[OLK-6.6] Backported patches of Transient Scheduler Attacks (TSA) · Pull Request !17676 · openEuler/kernel

Transient schedular Attack (TSA) patches for openEuler 6.6 kernel:

KVM: VMX: Split off hyperv_evmcs.{ch}
KVM: nVMX: Split off helper for emulating VMCLEAR on Hyper-V eVMCS
KVM: x86: Make Hyper-V emulation optional
cpufreq: intel_pstate: Update hybrid scaling factor for Meteor Lake
EDAC/i10nm: Add Intel Grand Ridge micro-server support
cpufreq: intel_pstate: Update default EPPs for Meteor Lake
x86/CPU/AMD: Improve the erratum 1386 workaround
x86/bugs: Switch to new Intel CPU model defines
x86/apic: Switch to new Intel CPU model defines
x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h
x86/aperfmperf: Switch to new Intel CPU model defines
EDAC/i10nm: Switch to new Intel CPU model defines
EDAC/skx: Switch to new Intel CPU model defines
cpufreq: Switch to new Intel CPU model defines
cpufreq: intel_pstate: Switch to new Intel CPU model defines
KVM: x86: Advertise AVX10.1 CPUID to userspace
x86/cpu: Introduce new microcode matching helper
x86/cpu: Expose only stepping min/max interface
KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init()
KVM: x86: Explicitly do runtime CPUID updates "after" initial setup
KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2
KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps
x86/cpu: Shorten CPU matching macro
x86/idle: Use MONITOR and MWAIT mnemonics in <asm/mwait.h>
x86/bugs: Rename MDS machinery to something more generic
x86/bugs: Add a Transient Scheduler Attacks mitigation
KVM: SVM: Advertise TSA CPUID bits to guests
x86/microcode: Rework early revisions reporting
x86/microcode/AMD: Flush patch buffer mapping after application
x86/microcode/AMD: Have __apply_microcode_amd() return bool
x86/microcode/AMD: Avoid -Wformat warning with clang-15
x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID
x86/microcode/AMD: Remove ret local var in early_apply_microcode()
x86/microcode/AMD: Remove unused save_microcode_in_initrd_amd() declarations
x86/microcode/AMD: Merge early_apply_microcode() into its single callsite
x86/microcode/AMD: Add get_patch_level()
x86/microcode/AMD: Load only SHA256-checksummed patches
x86/microcode/AMD: Add TSA microcode SHAs
x86/process: Move the buffer clearing before MONITOR
platform/x86/intel/ifs: Switch to new Intel CPU model defines

Unit test Results:
* Add tsa=on | off | user | vm to the kernel command line in /etc/default/grub
* Run the following command to check TSA support:

Test case 1: tsa=on

[amd@localhost ~]$ sudo dmesg | grep tsa=on
[sudo] password for amd:
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.6.0tsa_patches+ root=/dev/mapper/openeuler-root resume=UUID=087d4cec-3801-4b8a-90fd-7ef6789b065f rd.lvm.lv=openeuler/root rd.lvm.lv=openeuler/swap cgroup_disable=files apparmor=0 crashkernel=512M tsa=on mem_encrypt=on iommu=on kvm_amd.sev=1

[amd@localhost ~]$ lscpu | grep -i tsa
Vulnerability Tsa:                    Mitigation; Clear CPU buffers
[amd@localhost ~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/tsa:Mitigation: Clear CPU buffers
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected

Test case 2: tsa=off

[amd@localhost ~]$ sudo dmesg | grep tsa=off
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.6.0tsa_patches+ root=/dev/mapper/openeuler-root resume=UUID=087d4cec-3801-4b8a-90fd-7ef6789b065f rd.lvm.lv=openeuler/root rd.lvm.lv=openeuler/swap cgroup_disable=files apparmor=0 crashkernel=512M tsa=off mem_encrypt=on iommu=on kvm_amd.sev=1

[amd@localhost ~]$ lscpu | grep -i tsa
Vulnerability Tsa:                    Vulnerable

Test case 3: tsa=user

[amd@localhost ~]$ dmesg | grep tsa=user
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.6.0tsa_patches+ root=/dev/mapper/openeuler-root resume=UUID=087d4cec-3801-4b8a-90fd-7ef6789b065f rd.lvm.lv=openeuler/root rd.lvm.lv=openeuler/swap cgroup_disable=files apparmor=0 crashkernel=512M tsa=user mem_encrypt=on iommu=on kvm_amd.sev=1

[amd@localhost ~]$  lscpu | grep -i tsa
Vulnerability Tsa:                    Mitigation; Clear CPU buffers user/kernel boundary

Test case 4: tsa=vm

[amd@localhost ~]$ dmesg | grep tsa=vm
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.6.0tsa_patches+ root=/dev/mapper/openeuler-root resume=UUID=087d4cec-3801-4b8a-90fd-7ef6789b065f rd.lvm.lv=openeuler/root rd.lvm.lv=openeuler/swap cgroup_disable=files apparmor=0 crashkernel=512M tsa=vm mem_encrypt=on iommu=on kvm_amd.sev=1

[amd@localhost ~]$ lscpu | grep -i tsa
Vulnerability Tsa:                    Mitigation; Clear CPU buffers VM

GVPopenEuler/kernel

搜索帮助

GVP openEuler/kernel