# git rev-parse -q --verify eb094f06963bb0fd8134c6a9b805d4ad0002a7d4^{commit} eb094f06963bb0fd8134c6a9b805d4ad0002a7d4 already have revision, skipping fetch # git checkout -q -f -B kisskb eb094f06963bb0fd8134c6a9b805d4ad0002a7d4 # git clean -qxdf # < git log -1 # commit eb094f06963bb0fd8134c6a9b805d4ad0002a7d4 # Merge: 100d46bd72ec 012206a822a8 # Author: Linus Torvalds # Date: Tue Nov 12 10:53:24 2019 -0800 # # Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip # # Pull x86 TSX Async Abort and iTLB Multihit mitigations from Thomas Gleixner: # "The performance deterioration departement is not proud at all of # presenting the seventh installment of speculation mitigations and # hardware misfeature workarounds: # # 1) TSX Async Abort (TAA) - 'The Annoying Affair' # # TAA is a hardware vulnerability that allows unprivileged # speculative access to data which is available in various CPU # internal buffers by using asynchronous aborts within an Intel TSX # transactional region. # # The mitigation depends on a microcode update providing a new MSR # which allows to disable TSX in the CPU. CPUs which have no # microcode update can be mitigated by disabling TSX in the BIOS if # the BIOS provides a tunable. # # Newer CPUs will have a bit set which indicates that the CPU is not # vulnerable, but the MSR to disable TSX will be available # nevertheless as it is an architected MSR. That means the kernel # provides the ability to disable TSX on the kernel command line, # which is useful as TSX is a truly useful mechanism to accelerate # side channel attacks of all sorts. # # 2) iITLB Multihit (NX) - 'No eXcuses' # # iTLB Multihit is an erratum where some Intel processors may incur # a machine check error, possibly resulting in an unrecoverable CPU # lockup, when an instruction fetch hits multiple entries in the # instruction TLB. This can occur when the page size is changed # along with either the physical address or cache type. A malicious # guest running on a virtualized system can exploit this erratum to # perform a denial of service attack. # # The workaround is that KVM marks huge pages in the extended page # tables as not executable (NX). If the guest attempts to execute in # such a page, the page is broken down into 4k pages which are # marked executable. The workaround comes with a mechanism to # recover these shattered huge pages over time. # # Both issues come with full documentation in the hardware # vulnerabilities section of the Linux kernel user's and administrator's # guide. # # Thanks to all patch authors and reviewers who had the extraordinary # priviledge to be exposed to this nuisance. # # Special thanks to Borislav Petkov for polishing the final TAA patch # set and to Paolo Bonzini for shepherding the KVM iTLB workarounds and # providing also the backports to stable kernels for those!" # # * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: # x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs # Documentation: Add ITLB_MULTIHIT documentation # kvm: x86: mmu: Recovery of shattered NX large pages # kvm: Add helper function for creating VM worker threads # kvm: mmu: ITLB_MULTIHIT mitigation # cpu/speculation: Uninline and export CPU mitigations helpers # x86/cpu: Add Tremont to the cpu vulnerability whitelist # x86/bugs: Add ITLB_MULTIHIT bug infrastructure # x86/tsx: Add config options to set tsx=on|off|auto # x86/speculation/taa: Add documentation for TSX Async Abort # x86/tsx: Add "auto" option to the tsx= cmdline parameter # kvm/x86: Export MDS_NO=0 to guests when TSX is enabled # x86/speculation/taa: Add sysfs reporting for TSX Async Abort # x86/speculation/taa: Add mitigation for TSX Async Abort # x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default # x86/cpu: Add a helper function x86_read_arch_cap_msr() # x86/msr: Add the IA32_TSX_CTRL MSR # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa64-linux/bin/hppa64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa64-linux/bin/hppa64-linux-ld --version # < git log --format=%s --max-count=1 eb094f06963bb0fd8134c6a9b805d4ad0002a7d4 # < make -s -j 8 ARCH=parisc O=/kisskb/build/linus_a500_defconfig_parisc64 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa64-linux/bin/hppa64-linux- a500_defconfig # make -s -j 8 ARCH=parisc O=/kisskb/build/linus_a500_defconfig_parisc64 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa64-linux/bin/hppa64-linux- In file included from /kisskb/src/arch/parisc/include/asm/atomic.h:10, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/arch/parisc/include/asm/bitops.h:13, from /kisskb/src/include/linux/bitops.h:26, from /kisskb/src/include/linux/kernel.h:12, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/preempt.h:11, from /kisskb/src/include/linux/spinlock.h:51, from /kisskb/src/include/linux/seqlock.h:36, from /kisskb/src/include/linux/time.h:6, from /kisskb/src/fs/nfs/read.c:11: /kisskb/src/fs/nfs/read.c: In function 'nfs_read_completion': /kisskb/src/arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/nfs/read.c:196:5: note: in expansion of macro 'xchg' xchg(&nfs_req_openctx(req)->error, error); ^~~~ /kisskb/src/fs/nfs/read.c: In function 'nfs_readpage': /kisskb/src/arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/nfs/read.c:352:2: note: in expansion of macro 'xchg' xchg(&ctx->error, 0); ^~~~ In file included from /kisskb/src/arch/parisc/include/asm/atomic.h:10, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/arch/parisc/include/asm/bitops.h:13, from /kisskb/src/include/linux/bitops.h:26, from /kisskb/src/include/linux/kernel.h:12, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/module.h:9, from /kisskb/src/drivers/scsi/scsi_debug.c:18: /kisskb/src/drivers/scsi/scsi_debug.c: In function 'resp_start_stop': /kisskb/src/arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) /kisskb/src/arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro 'xchg' #define atomic_xchg(v, new) (xchg(&((v)->counter), new)) ^~~~ /kisskb/src/drivers/scsi/scsi_debug.c:1618:2: note: in expansion of macro 'atomic_xchg' atomic_xchg(&devip->stopped, stop); ^~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_a500_defconfig_parisc64 # Build took: 0:01:58.533184