Linux 6.12.47
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.12.47 kernel.
All users of the 6.12 kernel series must upgrade.
The updated 6.12.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/vmscape.rst | 110 ++++++++ Documentation/admin-guide/kernel-parameters.txt | 11 Makefile | 2 arch/x86/Kconfig | 9 arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/entry-common.h | 7 arch/x86/include/asm/nospec-branch.h | 2 arch/x86/kernel/cpu/bugs.c | 257 ++++++++++++++------- arch/x86/kernel/cpu/common.c | 84 ++++-- arch/x86/kvm/x86.c | 9 drivers/base/cpu.c | 3 include/linux/cpu.h | 1 14 files changed, 394 insertions(+), 105 deletions(-)
Greg Kroah-Hartman (1):
Linux 6.12.47
Pawan Gupta (7):
Documentation/hw-vuln: Add VMSCAPE documentation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enable the mitigation x86/bugs: Move cpu_bugs_smt_update() down x86/vmscape: Warn when STIBP is disabled with SMT x86/vmscape: Add old Intel CPUs to affected list
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -525,6 +525,7 @@ What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsa /sys/devices/system/cpu/vulnerabilities/tsx_async_abort + /sys/devices/system/cpu/vulnerabilities/vmscape Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -23,3 +23,4 @@ are configurable at compile, boot or run time. gather_data_sampling reg-file-data-sampling indirect-target-selection + vmscape
Documentation/admin-guide/hw-vuln/vmscape.rst new file +110 -0
110 lines not on this page · raw message
Documentation/admin-guide/kernel-parameters.txt +11 -0
@@ -3548,6 +3548,7 @@ srbds=off [X86,INTEL] ssbd=force-off [ARM64] tsx_async_abort=off [X86] + vmscape=off [X86] Exceptions: This does not have any effect on
@@ -7425,6 +7426,16 @@ vmpoff= [KNL,S390] Perform z/VM CP command after power off. Format: <command> + vmscape= [X86] Controls mitigation for VMscape attacks. + VMscape attacks can leak information from a userspace + hypervisor to a guest via speculative side-channels. + + off - disable the mitigation + ibpb - use Indirect Branch Prediction Barrier + (IBPB) mitigation (default) + force - force vulnerability detection even on + unaffected processors + vsyscall= [X86-64,EARLY] Controls the behavior of vsyscalls (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 12 -SUBLEVEL = 46 +SUBLEVEL = 47 EXTRAVERSION = NAME = Baby Opossum Posse
arch/x86/Kconfig +9 -0
@@ -2769,6 +2769,15 @@ config MITIGATION_TSA security vulnerability on AMD CPUs which can lead to forwarding of invalid info to subsequent instructions and thus can affect their timing and thereby cause a leakage. + +config MITIGATION_VMSCAPE + bool "Mitigate VMSCAPE" + depends on KVM + default y + help + Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security + vulnerability on Intel and AMD CPUs that may allow a guest to do + Spectre v2 style attacks on userspace hypervisor. endif config ARCH_HAS_ADD_PAGES
arch/x86/include/asm/cpufeatures.h +2 -0
@@ -482,6 +482,7 @@#define X86_FEATURE_TSA_SQ_NO (21*32+11)/* AMD CPU not vulnerable to TSA-SQ */ #define X86_FEATURE_TSA_L1_NO (21*32+12)/* AMD CPU not vulnerable to TSA-L1 */ #define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13)/* Clear CPU buffers using VERW before VMRUN */ +#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14)/* Use IBPB on exit-to-userspace, see VMSCAPE bug */ /* * BUG word(s)
@@ -536,4 +537,5 @@#define X86_BUG_ITS X86_BUG(1*32 + 5)/* "its" CPU is affected by Indirect Target Selection */ #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6)/* "its_native_only" CPU is affected by ITS, VMX is not affected */ #define X86_BUG_TSA X86_BUG( 1*32+ 9)/* "tsa" CPU is affected by Transient Scheduler Attacks */ +#define X86_BUG_VMSCAPE X86_BUG( 1*32+10)/* "vmscape" CPU is affected by VMSCAPE attacks from guests */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/entry-common.h +7 -0
@@ -92,6 +92,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,* 8 (ia32) bits. */ choose_random_kstack_offset (rdtsc ()); + +/* Avoid unnecessary reads of 'x86_ibpb_exit_to_user' */ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER ) && +this_cpu_read (x86_ibpb_exit_to_user)) { +indirect_branch_prediction_barrier (); +this_cpu_write (x86_ibpb_exit_to_user, false); + } }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
arch/x86/include/asm/nospec-branch.h +2 -0
@@ -549,6 +549,8 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature)extern u64 x86_pred_cmd; +DECLARE_PER_CPU (bool, x86_ibpb_exit_to_user); +static inline void indirect_branch_prediction_barrier (void ) {alternative_msr_write (MSR_IA32_PRED_CMD , x86_pred_cmd,X86_FEATURE_USE_IBPB );
arch/x86/kernel/cpu/bugs.c +183 -74
308 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +54 -30
114 lines not on this page · raw message
arch/x86/kvm/x86.c +9 -0
@@ -11069,6 +11069,15 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)if (vcpu->arch.guest_fpu.xfd_err)wrmsrl (MSR_IA32_XFD_ERR ,0 ); +/* +* Mark this CPU as needing a branch predictor flush before running +* userspace. Must be done before enabling preemption to ensure it gets +* set for the CPU that actually ran the guest, and not the CPU that it +* may migrate to. +*/ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER )) +this_cpu_write (x86_ibpb_exit_to_user, true); +/* * Consume any pending interrupts, including the possible source of * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
drivers/base/cpu.c +3 -0
@@ -601,6 +601,7 @@ CPU_SHOW_VULN_FALLBACK(gds);CPU_SHOW_VULN_FALLBACK (reg_file_data_sampling);CPU_SHOW_VULN_FALLBACK (indirect_target_selection);CPU_SHOW_VULN_FALLBACK (tsa); +CPU_SHOW_VULN_FALLBACK (vmscape); static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
@@ -618,6 +619,7 @@ static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); +static DEVICE_ATTR(vmscape, 0444, cpu_show_vmscape, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -636,6 +638,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_reg_file_data_sampling.attr, &dev_attr_indirect_target_selection.attr, &dev_attr_tsa.attr, + &dev_attr_vmscape.attr, NULL };
include/linux/cpu.h +1 -0
@@ -80,6 +80,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,extern ssize_t cpu_show_indirect_target_selection (struct device *dev,struct device_attribute *attr,char *buf);extern ssize_t cpu_show_tsa (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_vmscape (struct device *dev,struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,