linux-kernel - Re: [PATCH] x86/cpu/amd: Report zenbleed in sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <58bde8b7-018c-5f4c-282d-629cfb42515f@suse.com>
Date:   Sat, 29 Jul 2023 10:24:54 +0300
From:   Nikolay Borisov <nik.borisov@...e.com>
To:     Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Cc:     x86@...nel.org, bp@...en8.de, tglx@...utronix.de,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/cpu/amd: Report zenbleed in sysfs



On 29.07.23 г. 2:14 ч., Pawan Gupta wrote:
> On Thu, Jul 27, 2023 at 10:54:46AM +0300, Nikolay Borisov wrote:
>> Initial submission of Zenbleed fix omitted reporting the bug in sysfs.
>> There's no reason why it shouldn't be reported so let's add it among
>> the other vulnerabilities.
>>
>> Signed-off-by: Nikolay Borisov <nik.borisov@...e.com>
>> ---
>>   .../ABI/testing/sysfs-devices-system-cpu          |  1 +
>>   arch/x86/kernel/cpu/amd.c                         | 15 +++++++++++++++
>>   drivers/base/cpu.c                                |  8 ++++++++
>>   include/linux/cpu.h                               |  2 ++
>>   4 files changed, 26 insertions(+)
>>
>> diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
>> index ecd585ca2d50..30bb4196e451 100644
>> --- a/Documentation/ABI/testing/sysfs-devices-system-cpu
>> +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
>> @@ -524,6 +524,7 @@ What:		/sys/devices/system/cpu/vulnerabilities
>>   		/sys/devices/system/cpu/vulnerabilities/itlb_multihit
>>   		/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
>>   		/sys/devices/system/cpu/vulnerabilities/retbleed
>> +		/sys/devices/system/cpu/vulnerabilities/zenbleed
>>   Date:		January 2018
>>   Contact:	Linux kernel mailing list <linux-kernel@...r.kernel.org>
>>   Description:	Information about CPU vulnerabilities
>> diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
>> index 26ad7ca423e7..3ab9745eafc5 100644
>> --- a/arch/x86/kernel/cpu/amd.c
>> +++ b/arch/x86/kernel/cpu/amd.c
>> @@ -1279,6 +1279,21 @@ u32 amd_get_highest_perf(void)
>>   }
>>   EXPORT_SYMBOL_GPL(amd_get_highest_perf);
>>   
>> +ssize_t cpu_show_zenbleed(struct device *dev, struct device_attribute *attr, char *buf)
>> +{
>> +
> 
> Extra newline.
> 
>> +	if (!cpu_has_amd_erratum(&boot_cpu_data, amd_zenbleed) ||
>> +	    !boot_cpu_has(X86_FEATURE_AVX) ||
>> +	    boot_cpu_has(X86_FEATURE_HYPERVISOR))
>> +		return sysfs_emit(buf, "Not affected\n");
>> +
>> +	if (!cpu_has_zenbleed_microcode()) {
> 
> For readability this can check of microcode present case, and drop the
> NOT operator.
> 
>> +		return sysfs_emit(buf, "Mitigation: Chickenbit\n");
> 
> Shouldn't this be checking if the chicken bit is set? And if its not set
> then report "Vulnerable".
> 
> But, looking at zenbleed_check() it appear that the chicken bit for
> zenbleed will always be present, and it will always be set if microcode
> is not present.

Yeah, but based on feedback I got from Boris it seems this is not going 
to be merged so it doesn't matter.

> 
>> +	} else {
>> +		return sysfs_emit(buf, "Mitigation: Microcode\n");
>> +	}
>> +}