =====================================
52+
CVE-2020-0543 SRBDS Special Register Buffer Data Sampling
53+
============== ===== =====================================
54+
55+
Attack scenarios
56+
----------------
57+
An unprivileged user can extract values returned from RDRAND and RDSEED
58+
executed on another core or sibling thread using MDS techniques.
59+
60+
61+
Mitigation mechanism
62+
-------------------
63+
Intel will release microcode updates that modify the RDRAND, RDSEED, and
64+
EGETKEY instructions to overwrite secret special register data in the shared
65+
staging buffer before the secret data can be accessed by another logical
66+
processor.
67+
68+
During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core
69+
accesses from other logical processors will be delayed until the special
70+
register read is complete and the secret data in the shared staging buffer is
71+
overwritten.
72+
73+
This has three effects on performance:
74+
75+
#. RDRAND, RDSEED, or EGETKEY instructions have higher latency.
76+
77+
#. Executing RDRAND at the same time on multiple logical processors will be
78+
serialized, resulting in an overall reduction in the maximum RDRAND
79+
bandwidth.
80+
81+
#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other
82+
logical processors that miss their core caches, with an impact similar to
83+
legacy locked cache-line-split accesses.
84+
85+
The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable
86+
the mitigation for RDRAND and RDSEED instructions executed outside of Intel
87+
Software Guard Extensions (Intel SGX) enclaves. On logical processors that
88+
disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not
89+
take longer to execute and do not impact performance of sibling logical
90+
processors memory accesses. The opt-out mechanism does not affect Intel SGX
91+
enclaves (including execution of RDRAND or RDSEED inside an enclave, as well
92+
as EGETKEY execution).
93+
94+
IA32_MCU_OPT_CTRL MSR Definition
95+
--------------------------------
96+
Along with the mitigation for this issue, Intel added a new thread-scope
97+
IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and
98+
RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL =
99+
9]==1. This MSR is introduced through the microcode update.
100+
101+
Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor
102+
disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX
103+
enclave on that logical processor. Opting out of the mitigation for a
104+
particular logical processor does not affect the RDRAND and RDSEED mitigations
105+
for other logical processors.
106+
107+
Note that inside of an Intel SGX enclave, the mitigation is applied regardless
108+
of the value of RNGDS_MITG_DS.
109+
110+
Mitigation control on the kernel command line
111+
---------------------------------------------
112+
The kernel command line allows control over the SRBDS mitigation at boot time
113+
with the option "srbds=". The option for this is:
114+
115+
============= =============================================================
116+
off This option disables SRBDS mitigation for RDRAND and RDSEED on
117+
affected platforms.
118+
============= =============================================================
119+
120+
SRBDS System Information
121+
-----------------------
122+
The Linux kernel provides vulnerability status information through sysfs. For
123+
SRBDS this can be accessed by the following sysfs file:
124+
/sys/devices/system/cpu/vulnerabilities/srbds
125+
126+
The possible values contained in this file are:
127+
128+
============================== =============================================
129+
Not affected Processor not vulnerable
130+
Vulnerable Processor vulnerable and mitigation disabled
131+
Vulnerable: No microcode Processor vulnerable and microcode is missing
132+
mitigation
133+
Mitigation: Microcode Processor is vulnerable and mitigation is in
134+
effect.
135+
Mitigation: TSX disabled Processor is only vulnerable when TSX is
136+
enabled while this system was booted with TSX
137+
disabled.
138+
Unknown: Dependent on
139+
hypervisor status Running on virtual guest processor that is
140+
affected but with no way to know if host
141+
processor is mitigated or vulnerable.
142+
============================== =============================================
143+
144+
SRBDS Default mitigation
145+
------------------------
146+
This new microcode serializes processor access during execution of RDRAND,
147+
RDSEED ensures that the shared buffer is overwritten before it is released for
148+
reuse. Use the "srbds=off" kernel command line to disable the mitigation for
149+
RDRAND and RDSEED.

‎Documentation/admin-guide/kernel-parameters.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4579,6 +4579,26 @@
45794579
spia_pedr=
45804580
spia_peddr=
45814581

4582+
srbds= [X86,INTEL]
4583+
Control the Special Register Buffer Data Sampling
4584+
(SRBDS) mitigation.
4585+
4586+
Certain CPUs are vulnerable to an MDS-like
4587+
exploit which can leak bits from the random
4588+
number generator.
4589+
4590+
By default, this issue is mitigated by
4591+
microcode. However, the microcode fix can cause
4592+
the RDRAND and RDSEED instructions to become
4593+
much slower. Among other effects, this will
4594+
result in reduced throughput from /dev/urandom.
4595+
4596+
The microcode mitigation can be disabled with
4597+
the following option:
4598+
4599+
off: Disable mitigation and remove
4600+
performance impact to RDRAND and RDSEED
4601+
45824602
srcutree.counter_wrap_check [KNL]
45834603
Specifies how frequently to check for
45844604
grace-period sequence counter wrap for the

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 5
33
PATCHLEVEL = 4
4-
SUBLEVEL = 45
4+
SUBLEVEL = 46
55
EXTRAVERSION =
66
NAME = Kleptomaniac Octopus
77

‎arch/x86/include/asm/cpu_device_id.h‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,36 @@
99

1010
#include <linux/mod_devicetable.h>
1111

12+
#define X86_CENTAUR_FAM6_C7_D 0xd
13+
#define X86_CENTAUR_FAM6_NANO 0xf
14+
15+
#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
16+
17+
/**
18+
* X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
19+
* @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
20+
* The name is expanded to X86_VENDOR_@_vendor
21+
* @_family: The family number or X86_FAMILY_ANY
22+
* @_model: The model number, model constant or X86_MODEL_ANY
23+
* @_steppings: Bitmask for steppings, stepping constant or X86_STEPPING_ANY
24+
* @_feature: A X86_FEATURE bit or X86_FEATURE_ANY
25+
* @_data: Driver specific data or NULL. The internal storage
26+
* format is unsigned long. The supplied value, pointer
27+
* etc. is casted to unsigned long internally.
28+
*
29+
* Backport version to keep the SRBDS pile consistant. No shorter variants
30+
* required for this.
31+
*/
32+
#define X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
33+
_steppings, _feature, _data) { \
34+
.vendor = X86_VENDOR_##_vendor, \
35+
.family = _family, \
36+
.model = _model, \
37+
.steppings = _steppings, \
38+
.feature = _feature, \
39+
.driver_data = (unsigned long) _data \
40+
}
41+
1242
/*
1343
* Match specific microcode revisions.
1444
*

‎arch/x86/include/asm/cpufeatures.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,7 @@
357357
#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
358358
#define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
359359
#define X86_FEATURE_AVX512_VP2INTERSECT (18*32+ 8) /* AVX-512 Intersect for D/Q */
360+
#define X86_FEATURE_SRBDS_CTRL (18*32+ 9) /* "" SRBDS mitigation MSR available */
360361
#define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */
361362
#define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
362363
#define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
@@ -401,5 +402,6 @@
401402
#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
402403
#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
403404
#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
405+
#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
404406

405407
#endif /* _ASM_X86_CPUFEATURES_H */

‎arch/x86/include/asm/msr-index.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@
119119
#define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */
120120
#define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */
121121

122+
/* SRBDS support */
123+
#define MSR_IA32_MCU_OPT_CTRL 0x00000123
124+
#define RNGDS_MITG_DIS BIT(0)
125+
122126
#define MSR_IA32_SYSENTER_CS 0x00000174
123127
#define MSR_IA32_SYSENTER_ESP 0x00000175
124128
#define MSR_IA32_SYSENTER_EIP 0x00000176

0 commit comments

Comments
 (0)