Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 89270256 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.9.227 into android-4.9-q 



Changes in 4.9.227
	scsi: scsi_devinfo: fixup string compare
	usb: gadget: f_uac2: fix error handling in afunc_bind (again)
	esp6: fix memleak on error path in esp6_input
	spi: dw: use "smp_mb()" to avoid sending spi data error
	s390/ftrace: save traced function caller
	ARC: Fix ICCM & DCCM runtime size checks
	x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
	net: bmac: Fix read of MAC address from ROM
	net/ethernet/freescale: rework quiesce/activate for ucc_geth
	net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
	net: smsc911x: Fix runtime PM imbalance on error
	pppoe: only process PADT targeted at local interfaces
	mm: Fix mremap not considering huge pmd devmap
	HID: i2c-hid: add Schneider SCL142ALM to descriptor override
	p54usb: add AirVasT USB stick device-id
	kernel/relay.c: handle alloc_percpu returning NULL in relay_open
	mmc: fix compilation of user API
	slcan: Fix double-free on slcan_open() error path
	slip: not call free_netdev before rtnl_unlock in slip_open
	scsi: ufs: Release clock if DMA map fails
	airo: Fix read overflows sending packets
	devinet: fix memleak in inetdev_init()
	l2tp: do not use inet_hash()/inet_unhash()
	net: usb: qmi_wwan: add Telit LE910C1-EUX composition
	NFC: st21nfca: add missed kfree_skb() in an error path
	vsock: fix timeout in vsock_accept()
	l2tp: add sk_family checks to l2tp_validate_socket
	USB: serial: qcserial: add DW5816e QDL support
	USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
	USB: serial: option: add Telit LE910C1-EUX compositions
	usb: musb: Fix runtime PM imbalance on error
	vt: keyboard: avoid signed integer overflow in k_ascii
	tty: hvc_console, fix crashes on parallel open/close
	staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
	nvmem: qfprom: remove incorrect write support
	x86/cpu: Add a steppings field to struct x86_cpu_id
	x86/cpu: Add 'table' argument to cpu_matches()
	x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
	x86/speculation: Add SRBDS vulnerability and mitigation documentation
	x86/speculation: Add Ivy Bridge to affected list
	iio: vcnl4000: Fix i2c swapped word reading.
	uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
	Linux 4.9.227

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie391f1bd1785679263f1e375f0530e45459b58ed
parents 92339d65 e0799bae

Documentation/ABI/testing/sysfs-devices-system-cpu

+1 −0
Original line number Diff line number Diff line
@@ -358,6 +358,7 @@ What: /sys/devices/system/cpu/vulnerabilities 
		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass

		/sys/devices/system/cpu/vulnerabilities/l1tf

		/sys/devices/system/cpu/vulnerabilities/mds

		/sys/devices/system/cpu/vulnerabilities/srbds

		/sys/devices/system/cpu/vulnerabilities/tsx_async_abort

		/sys/devices/system/cpu/vulnerabilities/itlb_multihit

Date:		January 2018

Documentation/hw-vuln/index.rst

+2 −1
Original line number Diff line number Diff line
@@ -12,4 +12,5 @@ are configurable at compile, boot or run time. 
   l1tf

   mds

   tsx_async_abort

   multihit.rst
 
   multihit

   special-register-buffer-data-sampling

Documentation/hw-vuln/special-register-buffer-data-sampling.rst

0 → 100644
+149 −0
Original line number Diff line number Diff line 
.. SPDX-License-Identifier: GPL-2.0



SRBDS - Special Register Buffer Data Sampling

=============================================



SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to

infer values returned from special register accesses.  Special register

accesses are accesses to off core registers.  According to Intel's evaluation,

the special register reads that have a security expectation of privacy are

RDRAND, RDSEED and SGX EGETKEY.



When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved

to the core through the special register mechanism that is susceptible

to MDS attacks.



Affected processors

--------------------

Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may

be affected.



A processor is affected by SRBDS if its Family_Model and stepping is

in the following list, with the exception of the listed processors

exporting MDS_NO while Intel TSX is available yet not enabled. The

latter class of processors are only affected when Intel TSX is enabled

by software using TSX_CTRL_MSR otherwise they are not affected.



  =============  ============  ========

  common name    Family_Model  Stepping

  =============  ============  ========

  IvyBridge      06_3AH        All



  Haswell        06_3CH        All

  Haswell_L      06_45H        All

  Haswell_G      06_46H        All



  Broadwell_G    06_47H        All

  Broadwell      06_3DH        All



  Skylake_L      06_4EH        All

  Skylake        06_5EH        All



  Kabylake_L     06_8EH        <= 0xC

  Kabylake       06_9EH        <= 0xD

  =============  ============  ========



Related CVEs

------------



The following CVE entry is related to this SRBDS issue:



    ==============  =====  =====================================

    CVE-2020-0543   SRBDS  Special Register Buffer Data Sampling

    ==============  =====  =====================================



Attack scenarios

----------------

An unprivileged user can extract values returned from RDRAND and RDSEED

executed on another core or sibling thread using MDS techniques.





Mitigation mechanism

-------------------

Intel will release microcode updates that modify the RDRAND, RDSEED, and

EGETKEY instructions to overwrite secret special register data in the shared

staging buffer before the secret data can be accessed by another logical

processor.



During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core

accesses from other logical processors will be delayed until the special

register read is complete and the secret data in the shared staging buffer is

overwritten.



This has three effects on performance:



#. RDRAND, RDSEED, or EGETKEY instructions have higher latency.



#. Executing RDRAND at the same time on multiple logical processors will be

   serialized, resulting in an overall reduction in the maximum RDRAND

   bandwidth.



#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other

   logical processors that miss their core caches, with an impact similar to

   legacy locked cache-line-split accesses.



The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable

the mitigation for RDRAND and RDSEED instructions executed outside of Intel

Software Guard Extensions (Intel SGX) enclaves. On logical processors that

disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not

take longer to execute and do not impact performance of sibling logical

processors memory accesses. The opt-out mechanism does not affect Intel SGX

enclaves (including execution of RDRAND or RDSEED inside an enclave, as well

as EGETKEY execution).



IA32_MCU_OPT_CTRL MSR Definition

--------------------------------

Along with the mitigation for this issue, Intel added a new thread-scope

IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and

RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL =

9]==1. This MSR is introduced through the microcode update.



Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor

disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX

enclave on that logical processor. Opting out of the mitigation for a

particular logical processor does not affect the RDRAND and RDSEED mitigations

for other logical processors.



Note that inside of an Intel SGX enclave, the mitigation is applied regardless

of the value of RNGDS_MITG_DS.



Mitigation control on the kernel command line

---------------------------------------------

The kernel command line allows control over the SRBDS mitigation at boot time

with the option "srbds=".  The option for this is:



  ============= =============================================================

  off           This option disables SRBDS mitigation for RDRAND and RDSEED on

                affected platforms.

  ============= =============================================================



SRBDS System Information

-----------------------

The Linux kernel provides vulnerability status information through sysfs.  For

SRBDS this can be accessed by the following sysfs file:

/sys/devices/system/cpu/vulnerabilities/srbds



The possible values contained in this file are:



 ============================== =============================================

 Not affected                   Processor not vulnerable

 Vulnerable                     Processor vulnerable and mitigation disabled

 Vulnerable: No microcode       Processor vulnerable and microcode is missing

                                mitigation

 Mitigation: Microcode          Processor is vulnerable and mitigation is in

                                effect.

 Mitigation: TSX disabled       Processor is only vulnerable when TSX is

                                enabled while this system was booted with TSX

                                disabled.

 Unknown: Dependent on

 hypervisor status              Running on virtual guest processor that is

                                affected but with no way to know if host

                                processor is mitigated or vulnerable.

 ============================== =============================================



SRBDS Default mitigation

------------------------

This new microcode serializes processor access during execution of RDRAND,

RDSEED ensures that the shared buffer is overwritten before it is released for

reuse.  Use the "srbds=off" kernel command line to disable the mitigation for

RDRAND and RDSEED.

Documentation/kernel-parameters.txt

+20 −0
Original line number Diff line number Diff line
@@ -4286,6 +4286,26 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
	spia_pedr=

	spia_peddr=



	srbds=		[X86,INTEL]

			Control the Special Register Buffer Data Sampling

			(SRBDS) mitigation.



			Certain CPUs are vulnerable to an MDS-like

			exploit which can leak bits from the random

			number generator.



			By default, this issue is mitigated by

			microcode.  However, the microcode fix can cause

			the RDRAND and RDSEED instructions to become

			much slower.  Among other effects, this will

			result in reduced throughput from /dev/urandom.



			The microcode mitigation can be disabled with

			the following option:



			off:    Disable mitigation and remove

				performance impact to RDRAND and RDSEED



	ssbd=		[ARM64,HW]

			Speculative Store Bypass Disable control

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 9

SUBLEVEL = 226

SUBLEVEL = 227

EXTRAVERSION =

NAME = Roaring Lionus