From: Andrew Cooper <andrew.cooper3@citrix.com>

Date: Fri, 24 Jun 2022 14:41:21 +0100

Subject: x86/cpu/amd: Enumerate BTC_NO

Git-commit: 26aae8ccbc1972233afd08fb3f368947c0314265

Patch-mainline: v5.19-rc4

References: bsc#1199657 CVE-2022-29900 CVE-2022-29901

BTC_NO indicates that hardware is not susceptible to Branch Type Confusion.

Zen3 CPUs don't suffer BTC.

Hypervisors are expected to synthesise BTC_NO when it is appropriate

given the migration pool, to prevent kernels using heuristics.

  [ bp: Massage. ]

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Signed-off-by: Borislav Petkov <bp@suse.de>

---

 arch/x86/include/asm/cpufeatures.h |    1 +

 arch/x86/kernel/cpu/amd.c          |   21 +++++++++++++++------

 arch/x86/kernel/cpu/common.c       |    6 ++++--

 3 files changed, 20 insertions(+), 8 deletions(-)

--- a/arch/x86/include/asm/cpufeatures.h

+++ b/arch/x86/include/asm/cpufeatures.h

@@ -303,6 +303,7 @@

 #define X86_FEATURE_AMD_SSBD		(13*32+24) /* "" Speculative Store Bypass Disable */

 #define X86_FEATURE_VIRT_SSBD		(13*32+25) /* Virtualized Speculative Store Bypass Disable */

 #define X86_FEATURE_AMD_SSB_NO		(13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */

+#define X86_FEATURE_BTC_NO		(13*32+29) /* "" Not vulnerable to Branch Type Confusion */

 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */

 #define X86_FEATURE_DTHERM	(14*32+ 0) /* Digital Thermal Sensor */

--- a/arch/x86/kernel/cpu/amd.c

+++ b/arch/x86/kernel/cpu/amd.c

@@ -898,12 +898,21 @@ static void init_amd_zn(struct cpuinfo_x

 {

 	set_cpu_cap(c, X86_FEATURE_ZEN);

-	/*

-	 * Fix erratum 1076: CPB feature bit not being set in CPUID.

-	 * Always set it, except when running under a hypervisor.

-	 */

-	if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_CPB))

-		set_cpu_cap(c, X86_FEATURE_CPB);

+	/* Fix up CPUID bits, but only if not virtualised. */

+	if (!cpu_has(c, X86_FEATURE_HYPERVISOR)) {

+

+		/* Erratum 1076: CPB feature bit not being set in CPUID. */

+		if (!cpu_has(c, X86_FEATURE_CPB))

+			set_cpu_cap(c, X86_FEATURE_CPB);

+

+		/*

+		 * Zen3 (Fam19 model < 0x10) parts are not susceptible to

+		 * Branch Type Confusion, but predate the allocation of the

+		 * BTC_NO bit.

+		 */

+		if (c->x86 == 0x19 && !cpu_has(c, X86_FEATURE_BTC_NO))

+			set_cpu_cap(c, X86_FEATURE_BTC_NO);

+	}

 }

 static void init_amd(struct cpuinfo_x86 *c)

--- a/arch/x86/kernel/cpu/common.c

+++ b/arch/x86/kernel/cpu/common.c

@@ -1142,8 +1142,10 @@ static void __init cpu_set_bug_bits(stru

 	    !arch_cap_mmio_immune(ia32_cap))

 		setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);

-	if ((cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA)))

-		setup_force_cpu_bug(X86_BUG_RETBLEED);

+	if (!cpu_has(c, X86_FEATURE_BTC_NO)) {

+		if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA))

+			setup_force_cpu_bug(X86_BUG_RETBLEED);

+	}

 	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))

 		return;