Linux 5.15.193
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.15.193 kernel.
All users of the 5.15 kernel series must upgrade.
The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/vmscape.rst | 110 ++++++++ Documentation/admin-guide/kernel-parameters.txt | 11 Makefile | 2 arch/x86/Kconfig | 9 arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/entry-common.h | 7 arch/x86/include/asm/nospec-branch.h | 2 arch/x86/kernel/cpu/bugs.c | 264 ++++++++++++++------- arch/x86/kernel/cpu/common.c | 77 +++--- arch/x86/kvm/x86.c | 9 drivers/base/cpu.c | 6 include/linux/cpu.h | 1 14 files changed, 393 insertions(+), 109 deletions(-)
Greg Kroah-Hartman (1):
Linux 5.15.193
Pawan Gupta (7):
Documentation/hw-vuln: Add VMSCAPE documentation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enable the mitigation x86/bugs: Move cpu_bugs_smt_update() down x86/vmscape: Warn when STIBP is disabled with SMT x86/vmscape: Add old Intel CPUs to affected list
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -526,6 +526,7 @@ What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsa /sys/devices/system/cpu/vulnerabilities/tsx_async_abort + /sys/devices/system/cpu/vulnerabilities/vmscape Date: January 2018 Contact: Linux kernel mailing list <[email protected]> Description: Information about CPU vulnerabilities
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -23,3 +23,4 @@ are configurable at compile, boot or run time. srso reg-file-data-sampling indirect-target-selection + vmscape
Documentation/admin-guide/hw-vuln/vmscape.rst new file +110 -0
110 lines not on this page · raw message
Documentation/admin-guide/kernel-parameters.txt +11 -0
@@ -3107,6 +3107,7 @@ ssbd=force-off [ARM64] nospectre_bhb [ARM64] tsx_async_abort=off [X86] + vmscape=off [X86] Exceptions: This does not have any effect on
@@ -6399,6 +6400,16 @@ vmpoff= [KNL,S390] Perform z/VM CP command after power off. Format: <command> + vmscape= [X86] Controls mitigation for VMscape attacks. + VMscape attacks can leak information from a userspace + hypervisor to a guest via speculative side-channels. + + off - disable the mitigation + ibpb - use Indirect Branch Prediction Barrier + (IBPB) mitigation (default) + force - force vulnerability detection even on + unaffected processors + vsyscall= [X86-64] Controls the behavior of vsyscalls (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 15 -SUBLEVEL = 192 +SUBLEVEL = 193 EXTRAVERSION = NAME = Trick or Treat
arch/x86/Kconfig +9 -0
@@ -2537,6 +2537,15 @@ config MITIGATION_TSA security vulnerability on AMD CPUs which can lead to forwarding of invalid info to subsequent instructions and thus can affect their timing and thereby cause a leakage. + +config MITIGATION_VMSCAPE + bool "Mitigate VMSCAPE" + depends on KVM + default y + help + Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security + vulnerability on Intel and AMD CPUs that may allow a guest to do + Spectre v2 style attacks on userspace hypervisor. endif config ARCH_HAS_ADD_PAGES
arch/x86/include/asm/cpufeatures.h +2 -0
@@ -439,6 +439,7 @@#define X86_FEATURE_TSA_SQ_NO (21*32+11)/* "" AMD CPU not vulnerable to TSA-SQ */ #define X86_FEATURE_TSA_L1_NO (21*32+12)/* "" AMD CPU not vulnerable to TSA-L1 */ #define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13)/* "" Clear CPU buffers using VERW before VMRUN */ +#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14)/* Use IBPB on exit-to-userspace, see VMSCAPE bug */ /* * BUG word(s)
@@ -492,4 +493,5 @@#define X86_BUG_ITS X86_BUG(1*32 + 5)/* CPU is affected by Indirect Target Selection */ #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6)/* CPU is affected by ITS, VMX is not affected */ #define X86_BUG_TSA X86_BUG(1*32+ 9)/* "tsa" CPU is affected by Transient Scheduler Attacks */ +#define X86_BUG_VMSCAPE X86_BUG(1*32+10)/* "vmscape" CPU is affected by VMSCAPE attacks from guests */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/entry-common.h +7 -0
@@ -86,6 +86,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,* 6 (ia32) bits. */ choose_random_kstack_offset (rdtsc () &0xFF ); + +/* Avoid unnecessary reads of 'x86_ibpb_exit_to_user' */ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER ) && +this_cpu_read (x86_ibpb_exit_to_user)) { +indirect_branch_prediction_barrier (); +this_cpu_write (x86_ibpb_exit_to_user, false); + } }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
arch/x86/include/asm/nospec-branch.h +2 -0
@@ -396,6 +396,8 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature)extern u64 x86_pred_cmd; +DECLARE_PER_CPU (bool, x86_ibpb_exit_to_user); +static inline void indirect_branch_prediction_barrier (void ) {alternative_msr_write (MSR_IA32_PRED_CMD , x86_pred_cmd,X86_FEATURE_USE_IBPB );
arch/x86/kernel/cpu/bugs.c +186 -78
319 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +47 -30
104 lines not on this page · raw message
arch/x86/kvm/x86.c +9 -0
@@ -10023,6 +10023,15 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)static_call (kvm_x86_handle_exit_irqoff)(vcpu); +/* +* Mark this CPU as needing a branch predictor flush before running +* userspace. Must be done before enabling preemption to ensure it gets +* set for the CPU that actually ran the guest, and not the CPU that it +* may migrate to. +*/ +if (cpu_feature_enabled (X86_FEATURE_IBPB_EXIT_TO_USER )) +this_cpu_write (x86_ibpb_exit_to_user, true); +/* * Consume any pending interrupts, including the possible source of * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
drivers/base/cpu.c +6 -0
@@ -605,6 +605,10 @@ ssize_t __weak cpu_show_tsa(struct device *dev, struct device_attribute *attr, c {return sysfs_emit (buf,"Not affected\n" ); } +ssize_t __weak cpu_show_vmscape (struct device *dev,struct device_attribute *attr,char *buf) +{ +return sysfs_emit (buf,"Not affected\n" ); +} static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
@@ -622,6 +626,7 @@ static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NU static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); +static DEVICE_ATTR(vmscape, 0444, cpu_show_vmscape, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -640,6 +645,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_reg_file_data_sampling.attr, &dev_attr_indirect_target_selection.attr, &dev_attr_tsa.attr, + &dev_attr_vmscape.attr, NULL };
include/linux/cpu.h +1 -0
@@ -79,6 +79,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,extern ssize_t cpu_show_indirect_target_selection (struct device *dev,struct device_attribute *attr,char *buf);extern ssize_t cpu_show_tsa (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_vmscape (struct device *dev,struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,