mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
1,062,816 Commits 103 Branches 5,015 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Daniel Sneddon 0cc5643b63 x86/speculation: Add force option to GDS mitigation 
commit 553a5c03e9 upstream

The Gather Data Sampling (GDS) vulnerability allows malicious software
to infer stale data previously stored in vector registers. This may
include sensitive data such as cryptographic keys. GDS is mitigated in
microcode, and systems with up-to-date microcode are protected by
default. However, any affected system that is running with older
microcode will still be vulnerable to GDS attacks.

Since the gather instructions used by the attacker are part of the
AVX2 and AVX512 extensions, disabling these extensions prevents gather
instructions from being executed, thereby mitigating the system from
GDS. Disabling AVX2 is sufficient, but we don't have the granularity
to do this. The XCR0[2] disables AVX, with no option to just disable
AVX2.

Add a kernel parameter gather_data_sampling=force that will enable the
microcode mitigation if available, otherwise it will disable AVX on
affected systems.

This option will be ignored if cmdline mitigations=off.

This is a *big* hammer.  It is known to break buggy userspace that
uses incomplete, buggy AVX enumeration.  Unfortunately, such userspace
does exist in the wild:

	https://www.mail-archive.com/bug-coreutils@gnu.org/msg33046.html

[ dhansen: add some more ominous warnings about disabling AVX ]

Signed-off-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2023-08-08 19:58:32 +02:00
Documentation x86/speculation: Add force option to GDS mitigation 2023-08-08 19:58:32 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
arch x86/speculation: Add force option to GDS mitigation 2023-08-08 19:58:32 +02:00
block block/partition: fix signedness issue for Amiga partitions 2023-07-23 13:47:37 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() 2023-06-09 10:32:34 +02:00
drivers x86/speculation: Add Gather Data Sampling mitigation 2023-08-08 19:58:32 +02:00
fs ceph: never send metrics if disable_send_metrics is set 2023-08-03 10:22:46 +02:00
include init: Remove check_bugs() leftovers 2023-08-08 19:58:31 +02:00
init init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() 2023-08-08 19:58:31 +02:00
io_uring io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq 2023-08-03 10:22:47 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel tracing: Fix trace_event_raw_event_synth() if else statement 2023-08-03 10:22:46 +02:00
lib test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation 2023-07-23 13:47:25 +02:00
mm mm/damon/ops-common: atomically test and clear young on ptes and pmds 2023-07-23 13:47:47 +02:00
net rbd: harden get_lock_owner_info() a bit 2023-08-03 10:22:46 +02:00
samples samples: ftrace: Save required argument registers in sample trampolines 2023-07-23 13:47:55 +02:00
scripts kbuild: Disable GCOV for *.mod.o 2023-07-23 13:47:17 +02:00
security security: keys: Modify mismatched function name 2023-07-27 08:47:01 +02:00
sound ASoC: cs42l51: fix driver to properly autoload with automatic module loading 2023-08-03 10:22:47 +02:00
tools selftests: mptcp: join: only check for ip6tables if needed 2023-08-03 10:22:47 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: Grab a reference to KVM for VM and vCPU stats file descriptors 2023-08-03 10:22:40 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
…
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS cifs: missing directory in MAINTAINERS file 2023-08-03 10:22:29 +02:00
Makefile Linux 5.15.124 2023-08-03 10:22:47 +02:00
README
…

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.