Linux 6.16.7
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.16.7 kernel.
All users of the 6.16 kernel series must upgrade.
The updated 6.16.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.16.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/vmscape.rst | 110 ++++++++ Documentation/admin-guide/kernel-parameters.txt | 11 Makefile | 2 arch/x86/Kconfig | 9 arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/entry-common.h | 7 arch/x86/include/asm/nospec-branch.h | 2 arch/x86/kernel/cpu/bugs.c | 285 ++++++++++++++------- arch/x86/kernel/cpu/common.c | 86 ++++-- arch/x86/kvm/x86.c | 9 drivers/base/cpu.c | 3 include/linux/cpu.h | 1 14 files changed, 415 insertions(+), 114 deletions(-)
Greg Kroah-Hartman (1):
Linux 6.16.7
Pawan Gupta (7):
Documentation/hw-vuln: Add VMSCAPE documentation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enable the mitigation x86/bugs: Move cpu_bugs_smt_update() down x86/vmscape: Warn when STIBP is disabled with SMT x86/vmscape: Add old Intel CPUs to affected list
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -586,6 +586,7 @@ What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsa /sys/devices/system/cpu/vulnerabilities/tsx_async_abort + /sys/devices/system/cpu/vulnerabilities/vmscape Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -25,3 +25,4 @@ are configurable at compile, boot or run time. rsb old_microcode indirect-target-selection + vmscape
Documentation/admin-guide/hw-vuln/vmscape.rst new file +110 -0
110 lines not on this page · raw message
Documentation/admin-guide/kernel-parameters.txt +11 -0
@@ -3774,6 +3774,7 @@ srbds=off [X86,INTEL] ssbd=force-off [ARM64] tsx_async_abort=off [X86] + vmscape=off [X86] Exceptions: This does not have any effect on
@@ -7937,6 +7938,16 @@ vmpoff= [KNL,S390] Perform z/VM CP command after power off. Format: <command> + vmscape= [X86] Controls mitigation for VMscape attacks. + VMscape attacks can leak information from a userspace + hypervisor to a guest via speculative side-channels. + + off - disable the mitigation + ibpb - use Indirect Branch Prediction Barrier + (IBPB) mitigation (default) + force - force vulnerability detection even on + unaffected processors + vsyscall= [X86-64,EARLY] Controls the behavior of vsyscalls (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 16 -SUBLEVEL = 6 +SUBLEVEL = 7 EXTRAVERSION = NAME = Baby Opossum Posse
arch/x86/Kconfig +9 -0
@@ -2704,6 +2704,15 @@ config MITIGATION_TSA security vulnerability on AMD CPUs which can lead to forwarding of invalid info to subsequent instructions and thus can affect their timing and thereby cause a leakage. + +config MITIGATION_VMSCAPE + bool "Mitigate VMSCAPE" + depends on KVM + default y + help + Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security + vulnerability on Intel and AMD CPUs that may allow a guest to do + Spectre v2 style attacks on userspace hypervisor. endif config ARCH_HAS_ADD_PAGES
arch/x86/include/asm/cpufeatures.h +2 -0
@@ -492,6 +492,7 @@#define X86_FEATURE_TSA_SQ_NO (21*32+11)/* AMD CPU not vulnerable to TSA-SQ */ #define X86_FEATURE_TSA_L1_NO (21*32+12)/* AMD CPU not vulnerable to TSA-L1 */ #define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13)/* Clear CPU buffers using VERW before VMRUN */ +#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14)/* Use IBPB on exit-to-userspace, see VMSCAPE bug */ /* * BUG word(s)
@@ -548,4 +549,5 @@#define X86_BUG_ITS X86_BUG( 1*32+ 7)/* "its" CPU is affected by Indirect Target Selection */ #define X86_BUG_ITS_NATIVE_ONLY X86_BUG( 1*32+ 8)/* "its_native_only" CPU is affected by ITS, VMX is not affected */ #define X86_BUG_TSA X86_BUG( 1*32+ 9)/* "tsa" CPU is affected by Transient Scheduler Attacks */ +#define X86_BUG_VMSCAPE X86_BUG( 1*32+10)/* "vmscape" CPU is affected by VMSCAPE attacks from guests */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/entry-common.h +7 -0
@@ -93,6 +93,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,* 8 (ia32) bits. */ choose_random_kstack_offset (rdtsc ()); + +/* Avoid unnecessary reads of 'x86_ibpb_exit_to_user' */ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER ) && +this_cpu_read (x86_ibpb_exit_to_user)) { +indirect_branch_prediction_barrier (); +this_cpu_write (x86_ibpb_exit_to_user, false); + } }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
arch/x86/include/asm/nospec-branch.h +2 -0
@@ -530,6 +530,8 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature) : "memory"); } +DECLARE_PER_CPU (bool, x86_ibpb_exit_to_user); +static inline void indirect_branch_prediction_barrier (void ) { asm_inline volatile(ALTERNATIVE("", "call write_ibpb", X86_FEATURE_IBPB)
arch/x86/kernel/cpu/bugs.c +203 -82
348 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +55 -31
116 lines not on this page · raw message
arch/x86/kvm/x86.c +9 -0
@@ -11145,6 +11145,15 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)if (vcpu->arch.guest_fpu.xfd_err)wrmsrq (MSR_IA32_XFD_ERR ,0 ); +/* +* Mark this CPU as needing a branch predictor flush before running +* userspace. Must be done before enabling preemption to ensure it gets +* set for the CPU that actually ran the guest, and not the CPU that it +* may migrate to. +*/ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER )) +this_cpu_write (x86_ibpb_exit_to_user, true); +/* * Consume any pending interrupts, including the possible source of * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
drivers/base/cpu.c +3 -0
@@ -603,6 +603,7 @@ CPU_SHOW_VULN_FALLBACK(ghostwrite);CPU_SHOW_VULN_FALLBACK (old_microcode);CPU_SHOW_VULN_FALLBACK (indirect_target_selection);CPU_SHOW_VULN_FALLBACK (tsa); +CPU_SHOW_VULN_FALLBACK (vmscape); static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
@@ -622,6 +623,7 @@ static DEVICE_ATTR(ghostwrite, 0444, cpu_show_ghostwrite, NULL); static DEVICE_ATTR(old_microcode, 0444, cpu_show_old_microcode, NULL); static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); +static DEVICE_ATTR(vmscape, 0444, cpu_show_vmscape, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -642,6 +644,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_old_microcode.attr, &dev_attr_indirect_target_selection.attr, &dev_attr_tsa.attr, + &dev_attr_vmscape.attr, NULL };
include/linux/cpu.h +1 -0
@@ -83,6 +83,7 @@ extern ssize_t cpu_show_old_microcode(struct device *dev,extern ssize_t cpu_show_indirect_target_selection (struct device *dev,struct device_attribute *attr,char *buf);extern ssize_t cpu_show_tsa (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_vmscape (struct device *dev,struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,