x86/its: Enumerate Indirect Target Selection (ITS) bug

ITS bug in some pre-Alderlake Intel CPUs may allow indirect branches in the
first half of a cache line get predicted to a target of a branch located in
the second half of the cache line.

Set X86_BUG_ITS on affected CPUs. Mitigation to follow in later commits.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 6c2c152d8a67b9bf5836d4fe4860476684f282ff..2ff978fa414b5a7192f13489fb3a1ee5b4c24c2f 100644 (file)
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -533,4 +533,5 @@
 #define X86_BUG_BHI                    X86_BUG(1*32 + 3) /* "bhi" CPU is affected by Branch History Injection */
 #define X86_BUG_IBPB_NO_RET            X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */
 #define X86_BUG_SPECTRE_V2_USER                X86_BUG(1*32 + 5) /* "spectre_v2_user" CPU is affected by Spectre variant 2 attack between user processes */
+#define X86_BUG_ITS                    X86_BUG(1*32 + 6) /* "its" CPU is affected by Indirect Target Selection */
 #endif /* _ASM_X86_CPUFEATURES_H */

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index e6134ef2263d50d146ac5d37df129ba1a19150b6..e7d2f460fcc699e48ade18f95f92537d2571a649 100644 (file)
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -211,6 +211,14 @@
                                                 * VERW clears CPU Register
                                                 * File.
                                                 */
+#define ARCH_CAP_ITS_NO                        BIT_ULL(62) /*
+                                                    * Not susceptible to
+                                                    * Indirect Target Selection.
+                                                    * This bit is not set by
+                                                    * HW, but is synthesized by
+                                                    * VMMs for guests to know
+                                                    * their affected status.
+                                                    */
 
 #define MSR_IA32_FLUSH_CMD             0x0000010b
 #define L1D_FLUSH                      BIT(0)  /*

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 12126adbc3a9a7e2b767e024ececd3940098f3e8..accdee7ab1f70f271293a534eb3f594b53abef4d 100644 (file)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1227,6 +1227,8 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
 #define GDS            BIT(6)
 /* CPU is affected by Register File Data Sampling */
 #define RFDS           BIT(7)
+/* CPU is affected by Indirect Target Selection */
+#define ITS            BIT(8)
 
 static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
        VULNBL_INTEL_STEPS(INTEL_IVYBRIDGE,          X86_STEP_MAX,      SRBDS),
@@ -1238,22 +1240,25 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
        VULNBL_INTEL_STEPS(INTEL_BROADWELL_G,        X86_STEP_MAX,      SRBDS),
        VULNBL_INTEL_STEPS(INTEL_BROADWELL_X,        X86_STEP_MAX,      MMIO),
        VULNBL_INTEL_STEPS(INTEL_BROADWELL,          X86_STEP_MAX,      SRBDS),
-       VULNBL_INTEL_STEPS(INTEL_SKYLAKE_X,          X86_STEP_MAX,      MMIO | RETBLEED | GDS),
+       VULNBL_INTEL_STEPS(INTEL_SKYLAKE_X,                   0x5,      MMIO | RETBLEED | GDS),
+       VULNBL_INTEL_STEPS(INTEL_SKYLAKE_X,          X86_STEP_MAX,      MMIO | RETBLEED | GDS | ITS),
        VULNBL_INTEL_STEPS(INTEL_SKYLAKE_L,          X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS),
        VULNBL_INTEL_STEPS(INTEL_SKYLAKE,            X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS),
-       VULNBL_INTEL_STEPS(INTEL_KABYLAKE_L,         X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS),
-       VULNBL_INTEL_STEPS(INTEL_KABYLAKE,           X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS),
+       VULNBL_INTEL_STEPS(INTEL_KABYLAKE_L,                  0xb,      MMIO | RETBLEED | GDS | SRBDS),
+       VULNBL_INTEL_STEPS(INTEL_KABYLAKE_L,         X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_KABYLAKE,                    0xc,      MMIO | RETBLEED | GDS | SRBDS),
+       VULNBL_INTEL_STEPS(INTEL_KABYLAKE,           X86_STEP_MAX,      MMIO | RETBLEED | GDS | SRBDS | ITS),
        VULNBL_INTEL_STEPS(INTEL_CANNONLAKE_L,       X86_STEP_MAX,      RETBLEED),
-       VULNBL_INTEL_STEPS(INTEL_ICELAKE_L,          X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS),
-       VULNBL_INTEL_STEPS(INTEL_ICELAKE_D,          X86_STEP_MAX,      MMIO | GDS),
-       VULNBL_INTEL_STEPS(INTEL_ICELAKE_X,          X86_STEP_MAX,      MMIO | GDS),
-       VULNBL_INTEL_STEPS(INTEL_COMETLAKE,          X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS),
-       VULNBL_INTEL_STEPS(INTEL_COMETLAKE_L,                 0x0,      MMIO | RETBLEED),
-       VULNBL_INTEL_STEPS(INTEL_COMETLAKE_L,        X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS),
-       VULNBL_INTEL_STEPS(INTEL_TIGERLAKE_L,        X86_STEP_MAX,      GDS),
-       VULNBL_INTEL_STEPS(INTEL_TIGERLAKE,          X86_STEP_MAX,      GDS),
+       VULNBL_INTEL_STEPS(INTEL_ICELAKE_L,          X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_ICELAKE_D,          X86_STEP_MAX,      MMIO | GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_ICELAKE_X,          X86_STEP_MAX,      MMIO | GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_COMETLAKE,          X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_COMETLAKE_L,                 0x0,      MMIO | RETBLEED | ITS),
+       VULNBL_INTEL_STEPS(INTEL_COMETLAKE_L,        X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED | GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_TIGERLAKE_L,        X86_STEP_MAX,      GDS | ITS),
+       VULNBL_INTEL_STEPS(INTEL_TIGERLAKE,          X86_STEP_MAX,      GDS | ITS),
        VULNBL_INTEL_STEPS(INTEL_LAKEFIELD,          X86_STEP_MAX,      MMIO | MMIO_SBDS | RETBLEED),
-       VULNBL_INTEL_STEPS(INTEL_ROCKETLAKE,         X86_STEP_MAX,      MMIO | RETBLEED | GDS),
+       VULNBL_INTEL_STEPS(INTEL_ROCKETLAKE,         X86_STEP_MAX,      MMIO | RETBLEED | GDS | ITS),
        VULNBL_INTEL_TYPE(INTEL_ALDERLAKE,                   ATOM,      RFDS),
        VULNBL_INTEL_STEPS(INTEL_ALDERLAKE_L,        X86_STEP_MAX,      RFDS),
        VULNBL_INTEL_TYPE(INTEL_RAPTORLAKE,                  ATOM,      RFDS),
@@ -1318,6 +1323,32 @@ static bool __init vulnerable_to_rfds(u64 x86_arch_cap_msr)
        return cpu_matches(cpu_vuln_blacklist, RFDS);
 }
 
+static bool __init vulnerable_to_its(u64 x86_arch_cap_msr)
+{
+       /* The "immunity" bit trumps everything else: */
+       if (x86_arch_cap_msr & ARCH_CAP_ITS_NO)
+               return false;
+       if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+               return false;
+
+       /* None of the affected CPUs have BHI_CTRL */
+       if (boot_cpu_has(X86_FEATURE_BHI_CTRL))
+               return false;
+
+       /*
+        * If a VMM did not expose ITS_NO, assume that a guest could
+        * be running on a vulnerable hardware or may migrate to such
+        * hardware.
+        */
+       if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
+               return true;
+
+       if (cpu_matches(cpu_vuln_blacklist, ITS))
+               return true;
+
+       return false;
+}
+
 static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 {
        u64 x86_arch_cap_msr = x86_read_arch_cap_msr();
@@ -1449,6 +1480,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
        if (cpu_has(c, X86_FEATURE_AMD_IBPB) && !cpu_has(c, X86_FEATURE_AMD_IBPB_RET))
                setup_force_cpu_bug(X86_BUG_IBPB_NO_RET);
 
+       if (vulnerable_to_its(x86_arch_cap_msr))
+               setup_force_cpu_bug(X86_BUG_ITS);
+
        if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
                return;
 

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index df5b99ea1f18126d988108cfcefcb6f57c6e57f1..2626567c35df6129e020c3f1033612cbd9e107c1 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1584,7 +1584,7 @@ EXPORT_SYMBOL_GPL(kvm_emulate_rdpmc);
         ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \
         ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \
         ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \
-        ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO)
+        ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO | ARCH_CAP_ITS_NO)
 
 static u64 kvm_get_arch_capabilities(void)
 {
@@ -1618,6 +1618,8 @@ static u64 kvm_get_arch_capabilities(void)
                data |= ARCH_CAP_MDS_NO;
        if (!boot_cpu_has_bug(X86_BUG_RFDS))
                data |= ARCH_CAP_RFDS_NO;
+       if (!boot_cpu_has_bug(X86_BUG_ITS))
+               data |= ARCH_CAP_ITS_NO;
 
        if (!boot_cpu_has(X86_FEATURE_RTM)) {
                /*