Linux 6.6.106
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.6.106 kernel.
All users of the 6.6 kernel series must upgrade.
The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/vmscape.rst | 110 ++++++++ Documentation/admin-guide/kernel-parameters.txt | 11 Makefile | 2 arch/x86/Kconfig | 9 arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/entry-common.h | 7 arch/x86/include/asm/nospec-branch.h | 2 arch/x86/kernel/cpu/bugs.c | 257 ++++++++++++++------- arch/x86/kernel/cpu/common.c | 82 ++++-- arch/x86/kvm/x86.c | 9 drivers/base/cpu.c | 3 include/linux/cpu.h | 1 14 files changed, 392 insertions(+), 105 deletions(-)
Greg Kroah-Hartman (1):
Linux 6.6.106
Pawan Gupta (7):
Documentation/hw-vuln: Add VMSCAPE documentation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enable the mitigation x86/bugs: Move cpu_bugs_smt_update() down x86/vmscape: Warn when STIBP is disabled with SMT x86/vmscape: Add old Intel CPUs to affected list
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -528,6 +528,7 @@ What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsa /sys/devices/system/cpu/vulnerabilities/tsx_async_abort + /sys/devices/system/cpu/vulnerabilities/vmscape Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -23,3 +23,4 @@ are configurable at compile, boot or run time. gather_data_sampling reg-file-data-sampling indirect-target-selection + vmscape
Documentation/admin-guide/hw-vuln/vmscape.rst new file +110 -0
110 lines not on this page · raw message
Documentation/admin-guide/kernel-parameters.txt +11 -0
@@ -3368,6 +3368,7 @@ srbds=off [X86,INTEL] ssbd=force-off [ARM64] tsx_async_abort=off [X86] + vmscape=off [X86] Exceptions: This does not have any effect on
@@ -7074,6 +7075,16 @@ vmpoff= [KNL,S390] Perform z/VM CP command after power off. Format: <command> + vmscape= [X86] Controls mitigation for VMscape attacks. + VMscape attacks can leak information from a userspace + hypervisor to a guest via speculative side-channels. + + off - disable the mitigation + ibpb - use Indirect Branch Prediction Barrier + (IBPB) mitigation (default) + force - force vulnerability detection even on + unaffected processors + vsyscall= [X86-64] Controls the behavior of vsyscalls (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 6 -SUBLEVEL = 105 +SUBLEVEL = 106 EXTRAVERSION = NAME = Pinguïn Aangedreven
arch/x86/Kconfig +9 -0
@@ -2630,6 +2630,15 @@ config MITIGATION_TSA security vulnerability on AMD CPUs which can lead to forwarding of invalid info to subsequent instructions and thus can affect their timing and thereby cause a leakage. + +config MITIGATION_VMSCAPE + bool "Mitigate VMSCAPE" + depends on KVM + default y + help + Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security + vulnerability on Intel and AMD CPUs that may allow a guest to do + Spectre v2 style attacks on userspace hypervisor. endif config ARCH_HAS_ADD_PAGES
arch/x86/include/asm/cpufeatures.h +2 -0
@@ -475,6 +475,7 @@#define X86_FEATURE_TSA_SQ_NO (21*32+11)/* "" AMD CPU not vulnerable to TSA-SQ */ #define X86_FEATURE_TSA_L1_NO (21*32+12)/* "" AMD CPU not vulnerable to TSA-L1 */ #define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13)/* "" Clear CPU buffers using VERW before VMRUN */ +#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14)/* Use IBPB on exit-to-userspace, see VMSCAPE bug */ /* * BUG word(s)
@@ -528,4 +529,5 @@#define X86_BUG_ITS X86_BUG(1*32 + 5)/* CPU is affected by Indirect Target Selection */ #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6)/* CPU is affected by ITS, VMX is not affected */ #define X86_BUG_TSA X86_BUG(1*32+ 9)/* "tsa" CPU is affected by Transient Scheduler Attacks */ +#define X86_BUG_VMSCAPE X86_BUG( 1*32+10)/* "vmscape" CPU is affected by VMSCAPE attacks from guests */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/entry-common.h +7 -0
@@ -83,6 +83,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,* 8 (ia32) bits. */ choose_random_kstack_offset (rdtsc ()); + +/* Avoid unnecessary reads of 'x86_ibpb_exit_to_user' */ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER ) && +this_cpu_read (x86_ibpb_exit_to_user)) { +indirect_branch_prediction_barrier (); +this_cpu_write (x86_ibpb_exit_to_user, false); + } }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
arch/x86/include/asm/nospec-branch.h +2 -0
@@ -559,6 +559,8 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature)extern u64 x86_pred_cmd; +DECLARE_PER_CPU (bool, x86_ibpb_exit_to_user); +static inline void indirect_branch_prediction_barrier (void ) {alternative_msr_write (MSR_IA32_PRED_CMD , x86_pred_cmd,X86_FEATURE_USE_IBPB );
arch/x86/kernel/cpu/bugs.c +183 -74
306 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +52 -30
112 lines not on this page · raw message
arch/x86/kvm/x86.c +9 -0
@@ -10864,6 +10864,15 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)if (vcpu->arch.guest_fpu.xfd_err)wrmsrl (MSR_IA32_XFD_ERR ,0 ); +/* +* Mark this CPU as needing a branch predictor flush before running +* userspace. Must be done before enabling preemption to ensure it gets +* set for the CPU that actually ran the guest, and not the CPU that it +* may migrate to. +*/ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER )) +this_cpu_write (x86_ibpb_exit_to_user, true); +/* * Consume any pending interrupts, including the possible source of * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
drivers/base/cpu.c +3 -0
@@ -568,6 +568,7 @@ CPU_SHOW_VULN_FALLBACK(gds);CPU_SHOW_VULN_FALLBACK (reg_file_data_sampling);CPU_SHOW_VULN_FALLBACK (indirect_target_selection);CPU_SHOW_VULN_FALLBACK (tsa); +CPU_SHOW_VULN_FALLBACK (vmscape); static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
@@ -585,6 +586,7 @@ static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); +static DEVICE_ATTR(vmscape, 0444, cpu_show_vmscape, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -603,6 +605,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_reg_file_data_sampling.attr, &dev_attr_indirect_target_selection.attr, &dev_attr_tsa.attr, + &dev_attr_vmscape.attr, NULL };
include/linux/cpu.h +1 -0
@@ -80,6 +80,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,extern ssize_t cpu_show_indirect_target_selection (struct device *dev,struct device_attribute *attr,char *buf);extern ssize_t cpu_show_tsa (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_vmscape (struct device *dev,struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,