- 12 Jan, 2018 40 commits
-
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 With the switch to using LFENCE_RDTSC on AMD platforms there is no longer a need for the MFENCE_RDTSC feature. Remove it usage and definition. Signed-off-by:
Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by:
Andy Whitcroft <apw@canonical.com> (backported from commit 1faf0ed25006beed56fd6465d53c61250ed22d39) Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 In order to reduce the impact of using MFENCE, make the execution of the LFENCE instruction serialized. This is done by setting bit 1 of MSR 0xc0011029 (DE_CFG). Some families that support LFENCE do not have this MSR. For these families, the LFENCE instruction is already serialized. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Clear registers on VM exit to prevent speculative use of them. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add code to overwrite the local CPU RSB entries from the previous less privileged mode. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Provide the guest with the speculative control CPUID related values. Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com> Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Set IBPB (Indirect Branch Prediction Barrier) when the current CPU is going to run a VCPU different from what was previously run. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Set/restore the guests IBRS value on VM entry. On VM exit back to the kernel save the guest IBRS value and then set IBRS to 1. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Allow guest access to the speculative control MSRs without being intercepted. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add an IBPB feature check to the speculative control update check after a microcode reload. Signed-off-by:
-
Tom Lendacky authored
CVE-2017-5753 CVE-2017-5715 Add speculative control support for AMD processors. For AMD, speculative control is indicated as follows: CPUID EAX=0x00000007, ECX=0x00 return EDX[26] indicates support for both IBRS and IBPB. CPUID EAX=0x80000008, ECX=0x00 return EBX[12] indicates support for just IBPB. On AMD family 0x10, 0x12 and 0x16 processors where either of the above features are not supported, IBPB can be achieved by disabling indirect branch predictor support in MSR 0xc0011021[14] at boot. Signed-off-by:
-
Borislav Petkov authored
CVE-2017-5753 CVE-2017-5715 The kernel accesses IC_CFG MSR (0xc0011021) on AMD because it checks whether the way access filter is enabled on some F15h models, and, if so, disables it. kvm doesn't handle that MSR access and complains about it, which can get really noisy in dmesg when one starts kvm guests all the time for testing. And it is useless anyway - guest kernel shouldn't be doing such changes anyway so tell it that that filter is disabled. Signed-off-by:
Borislav Petkov <bp@suse.de> Reviewed-by:
Ingo Molnar <mingo@kernel.org> (cherry picked from commit ae8b7875) Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Signed-off-by:
Tim Chen <tim.c.chen@linux.intel.com> Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 To prevent the unused registers %r8-%r15, from being used speculatively, we clear them upon syscall entrance for code hygiene in 32 bit compatible mode. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 To prevent the unused registers %r12-%r15, %rbp and %rbx from being used speculatively, we clear them upon syscall entrance for code hygiene. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 There are 2 ways to control IBPB and IBRS 1. At boot time noibrs kernel boot parameter will disable IBRS usage noibpb kernel boot parameter will disable IBPB usage Otherwise if the above parameters are not specified, the system will enable ibrs and ibpb usage if the cpu supports it. 2. At run time echo 0 > /proc/sys/kernel/ibrs_enabled will turn off IBRS echo 1 > /proc/sys/kernel/ibrs_enabled will turn on IBRS in kernel echo 2 > /proc/sys/kernel/ibrs_enabled will turn on IBRS in both userspace and kernel Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Add code to pad the local CPU's RSB entries to protect from previous less privilege mode. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Restore guest IBRS on VM entry and set it to 1 on VM exit back to kernel. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Set IBPB (Indirect branch prediction barrier) when switching VM. Signed-off-by:
-
Wei Wang authored
CVE-2017-5753 CVE-2017-5715 Add field to access guest MSR_IA332_SPEC_CTRL and MSR_IA32_PRED_CMD state. Signed-off-by:
Wei Wang <wei.w.wang@intel.com> Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Stuff RSB to prevent RSB underflow on non-SMEP platform. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 To reduce overhead of setting IBPB, we only do that when the new thread cannot ptrace the current one. If the new thread has ptrace capability on current thread, it is safe. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Set IBPB on context switch with changing of page table. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Clear IBRS when cpu is offlined and set it when brining it back online. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Clear IBRS on idle entry and set it on idle exit into kernel on mwait. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Set IBRS upon kernel entrance via syscall and interrupts. Clear it upon exit. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Setup macros to control IBRS and IBPB Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 Report presence of IBPB and IBRS. Signed-off-by:
-
Tim Chen authored
CVE-2017-5753 CVE-2017-5715 cpuid ax=0x7, return rdx bit 26 to indicate presence of this feature IA32_SPEC_CTRL (0x48) and IA32_PRED_CMD (0x49) IA32_SPEC_CTRL, bit0 – Indirect Branch Restricted Speculation (IBRS) IA32_PRED_CMD, bit0 – Indirect Branch Prediction Barrier (IBPB) Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
Elena Reshetova <elena.reshetova@intel.com> Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 Real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 real commit text tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 When constant blinding is enabled (bpf_jit_harden = 1), this adds a generic memory barrier (lfence for intel, mfence for AMD) before emitting x86 jitted code for the BPF_ALU(64)_OR_X and BPF_ALU_LHS_X (for BPF_REG_AX register) eBPF instructions. This is needed in order to prevent speculative execution on out of bounds BPF_MAP array indexes when JIT is enabled. This way an arbitary kernel memory is not exposed through side-channel attacks. For more details, please see this Google Project Zero report: tbd Signed-off-by:
-
Elena Reshetova authored
CVE-2017-5753 CVE-2017-5715 This adds a generic memory barrier before LD_IMM_DW and LDX_MEM_B/H/W/DW eBPF instructions during eBPF program execution in order to prevent speculative execution on out of bound BFP_MAP array indexes. This way an arbitary kernel memory is not exposed through side channel attacks. For more details, please see this Google Project Zero report: tbd Signed-off-by:
-
