[devel-6.6] Backported patches of Transient Scheduler Attacks (TSA) for OpenAnolis · Pull Request !5654 · anolis/cloud-kernel

bugzilla:https://bugzilla.openanolis.cn/show_bug.cgi?id=24072

Transient schedular Attack (TSA) patches for openAnolis 6.6 kernel: 
 
cpufreq: intel_pstate: Update hybrid scaling factor for Meteor Lake 
EDAC/i10nm: Add Intel Grand Ridge micro-server support 
cpufreq: intel_pstate: Update default EPPs for Meteor Lake 
x86/CPU/AMD: Improve the erratum 1386 workaround 
x86/bugs: Switch to new Intel CPU model defines 
x86/apic: Switch to new Intel CPU model defines 
x86/aperfmperf: Switch to new Intel CPU model defines 
EDAC/i10nm: Switch to new Intel CPU model defines 
EDAC/skx: Switch to new Intel CPU model defines 
cpufreq: Switch to new Intel CPU model defines 
cpufreq: intel_pstate: Switch to new Intel CPU model defines 
platform/x86/intel/ifs: Switch to new Intel CPU model defines 
x86/cpu: Introduce new microcode matching helper 
x86/cpu: Expose only stepping min/max interface 
x86/cpu: Shorten CPU matching macro 
x86/bugs: Rename MDS machinery to something more generic 
x86/bugs: Add a Transient Scheduler Attacks mitigation 
KVM: VMX: Split off hyperv_evmcs.{ch} 
KVM: nVMX: Split off helper for emulating VMCLEAR on Hyper-V eVMCS 
KVM: x86: Make Hyper-V emulation optional 
KVM: x86: Advertise AVX10.1 CPUID to userspace 
KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() 
KVM: x86: Explicitly do runtime CPUID updates "after" initial setup 
KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 
KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps 
KVM: SVM: Advertise TSA CPUID bits to guests 
x86/microcode/AMD: Add TSA microcode SHAs 
x86/process: Move the buffer clearing before MONITOR 
 
Unit test Results:

* Add tsa=on | off | user | vm to the kernel command line in /etc/default/grub 
* Run the following command to check TSA support: 
 
[amd@titanite-hostos ~]$ uname -r 
6.6.88tsa_patches+

Test Case 1: tsa=on
[amd@titanite-hostos ~]$ lscpu | grep -i tsa 
Vulnerability Tsa:                    Mitigation; Clear CPU buffers
 
[amd@titanite-hostos ~]$ grep . /sys/devices/system/cpu/vulnerabilities/t* 
/sys/devices/system/cpu/vulnerabilities/tsa:Mitigation: Clear CPU buffers

Test Case 2 : tsa=off

[amd@titanite-hostos ~]$ dmesg | grep tsa=off
[    0.000000] Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.6.88tsa_patches+ root=/dev/mapper/ao_anolis-root ro crashkernel=0M-2G:0M,2G-8G:192M,8G-128G:256M,128G-376G:384M,376G-:448M cgroup.memory=nokmem resume=UUID=cc7c14df-187a-43be-bd6a-5191660c5ba0 rd.lvm.lv=ao_anolis/root rd.lvm.lv=ao_anolis/swap rhgb quiet tsa=off

[amd@titanite-hostos ~]$ lscpu | grep -i tsa
Vulnerability Tsa:                    Vulnerable

Test case 3 : tsa=user

[root@titanite-hostos amd]# dmesg | grep tsa=user
[    0.000000] Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.6.88tsa_patches+ root=/dev/mapper/ao_anolis-root ro crashkernel=0M-2G:0M,2G-8G:192M,8G-128G:256M,128G-376G:384M,376G-:448M cgroup.memory=nokmem resume=UUID=cc7c14df-187a-43be-bd6a-5191660c5ba0 rd.lvm.lv=ao_anolis/root rd.lvm.lv=ao_anolis/swap rhgb quiet tsa=user

[root@titanite-hostos amd]# lscpu | grep -i tsa
Vulnerability Tsa:                    Mitigation; Clear CPU buffers user/kernel boundary

Test case 4 : tsa=vm

[amd@titanite-hostos ~]$ dmesg | grep tsa=vm
[    0.000000] Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.6.88tsa_patches+ root=/dev/mapper/ao_anolis-root ro crashkernel=0M-2G:0M,2G-8G:192M,8G-128G:256M,128G-376G:384M,376G-:448M cgroup.memory=nokmem resume=UUID=cc7c14df-187a-43be-bd6a-5191660c5ba0 rd.lvm.lv=ao_anolis/root rd.lvm.lv=ao_anolis/swap rhgb quiet tsa=vm

[amd@titanite-hostos ~]$ lscpu | grep -i tsa
Vulnerability Tsa:                    Mitigation; Clear CPU buffers VM

类型	指派人员	状态
审查	Guanjun xunlei 半叶枫尘 Artie Ding winterddd xueshuai guobin 冯光辉 Guixin Liu health_jay kun-llfl MinLi Xuchun Shang	已完成 (0/0人)
测试	小龙	进行中 (0/1人)

GVPanolis/cloud-kernel

搜索帮助

GVP anolis/cloud-kernel