-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 08 Aug 2023 02:33:54 +0200 Source: linux Architecture: source Version: 5.10.179-4 Distribution: bullseye-security Urgency: high Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: Ben Hutchings <benh@debian.org> Changes: linux (5.10.179-4) bullseye-security; urgency=high . [ Salvatore Bonaccorso ] * [x86] Add mitigations for Gather Data Sampling (GDS) (CVE-2022-40982) - init: Provide arch_cpu_finalize_init() - x86/cpu: Switch to arch_cpu_finalize_init() - ARM: cpu: Switch to arch_cpu_finalize_init() - ia64/cpu: Switch to arch_cpu_finalize_init() - m68k/cpu: Switch to arch_cpu_finalize_init() - mips/cpu: Switch to arch_cpu_finalize_init() - sh/cpu: Switch to arch_cpu_finalize_init() - sparc/cpu: Switch to arch_cpu_finalize_init() - um/cpu: Switch to arch_cpu_finalize_init() - init: Remove check_bugs() leftovers - init: Invoke arch_cpu_finalize_init() earlier - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() - x86/fpu: Remove cpuinfo argument from init functions - x86/fpu: Mark init functions __init - x86/fpu: Move FPU initialization into arch_cpu_finalize_init() - x86/speculation: Add Gather Data Sampling mitigation - x86/speculation: Add force option to GDS mitigation - x86/speculation: Add Kconfig option for GDS - KVM: Add GDS_NO support to KVM - x86/xen: Fix secondary processors' FPU initialization - x86/mm: fix poking_init() for Xen PV guests - x86/mm: Use mm_alloc() in poking_init() - mm: Move mm_cachep initialization to mm_init() - x86/mm: Initialize text poking earlier . [ Ben Hutchings ] * Documentation/x86: Fix backwards on/off logic about YMM support * [x86] Add a Speculative RAS Overflow (SRSO) mitigation (CVE-2023-20569) - x86/cpu: Add VM page flush MSR availablility as a CPUID feature - x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX] - tools headers cpufeatures: Sync with the kernel sources - x86/bugs: Increase the x86 bugs vector size to two u32s - x86/cpu, kvm: Add support for CPUID_80000021_EAX - x86/srso: Add a Speculative RAS Overflow mitigation - x86/srso: Add IBPB_BRTYPE support - x86/srso: Add SRSO_NO support - x86/srso: Add IBPB - x86/srso: Add IBPB on VMEXIT - x86/srso: Fix return thunks in generated code - x86/srso: Tie SBPB bit setting to microcode patch detection * Bump ABI to 24 Checksums-Sha1: bc50e188d258594af3630116016ff0642bd69cc6 197083 linux_5.10.179-4.dsc 8d554fa7402b9a12a323dc10417a42f014727482 1637092 linux_5.10.179-4.debian.tar.xz cdb3c42f58d4973ac7121bb697fb0d4f2416fef6 6115 linux_5.10.179-4_source.buildinfo Checksums-Sha256: f5d2fe8a53301e6c26f9d81f9a80cc047c1e92c91c382835f79201e055c3fa57 197083 linux_5.10.179-4.dsc 7723a0c1d1e92bd1a5f4f2609acc7d47c0fb17cecb904aaec77fad2752cc7092 1637092 linux_5.10.179-4.debian.tar.xz 2074bf3c81d6c00720657d8db43685ba07ade91ab5b93a2f6f30153ffdcffe4f 6115 linux_5.10.179-4_source.buildinfo Files: 3efdce1e6387285a3412ed102c161927 197083 kernel optional linux_5.10.179-4.dsc a1f51d3f47f2d284ca83bdeb2b191a30 1637092 kernel optional linux_5.10.179-4.debian.tar.xz 275d91aaf2ad32912ad948c065ed3994 6115 kernel optional linux_5.10.179-4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmTRqRMACgkQ57/I7JWG EQnr4RAA1VXKe1HHJh/fv0enHrfjf9HwaHK4pq1o6w2XA9U6Z9fnn70VSOnAL0J5 9JqJrVuv6dMpVM8Ghu/Iiq5CLFtUAKrrqLLUetU8AXOd4BUSZsgH50T219YUto3/ bA29LnAvGPFM7owSanghpYSrQjxQtQuTlL77oj2Pvm7ZRBCEMR3z9+pX5rku5v// nbq/sm4O5TGTfMAQWQiwdSTW+GHQ087TmB0I7OTf1ftIIsjVTLWzR9zpoUbCUYoH 5Hm5uAti51NlmAprJ46SUMVIbVnf92v+tRKy23Vic0uUkzFLAIfjJEBFc4pDiQXO QodTAWWO2Qs9S1f++uSQYw1SfrGzrCuYe4oHQiNyV8XCMHkFSxvYwV1UyULp4Ok6 Ba3cu6xevZBdOtgCguYfkSyX6dA6jOd7YfGAli7k9F41N3CQaWu7yR46SWVxTTxP 2wbC70X39TVsCWNY8lv6mUV/HrE8kcwSBeq9+lXFI/NARbTI43F+d57Pu6fMmWpo DgJDj7vidK+KQMHTF6iLAlDD16e5mzrBMsGxLRPD0j2joCS9NBriPJ+aMQ1MB2hS guOG8voWNb/GE8R1haEGOBGu245K9NiEOpGOHpummVUqgOmzL+pyR8gyccLLBPxJ PlX3KQsfMzAH7Yi0MymyV2vhqYgi1Vs/wpGCfJOGSVTl/Byz0eo= =2WVX -----END PGP SIGNATURE-----
