Skip to content

Commit ac7c015

Browse files
popcornmixpopcornmix
committed
Merge remote-tracking branch 'stable/linux-6.1.y' into rpi-6.1.y
2 parents 9d516c9 + 0a4a785 commit ac7c015

File tree

72 files changed

+1152
-412
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+1152
-412
lines changed

‎Documentation/ABI/testing/sysfs-devices-system-cpu

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -513,17 +513,18 @@ Description: information about CPUs heterogeneity.
513513
cpu_capacity: capacity of cpuX.
514514

515515
What: /sys/devices/system/cpu/vulnerabilities
516+
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
517+
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
518+
/sys/devices/system/cpu/vulnerabilities/l1tf
519+
/sys/devices/system/cpu/vulnerabilities/mds
516520
/sys/devices/system/cpu/vulnerabilities/meltdown
521+
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
522+
/sys/devices/system/cpu/vulnerabilities/retbleed
523+
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
517524
/sys/devices/system/cpu/vulnerabilities/spectre_v1
518525
/sys/devices/system/cpu/vulnerabilities/spectre_v2
519-
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
520-
/sys/devices/system/cpu/vulnerabilities/l1tf
521-
/sys/devices/system/cpu/vulnerabilities/mds
522526
/sys/devices/system/cpu/vulnerabilities/srbds
523527
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
524-
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
525-
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
526-
/sys/devices/system/cpu/vulnerabilities/retbleed
527528
Date: January 2018
528529
Contact: Linux kernel mailing list <[email protected]>
529530
Description: Information about CPU vulnerabilities

‎Documentation/admin-guide/hw-vuln/gather_data_sampling.rst

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
GDS - Gather Data Sampling
4+
==========================
5+
6+
Gather Data Sampling is a hardware vulnerability which allows unprivileged
7+
speculative access to data which was previously stored in vector registers.
8+
9+
Problem
10+
-------
11+
When a gather instruction performs loads from memory, different data elements
12+
are merged into the destination vector register. However, when a gather
13+
instruction that is transiently executed encounters a fault, stale data from
14+
architectural or internal vector registers may get transiently forwarded to the
15+
destination vector register instead. This will allow a malicious attacker to
16+
infer stale data using typical side channel techniques like cache timing
17+
attacks. GDS is a purely sampling-based attack.
18+
19+
The attacker uses gather instructions to infer the stale vector register data.
20+
The victim does not need to do anything special other than use the vector
21+
registers. The victim does not need to use gather instructions to be
22+
vulnerable.
23+
24+
Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks
25+
are possible.
26+
27+
Attack scenarios
28+
----------------
29+
Without mitigation, GDS can infer stale data across virtually all
30+
permission boundaries:
31+
32+
Non-enclaves can infer SGX enclave data
33+
Userspace can infer kernel data
34+
Guests can infer data from hosts
35+
Guest can infer guest from other guests
36+
Users can infer data from other users
37+
38+
Because of this, it is important to ensure that the mitigation stays enabled in
39+
lower-privilege contexts like guests and when running outside SGX enclaves.
40+
41+
The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure
42+
that guests are not allowed to disable the GDS mitigation. If a host erred and
43+
allowed this, a guest could theoretically disable GDS mitigation, mount an
44+
attack, and re-enable it.
45+
46+
Mitigation mechanism
47+
--------------------
48+
This issue is mitigated in microcode. The microcode defines the following new
49+
bits:
50+
51+
================================ === ============================
52+
IA32_ARCH_CAPABILITIES[GDS_CTRL] R/O Enumerates GDS vulnerability
53+
and mitigation support.
54+
IA32_ARCH_CAPABILITIES[GDS_NO] R/O Processor is not vulnerable.
55+
IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation
56+
0 by default.
57+
IA32_MCU_OPT_CTRL[GDS_MITG_LOCK] R/W Locks GDS_MITG_DIS=0. Writes
58+
to GDS_MITG_DIS are ignored
59+
Can't be cleared once set.
60+
================================ === ============================
61+
62+
GDS can also be mitigated on systems that don't have updated microcode by
63+
disabling AVX. This can be done by setting gather_data_sampling="force" or
64+
"clearcpuid=avx" on the kernel command-line.
65+
66+
If used, these options will disable AVX use by turning off XSAVE YMM support.
67+
However, the processor will still enumerate AVX support. Userspace that
68+
does not follow proper AVX enumeration to check both AVX *and* XSAVE YMM
69+
support will break.
70+
71+
Mitigation control on the kernel command line
72+
---------------------------------------------
73+
The mitigation can be disabled by setting "gather_data_sampling=off" or
74+
"mitigations=off" on the kernel command line. Not specifying either will default
75+
to the mitigation being enabled. Specifying "gather_data_sampling=force" will
76+
use the microcode mitigation when available or disable AVX on affected systems
77+
where the microcode hasn't been updated to include the mitigation.
78+
79+
GDS System Information
80+
------------------------
81+
The kernel provides vulnerability status information through sysfs. For
82+
GDS this can be accessed by the following sysfs file:
83+
84+
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
85+
86+
The possible values contained in this file are:
87+
88+
============================== =============================================
89+
Not affected Processor not vulnerable.
90+
Vulnerable Processor vulnerable and mitigation disabled.
91+
Vulnerable: No microcode Processor vulnerable and microcode is missing
92+
mitigation.
93+
Mitigation: AVX disabled,
94+
no microcode Processor is vulnerable and microcode is missing
95+
mitigation. AVX disabled as mitigation.
96+
Mitigation: Microcode Processor is vulnerable and mitigation is in
97+
effect.
98+
Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in
99+
effect and cannot be disabled.
100+
Unknown: Dependent on
101+
hypervisor status Running on a virtual guest processor that is
102+
affected but with no way to know if host
103+
processor is mitigated or vulnerable.
104+
============================== =============================================
105+
106+
GDS Default mitigation
107+
----------------------
108+
The updated microcode will enable the mitigation by default. The kernel's
109+
default action is to leave the mitigation enabled.

‎Documentation/admin-guide/hw-vuln/index.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ are configurable at compile, boot or run time.
1919
l1d_flush.rst
2020
processor_mmio_stale_data.rst
2121
cross-thread-rsb.rst
22+
gather_data_sampling.rst
23+
srso

‎Documentation/admin-guide/hw-vuln/srso.rst

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
Speculative Return Stack Overflow (SRSO)
4+
========================================
5+
6+
This is a mitigation for the speculative return stack overflow (SRSO)
7+
vulnerability found on AMD processors. The mechanism is by now the well
8+
known scenario of poisoning CPU functional units - the Branch Target
9+
Buffer (BTB) and Return Address Predictor (RAP) in this case - and then
10+
tricking the elevated privilege domain (the kernel) into leaking
11+
sensitive data.
12+
13+
AMD CPUs predict RET instructions using a Return Address Predictor (aka
14+
Return Address Stack/Return Stack Buffer). In some cases, a non-architectural
15+
CALL instruction (i.e., an instruction predicted to be a CALL but is
16+
not actually a CALL) can create an entry in the RAP which may be used
17+
to predict the target of a subsequent RET instruction.
18+
19+
The specific circumstances that lead to this varies by microarchitecture
20+
but the concern is that an attacker can mis-train the CPU BTB to predict
21+
non-architectural CALL instructions in kernel space and use this to
22+
control the speculative target of a subsequent kernel RET, potentially
23+
leading to information disclosure via a speculative side-channel.
24+
25+
The issue is tracked under CVE-2023-20569.
26+
27+
Affected processors
28+
-------------------
29+
30+
AMD Zen, generations 1-4. That is, all families 0x17 and 0x19. Older
31+
processors have not been investigated.
32+
33+
System information and options
34+
------------------------------
35+
36+
First of all, it is required that the latest microcode be loaded for
37+
mitigations to be effective.
38+
39+
The sysfs file showing SRSO mitigation status is:
40+
41+
/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
42+
43+
The possible values in this file are:
44+
45+
- 'Not affected' The processor is not vulnerable
46+
47+
- 'Vulnerable: no microcode' The processor is vulnerable, no
48+
microcode extending IBPB functionality
49+
to address the vulnerability has been
50+
applied.
51+
52+
- 'Mitigation: microcode' Extended IBPB functionality microcode
53+
patch has been applied. It does not
54+
address User->Kernel and Guest->Host
55+
transitions protection but it does
56+
address User->User and VM->VM attack
57+
vectors.
58+
59+
(spec_rstack_overflow=microcode)
60+
61+
- 'Mitigation: safe RET' Software-only mitigation. It complements
62+
the extended IBPB microcode patch
63+
functionality by addressing User->Kernel
64+
and Guest->Host transitions protection.
65+
66+
Selected by default or by
67+
spec_rstack_overflow=safe-ret
68+
69+
- 'Mitigation: IBPB' Similar protection as "safe RET" above
70+
but employs an IBPB barrier on privilege
71+
domain crossings (User->Kernel,
72+
Guest->Host).
73+
74+
(spec_rstack_overflow=ibpb)
75+
76+
- 'Mitigation: IBPB on VMEXIT' Mitigation addressing the cloud provider
77+
scenario - the Guest->Host transitions
78+
only.
79+
80+
(spec_rstack_overflow=ibpb-vmexit)
81+
82+
In order to exploit vulnerability, an attacker needs to:
83+
84+
- gain local access on the machine
85+
86+
- break kASLR
87+
88+
- find gadgets in the running kernel in order to use them in the exploit
89+
90+
- potentially create and pin an additional workload on the sibling
91+
thread, depending on the microarchitecture (not necessary on fam 0x19)
92+
93+
- run the exploit
94+
95+
Considering the performance implications of each mitigation type, the
96+
default one is 'Mitigation: safe RET' which should take care of most
97+
attack vectors, including the local User->Kernel one.
98+
99+
As always, the user is advised to keep her/his system up-to-date by
100+
applying software updates regularly.
101+
102+
The default setting will be reevaluated when needed and especially when
103+
new attack vectors appear.
104+
105+
As one can surmise, 'Mitigation: safe RET' does come at the cost of some
106+
performance depending on the workload. If one trusts her/his userspace
107+
and does not want to suffer the performance impact, one can always
108+
disable the mitigation with spec_rstack_overflow=off.
109+
110+
Similarly, 'Mitigation: IBPB' is another full mitigation type employing
111+
an indrect branch prediction barrier after having applied the required
112+
microcode patch for one's system. This mitigation comes also at
113+
a performance cost.
114+
115+
Mitigation: safe RET
116+
--------------------
117+
118+
The mitigation works by ensuring all RET instructions speculate to
119+
a controlled location, similar to how speculation is controlled in the
120+
retpoline sequence. To accomplish this, the __x86_return_thunk forces
121+
the CPU to mispredict every function return using a 'safe return'
122+
sequence.
123+
124+
To ensure the safety of this mitigation, the kernel must ensure that the
125+
safe return sequence is itself free from attacker interference. In Zen3
126+
and Zen4, this is accomplished by creating a BTB alias between the
127+
untraining function srso_untrain_ret_alias() and the safe return
128+
function srso_safe_ret_alias() which results in evicting a potentially
129+
poisoned BTB entry and using that safe one for all function returns.
130+
131+
In older Zen1 and Zen2, this is accomplished using a reinterpretation
132+
technique similar to Retbleed one: srso_untrain_ret() and
133+
srso_safe_ret().

‎Documentation/admin-guide/kernel-parameters.txt

Lines changed: 45 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1593,6 +1593,26 @@
15931593
Format: off | on
15941594
default: on
15951595

1596+
gather_data_sampling=
1597+
[X86,INTEL] Control the Gather Data Sampling (GDS)
1598+
mitigation.
1599+
1600+
Gather Data Sampling is a hardware vulnerability which
1601+
allows unprivileged speculative access to data which was
1602+
previously stored in vector registers.
1603+
1604+
This issue is mitigated by default in updated microcode.
1605+
The mitigation may have a performance impact but can be
1606+
disabled. On systems without the microcode mitigation
1607+
disabling AVX serves as a mitigation.
1608+
1609+
force: Disable AVX to mitigate systems without
1610+
microcode mitigation. No effect if the microcode
1611+
mitigation is present. Known to cause crashes in
1612+
userspace with buggy AVX enumeration.
1613+
1614+
off: Disable GDS mitigation.
1615+
15961616
gcov_persist= [GCOV] When non-zero (default), profiling data for
15971617
kernel modules is saved and remains accessible via
15981618
debugfs, even when the module is unloaded/reloaded.
@@ -3228,24 +3248,25 @@
32283248
Disable all optional CPU mitigations. This
32293249
improves system performance, but it may also
32303250
expose users to several CPU vulnerabilities.
3231-
Equivalent to: nopti [X86,PPC]
3232-
if nokaslr then kpti=0 [ARM64]
3233-
nospectre_v1 [X86,PPC]
3234-
nobp=0 [S390]
3235-
nospectre_v2 [X86,PPC,S390,ARM64]
3236-
spectre_v2_user=off [X86]
3237-
spec_store_bypass_disable=off [X86,PPC]
3238-
ssbd=force-off [ARM64]
3239-
nospectre_bhb [ARM64]
3251+
Equivalent to: if nokaslr then kpti=0 [ARM64]
3252+
gather_data_sampling=off [X86]
3253+
kvm.nx_huge_pages=off [X86]
32403254
l1tf=off [X86]
32413255
mds=off [X86]
3242-
tsx_async_abort=off [X86]
3243-
kvm.nx_huge_pages=off [X86]
3244-
srbds=off [X86,INTEL]
3256+
mmio_stale_data=off [X86]
32453257
no_entry_flush [PPC]
32463258
no_uaccess_flush [PPC]
3247-
mmio_stale_data=off [X86]
3259+
nobp=0 [S390]
3260+
nopti [X86,PPC]
3261+
nospectre_bhb [ARM64]
3262+
nospectre_v1 [X86,PPC]
3263+
nospectre_v2 [X86,PPC,S390,ARM64]
32483264
retbleed=off [X86]
3265+
spec_store_bypass_disable=off [X86,PPC]
3266+
spectre_v2_user=off [X86]
3267+
srbds=off [X86,INTEL]
3268+
ssbd=force-off [ARM64]
3269+
tsx_async_abort=off [X86]
32493270

32503271
Exceptions:
32513272
This does not have any effect on
@@ -5764,6 +5785,17 @@
57645785
Not specifying this option is equivalent to
57655786
spectre_v2_user=auto.
57665787

5788+
spec_rstack_overflow=
5789+
[X86] Control RAS overflow mitigation on AMD Zen CPUs
5790+
5791+
off - Disable mitigation
5792+
microcode - Enable microcode mitigation only
5793+
safe-ret - Enable sw-only safe RET mitigation (default)
5794+
ibpb - Enable mitigation by issuing IBPB on
5795+
kernel entry
5796+
ibpb-vmexit - Issue IBPB only on VMEXIT
5797+
(cloud-specific mitigation)
5798+
57675799
spec_store_bypass_disable=
57685800
[HW] Control Speculative Store Bypass (SSB) Disable mitigation
57695801
(Speculative Store Bypass vulnerability)

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 1
4-
SUBLEVEL = 43
4+
SUBLEVEL = 44
55
EXTRAVERSION =
66
NAME = Curry Ramen
77

‎arch/Kconfig

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,9 @@ config ARCH_HAS_DMA_SET_UNCACHED
285285
config ARCH_HAS_DMA_CLEAR_UNCACHED
286286
bool
287287

288+
config ARCH_HAS_CPU_FINALIZE_INIT
289+
bool
290+
288291
# Select if arch init_task must go in the __init_task_data section
289292
config ARCH_TASK_STRUCT_ON_STACK
290293
bool

‎arch/alpha/include/asm/bugs.h

Lines changed: 0 additions & 20 deletions
This file was deleted.

0 commit comments

Comments
 (0)