diff --git a/debian/changelog b/debian/changelog index 829b519..1dbb293 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +linux (6.15.6-1) sid; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.6 + + -- Konstantin Demin Thu, 10 Jul 2025 19:38:23 +0300 + linux (6.15.5-1) sid; urgency=medium * New upstream stable update: diff --git a/debian/config/config b/debian/config/config index f0d296f..bcced84 100644 --- a/debian/config/config +++ b/debian/config/config @@ -116,6 +116,7 @@ CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y # CONFIG_MITIGATION_SPECTRE_V2 is not set # CONFIG_MITIGATION_SRBDS is not set # CONFIG_MITIGATION_SSB is not set +# CONFIG_MITIGATION_TSA is not set CONFIG_PCI_MMCONFIG=y # CONFIG_ISA_BUS is not set CONFIG_ISA_DMA_API=y diff --git a/debian/patches/bugfix/all/Revert-mmc-sdhci-Disable-SD-card-clock-before-changi.patch b/debian/patches/bugfix/all/Revert-mmc-sdhci-Disable-SD-card-clock-before-changi.patch deleted file mode 100644 index db74c89..0000000 --- a/debian/patches/bugfix/all/Revert-mmc-sdhci-Disable-SD-card-clock-before-changi.patch +++ /dev/null @@ -1,45 +0,0 @@ -From: Ulf Hansson -Date: Tue, 24 Jun 2025 13:09:32 +0200 -Subject: Revert "mmc: sdhci: Disable SD card clock before changing parameters" -Origin: https://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc.git/commit?id=dcc3bcfc5b50c625b475dcc25d167b6b947a6637 -Bug-Debian: https://bugs.debian.org/1108065 - -It has turned out the trying to strictly conform to the SDHCI specification -is causing problems. Let's revert and start over. - -This reverts commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc. - -Cc: Erick Shepherd -Cc: stable@vger.kernel.org -Fixes: fb3bbc46c94f ("mmc: sdhci: Disable SD card clock before changing parameters") -Suggested-by: Adrian Hunter -Reported-by: Jonathan Liu -Reported-by: Salvatore Bonaccorso -Closes: https://bugs.debian.org/1108065 -Acked-by: Adrian Hunter -Signed-off-by: Ulf Hansson -Link: https://lore.kernel.org/r/20250624110932.176925-1-ulf.hansson@linaro.org ---- - drivers/mmc/host/sdhci.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2065,15 +2065,10 @@ void sdhci_set_clock(struct sdhci_host * - - host->mmc->actual_clock = 0; - -- clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); -- if (clk & SDHCI_CLOCK_CARD_EN) -- sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, -- SDHCI_CLOCK_CONTROL); -+ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); - -- if (clock == 0) { -- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); -+ if (clock == 0) - return; -- } - - clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); - sdhci_enable_clk(host, clk); diff --git a/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch b/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch index dc9e63f..7dd3321 100644 --- a/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch +++ b/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch @@ -42,7 +42,7 @@ Signed-off-by: Ben Hutchings Ignore sysrq setting - this boot parameter will --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -3169,6 +3169,14 @@ config COMPAT_32 +@@ -3178,6 +3178,14 @@ config COMPAT_32 select HAVE_UID16 select OLD_SIGSUSPEND3 diff --git a/debian/patches/patchset-pf/fixes/0009-anon_inode-rework-assertions.patch b/debian/patches/patchset-pf/fixes/0009-anon_inode-rework-assertions.patch deleted file mode 100644 index 2f16454..0000000 --- a/debian/patches/patchset-pf/fixes/0009-anon_inode-rework-assertions.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 1e0bf201a90df1058f012f12adcc454d4d7c9a69 Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Wed, 2 Jul 2025 11:23:55 +0200 -Subject: anon_inode: rework assertions - -Making anonymous inodes regular files comes with a lot of risk and -regression potential as evidenced by a recent hickup in io_uring. We're -better of continuing to not have them be regular files. Since we have -S_ANON_INODE we can port all of our assertions easily. - -Link: https://lore.kernel.org/20250702-work-fixes-v1-1-ff76ea589e33@kernel.org -Fixes: cfd86ef7e8e7 ("anon_inode: use a proper mode internally") -Acked-by: Jens Axboe -Cc: stable@kernel.org -Reported-by: Jens Axboe -Signed-off-by: Christian Brauner ---- - fs/exec.c | 9 +++++++-- - fs/libfs.c | 8 +++----- - fs/namei.c | 2 +- - 3 files changed, 11 insertions(+), 8 deletions(-) - ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -111,6 +111,9 @@ static inline void put_binfmt(struct lin - - bool path_noexec(const struct path *path) - { -+ /* If it's an anonymous inode make sure that we catch any shenanigans. */ -+ VFS_WARN_ON_ONCE(IS_ANON_FILE(d_inode(path->dentry)) && -+ !(path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC)); - return (path->mnt->mnt_flags & MNT_NOEXEC) || - (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC); - } -@@ -894,13 +897,15 @@ static struct file *do_open_execat(int f - if (IS_ERR(file)) - return file; - -+ if (path_noexec(&file->f_path)) -+ return ERR_PTR(-EACCES); -+ - /* - * In the past the regular type check was here. It moved to may_open() in - * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is - * an invariant that all non-regular files error out before we get here. - */ -- if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) || -- path_noexec(&file->f_path)) -+ if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode))) - return ERR_PTR(-EACCES); - - err = exe_file_deny_write_access(file); ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -1648,12 +1648,10 @@ struct inode *alloc_anon_inode(struct su - */ - inode->i_state = I_DIRTY; - /* -- * Historically anonymous inodes didn't have a type at all and -- * userspace has come to rely on this. Internally they're just -- * regular files but S_IFREG is masked off when reporting -- * information to userspace. -+ * Historically anonymous inodes don't have a type at all and -+ * userspace has come to rely on this. - */ -- inode->i_mode = S_IFREG | S_IRUSR | S_IWUSR; -+ inode->i_mode = S_IRUSR | S_IWUSR; - inode->i_uid = current_fsuid(); - inode->i_gid = current_fsgid(); - inode->i_flags |= S_PRIVATE | S_ANON_INODE; ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3464,7 +3464,7 @@ static int may_open(struct mnt_idmap *id - return -EACCES; - break; - default: -- VFS_BUG_ON_INODE(1, inode); -+ VFS_BUG_ON_INODE(!IS_ANON_FILE(inode), inode); - } - - error = inode_permission(idmap, inode, MAY_OPEN | acc_mode); diff --git a/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch b/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch new file mode 100644 index 0000000..eff552c --- /dev/null +++ b/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch @@ -0,0 +1,136 @@ +From b885aa903c313644f7ba8d46d4c09ead1b52f1f1 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 1 Jul 2025 17:38:38 +0100 +Subject: netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag + wangling + +Provide helpers to clear and test the NETFS_RREQ_IN_PROGRESS and to insert +the appropriate barrierage. + +Signed-off-by: David Howells +Link: https://lore.kernel.org/20250701163852.2171681-4-dhowells@redhat.com +Tested-by: Steve French +Reviewed-by: Paulo Alcantara +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +--- + fs/netfs/internal.h | 18 ++++++++++++++++++ + fs/netfs/misc.c | 10 +++++----- + fs/netfs/read_collect.c | 4 ++-- + fs/netfs/write_collect.c | 4 ++-- + 4 files changed, 27 insertions(+), 9 deletions(-) + +--- a/fs/netfs/internal.h ++++ b/fs/netfs/internal.h +@@ -275,6 +275,24 @@ static inline void netfs_wake_rreq_flag( + } + + /* ++ * Test the NETFS_RREQ_IN_PROGRESS flag, inserting an appropriate barrier. ++ */ ++static inline bool netfs_check_rreq_in_progress(const struct netfs_io_request *rreq) ++{ ++ /* Order read of flags before read of anything else, such as error. */ ++ return test_bit_acquire(NETFS_RREQ_IN_PROGRESS, &rreq->flags); ++} ++ ++/* ++ * Test the NETFS_SREQ_IN_PROGRESS flag, inserting an appropriate barrier. ++ */ ++static inline bool netfs_check_subreq_in_progress(const struct netfs_io_subrequest *subreq) ++{ ++ /* Order read of flags before read of anything else, such as error. */ ++ return test_bit_acquire(NETFS_SREQ_IN_PROGRESS, &subreq->flags); ++} ++ ++/* + * fscache-cache.c + */ + #ifdef CONFIG_PROC_FS +--- a/fs/netfs/misc.c ++++ b/fs/netfs/misc.c +@@ -356,14 +356,14 @@ void netfs_wait_for_in_progress_stream(s + DEFINE_WAIT(myself); + + list_for_each_entry(subreq, &stream->subrequests, rreq_link) { +- if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags)) ++ if (!netfs_check_subreq_in_progress(subreq)) + continue; + + trace_netfs_rreq(rreq, netfs_rreq_trace_wait_queue); + for (;;) { + prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE); + +- if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags)) ++ if (!netfs_check_subreq_in_progress(subreq)) + break; + + trace_netfs_sreq(subreq, netfs_sreq_trace_wait_for); +@@ -400,7 +400,7 @@ static int netfs_collect_in_app(struct n + struct netfs_io_subrequest, + rreq_link); + if (subreq && +- (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags) || ++ (!netfs_check_subreq_in_progress(subreq) || + test_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags))) { + need_collect = true; + break; +@@ -454,7 +454,7 @@ static ssize_t netfs_wait_for_in_progres + } + } + +- if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) ++ if (!netfs_check_rreq_in_progress(rreq)) + break; + + schedule(); +@@ -525,7 +525,7 @@ static void netfs_wait_for_pause(struct + } + } + +- if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags) || ++ if (!netfs_check_rreq_in_progress(rreq) || + !test_bit(NETFS_RREQ_PAUSE, &rreq->flags)) + break; + +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -220,7 +220,7 @@ reassess: + stream->collected_to = front->start; + } + +- if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags)) ++ if (netfs_check_subreq_in_progress(front)) + notes |= HIT_PENDING; + smp_rmb(); /* Read counters after IN_PROGRESS flag. */ + transferred = READ_ONCE(front->transferred); +@@ -447,7 +447,7 @@ void netfs_read_collection_worker(struct + struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work); + + netfs_see_request(rreq, netfs_rreq_trace_see_work); +- if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) { ++ if (netfs_check_rreq_in_progress(rreq)) { + if (netfs_read_collection(rreq)) + /* Drop the ref from the IN_PROGRESS flag. */ + netfs_put_request(rreq, netfs_rreq_trace_put_work_ip); +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -240,7 +240,7 @@ reassess_streams: + } + + /* Stall if the front is still undergoing I/O. */ +- if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags)) { ++ if (netfs_check_subreq_in_progress(front)) { + notes |= HIT_PENDING; + break; + } +@@ -434,7 +434,7 @@ void netfs_write_collection_worker(struc + struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work); + + netfs_see_request(rreq, netfs_rreq_trace_see_work); +- if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) { ++ if (netfs_check_rreq_in_progress(rreq)) { + if (netfs_write_collection(rreq)) + /* Drop the ref from the IN_PROGRESS flag. */ + netfs_put_request(rreq, netfs_rreq_trace_put_work_ip); diff --git a/debian/patches/patchset-pf/smb/0001-cifs-all-initializations-for-tcon-should-happen-in-t.patch b/debian/patches/patchset-pf/smb/0001-cifs-all-initializations-for-tcon-should-happen-in-t.patch deleted file mode 100644 index 622211c..0000000 --- a/debian/patches/patchset-pf/smb/0001-cifs-all-initializations-for-tcon-should-happen-in-t.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 57fd039971b09ce2e6a442f822146099f72888c3 Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N -Date: Mon, 30 Jun 2025 23:09:34 +0530 -Subject: cifs: all initializations for tcon should happen in tcon_info_alloc - -Today, a few work structs inside tcon are initialized inside -cifs_get_tcon and not in tcon_info_alloc. As a result, if a tcon -is obtained from tcon_info_alloc, but not called as a part of -cifs_get_tcon, we may trip over. - -Cc: -Signed-off-by: Shyam Prasad N -Reviewed-by: Paulo Alcantara (Red Hat) -Signed-off-by: Steve French ---- - fs/smb/client/cifsproto.h | 1 + - fs/smb/client/connect.c | 8 +------- - fs/smb/client/misc.c | 6 ++++++ - 3 files changed, 8 insertions(+), 7 deletions(-) - ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -136,6 +136,7 @@ extern int SendReceiveBlockingLock(const - struct smb_hdr *out_buf, - int *bytes_returned); - -+void smb2_query_server_interfaces(struct work_struct *work); - void - cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server, - bool all_channels); ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -97,7 +97,7 @@ static int reconn_set_ipaddr_from_hostna - return rc; - } - --static void smb2_query_server_interfaces(struct work_struct *work) -+void smb2_query_server_interfaces(struct work_struct *work) - { - int rc; - int xid; -@@ -2880,20 +2880,14 @@ cifs_get_tcon(struct cifs_ses *ses, stru - tcon->max_cached_dirs = ctx->max_cached_dirs; - tcon->nodelete = ctx->nodelete; - tcon->local_lease = ctx->local_lease; -- INIT_LIST_HEAD(&tcon->pending_opens); - tcon->status = TID_GOOD; - -- INIT_DELAYED_WORK(&tcon->query_interfaces, -- smb2_query_server_interfaces); - if (ses->server->dialect >= SMB30_PROT_ID && - (ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { - /* schedule query interfaces poll */ - queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, - (SMB_INTERFACE_POLL_INTERVAL * HZ)); - } --#ifdef CONFIG_CIFS_DFS_UPCALL -- INIT_DELAYED_WORK(&tcon->dfs_cache_work, dfs_cache_refresh); --#endif - spin_lock(&cifs_tcp_ses_lock); - list_add(&tcon->tcon_list, &ses->tcon_list); - spin_unlock(&cifs_tcp_ses_lock); ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -151,6 +151,12 @@ tcon_info_alloc(bool dir_leases_enabled, - #ifdef CONFIG_CIFS_DFS_UPCALL - INIT_LIST_HEAD(&ret_buf->dfs_ses_list); - #endif -+ INIT_LIST_HEAD(&ret_buf->pending_opens); -+ INIT_DELAYED_WORK(&ret_buf->query_interfaces, -+ smb2_query_server_interfaces); -+#ifdef CONFIG_CIFS_DFS_UPCALL -+ INIT_DELAYED_WORK(&ret_buf->dfs_cache_work, dfs_cache_refresh); -+#endif - - return ret_buf; - } diff --git a/debian/patches/patchset-zen/fixes/0002-x86-cpu-Help-users-notice-when-running-old-Intel-mic.patch b/debian/patches/patchset-zen/fixes/0002-x86-cpu-Help-users-notice-when-running-old-Intel-mic.patch deleted file mode 100644 index 71e33f0..0000000 --- a/debian/patches/patchset-zen/fixes/0002-x86-cpu-Help-users-notice-when-running-old-Intel-mic.patch +++ /dev/null @@ -1,471 +0,0 @@ -From a66b7c34e1f618194d288d1b1982af805d5be57f Mon Sep 17 00:00:00 2001 -From: Dave Hansen -Date: Tue, 22 Apr 2025 08:32:47 +0200 -Subject: x86/cpu: Help users notice when running old Intel microcode - -Old microcode is bad for users and for kernel developers. - -For users, it exposes them to known fixed security and/or functional -issues. These obviously rarely result in instant dumpster fires in -every environment. But it is as important to keep your microcode up -to date as it is to keep your kernel up to date. - -Old microcode also makes kernels harder to debug. A developer looking -at an oops need to consider kernel bugs, known CPU issues and unknown -CPU issues as possible causes. If they know the microcode is up to -date, they can mostly eliminate known CPU issues as the cause. - -Make it easier to tell if CPU microcode is out of date. Add a list -of released microcode. If the loaded microcode is older than the -release, tell users in a place that folks can find it: - - /sys/devices/system/cpu/vulnerabilities/old_microcode - -Tell kernel kernel developers about it with the existing taint -flag: - - TAINT_CPU_OUT_OF_SPEC - -== Discussion == - -When a user reports a potential kernel issue, it is very common -to ask them to reproduce the issue on mainline. Running mainline, -they will (independently from the distro) acquire a more up-to-date -microcode version list. If their microcode is old, they will -get a warning about the taint and kernel developers can take that -into consideration when debugging. - -Just like any other entry in "vulnerabilities/", users are free to -make their own assessment of their exposure. - -== Microcode Revision Discussion == - -The microcode versions in the table were generated from the Intel -microcode git repo: - - 8ac9378a8487 ("microcode-20241112 Release") - -which as of this writing lags behind the latest microcode-20250211. - -It can be argued that the versions that the kernel picks to call "old" -should be a revision or two old. Which specific version is picked is -less important to me than picking *a* version and enforcing it. - -This repository contains only microcode versions that Intel has deemed -to be OS-loadable. It is quite possible that the BIOS has loaded a -newer microcode than the latest in this repo. If this happens, the -system is considered to have new microcode, not old. - -Specifically, the sysfs file and taint flag answer the question: - - Is the CPU running on the latest OS-loadable microcode, - or something even later that the BIOS loaded? - -In other words, Intel never publishes an authoritative list of CPUs -and latest microcode revisions. Until it does, this is the best that -Linux can do. - -Also note that the "intel-ucode-defs.h" file is simple, ugly and -has lots of magic numbers. That's on purpose and should allow a -single file to be shared across lots of stable kernel regardless of if -they have the new "VFM" infrastructure or not. It was generated with -a dumb script. - -== FAQ == - -Q: Does this tell me if my system is secure or insecure? -A: No. It only tells you if your microcode was old when the - system booted. - -Q: Should the kernel warn if the microcode list itself is too old? -A: No. New kernels will get new microcode lists, both mainline - and stable. The only way to have an old list is to be running - an old kernel in which case you have bigger problems. - -Q: Is this for security or functional issues? -A: Both. - -Q: If a given microcode update only has functional problems but - no security issues, will it be considered old? -A: Yes. All microcode image versions within a microcode release - are treated identically. Intel appears to make security - updates without disclosing them in the release notes. Thus, - all updates are considered to be security-relevant. - -Q: Who runs old microcode? -A: Anybody with an old distro. This happens all the time inside - of Intel where there are lots of weird systems in labs that - might not be getting regular distro updates and might also - be running rather exotic microcode images. - -Q: If I update my microcode after booting will it stop saying - "Vulnerable"? -A: No. Just like all the other vulnerabilies, you need to - reboot before the kernel will reassess your vulnerability. - -Signed-off-by: Dave Hansen -Signed-off-by: Ingo Molnar -Cc: "Ahmed S. Darwish" -Cc: Andrew Cooper -Cc: Andy Lutomirski -Cc: Brian Gerst -Cc: John Ogness -Cc: Josh Poimboeuf -Cc: Juergen Gross -Cc: H. Peter Anvin -Cc: Kees Cook -Cc: Linus Torvalds -Link: https://lore.kernel.org/all/20250421195659.CF426C07%40davehans-spike.ostc.intel.com ---- - .../ABI/testing/sysfs-devices-system-cpu | 1 + - Documentation/admin-guide/hw-vuln/index.rst | 1 + - .../admin-guide/hw-vuln/old_microcode.rst | 21 +++ - arch/x86/include/asm/cpufeatures.h | 6 +- - arch/x86/kernel/cpu/bugs.c | 16 ++ - arch/x86/kernel/cpu/common.c | 42 +++++ - .../kernel/cpu/microcode/intel-ucode-defs.h | 150 ++++++++++++++++++ - drivers/base/cpu.c | 3 + - include/linux/cpu.h | 2 + - 9 files changed, 240 insertions(+), 2 deletions(-) - create mode 100644 Documentation/admin-guide/hw-vuln/old_microcode.rst - create mode 100644 arch/x86/kernel/cpu/microcode/intel-ucode-defs.h - ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -517,6 +517,7 @@ What: /sys/devices/system/cpu/vulnerabi - /sys/devices/system/cpu/vulnerabilities/mds - /sys/devices/system/cpu/vulnerabilities/meltdown - /sys/devices/system/cpu/vulnerabilities/mmio_stale_data -+ /sys/devices/system/cpu/vulnerabilities/old_microcode - /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling - /sys/devices/system/cpu/vulnerabilities/retbleed - /sys/devices/system/cpu/vulnerabilities/spec_store_bypass ---- a/Documentation/admin-guide/hw-vuln/index.rst -+++ b/Documentation/admin-guide/hw-vuln/index.rst -@@ -23,4 +23,5 @@ are configurable at compile, boot or run - gather_data_sampling - reg-file-data-sampling - rsb -+ old_microcode - indirect-target-selection ---- /dev/null -+++ b/Documentation/admin-guide/hw-vuln/old_microcode.rst -@@ -0,0 +1,21 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+============= -+Old Microcode -+============= -+ -+The kernel keeps a table of released microcode. Systems that had -+microcode older than this at boot will say "Vulnerable". This means -+that the system was vulnerable to some known CPU issue. It could be -+security or functional, the kernel does not know or care. -+ -+You should update the CPU microcode to mitigate any exposure. This is -+usually accomplished by updating the files in -+/lib/firmware/intel-ucode/ via normal distribution updates. Intel also -+distributes these files in a github repo: -+ -+ https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files.git -+ -+Just like all the other hardware vulnerabilities, exposure is -+determined at boot. Runtime microcode updates do not change the status -+of this vulnerability. ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -534,6 +534,8 @@ - #define X86_BUG_BHI X86_BUG(1*32 + 3) /* "bhi" CPU is affected by Branch History Injection */ - #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */ - #define X86_BUG_SPECTRE_V2_USER X86_BUG(1*32 + 5) /* "spectre_v2_user" CPU is affected by Spectre variant 2 attack between user processes */ --#define X86_BUG_ITS X86_BUG(1*32 + 6) /* "its" CPU is affected by Indirect Target Selection */ --#define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 7) /* "its_native_only" CPU is affected by ITS, VMX is not affected */ -+#define X86_BUG_OLD_MICROCODE X86_BUG(1*32 + 6) /* "old_microcode" CPU has old microcode, it is surely vulnerable to something */ -+#define X86_BUG_ITS X86_BUG(1*32 + 7) /* "its" CPU is affected by Indirect Target Selection */ -+#define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 8) /* "its_native_only" CPU is affected by ITS, VMX is not affected */ -+ - #endif /* _ASM_X86_CPUFEATURES_H */ ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -2954,6 +2954,14 @@ static ssize_t its_show_state(char *buf) - return sysfs_emit(buf, "%s\n", its_strings[its_mitigation]); - } - -+static ssize_t old_microcode_show_state(char *buf) -+{ -+ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) -+ return sysfs_emit(buf, "Unknown: running under hypervisor"); -+ -+ return sysfs_emit(buf, "Vulnerable\n"); -+} -+ - static char *stibp_state(void) - { - if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) && -@@ -3136,6 +3144,9 @@ static ssize_t cpu_show_common(struct de - case X86_BUG_RFDS: - return rfds_show_state(buf); - -+ case X86_BUG_OLD_MICROCODE: -+ return old_microcode_show_state(buf); -+ - case X86_BUG_ITS: - return its_show_state(buf); - -@@ -3219,6 +3230,11 @@ ssize_t cpu_show_reg_file_data_sampling( - return cpu_show_common(dev, attr, buf, X86_BUG_RFDS); - } - -+ssize_t cpu_show_old_microcode(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_common(dev, attr, buf, X86_BUG_OLD_MICROCODE); -+} -+ - ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_attribute *attr, char *buf) - { - return cpu_show_common(dev, attr, buf, X86_BUG_ITS); ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1352,10 +1352,52 @@ static bool __init vulnerable_to_its(u64 - return false; - } - -+static struct x86_cpu_id cpu_latest_microcode[] = { -+#include "microcode/intel-ucode-defs.h" -+ {} -+}; -+ -+static bool __init cpu_has_old_microcode(void) -+{ -+ const struct x86_cpu_id *m = x86_match_cpu(cpu_latest_microcode); -+ -+ /* Give unknown CPUs a pass: */ -+ if (!m) { -+ /* Intel CPUs should be in the list. Warn if not: */ -+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) -+ pr_info("x86/CPU: Model not found in latest microcode list\n"); -+ return false; -+ } -+ -+ /* -+ * Hosts usually lie to guests with a super high microcode -+ * version. Just ignore what hosts tell guests: -+ */ -+ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) -+ return false; -+ -+ /* Consider all debug microcode to be old: */ -+ if (boot_cpu_data.microcode & BIT(31)) -+ return true; -+ -+ /* Give new microcode a pass: */ -+ if (boot_cpu_data.microcode >= m->driver_data) -+ return false; -+ -+ /* Uh oh, too old: */ -+ return true; -+} -+ - static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - { - u64 x86_arch_cap_msr = x86_read_arch_cap_msr(); - -+ if (cpu_has_old_microcode()) { -+ pr_warn("x86/CPU: Running old microcode\n"); -+ setup_force_cpu_bug(X86_BUG_OLD_MICROCODE); -+ add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); -+ } -+ - /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */ - if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) && - !(x86_arch_cap_msr & ARCH_CAP_PSCHANGE_MC_NO)) ---- /dev/null -+++ b/arch/x86/kernel/cpu/microcode/intel-ucode-defs.h -@@ -0,0 +1,150 @@ -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x03, .steppings = 0x0004, .driver_data = 0x2 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x05, .steppings = 0x0001, .driver_data = 0x45 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x05, .steppings = 0x0002, .driver_data = 0x40 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x05, .steppings = 0x0004, .driver_data = 0x2c }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x05, .steppings = 0x0008, .driver_data = 0x10 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x06, .steppings = 0x0001, .driver_data = 0xa }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x06, .steppings = 0x0020, .driver_data = 0x3 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x06, .steppings = 0x0400, .driver_data = 0xd }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x06, .steppings = 0x2000, .driver_data = 0x7 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x07, .steppings = 0x0002, .driver_data = 0x14 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x07, .steppings = 0x0004, .driver_data = 0x38 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x07, .steppings = 0x0008, .driver_data = 0x2e }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x08, .steppings = 0x0002, .driver_data = 0x11 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x08, .steppings = 0x0008, .driver_data = 0x8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x08, .steppings = 0x0040, .driver_data = 0xc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x08, .steppings = 0x0400, .driver_data = 0x5 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x09, .steppings = 0x0020, .driver_data = 0x47 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0a, .steppings = 0x0001, .driver_data = 0x3 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0a, .steppings = 0x0002, .driver_data = 0x1 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0b, .steppings = 0x0002, .driver_data = 0x1d }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0b, .steppings = 0x0010, .driver_data = 0x2 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0d, .steppings = 0x0040, .driver_data = 0x18 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0e, .steppings = 0x0100, .driver_data = 0x39 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0e, .steppings = 0x1000, .driver_data = 0x59 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x0004, .driver_data = 0x5d }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x0040, .driver_data = 0xd2 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x0080, .driver_data = 0x6b }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x0400, .driver_data = 0x95 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x0800, .driver_data = 0xbc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x0f, .steppings = 0x2000, .driver_data = 0xa4 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x16, .steppings = 0x0002, .driver_data = 0x44 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x17, .steppings = 0x0040, .driver_data = 0x60f }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x17, .steppings = 0x0080, .driver_data = 0x70a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x17, .steppings = 0x0400, .driver_data = 0xa0b }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1a, .steppings = 0x0010, .driver_data = 0x12 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1a, .steppings = 0x0020, .driver_data = 0x1d }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1c, .steppings = 0x0004, .driver_data = 0x219 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1c, .steppings = 0x0400, .driver_data = 0x107 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1d, .steppings = 0x0002, .driver_data = 0x29 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x1e, .steppings = 0x0020, .driver_data = 0xa }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x25, .steppings = 0x0004, .driver_data = 0x11 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x25, .steppings = 0x0020, .driver_data = 0x7 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x26, .steppings = 0x0002, .driver_data = 0x105 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2a, .steppings = 0x0080, .driver_data = 0x2f }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2c, .steppings = 0x0004, .driver_data = 0x1f }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2d, .steppings = 0x0040, .driver_data = 0x621 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2d, .steppings = 0x0080, .driver_data = 0x71a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2e, .steppings = 0x0040, .driver_data = 0xd }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x2f, .steppings = 0x0004, .driver_data = 0x3b }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x37, .steppings = 0x0100, .driver_data = 0x838 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x37, .steppings = 0x0200, .driver_data = 0x90d }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3a, .steppings = 0x0200, .driver_data = 0x21 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3c, .steppings = 0x0008, .driver_data = 0x28 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3d, .steppings = 0x0010, .driver_data = 0x2f }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3e, .steppings = 0x0010, .driver_data = 0x42e }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3e, .steppings = 0x0040, .driver_data = 0x600 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3e, .steppings = 0x0080, .driver_data = 0x715 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3f, .steppings = 0x0004, .driver_data = 0x49 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x3f, .steppings = 0x0010, .driver_data = 0x1a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x45, .steppings = 0x0002, .driver_data = 0x26 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x46, .steppings = 0x0002, .driver_data = 0x1c }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x47, .steppings = 0x0002, .driver_data = 0x22 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x4c, .steppings = 0x0008, .driver_data = 0x368 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x4c, .steppings = 0x0010, .driver_data = 0x411 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x4d, .steppings = 0x0100, .driver_data = 0x12d }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x4e, .steppings = 0x0008, .driver_data = 0xf0 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0008, .driver_data = 0x1000191 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0010, .driver_data = 0x2007006 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0020, .driver_data = 0x3000010 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0040, .driver_data = 0x4003605 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0080, .driver_data = 0x5003707 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x55, .steppings = 0x0800, .driver_data = 0x7002904 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x56, .steppings = 0x0004, .driver_data = 0x1c }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x56, .steppings = 0x0008, .driver_data = 0x700001c }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x56, .steppings = 0x0010, .driver_data = 0xf00001a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x56, .steppings = 0x0020, .driver_data = 0xe000015 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x5c, .steppings = 0x0004, .driver_data = 0x14 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x5c, .steppings = 0x0200, .driver_data = 0x48 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x5c, .steppings = 0x0400, .driver_data = 0x28 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x5e, .steppings = 0x0008, .driver_data = 0xf0 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x5f, .steppings = 0x0002, .driver_data = 0x3e }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x66, .steppings = 0x0008, .driver_data = 0x2a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x6a, .steppings = 0x0020, .driver_data = 0xc0002f0 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x6a, .steppings = 0x0040, .driver_data = 0xd0003e7 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x6c, .steppings = 0x0002, .driver_data = 0x10002b0 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x7a, .steppings = 0x0002, .driver_data = 0x42 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x7a, .steppings = 0x0100, .driver_data = 0x24 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x7e, .steppings = 0x0020, .driver_data = 0xc6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8a, .steppings = 0x0002, .driver_data = 0x33 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8c, .steppings = 0x0002, .driver_data = 0xb8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8c, .steppings = 0x0004, .driver_data = 0x38 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8d, .steppings = 0x0002, .driver_data = 0x52 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8e, .steppings = 0x0200, .driver_data = 0xf6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8e, .steppings = 0x0400, .driver_data = 0xf6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8e, .steppings = 0x0800, .driver_data = 0xf6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8e, .steppings = 0x1000, .driver_data = 0xfc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8f, .steppings = 0x0100, .driver_data = 0x2c000390 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8f, .steppings = 0x0080, .driver_data = 0x2b000603 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8f, .steppings = 0x0040, .driver_data = 0x2c000390 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8f, .steppings = 0x0020, .driver_data = 0x2c000390 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x8f, .steppings = 0x0010, .driver_data = 0x2c000390 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x96, .steppings = 0x0002, .driver_data = 0x1a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x97, .steppings = 0x0004, .driver_data = 0x37 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x97, .steppings = 0x0020, .driver_data = 0x37 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xbf, .steppings = 0x0004, .driver_data = 0x37 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xbf, .steppings = 0x0020, .driver_data = 0x37 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9a, .steppings = 0x0008, .driver_data = 0x435 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9a, .steppings = 0x0010, .driver_data = 0x435 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9c, .steppings = 0x0001, .driver_data = 0x24000026 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9e, .steppings = 0x0200, .driver_data = 0xf8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9e, .steppings = 0x0400, .driver_data = 0xf8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9e, .steppings = 0x0800, .driver_data = 0xf6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9e, .steppings = 0x1000, .driver_data = 0xf8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0x9e, .steppings = 0x2000, .driver_data = 0x100 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa5, .steppings = 0x0004, .driver_data = 0xfc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa5, .steppings = 0x0008, .driver_data = 0xfc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa5, .steppings = 0x0020, .driver_data = 0xfc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa6, .steppings = 0x0001, .driver_data = 0xfe }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa6, .steppings = 0x0002, .driver_data = 0xfc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xa7, .steppings = 0x0002, .driver_data = 0x62 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xaa, .steppings = 0x0010, .driver_data = 0x20 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xb7, .steppings = 0x0002, .driver_data = 0x12b }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xba, .steppings = 0x0004, .driver_data = 0x4123 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xba, .steppings = 0x0008, .driver_data = 0x4123 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xba, .steppings = 0x0100, .driver_data = 0x4123 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xbe, .steppings = 0x0001, .driver_data = 0x1a }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xcf, .steppings = 0x0004, .driver_data = 0x21000283 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0x6, .model = 0xcf, .steppings = 0x0002, .driver_data = 0x21000283 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x00, .steppings = 0x0080, .driver_data = 0x12 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x00, .steppings = 0x0400, .driver_data = 0x15 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x01, .steppings = 0x0004, .driver_data = 0x2e }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x02, .steppings = 0x0010, .driver_data = 0x21 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x02, .steppings = 0x0020, .driver_data = 0x2c }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x02, .steppings = 0x0040, .driver_data = 0x10 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x02, .steppings = 0x0080, .driver_data = 0x39 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x02, .steppings = 0x0200, .driver_data = 0x2f }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x03, .steppings = 0x0004, .driver_data = 0xa }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x03, .steppings = 0x0008, .driver_data = 0xc }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x03, .steppings = 0x0010, .driver_data = 0x17 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0002, .driver_data = 0x17 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0008, .driver_data = 0x5 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0010, .driver_data = 0x6 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0080, .driver_data = 0x3 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0100, .driver_data = 0xe }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0200, .driver_data = 0x3 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x04, .steppings = 0x0400, .driver_data = 0x4 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x06, .steppings = 0x0004, .driver_data = 0xf }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x06, .steppings = 0x0010, .driver_data = 0x4 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x06, .steppings = 0x0020, .driver_data = 0x8 }, -+{ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, .vendor = X86_VENDOR_INTEL, .family = 0xf, .model = 0x06, .steppings = 0x0100, .driver_data = 0x9 }, ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -600,6 +600,7 @@ CPU_SHOW_VULN_FALLBACK(spec_rstack_overf - CPU_SHOW_VULN_FALLBACK(gds); - CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling); - CPU_SHOW_VULN_FALLBACK(ghostwrite); -+CPU_SHOW_VULN_FALLBACK(old_microcode); - CPU_SHOW_VULN_FALLBACK(indirect_target_selection); - - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); -@@ -617,6 +618,7 @@ static DEVICE_ATTR(spec_rstack_overflow, - static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); - static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); - static DEVICE_ATTR(ghostwrite, 0444, cpu_show_ghostwrite, NULL); -+static DEVICE_ATTR(old_microcode, 0444, cpu_show_old_microcode, NULL); - static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { -@@ -635,6 +637,7 @@ static struct attribute *cpu_root_vulner - &dev_attr_gather_data_sampling.attr, - &dev_attr_reg_file_data_sampling.attr, - &dev_attr_ghostwrite.attr, -+ &dev_attr_old_microcode.attr, - &dev_attr_indirect_target_selection.attr, - NULL - }; ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -78,6 +78,8 @@ extern ssize_t cpu_show_gds(struct devic - extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_ghostwrite(struct device *dev, struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_old_microcode(struct device *dev, -+ struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_indirect_target_selection(struct device *dev, - struct device_attribute *attr, char *buf); - diff --git a/debian/patches/series b/debian/patches/series index fb904c7..74b4505 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -69,7 +69,6 @@ features/x86/x86-make-x32-syscall-support-conditional.patch # Miscellaneous bug fixes bugfix/all/disable-some-marvell-phys.patch bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch -bugfix/all/Revert-mmc-sdhci-Disable-SD-card-clock-before-changi.patch # Miscellaneous features @@ -140,8 +139,6 @@ patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch -patchset-pf/smb/0001-cifs-all-initializations-for-tcon-should-happen-in-t.patch - patchset-xanmod/binder/0001-binder-turn-into-module.patch patchset-xanmod/clearlinux/0001-sched-wait-Do-accept-in-LIFO-order-for-cache-efficie.patch @@ -231,7 +228,6 @@ patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patc patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch -patchset-pf/fixes/0009-anon_inode-rework-assertions.patch +patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch patchset-zen/fixes/0001-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch -patchset-zen/fixes/0002-x86-cpu-Help-users-notice-when-running-old-Intel-mic.patch