Format: 1.8
Date: Fri, 12 Jan 2018 14:48:15 -0800
Source: linux-aws
Binary: linux-aws-headers-4.4.0-1011 linux-aws-tools-4.4.0-1011 linux-aws-cloud-tools-4.4.0-1011 linux-image-4.4.0-1011-aws linux-image-extra-4.4.0-1011-aws linux-headers-4.4.0-1011-aws linux-image-4.4.0-1011-aws-dbgsym linux-tools-4.4.0-1011-aws linux-cloud-tools-4.4.0-1011-aws linux-aws-udebs-aws
Architecture: source
Version: 4.4.0-1011.11
Distribution: trusty
Urgency: low
Maintainer: Ubuntu Kernel Team <kernel-team@lists.ubuntu.com>
Changed-By: Kamal Mostafa <kamal@canonical.com>
Description:
 linux-aws-cloud-tools-4.4.0-1011 - Linux kernel version specific cloud tools for version 4.4.0-1011
 linux-aws-headers-4.4.0-1011 - Header files related to Linux kernel version 4.4.0
 linux-aws-tools-4.4.0-1011 - Linux kernel version specific tools for version 4.4.0-1011
 linux-aws-udebs-aws - Metapackage depending on kernel udebs (udeb)
 linux-cloud-tools-4.4.0-1011-aws - Linux kernel version specific cloud tools for version 4.4.0-1011
 linux-headers-4.4.0-1011-aws - Linux kernel headers for version 4.4.0 on 64 bit x86 SMP
 linux-image-4.4.0-1011-aws - Linux kernel image for version 4.4.0 on 64 bit x86 SMP
 linux-image-4.4.0-1011-aws-dbgsym - Linux kernel debug image for version 4.4.0 on 64 bit x86 SMP
 linux-image-extra-4.4.0-1011-aws - Linux kernel extra modules for version 4.4.0 on 64 bit x86 SMP
 linux-tools-4.4.0-1011-aws - Linux kernel version specific tools for version 4.4.0-1011
Launchpad-Bugs-Fixed: 1742771 1742772 1742995 1742998
Changes:
 linux-aws (4.4.0-1011.11) trusty; urgency=low
 .
   * linux-aws: 4.4.0-1011.11 -proposed tracker (LP: #1742998)
 .
   [ Ubuntu: 4.4.0-110.133 ]
 .
   * linux: 4.4.0-110.133 -proposed tracker (LP: #1742995)
   * CVE-2017-5753
     - x86/microcode/AMD: Add support for fam17h microcode loading
     - bpf: add bpf_patch_insn_single helper
     - bpf: prepare bpf_int_jit_compile/bpf_prog_select_runtime apis
     - bpf: add generic constant blinding for use in jits
     - locking/barriers: introduce new memory barrier gmb()
     - bpf: prevent speculative execution in eBPF interpreter
     - x86, bpf, jit: prevent speculative execution when JIT is enabled
     - uvcvideo: prevent speculative execution
     - carl9170: prevent speculative execution
     - qla2xxx: prevent speculative execution
     - Thermal/int340x: prevent speculative execution
     - userns: prevent speculative execution
     - ipv6: prevent speculative execution
     - fs: prevent speculative execution
     - net: mpls: prevent speculative execution
     - udf: prevent speculative execution
     - x86/feature: Enable the x86 feature to control Speculation
     - x86/feature: Report presence of IBPB and IBRS control
     - x86/enter: MACROS to set/clear IBRS and set IBPB
     - x86/enter: Use IBRS on syscall and interrupts
     - x86/idle: Disable IBRS entering idle and enable it on wakeup
     - x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup
     - x86/mm: Set IBPB upon context switch
     - x86/mm: Only set IBPB when the new thread cannot ptrace current thread
     - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform
     - x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm
     - x86/kvm: Set IBPB when switching VM
     - x86/kvm: Toggle IBRS on VM entry and exit
     - x86/kvm: Pad RSB on VM transition
     - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature
     - x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb control
     - x86/syscall: Clear unused extra registers on syscall entrance
     - x86/syscall: Clear unused extra registers on 32-bit compatible syscall
       entrance
     - x86/entry: Use retpoline for syscall's indirect calls
     - x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR
     - x86/cpu/AMD: Add speculative control support for AMD
     - x86/microcode: Extend post microcode reload to support IBPB feature
     - KVM: SVM: Do not intercept new speculative control MSRs
     - x86/svm: Set IBRS value on VM entry and exit
     - x86/svm: Set IBPB when running a different VCPU
     - KVM: x86: Add speculative control CPUID support for guests
     - x86/svm: Add code to clobber the RSB on VM exit
     - x86/svm: Add code to clear registers on VM exit
     - x86/cpu/AMD: Make the LFENCE instruction serialized
     - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
     - powerpc: add gmb barrier
     - s390/spinlock: add gmb memory barrier
     - SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit
     - arm64: no gmb() implementation yet
     - arm: no gmb() implementation yet
   * CVE-2017-5715
     - x86/microcode/AMD: Add support for fam17h microcode loading
     - bpf: add bpf_patch_insn_single helper
     - bpf: prepare bpf_int_jit_compile/bpf_prog_select_runtime apis
     - bpf: add generic constant blinding for use in jits
     - locking/barriers: introduce new memory barrier gmb()
     - bpf: prevent speculative execution in eBPF interpreter
     - x86, bpf, jit: prevent speculative execution when JIT is enabled
     - uvcvideo: prevent speculative execution
     - carl9170: prevent speculative execution
     - qla2xxx: prevent speculative execution
     - Thermal/int340x: prevent speculative execution
     - userns: prevent speculative execution
     - ipv6: prevent speculative execution
     - fs: prevent speculative execution
     - net: mpls: prevent speculative execution
     - udf: prevent speculative execution
     - x86/feature: Enable the x86 feature to control Speculation
     - x86/feature: Report presence of IBPB and IBRS control
     - x86/enter: MACROS to set/clear IBRS and set IBPB
     - x86/enter: Use IBRS on syscall and interrupts
     - x86/idle: Disable IBRS entering idle and enable it on wakeup
     - x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup
     - x86/mm: Set IBPB upon context switch
     - x86/mm: Only set IBPB when the new thread cannot ptrace current thread
     - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform
     - x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm
     - x86/kvm: Set IBPB when switching VM
     - x86/kvm: Toggle IBRS on VM entry and exit
     - x86/kvm: Pad RSB on VM transition
     - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature
     - x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb control
     - x86/syscall: Clear unused extra registers on syscall entrance
     - x86/syscall: Clear unused extra registers on 32-bit compatible syscall
       entrance
     - x86/entry: Use retpoline for syscall's indirect calls
     - x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR
     - x86/cpu/AMD: Add speculative control support for AMD
     - x86/microcode: Extend post microcode reload to support IBPB feature
     - KVM: SVM: Do not intercept new speculative control MSRs
     - x86/svm: Set IBRS value on VM entry and exit
     - x86/svm: Set IBPB when running a different VCPU
     - KVM: x86: Add speculative control CPUID support for guests
     - x86/svm: Add code to clobber the RSB on VM exit
     - x86/svm: Add code to clear registers on VM exit
     - x86/cpu/AMD: Make the LFENCE instruction serialized
     - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
     - powerpc: add gmb barrier
     - s390/spinlock: add gmb memory barrier
     - SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit
     - arm64: no gmb() implementation yet
     - arm: no gmb() implementation yet
   * powerpc: flush L1D on return to use (LP: #1742772)
     - SAUCE: powerpc: Secure memory rfi flush
     - SAUCE: rfi-flush: Make DEBUG_RFI a CONFIG option
     - SAUCE: rfi-flush: Add HRFI_TO_UNKNOWN and use it in denorm
     - SAUCE: Fixup rfid in kvmppc_skip_Hinterrupt should be hrfid
     - SAUCE: rfi-flush: kvmppc_skip_(H)interrupt returns to host
     - SAUCE: KVM: Revert the implementation of H_GET_CPU_CHARACTERISTICS
     - SAUCE: rfi-flush: Implement congruence-first fallback flush
     - SAUCE: rfi-flush: Make l1d_flush_type bit flags
     - SAUCE: rfi-flush: Push the instruction selection down to the patching
       routine
     - SAUCE: rfi-flush: Expand the RFI section to two nop slots
     - SAUCE: rfi-flush: Support more than one flush type at once
     - SAUCE: rfi-flush: Allow HV to advertise multiple flush types
     - SAUCE: rfi-flush: Add speculation barrier before ori 30,30,0 flush
     - SAUCE: powerpc/asm: Allow including ppc_asm.h in asm files
     - SAUCE: Remove setup.h include file otherwise compilation complains about
       missing header file.
     - SAUCE: Fix compilation errors for arch/powerpc/lib/feature-fixups.c
     - SAUCE: rfi-flush: Add barriers to the fallback L1D flushing
     - SAUCE: rfi-flush: Rework powernv logic to be more cautious
     - SAUCE: rfi-flush: Rework pseries logic to be more cautious
     - SAUCE: rfi-flush: Fix the fallback flush to actually activate
     - SAUCE: rfi-flush: Fix HRFI_TO_UNKNOWN
     - SAUCE: rfi-flush: Refactor the macros so the nops are defined once
     - SAUCE: rfi-flush: Add no_rfi_flush and nopti comandline options
     - SAUCE: rfi-flush: Use rfi-flush in printks
     - SAUCE: rfi-flush: Fallback flush add load dependency
     - SAUCE: rfi-flush: Fix the 32-bit KVM build
     - SAUCE: rfi-flush: Fix some RFI conversions in the KVM code
     - SAUCE: UBUNTU: [Config] Disable CONFIG_PPC_DEBUG_RFI
   * s390: add ppa to kernel entry/exit (LP: #1742771)
     - s390: introduce CPU alternatives
     - s390: add ppa to kernel entry / exit
   * CVE-2017-5754
     - x86/tlb: Drop the _GPL from the cpu_tlbstate export
     - Map the vsyscall page with _PAGE_USER
     - s390: introduce CPU alternatives
     - s390: add ppa to kernel entry / exit
     - SAUCE: powerpc: Secure memory rfi flush
     - SAUCE: rfi-flush: Make DEBUG_RFI a CONFIG option
     - SAUCE: rfi-flush: Add HRFI_TO_UNKNOWN and use it in denorm
     - SAUCE: Fixup rfid in kvmppc_skip_Hinterrupt should be hrfid
     - SAUCE: rfi-flush: kvmppc_skip_(H)interrupt returns to host
     - SAUCE: KVM: Revert the implementation of H_GET_CPU_CHARACTERISTICS
     - SAUCE: rfi-flush: Implement congruence-first fallback flush
     - SAUCE: rfi-flush: Make l1d_flush_type bit flags
     - SAUCE: rfi-flush: Push the instruction selection down to the patching
       routine
     - SAUCE: rfi-flush: Expand the RFI section to two nop slots
     - SAUCE: rfi-flush: Support more than one flush type at once
     - SAUCE: rfi-flush: Allow HV to advertise multiple flush types
     - SAUCE: rfi-flush: Add speculation barrier before ori 30,30,0 flush
     - SAUCE: powerpc/asm: Allow including ppc_asm.h in asm files
     - SAUCE: Remove setup.h include file otherwise compilation complains about
       missing header file.
     - SAUCE: Fix compilation errors for arch/powerpc/lib/feature-fixups.c
     - SAUCE: rfi-flush: Add barriers to the fallback L1D flushing
     - SAUCE: rfi-flush: Rework powernv logic to be more cautious
     - SAUCE: rfi-flush: Rework pseries logic to be more cautious
     - SAUCE: rfi-flush: Fix the fallback flush to actually activate
     - SAUCE: rfi-flush: Fix HRFI_TO_UNKNOWN
     - SAUCE: rfi-flush: Refactor the macros so the nops are defined once
     - SAUCE: rfi-flush: Add no_rfi_flush and nopti comandline options
     - SAUCE: rfi-flush: Use rfi-flush in printks
     - SAUCE: rfi-flush: Fallback flush add load dependency
     - SAUCE: rfi-flush: Fix the 32-bit KVM build
     - SAUCE: rfi-flush: Fix some RFI conversions in the KVM code
     - SAUCE: UBUNTU: [Config] Disable CONFIG_PPC_DEBUG_RFI
Checksums-Sha1:
 6e1a49f5a254b28da2c35a42e1614d6b497940a9 3179 linux-aws_4.4.0-1011.11.dsc
 2a226689edac7dea4f77611bce39b1017ca06e22 14158366 linux-aws_4.4.0-1011.11.diff.gz
Checksums-Sha256:
 b0c68d98b41eeace16785a4b3dc566400f32ba80518a72a21d9e1ded95537743 3179 linux-aws_4.4.0-1011.11.dsc
 3c0b88dca67063aea5be3dbde3070807ab7174ce71b50e5828e4a847bcfee867 14158366 linux-aws_4.4.0-1011.11.diff.gz
Files:
 638c2625e3a09676d74db1013d9274ee 3179 devel optional linux-aws_4.4.0-1011.11.dsc
 3f76c97e02faab7864a7dc73480717e2 14158366 devel optional linux-aws_4.4.0-1011.11.diff.gz