Linux 4.19.248
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.19.248 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++ Documentation/admin-guide/kernel-parameters.txt | 36 + Makefile | 2 arch/x86/include/asm/cpufeatures.h | 1 arch/x86/include/asm/intel-family.h | 11 arch/x86/include/asm/msr-index.h | 25 + arch/x86/include/asm/nospec-branch.h | 2 arch/x86/kernel/cpu/bugs.c | 235 ++++++++- arch/x86/kernel/cpu/common.c | 52 +- arch/x86/kvm/vmx.c | 77 +++ arch/x86/kvm/x86.c | 4 drivers/base/cpu.c | 8 include/linux/cpu.h | 4 15 files changed, 664 insertions(+), 41 deletions(-)
Gayatri Kammela (2):
x86/cpu: Add Elkhart Lake to Intel family x86/cpu: Add another Alder Lake CPU to the Intel family
Greg Kroah-Hartman (1):
Linux 4.19.248
Guenter Roeck (1):
cpu/speculation: Add prototype for cpu_show_srbds()
Josh Poimboeuf (1):
x86/speculation/mmio: Print SMT warning
Pawan Gupta (10):
Documentation: Add documentation for Processor MMIO Stale Data x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug x86/speculation: Add a common function for MD_CLEAR mitigation update x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations x86/speculation/mmio: Enable CPU Fill buffer clearing on idle x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data x86/speculation/srbds: Update SRBDS mitigation selection x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
KVM: x86/speculation: Disable Fill buffer clear within guests
Tony Luck (1):
x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family
Zhang Rui (1):
x86/cpu: Add Jasper Lake to Intel family
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -481,6 +481,7 @@ What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsx_async_abort /sys/devices/system/cpu/vulnerabilities/itlb_multihit + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst
Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file +246 -0
246 lines not on this page · raw message
Documentation/admin-guide/kernel-parameters.txt +36 -0
@@ -2574,6 +2574,7 @@ kvm.nx_huge_pages=off [X86] no_entry_flush [PPC] no_uaccess_flush [PPC] + mmio_stale_data=off [X86] Exceptions: This does not have any effect on
@@ -2595,6 +2596,7 @@ Equivalent to: l1tf=flush,nosmt [X86] mds=full,nosmt [X86] tsx_async_abort=full,nosmt [X86] + mmio_stale_data=full,nosmt [X86] mminit_loglevel= [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
@@ -2604,6 +2606,40 @@ log everything. Information is printed at KERN_DEBUG so loglevel=8 may also need to be specified. + mmio_stale_data= + [X86,INTEL] Control mitigation for the Processor + MMIO Stale Data vulnerabilities. + + Processor MMIO Stale Data is a class of + vulnerabilities that may expose data after an MMIO + operation. Exposed data could originate or end in + the same CPU buffers as affected by MDS and TAA. + Therefore, similar to MDS and TAA, the mitigation + is to clear the affected CPU buffers. + + This parameter controls the mitigation. The + options are: + + full - Enable mitigation on vulnerable CPUs + + full,nosmt - Enable mitigation and disable SMT on + vulnerable CPUs. + + off - Unconditionally disable mitigation + + On MDS or TAA affected machines, + mmio_stale_data=off can be prevented by an active + MDS or TAA mitigation as these vulnerabilities are + mitigated with the same mechanism so in order to + disable this mitigation, you need to specify + mds=off and tsx_async_abort=off too. + + Not specifying this option is equivalent to + mmio_stale_data=full. + + For details see: + Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst + module.sig_enforce [KNL] When CONFIG_MODULE_SIG is set, this means that modules without (valid) signatures will fail to load.
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 19 -SUBLEVEL = 247 +SUBLEVEL = 248 EXTRAVERSION = NAME = "People's Front"
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -394,5 +394,6 @@#define X86_BUG_TAA X86_BUG(22)/* CPU is affected by TSX Async Abort(TAA) */ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23)/* CPU may incur MCE during certain page attribute changes */ #define X86_BUG_SRBDS X86_BUG(24)/* CPU may leak RNG bits if not mitigated */ +#define X86_BUG_MMIO_STALE_DATA X86_BUG(25)/* CPU is affected by Processor MMIO Stale Data vulnerabilities */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/intel-family.h +11 -0
@@ -64,6 +64,14 @@#define INTEL_FAM6_COMETLAKE 0xA5#define INTEL_FAM6_COMETLAKE_L 0xA6 +#define INTEL_FAM6_ROCKETLAKE 0xA7 + +/* Hybrid Core/Atom Processors */ + +#define INTEL_FAM6_LAKEFIELD 0x8A +#define INTEL_FAM6_ALDERLAKE 0x97 +#define INTEL_FAM6_ALDERLAKE_L 0x9A +/* "Small Core" Processors (Atom) */ #define INTEL_FAM6_ATOM_BONNELL 0x1C/* Diamondville, Pineview */
@@ -83,7 +91,10 @@#define INTEL_FAM6_ATOM_GOLDMONT 0x5C/* Apollo Lake */ #define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F/* Denverton */ #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A/* Gemini Lake */ +#define INTEL_FAM6_ATOM_TREMONT_X 0x86/* Jacobsville */ +#define INTEL_FAM6_ATOM_TREMONT 0x96/* Elkhart Lake */ +#define INTEL_FAM6_ATOM_TREMONT_L 0x9C/* Jasper Lake */ /* Xeon Phi */
arch/x86/include/asm/msr-index.h +25 -0
@@ -96,6 +96,30 @@* Not susceptible to * TSX Async Abort (TAA) vulnerabilities. */ +#define ARCH_CAP_SBDR_SSDP_NO BIT(13)/* +* Not susceptible to SBDR and SSDP +* variants of Processor MMIO stale data +* vulnerabilities. +*/ +#define ARCH_CAP_FBSDP_NO BIT(14)/* +* Not susceptible to FBSDP variant of +* Processor MMIO stale data +* vulnerabilities. +*/ +#define ARCH_CAP_PSDP_NO BIT(15)/* +* Not susceptible to PSDP variant of +* Processor MMIO stale data +* vulnerabilities. +*/ +#define ARCH_CAP_FB_CLEAR BIT(17)/* +* VERW clears CPU fill buffer +* even on MDS_NO CPUs. +*/ +#define ARCH_CAP_FB_CLEAR_CTRL BIT(18)/* +* MSR_IA32_MCU_OPT_CTRL[FB_CLEAR_DIS] +* bit available to control VERW +* behavior. +*/ #define MSR_IA32_FLUSH_CMD 0x0000010b#define L1D_FLUSH BIT(0)/*
@@ -113,6 +137,7 @@/* SRBDS support */ #define MSR_IA32_MCU_OPT_CTRL 0x00000123#define RNGDS_MITG_DIS BIT(0) +#define FB_CLEAR_DIS BIT(3)/* CPU Fill buffer clear disable */ #define MSR_IA32_SYSENTER_CS 0x00000174#define MSR_IA32_SYSENTER_ESP 0x00000175
arch/x86/include/asm/nospec-branch.h +2 -0
@@ -323,6 +323,8 @@ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);DECLARE_STATIC_KEY_FALSE (mds_user_clear);DECLARE_STATIC_KEY_FALSE (mds_idle_clear); +DECLARE_STATIC_KEY_FALSE (mmio_stale_data_clear); +#include <asm/segment.h> /**
arch/x86/kernel/cpu/bugs.c +199 -36
334 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +49 -3
85 lines not on this page · raw message
arch/x86/kvm/vmx.c +76 -1
129 lines not on this page · raw message
arch/x86/kvm/x86.c +4 -0
@@ -1220,6 +1220,10 @@ u64 kvm_get_arch_capabilities(void)/* KVM does not emulate MSR_IA32_TSX_CTRL. */ data &= ~ARCH_CAP_TSX_CTRL_MSR ; + +/* Guests don't need to know "Fill buffer clear control" exists */ + data &= ~ARCH_CAP_FB_CLEAR_CTRL ; +return data; }
drivers/base/cpu.c +8 -0
@@ -571,6 +571,12 @@ ssize_t __weak cpu_show_srbds(struct device *dev,return sprintf (buf,"Not affected\n" ); } +ssize_t __weak cpu_show_mmio_stale_data (struct device *dev, +struct device_attribute *attr,char *buf) +{ +return sysfs_emit (buf,"Not affected\n" ); +} + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
@@ -580,6 +586,7 @@ static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL); static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); +static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -591,6 +598,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_tsx_async_abort.attr, &dev_attr_itlb_multihit.attr, &dev_attr_srbds.attr, + &dev_attr_mmio_stale_data.attr, NULL };
include/linux/cpu.h +4 -0
@@ -64,6 +64,10 @@ extern ssize_t cpu_show_tsx_async_abort(struct device *dev, char *buf);extern ssize_t cpu_show_itlb_multihit (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_srbds (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_mmio_stale_data (struct device *dev, +struct device_attribute *attr, +char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,