Linux 4.14.321
Greg Kroah-Hartman
maintainer-----------------
Note, PLEASE TEST this kernel if you are on the 4.14.y tree before using it in a real workload. This was a quick release due to the obvious security fixes in it, and as such, it has not had very much testing "in the wild". Please let us know of any problems seen. Also note that the user/kernel api for the new security mitigations might be changing over time, so do not get used to them being fixed in stone just yet.
-----------------
I'm announcing the release of the 4.14.321 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 11 Documentation/admin-guide/hw-vuln/gather_data_sampling.rst | 109 ++++++ Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/kernel-parameters.txt | 39 +- Makefile | 2 arch/Kconfig | 3 arch/alpha/include/asm/bugs.h | 20 - arch/arm/Kconfig | 1 arch/arm/include/asm/bugs.h | 4 arch/arm/kernel/bugs.c | 3 arch/ia64/Kconfig | 1 arch/ia64/include/asm/bugs.h | 20 - arch/ia64/kernel/setup.c | 3 arch/m68k/Kconfig | 1 arch/m68k/include/asm/bugs.h | 21 - arch/m68k/kernel/setup_mm.c | 3 arch/mips/Kconfig | 1 arch/mips/include/asm/bugs.h | 17 - arch/mips/kernel/setup.c | 13 arch/parisc/include/asm/bugs.h | 20 - arch/powerpc/include/asm/bugs.h | 18 - arch/sh/Kconfig | 1 arch/sh/include/asm/bugs.h | 78 ---- arch/sh/include/asm/processor.h | 2 arch/sh/kernel/idle.c | 1 arch/sh/kernel/setup.c | 55 +++ arch/sparc/Kconfig | 1 arch/sparc/include/asm/bugs.h | 18 - arch/sparc/kernel/setup_32.c | 7 arch/um/Kconfig.common | 1 arch/um/include/asm/bugs.h | 7 arch/um/kernel/um_arch.c | 3 arch/x86/Kconfig | 20 + arch/x86/include/asm/bugs.h | 2 arch/x86/include/asm/cpufeatures.h | 1 arch/x86/include/asm/fpu/internal.h | 2 arch/x86/include/asm/mem_encrypt.h | 2 arch/x86/include/asm/msr-index.h | 11 arch/x86/kernel/cpu/bugs.c | 209 +++++++++---- arch/x86/kernel/cpu/common.c | 117 ++++++- arch/x86/kernel/cpu/cpu.h | 2 arch/x86/kernel/fpu/init.c | 8 arch/x86/kernel/smpboot.c | 1 arch/x86/kvm/x86.c | 5 arch/x86/xen/smp_pv.c | 2 arch/xtensa/include/asm/bugs.h | 18 - drivers/base/cpu.c | 8 drivers/net/xen-netback/netback.c | 15 include/asm-generic/bugs.h | 11 include/linux/cpu.h | 6 init/main.c | 15 51 files changed, 579 insertions(+), 361 deletions(-)
Daniel Sneddon (4):
x86/speculation: Add Gather Data Sampling mitigation x86/speculation: Add force option to GDS mitigation x86/speculation: Add Kconfig option for GDS
KVM: Add GDS_NO support to KVM
Dave Hansen (1):
Documentation/x86: Fix backwards on/off logic about YMM support
Greg Kroah-Hartman (2):
x86: fix backwards merge of GDS/SRSO bit
Linux 4.14.321
Juergen Gross (1):
x86/xen: Fix secondary processors' FPU initialization
Ross Lagerwall (1):
xen/netback: Fix buffer overrun triggered by unusual packet
Thomas Gleixner (15):
init: Provide arch_cpu_finalize_init()
x86/cpu: Switch to arch_cpu_finalize_init()
ARM: cpu: Switch to arch_cpu_finalize_init() ia64/cpu: Switch to arch_cpu_finalize_init() m68k/cpu: Switch to arch_cpu_finalize_init() mips/cpu: Switch to arch_cpu_finalize_init()
sh/cpu: Switch to arch_cpu_finalize_init()
sparc/cpu: Switch to arch_cpu_finalize_init()
um/cpu: Switch to arch_cpu_finalize_init()
init: Remove check_bugs() leftovers
init: Invoke arch_cpu_finalize_init() earlier
init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() x86/fpu: Remove cpuinfo argument from init functions x86/fpu: Mark init functions __init
x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +6 -5
@@ -375,16 +375,17 @@ Description: information about CPUs heterogeneity. cpu_capacity: capacity of cpu#. What: /sys/devices/system/cpu/vulnerabilities + /sys/devices/system/cpu/vulnerabilities/gather_data_sampling + /sys/devices/system/cpu/vulnerabilities/itlb_multihit + /sys/devices/system/cpu/vulnerabilities/l1tf + /sys/devices/system/cpu/vulnerabilities/mds /sys/devices/system/cpu/vulnerabilities/meltdown + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + /sys/devices/system/cpu/vulnerabilities/spec_store_bypass /sys/devices/system/cpu/vulnerabilities/spectre_v1 /sys/devices/system/cpu/vulnerabilities/spectre_v2 - /sys/devices/system/cpu/vulnerabilities/spec_store_bypass - /sys/devices/system/cpu/vulnerabilities/l1tf - /sys/devices/system/cpu/vulnerabilities/mds /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsx_async_abort - /sys/devices/system/cpu/vulnerabilities/itlb_multihit - /sys/devices/system/cpu/vulnerabilities/mmio_stale_data Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/gather_data_sampling.rst new file +109 -0
109 lines not on this page · raw message
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -16,3 +16,4 @@ are configurable at compile, boot or run time. multihit.rst special-register-buffer-data-sampling.rst processor_mmio_stale_data.rst + gather_data_sampling.rst
Documentation/admin-guide/kernel-parameters.txt +30 -9
@@ -1232,6 +1232,26 @@ Format: off | on default: on + gather_data_sampling= + [X86,INTEL] Control the Gather Data Sampling (GDS) + mitigation. + + Gather Data Sampling is a hardware vulnerability which + allows unprivileged speculative access to data which was + previously stored in vector registers. + + This issue is mitigated by default in updated microcode. + The mitigation may have a performance impact but can be + disabled. On systems without the microcode mitigation + disabling AVX serves as a mitigation. + + force: Disable AVX to mitigate systems without + microcode mitigation. No effect if the microcode + mitigation is present. Known to cause crashes in + userspace with buggy AVX enumeration. + + off: Disable GDS mitigation. + gcov_persist= [GCOV] When non-zero (default), profiling data for kernel modules is saved and remains accessible via debugfs, even when the module is unloaded/reloaded.
@@ -2433,22 +2453,23 @@ Disable all optional CPU mitigations. This improves system performance, but it may also expose users to several CPU vulnerabilities. - Equivalent to: nopti [X86,PPC] + Equivalent to: gather_data_sampling=off [X86] kpti=0 [ARM64] - nospectre_v1 [PPC] + kvm.nx_huge_pages=off [X86] + l1tf=off [X86] + mds=off [X86] + mmio_stale_data=off [X86] + no_entry_flush [PPC] + no_uaccess_flush [PPC] nobp=0 [S390] + nopti [X86,PPC] + nospectre_v1 [PPC] nospectre_v1 [X86] nospectre_v2 [X86,PPC,S390,ARM64] - spectre_v2_user=off [X86] spec_store_bypass_disable=off [X86,PPC] + spectre_v2_user=off [X86] ssbd=force-off [ARM64] - l1tf=off [X86] - mds=off [X86] tsx_async_abort=off [X86] - kvm.nx_huge_pages=off [X86] - no_entry_flush [PPC] - no_uaccess_flush [PPC] - mmio_stale_data=off [X86] Exceptions: This does not have any effect on
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 14 -SUBLEVEL = 320 +SUBLEVEL = 321 EXTRAVERSION = NAME = Petit Gorille
arch/Kconfig +3 -0
@@ -237,6 +237,9 @@ config ARCH_HAS_FORTIFY_SOURCE config ARCH_HAS_SET_MEMORY bool +config ARCH_HAS_CPU_FINALIZE_INIT + bool + # Select if arch init_task initializer is different to init/init_task.c config ARCH_INIT_TASK bool
arch/alpha/include/asm/bugs.h deleted +0 -20
@@ -1,20 +0,0 @@ -/* -* include/asm-alpha/bugs.h -* -* Copyright (C) 1994 Linus Torvalds -*/ - -/* -* This is included by init/main.c to check for architecture-dependent bugs. -* -* Needs: -* void check_bugs(void); -*/ - -/* -* I don't know of any alpha bugs yet.. Nice chip -*/ - -static void check_bugs (void ) -{ -}
arch/arm/Kconfig +1 -0
@@ -3,6 +3,7 @@ config ARM bool default y select ARCH_CLOCKSOURCE_DATA + select ARCH_HAS_CPU_FINALIZE_INIT if MMU select ARCH_HAS_DEBUG_VIRTUAL select ARCH_HAS_DEVMEM_IS_ALLOWED select ARCH_HAS_ELF_RANDOMIZE
arch/arm/include/asm/bugs.h +0 -4
@@ -1,6 +1,4 @@/* -* arch/arm/include/asm/bugs.h -* * Copyright (C) 1995-2003 Russell King * * This program is free software; you can redistribute it and/or modify
@@ -13,10 +11,8 @@extern void check_writebuffer_bugs (void );#ifdef CONFIG_MMU -extern void check_bugs (void );extern void check_other_bugs (void );#else -#define check_bugs () do { } while (0)#define check_other_bugs () do { } while (0)#endif
arch/arm/kernel/bugs.c +2 -1
@@ -1,5 +1,6 @@// SPDX-Identifier: GPL-2.0 #include <linux/init.h> +#include <linux/cpu.h> #include <asm/bugs.h> #include <asm/proc-fns.h>
@@ -11,7 +12,7 @@ void check_other_bugs(void)#endif } -void __init check_bugs (void ) +void __init arch_cpu_finalize_init (void ) {check_writebuffer_bugs ();check_other_bugs ();
arch/ia64/Kconfig +1 -0
@@ -12,6 +12,7 @@ menu "Processor type and features" config IA64 bool + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_MIGHT_HAVE_PC_PARPORT select ARCH_MIGHT_HAVE_PC_SERIO select PCI if (!IA64_HP_SIM)
arch/ia64/include/asm/bugs.h deleted +0 -20
@@ -1,20 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* -* This is included by init/main.c to check for architecture-dependent bugs. -* -* Needs: -* void check_bugs(void); -* -* Based on <asm-alpha/bugs.h>. -* -* Modified 1998, 1999, 2003 -* David Mosberger-Tang <[email protected]>, Hewlett-Packard Co. -*/ -#ifndef _ASM_IA64_BUGS_H -#define _ASM_IA64_BUGS_H - -#include <asm/processor.h> - -extern void check_bugs (void ); - -#endif /* _ASM_IA64_BUGS_H */
arch/ia64/kernel/setup.c +1 -2
@@ -1053,8 +1053,7 @@ cpu_init (void)platform_cpu_init (); } -void __init -check_bugs (void ) +void __init arch_cpu_finalize_init (void ) {ia64_patch_mckinley_e9 ((unsigned long ) __start___mckinley_e9_bundles, (unsigned long ) __end___mckinley_e9_bundles);
arch/m68k/Kconfig +1 -0
@@ -2,6 +2,7 @@ config M68K bool default y + select ARCH_HAS_CPU_FINALIZE_INIT if MMU select ARCH_MIGHT_HAVE_PC_PARPORT if ISA select ARCH_NO_COHERENT_DMA_MMAP if !MMU select HAVE_IDE
arch/m68k/include/asm/bugs.h deleted +0 -21
@@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* -* include/asm-m68k/bugs.h -* -* Copyright (C) 1994 Linus Torvalds -*/ - -/* -* This is included by init/main.c to check for architecture-dependent bugs. -* -* Needs: -* void check_bugs(void); -*/ - -#ifdef CONFIG_MMU -extern void check_bugs (void );/* in arch/m68k/kernel/setup.c */ -#else -static void check_bugs (void ) -{ -} -#endif
arch/m68k/kernel/setup_mm.c +2 -1
@@ -10,6 +10,7 @@*/ #include <linux/kernel.h> +#include <linux/cpu.h> #include <linux/mm.h> #include <linux/sched.h> #include <linux/delay.h>
@@ -549,7 +550,7 @@ static int __init proc_hardware_init(void)module_init (proc_hardware_init);#endif -void check_bugs (void ) +void __init arch_cpu_finalize_init (void ) {#if defined(CONFIG_FPU ) && !defined(CONFIG_M68KFPU_EMU )if (m68k_fputype ==0 ) {
arch/mips/Kconfig +1 -0
@@ -4,6 +4,7 @@ config MIPS default y select ARCH_BINFMT_ELF_STATE select ARCH_CLOCKSOURCE_DATA + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_DISCARD_MEMBLOCK select ARCH_HAS_ELF_RANDOMIZE select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
arch/mips/include/asm/bugs.h +0 -17
@@ -1,17 +1,11 @@/* SPDX-License-Identifier: GPL-2.0 */ /* -* This is included by init/main.c to check for architecture-dependent bugs. -* * Copyright (C) 2007 Maciej W. Rozycki -* -* Needs: -* void check_bugs(void); */ #ifndef _ASM_BUGS_H#define _ASM_BUGS_H#include <linux/bug.h> -#include <linux/delay.h> #include <linux/smp.h> #include <asm/cpu.h>
@@ -31,17 +25,6 @@ static inline void check_bugs_early(void)#endif } -static inline void check_bugs (void ) -{ -unsigned int cpu =smp_processor_id (); - - cpu_data[cpu].udelay_val = loops_per_jiffy; -check_bugs32 (); -#ifdef CONFIG_64BIT -check_bugs64 (); -#endif -} -static inline int r4k_daddiu_bug (void ) {#ifdef CONFIG_64BIT
arch/mips/kernel/setup.c +13 -0
@@ -11,6 +11,8 @@* Copyright (C) 2000, 2001, 2002, 2007 Maciej W. Rozycki */ #include <linux/init.h> +#include <linux/cpu.h> +#include <linux/delay.h> #include <linux/ioport.h> #include <linux/export.h> #include <linux/screen_info.h>
@@ -1060,3 +1062,14 @@ static int __init debugfs_mips(void) }arch_initcall (debugfs_mips);#endif + +void __init arch_cpu_finalize_init (void ) +{ +unsigned int cpu =smp_processor_id (); + + cpu_data[cpu].udelay_val = loops_per_jiffy; +check_bugs32 (); + +if (IS_ENABLED (CONFIG_CPU_R4X00_BUGS64 )) +check_bugs64 (); +}
arch/parisc/include/asm/bugs.h deleted +0 -20
@@ -1,20 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* -* include/asm-parisc/bugs.h -* -* Copyright (C) 1999 Mike Shaver -*/ - -/* -* This is included by init/main.c to check for architecture-dependent bugs. -* -* Needs: -* void check_bugs(void); -*/ - -#include <asm/processor.h> - -static inline void check_bugs (void ) -{ -// identify_cpu(&boot_cpu_data); -}
arch/powerpc/include/asm/bugs.h deleted +0 -18
@@ -1,18 +0,0 @@ -#ifndef _ASM_POWERPC_BUGS_H -#define _ASM_POWERPC_BUGS_H - -/* -* This program is free software; you can redistribute it and/or -* modify it under the terms of the GNU General Public License -* as published by the Free Software Foundation; either version -* 2 of the License, or (at your option) any later version. -*/ - -/* -* This file is included by 'init/main.c' to check for -* architecture-dependent bugs. -*/ - -static inline void check_bugs (void ) { } - -#endif /* _ASM_POWERPC_BUGS_H */
arch/sh/Kconfig +1 -0
@@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 config SUPERH def_bool y + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST select ARCH_MIGHT_HAVE_PC_PARPORT select ARCH_NO_COHERENT_DMA_MMAP if !MMU
arch/sh/include/asm/bugs.h deleted +0 -78
78 lines not on this page · raw message
arch/sh/include/asm/processor.h +2 -0
@@ -173,6 +173,8 @@ extern unsigned int instruction_size(unsigned int insn);#define instruction_size (insn) (4)#endif +void select_idle_routine (void ); +#endif /* __ASSEMBLY__ */ #ifdef CONFIG_SUPERH32
arch/sh/kernel/idle.c +1 -0
@@ -18,6 +18,7 @@#include <linux/smp.h> #include <linux/atomic.h> #include <asm/pgalloc.h> +#include <asm/processor.h> #include <asm/smp.h> #include <asm/bl_bit.h>
arch/sh/kernel/setup.c +55 -0
64 lines not on this page · raw message
arch/sparc/Kconfig +1 -0
@@ -12,6 +12,7 @@ config 64BIT config SPARC bool default y + select ARCH_HAS_CPU_FINALIZE_INIT if !SMP select ARCH_MIGHT_HAVE_PC_PARPORT if SPARC64 && PCI select ARCH_MIGHT_HAVE_PC_SERIO select OF
arch/sparc/include/asm/bugs.h deleted +0 -18
@@ -1,18 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* include/asm/bugs.h: Sparc probes for various bugs. -* -* Copyright (C) 1996, 2007 David S. Miller ([email protected]) -*/ - -#ifdef CONFIG_SPARC32 -#include <asm/cpudata.h> -#endif - -extern unsigned long loops_per_jiffy; - -static void __init check_bugs (void ) -{ -#if defined(CONFIG_SPARC32 ) && !defined(CONFIG_SMP ) -cpu_data (0 ).udelay_val = loops_per_jiffy; -#endif -}
arch/sparc/kernel/setup_32.c +7 -0
@@ -422,3 +422,10 @@ static int __init topology_init(void) }subsys_initcall (topology_init); + +#if defined(CONFIG_SPARC32 ) && !defined(CONFIG_SMP ) +void __init arch_cpu_finalize_init (void ) +{ +cpu_data (0 ).udelay_val = loops_per_jiffy; +} +#endif
arch/um/Kconfig.common +1 -0
@@ -2,6 +2,7 @@ config UML bool default y + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_KCOV select HAVE_ARCH_AUDITSYSCALL select HAVE_ARCH_SECCOMP_FILTER
arch/um/include/asm/bugs.h deleted +0 -7
@@ -1,7 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef __UM_BUGS_H -#define __UM_BUGS_H - -void check_bugs (void ); - -#endif
arch/um/kernel/um_arch.c +2 -1
@@ -3,6 +3,7 @@* Licensed under the GPL */ +#include <linux/cpu.h> #include <linux/delay.h> #include <linux/init.h> #include <linux/mm.h>
@@ -352,7 +353,7 @@ void __init setup_arch(char **cmdline_p)setup_hostinfo (host_info,sizeof host_info); } -void __init check_bugs (void ) +void __init arch_cpu_finalize_init (void ) {arch_check_bugs ();os_check_bugs ();
arch/x86/Kconfig +20 -0
@@ -47,6 +47,7 @@ config X86 select ARCH_CLOCKSOURCE_DATA select ARCH_DISCARD_MEMBLOCK select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_DEBUG_VIRTUAL select ARCH_HAS_DEVMEM_IS_ALLOWED select ARCH_HAS_ELF_RANDOMIZE
@@ -2386,6 +2387,25 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK def_bool y depends on X86_64 || X86_PAE +config GDS_FORCE_MITIGATION + bool "Force GDS Mitigation" + depends on CPU_SUP_INTEL + default n + help + Gather Data Sampling (GDS) is a hardware vulnerability which allows + unprivileged speculative access to data which was previously stored in + vector registers. + + This option is equivalent to setting gather_data_sampling=force on the + command line. The microcode mitigation is used if present, otherwise + AVX is disabled as a mitigation. On affected systems that are missing + the microcode any userspace code that unconditionally uses AVX will + break with this option set. + + Setting this option on systems not vulnerable to GDS has no effect. + + If in doubt, say N. + config ARCH_ENABLE_HUGEPAGE_MIGRATION def_bool y depends on X86_64 && HUGETLB_PAGE && MIGRATION
arch/x86/include/asm/bugs.h +0 -2
@@ -4,8 +4,6 @@#include <asm/processor.h> -extern void check_bugs (void ); -#if defined(CONFIG_CPU_SUP_INTEL )void check_mpx_erratum (struct cpuinfo_x86 *c);#else
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -408,5 +408,6 @@#define X86_BUG_MMIO_UNKNOWN X86_BUG(26)/* CPU is too old and its MMIO Stale Data status is unknown */ #define X86_BUG_RETBLEED X86_BUG(27)/* CPU is affected by RETBleed */ #define X86_BUG_EIBRS_PBRSB X86_BUG(28)/* EIBRS is vulnerable to Post Barrier RSB Predictions */ +#define X86_BUG_GDS X86_BUG(29)/* CPU is affected by Gather Data Sampling */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/fpu/internal.h +1 -1
@@ -42,7 +42,7 @@ extern int dump_fpu(struct pt_regs *ptregs, struct user_i387_struct *fpstate);extern void fpu__init_cpu (void );extern void fpu__init_system_xstate (void );extern void fpu__init_cpu_xstate (void ); -extern void fpu__init_system (struct cpuinfo_x86 *c); +extern void fpu__init_system (void );extern void fpu__init_check_bugs (void );extern void fpu__resume_cpu (void );extern u64 fpu__get_supported_xfeatures_mask (void );
arch/x86/include/asm/mem_encrypt.h +2 -0
@@ -64,6 +64,8 @@ static inline void __init sme_early_init(void) { }static inline void __init sme_encrypt_kernel (struct boot_params *bp) { }static inline void __init sme_enable (struct boot_params *bp) { } +static inline void mem_encrypt_init (void ) { } +#endif /* CONFIG_AMD_MEM_ENCRYPT */ /*
arch/x86/include/asm/msr-index.h +11 -0
@@ -138,6 +138,15 @@* Not susceptible to Post-Barrier * Return Stack Buffer Predictions. */ +#define ARCH_CAP_GDS_CTRL BIT(25)/* +* CPU is vulnerable to Gather +* Data Sampling (GDS) and +* has controls for mitigation. +*/ +#define ARCH_CAP_GDS_NO BIT(26)/* +* CPU is not vulnerable to Gather +* Data Sampling (GDS). +*/ #define MSR_IA32_FLUSH_CMD 0x0000010b#define L1D_FLUSH BIT(0)/*
@@ -156,6 +165,8 @@#define MSR_IA32_MCU_OPT_CTRL 0x00000123#define RNGDS_MITG_DIS BIT(0)#define FB_CLEAR_DIS BIT(3)/* CPU Fill buffer clear disable */ +#define GDS_MITG_DIS BIT(4)/* Disable GDS mitigation */ +#define GDS_MITG_LOCKED BIT(5)/* GDS mitigation locked */ #define MSR_IA32_SYSENTER_CS 0x00000174#define MSR_IA32_SYSENTER_ESP 0x00000175
arch/x86/kernel/cpu/bugs.c +159 -50
264 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +102 -15
185 lines not on this page · raw message
arch/x86/kernel/cpu/cpu.h +2 -0
@@ -67,9 +67,11 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);extern int detect_ht_early (struct cpuinfo_x86 *c);unsigned int aperfmperf_get_khz (int cpu); +void cpu_select_mitigations (void );extern void x86_spec_ctrl_setup_ap (void );extern void update_srbds_msr (void ); +extern void update_gds_msr (void );extern u64 x86_read_arch_cap_msr (void );
arch/x86/kernel/fpu/init.c +4 -4
@@ -49,7 +49,7 @@ void fpu__init_cpu(void)fpu__init_cpu_xstate (); } -static bool fpu__probe_without_cpuid (void ) +static bool __init fpu__probe_without_cpuid (void ) {unsigned long cr0;u16 fsw, fcw;
@@ -67,7 +67,7 @@ static bool fpu__probe_without_cpuid(void)return fsw ==0 && (fcw &0x103f ) ==0x003f ; } -static void fpu__init_system_early_generic (struct cpuinfo_x86 *c) +static void __init fpu__init_system_early_generic (void ) {if (!boot_cpu_has (X86_FEATURE_CPUID ) && !test_bit (X86_FEATURE_FPU , (unsigned long *)cpu_caps_cleared)) {
@@ -297,10 +297,10 @@ static void __init fpu__init_parse_early_param(void)* Called on the boot CPU once per system bootup, to set up the initial * FPU state that is later cloned into all processes: */ -void __init fpu__init_system (struct cpuinfo_x86 *c) +void __init fpu__init_system (void ) {fpu__init_parse_early_param (); -fpu__init_system_early_generic (c); +fpu__init_system_early_generic ();/* * The FPU has to be operational for some of the
arch/x86/kernel/smpboot.c +1 -0
@@ -232,6 +232,7 @@ static void notrace start_secondary(void *unused)#endif load_current_idt ();cpu_init (); +fpu__init_cpu (); x86_cpuinit.early_percpu_clock_init ();preempt_disable ();smp_callin ();
arch/x86/kvm/x86.c +5 -0
@@ -201,6 +201,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {u64 __read_mostly host_xcr0; +extern bool gds_ucode_mitigated (void ); +static int emulator_fix_hypercall (struct x86_emulate_ctxt *ctxt);static inline void kvm_async_pf_hash_reset (struct kvm_vcpu *vcpu)
@@ -1131,6 +1133,9 @@ u64 kvm_get_arch_capabilities(void)/* Guests don't need to know "Fill buffer clear control" exists */ data &= ~ARCH_CAP_FB_CLEAR_CTRL ; +if (!boot_cpu_has_bug (X86_BUG_GDS ) ||gds_ucode_mitigated ()) + data |=ARCH_CAP_GDS_NO ; +return data; }
arch/x86/xen/smp_pv.c +2 -0
@@ -27,6 +27,7 @@#include <asm/desc.h> #include <asm/pgtable.h> #include <asm/cpu.h> +#include <asm/fpu/internal.h> #include <xen/interface/xen.h> #include <xen/interface/vcpu.h>
@@ -58,6 +59,7 @@ static void cpu_bringup(void)int cpu;cpu_init (); +fpu__init_cpu ();touch_softlockup_watchdog ();preempt_disable ();
arch/xtensa/include/asm/bugs.h deleted +0 -18
@@ -1,18 +0,0 @@ -/* -* include/asm-xtensa/bugs.h -* -* This is included by init/main.c to check for architecture-dependent bugs. -* -* Xtensa processors don't have any bugs. :) -* -* This file is subject to the terms and conditions of the GNU General -* Public License. See the file "COPYING" in the main directory of -* this archive for more details. -*/ - -#ifndef _XTENSA_BUGS_H -#define _XTENSA_BUGS_H - -static void check_bugs (void ) { } - -#endif /* _XTENSA_BUGS_H */
drivers/base/cpu.c +8 -0
@@ -570,6 +570,12 @@ ssize_t __weak cpu_show_retbleed(struct device *dev,return sysfs_emit (buf,"Not affected\n" ); } +ssize_t __weak cpu_show_gds (struct device *dev, +struct device_attribute *attr,char *buf) +{ +return sysfs_emit (buf,"Not affected\n" ); +} + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
@@ -581,6 +587,7 @@ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL); static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL); +static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -594,6 +601,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_srbds.attr, &dev_attr_mmio_stale_data.attr, &dev_attr_retbleed.attr, + &dev_attr_gather_data_sampling.attr, NULL };
drivers/net/xen-netback/netback.c +10 -5
@@ -389,7 +389,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue,struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops;struct xen_netif_tx_request *txp = first; - nr_slots = shinfo->nr_frags +1 ; + nr_slots = shinfo->nr_frags + frag_overflow +1 ;copy_count (skb) =0 ;XENVIF_TX_CB (skb)->split_mask =0 ;
@@ -455,8 +455,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, } } -for (shinfo->nr_frags =0 ; shinfo->nr_frags < nr_slots; - shinfo->nr_frags++, gop++) { +for (shinfo->nr_frags =0 ; nr_slots >0 && shinfo->nr_frags <MAX_SKB_FRAGS ; + shinfo->nr_frags++, gop++, nr_slots--) { index =pending_index (queue->pending_cons++); pending_idx = queue->pending_ring[index]; xenvif_tx_create_map_op(queue, pending_idx, txp,
@@ -469,12 +469,12 @@ static void xenvif_get_requests(struct xenvif_queue *queue, txp++; } -if (frag_overflow) { +if (nr_slots >0 ) { shinfo =skb_shinfo (nskb); frags = shinfo->frags; -for (shinfo->nr_frags =0 ; shinfo->nr_frags < frag_overflow; +for (shinfo->nr_frags =0 ; shinfo->nr_frags < nr_slots; shinfo->nr_frags++, txp++, gop++) { index =pending_index (queue->pending_cons++); pending_idx = queue->pending_ring[index];
@@ -485,6 +485,11 @@ static void xenvif_get_requests(struct xenvif_queue *queue, }skb_shinfo (skb)->frag_list = nskb; + }else if (nskb) { +/* A frag_list skb was allocated but it is no longer needed +* because enough slots were converted to copy ops above. +*/ +kfree_skb (nskb); } (*copy_ops) = cop - queue->tx_copy_ops;
include/asm-generic/bugs.h deleted +0 -11
@@ -1,11 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef __ASM_GENERIC_BUGS_H -#define __ASM_GENERIC_BUGS_H -/* -* This file is included by 'init/main.c' to check for -* architecture-dependent bugs. -*/ - -static inline void check_bugs (void ) { } - -#endif /* __ASM_GENERIC_BUGS_H */
include/linux/cpu.h +6 -0
@@ -178,6 +178,12 @@ void arch_cpu_idle_enter(void);void arch_cpu_idle_exit (void );void arch_cpu_idle_dead (void ); +#ifdef CONFIG_ARCH_HAS_CPU_FINALIZE_INIT +void arch_cpu_finalize_init (void ); +#else +static inline void arch_cpu_finalize_init (void ) { } +#endif +int cpu_report_state (int cpu);int cpu_check_up_prepare (int cpu);void cpu_set_state_online (int cpu);
init/main.c +3 -12
@@ -90,7 +90,6 @@#include <linux/rodata_test.h> #include <asm/io.h> -#include <asm/bugs.h> #include <asm/setup.h> #include <asm/sections.h> #include <asm/cacheflush.h>
@@ -486,8 +485,6 @@ void __init __weak thread_stack_cache_init(void) }#endif -void __init __weak mem_encrypt_init (void ) { } -/* * Set up kernel memory allocators */
@@ -649,14 +646,6 @@ asmlinkage __visible void __init start_kernel(void)*/ locking_selftest (); -/* -* This needs to be called before any devices perform DMA -* operations that might use the SWIOTLB bounce buffers. It will -* mark the bounce buffers as decrypted so that their usage will -* not cause "plain-text" data to be decrypted when accessed. -*/ -mem_encrypt_init (); -#ifdef CONFIG_BLK_DEV_INITRD if (initrd_start && !initrd_below_start_ok &&page_to_pfn (virt_to_page ((void *)initrd_start)) < min_low_pfn) {
@@ -673,6 +662,9 @@ asmlinkage __visible void __init start_kernel(void)if (late_time_init)late_time_init ();calibrate_delay (); + +arch_cpu_finalize_init (); +pidmap_init ();anon_vma_init ();acpi_early_init ();
@@ -698,7 +690,6 @@ asmlinkage __visible void __init start_kernel(void)taskstats_init_early ();delayacct_init (); -check_bugs ();acpi_subsystem_init ();arch_post_acpi_subsys_init ();