Re: [pve-devel] [PATCH pve-kernel 0/2] cherry-picks and config-options for downfall

2023-08-11 Thread Stoiko Ivanov
On Fri, 11 Aug 2023 18:01:02 +0200
Stoiko Ivanov  wrote:

please ignore this - I accidentally sent a patch too many (which got
removed in the moderation queue)

the actual series is the next thread on the list

> Changes taken from ubuntu's repository (at launchpad)
> sending as individual cherry-picks, as we're currently based on our
> own tag.
> 
> Split into 2 patches as applying the patches happens after we copy the
> source (and remove debian/ubuntu specific folders)
> 
> The resulting build should in all cases be tested on an affected machine too!
> 
> Stoiko Ivanov (2):
>   add fixes for downfall
>   d/rules: enable mitigation config-options
> 
>  debian/rules  |   4 +-
>  ...-init-Provide-arch_cpu_finalize_init.patch |  85 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch | 235 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch |  82 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch |  89 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch | 108 
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch | 217 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
>  ...cpu-Switch-to-arch_cpu_finalize_init.patch |  75 +++
>  ...022-init-Remove-check_bugs-leftovers.patch | 172 +
>  ...nvoke-arch_cpu_finalize_init-earlier.patch |  64 ++
>  ...m_encrypt_init-into-arch_cpu_finaliz.patch | 121 
>  ...it-Initialize-signal-frame-size-late.patch |  81 +++
>  ...cpuinfo-argument-from-init-functions.patch |  76 +++
>  ...7-x86-fpu-Mark-init-functions-__init.patch |  44 ++
>  ...-initialization-into-arch_cpu_finali.patch |  80 +++
>  ...-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch |  69 ++
>  ...ondary-processors-FPU-initialization.patch |  42 ++
>  ...-Add-Gather-Data-Sampling-mitigation.patch | 595 ++
>  ...n-Add-force-option-to-GDS-mitigation.patch | 172 +
>  ...eculation-Add-Kconfig-option-for-GDS.patch |  75 +++
>  .../0034-KVM-Add-GDS_NO-support-to-KVM.patch  |  85 +++
>  ...6-Fix-backwards-on-off-logic-about-Y.patch |  38 ++
>  24 files changed, 2768 insertions(+), 1 deletion(-)
>  create mode 100644 
> patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0014-x86-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0015-ARM-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0016-ia64-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0017-m68k-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0018-mips-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0019-sh-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0020-sparc-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 
> patches/kernel/0021-um-cpu-Switch-to-arch_cpu_finalize_init.patch
>  create mode 100644 patches/kernel/0022-init-Remove-check_bugs-leftovers.patch
>  create mode 100644 
> patches/kernel/0023-init-Invoke-arch_cpu_finalize_init-earlier.patch
>  create mode 100644 
> patches/kernel/0024-init-x86-Move-mem_encrypt_init-into-arch_cpu_finaliz.patch
>  create mode 100644 
> patches/kernel/0025-x86-init-Initialize-signal-frame-size-late.patch
>  create mode 100644 
> patches/kernel/0026-x86-fpu-Remove-cpuinfo-argument-from-init-functions.patch
>  create mode 100644 
> patches/kernel/0027-x86-fpu-Mark-init-functions-__init.patch
>  create mode 100644 
> patches/kernel/0028-x86-fpu-Move-FPU-initialization-into-arch_cpu_finali.patch
>  create mode 100644 
> patches/kernel/0029-x86-mem_encrypt-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch
>  create mode 100644 
> patches/kernel/0030-x86-xen-Fix-secondary-processors-FPU-initialization.patch
>  create mode 100644 
> patches/kernel/0031-x86-speculation-Add-Gather-Data-Sampling-mitigation.patch
>  create mode 100644 
> patches/kernel/0032-x86-speculation-Add-force-option-to-GDS-mitigation.patch
>  create mode 100644 
> patches/kernel/0033-x86-speculation-Add-Kconfig-option-for-GDS.patch
>  create mode 100644 patches/kernel/0034-KVM-Add-GDS_NO-support-to-KVM.patch
>  create mode 100644 
> patches/kernel/0035-Documentation-x86-Fix-backwards-on-off-logic-about-Y.patch
> 



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-kernel 2/2] d/rules: enable mitigation config-options

2023-08-11 Thread Stoiko Ivanov
CONFIG_ARCH_HAS_CPU_FINALIZE_INIT and CONFIG_GDS_FORCE_MITIGATION
follows commit 3edbe24ed004516bd910f6e97fbd4b62cf589239
in ubuntu-upstream/master-next

Signed-off-by: Stoiko Ivanov 
---
 debian/rules | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index b4bfb5c14e20..9a26a0bf4317 100755
--- a/debian/rules
+++ b/debian/rules
@@ -96,7 +96,9 @@ PMX_CONFIG_OPTS= \
 -e CONFIG_SECURITY_LOCKDOWN_LSM \
 -e CONFIG_SECURITY_LOCKDOWN_LSM_EARLY \
 --set-str CONFIG_LSM lockdown,yama,integrity,apparmor \
--e CONFIG_PAGE_TABLE_ISOLATION
+-e CONFIG_PAGE_TABLE_ISOLATION \
+-e CONFIG_ARCH_HAS_CPU_FINALIZE_INIT \
+-e CONFIG_GDS_FORCE_MITIGATION
 
 debian/control: $(wildcard debian/*.in)
sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel.prerm.in > 
debian/$(PMX_KERNEL_PKG).prerm
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-kernel 1/2] add fixes for downfall

2023-08-11 Thread Stoiko Ivanov
by cherry-picking the relevant commits from launchpad/lunar [0].
(relevant commits are based on k.o/stable commits for this)

minimally tested by booting my (ryzen) machine with this kernel and
skimming through dmesg after boot.

[0] git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/lunar

Signed-off-by: Stoiko Ivanov 
---
 ...-init-Provide-arch_cpu_finalize_init.patch |  85 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 235 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  82 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  89 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 108 
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 217 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  75 +++
 ...022-init-Remove-check_bugs-leftovers.patch | 172 +
 ...nvoke-arch_cpu_finalize_init-earlier.patch |  64 ++
 ...m_encrypt_init-into-arch_cpu_finaliz.patch | 121 
 ...it-Initialize-signal-frame-size-late.patch |  81 +++
 ...cpuinfo-argument-from-init-functions.patch |  76 +++
 ...7-x86-fpu-Mark-init-functions-__init.patch |  44 ++
 ...-initialization-into-arch_cpu_finali.patch |  80 +++
 ...-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch |  69 ++
 ...ondary-processors-FPU-initialization.patch |  42 ++
 ...-Add-Gather-Data-Sampling-mitigation.patch | 595 ++
 ...n-Add-force-option-to-GDS-mitigation.patch | 172 +
 ...eculation-Add-Kconfig-option-for-GDS.patch |  75 +++
 .../0034-KVM-Add-GDS_NO-support-to-KVM.patch  |  85 +++
 ...6-Fix-backwards-on-off-logic-about-Y.patch |  38 ++
 23 files changed, 2765 insertions(+)
 create mode 100644 
patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0014-x86-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0015-ARM-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0016-ia64-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0017-m68k-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0018-mips-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0019-sh-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0020-sparc-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0021-um-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 patches/kernel/0022-init-Remove-check_bugs-leftovers.patch
 create mode 100644 
patches/kernel/0023-init-Invoke-arch_cpu_finalize_init-earlier.patch
 create mode 100644 
patches/kernel/0024-init-x86-Move-mem_encrypt_init-into-arch_cpu_finaliz.patch
 create mode 100644 
patches/kernel/0025-x86-init-Initialize-signal-frame-size-late.patch
 create mode 100644 
patches/kernel/0026-x86-fpu-Remove-cpuinfo-argument-from-init-functions.patch
 create mode 100644 patches/kernel/0027-x86-fpu-Mark-init-functions-__init.patch
 create mode 100644 
patches/kernel/0028-x86-fpu-Move-FPU-initialization-into-arch_cpu_finali.patch
 create mode 100644 
patches/kernel/0029-x86-mem_encrypt-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch
 create mode 100644 
patches/kernel/0030-x86-xen-Fix-secondary-processors-FPU-initialization.patch
 create mode 100644 
patches/kernel/0031-x86-speculation-Add-Gather-Data-Sampling-mitigation.patch
 create mode 100644 
patches/kernel/0032-x86-speculation-Add-force-option-to-GDS-mitigation.patch
 create mode 100644 
patches/kernel/0033-x86-speculation-Add-Kconfig-option-for-GDS.patch
 create mode 100644 patches/kernel/0034-KVM-Add-GDS_NO-support-to-KVM.patch
 create mode 100644 
patches/kernel/0035-Documentation-x86-Fix-backwards-on-off-logic-about-Y.patch

diff --git a/patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch 
b/patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
new file mode 100644
index ..440a7a039576
--- /dev/null
+++ b/patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
@@ -0,0 +1,85 @@
+From  Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner 
+Date: Wed, 14 Jun 2023 01:39:22 +0200
+Subject: [PATCH] init: Provide arch_cpu_finalize_init()
+
+check_bugs() has become a dumping ground for all sorts of activities to
+finalize the CPU initialization before running the rest of the init code.
+
+Most are empty, a few do actual bug checks, some do alternative patching
+and some cobble a CPU advertisement string together
+
+Aside of that the current implementation requires duplicated function
+declaration and mostly empty header files for them.
+
+Provide a new function arch_cpu_finalize_init(). Provide a generic
+declaration if CONFIG_ARCH_HAS_CPU_FINALIZE_INIT is selected and a stub
+inline otherwise.
+
+This requires a temporary #ifdef in start_kernel() which will be removed
+along with check_bugs() once the architectures are converted 

[pve-devel] [PATCH pve-kernel 0/2] cherry-picks and config-options for downfall

2023-08-11 Thread Stoiko Ivanov
Changes taken from ubuntu's repository (at launchpad)
sending as individual cherry-picks, as we're currently based on our
own tag.

Split into 2 patches as applying the patches happens after we copy the
source (and remove debian/ubuntu specific folders)

The resulting build should in all cases be tested on an affected machine too!

Stoiko Ivanov (2):
  add fixes for downfall
  d/rules: enable mitigation config-options

 debian/rules  |   4 +-
 ...-init-Provide-arch_cpu_finalize_init.patch |  85 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 235 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  82 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  89 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 108 
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 217 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  75 +++
 ...022-init-Remove-check_bugs-leftovers.patch | 172 +
 ...nvoke-arch_cpu_finalize_init-earlier.patch |  64 ++
 ...m_encrypt_init-into-arch_cpu_finaliz.patch | 121 
 ...it-Initialize-signal-frame-size-late.patch |  81 +++
 ...cpuinfo-argument-from-init-functions.patch |  76 +++
 ...7-x86-fpu-Mark-init-functions-__init.patch |  44 ++
 ...-initialization-into-arch_cpu_finali.patch |  80 +++
 ...-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch |  69 ++
 ...ondary-processors-FPU-initialization.patch |  42 ++
 ...-Add-Gather-Data-Sampling-mitigation.patch | 595 ++
 ...n-Add-force-option-to-GDS-mitigation.patch | 172 +
 ...eculation-Add-Kconfig-option-for-GDS.patch |  75 +++
 .../0034-KVM-Add-GDS_NO-support-to-KVM.patch  |  85 +++
 ...6-Fix-backwards-on-off-logic-about-Y.patch |  38 ++
 24 files changed, 2768 insertions(+), 1 deletion(-)
 create mode 100644 
patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0014-x86-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0015-ARM-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0016-ia64-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0017-m68k-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0018-mips-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0019-sh-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0020-sparc-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0021-um-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 patches/kernel/0022-init-Remove-check_bugs-leftovers.patch
 create mode 100644 
patches/kernel/0023-init-Invoke-arch_cpu_finalize_init-earlier.patch
 create mode 100644 
patches/kernel/0024-init-x86-Move-mem_encrypt_init-into-arch_cpu_finaliz.patch
 create mode 100644 
patches/kernel/0025-x86-init-Initialize-signal-frame-size-late.patch
 create mode 100644 
patches/kernel/0026-x86-fpu-Remove-cpuinfo-argument-from-init-functions.patch
 create mode 100644 patches/kernel/0027-x86-fpu-Mark-init-functions-__init.patch
 create mode 100644 
patches/kernel/0028-x86-fpu-Move-FPU-initialization-into-arch_cpu_finali.patch
 create mode 100644 
patches/kernel/0029-x86-mem_encrypt-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch
 create mode 100644 
patches/kernel/0030-x86-xen-Fix-secondary-processors-FPU-initialization.patch
 create mode 100644 
patches/kernel/0031-x86-speculation-Add-Gather-Data-Sampling-mitigation.patch
 create mode 100644 
patches/kernel/0032-x86-speculation-Add-force-option-to-GDS-mitigation.patch
 create mode 100644 
patches/kernel/0033-x86-speculation-Add-Kconfig-option-for-GDS.patch
 create mode 100644 patches/kernel/0034-KVM-Add-GDS_NO-support-to-KVM.patch
 create mode 100644 
patches/kernel/0035-Documentation-x86-Fix-backwards-on-off-logic-about-Y.patch

-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-kernel 0/2] cherry-picks and config-options for downfall

2023-08-11 Thread Stoiko Ivanov
Changes taken from ubuntu's repository (at launchpad)
sending as individual cherry-picks, as we're currently based on our
own tag.

Split into 2 patches as applying the patches happens after we copy the
source (and remove debian/ubuntu specific folders)

The resulting build should in all cases be tested on an affected machine too!

Stoiko Ivanov (2):
  add fixes for downfall
  d/rules: enable mitigation config-options

 debian/rules  |   4 +-
 ...-init-Provide-arch_cpu_finalize_init.patch |  85 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 235 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  82 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  89 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 108 
 ...cpu-Switch-to-arch_cpu_finalize_init.patch | 217 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  80 +++
 ...cpu-Switch-to-arch_cpu_finalize_init.patch |  75 +++
 ...022-init-Remove-check_bugs-leftovers.patch | 172 +
 ...nvoke-arch_cpu_finalize_init-earlier.patch |  64 ++
 ...m_encrypt_init-into-arch_cpu_finaliz.patch | 121 
 ...it-Initialize-signal-frame-size-late.patch |  81 +++
 ...cpuinfo-argument-from-init-functions.patch |  76 +++
 ...7-x86-fpu-Mark-init-functions-__init.patch |  44 ++
 ...-initialization-into-arch_cpu_finali.patch |  80 +++
 ...-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch |  69 ++
 ...ondary-processors-FPU-initialization.patch |  42 ++
 ...-Add-Gather-Data-Sampling-mitigation.patch | 595 ++
 ...n-Add-force-option-to-GDS-mitigation.patch | 172 +
 ...eculation-Add-Kconfig-option-for-GDS.patch |  75 +++
 .../0034-KVM-Add-GDS_NO-support-to-KVM.patch  |  85 +++
 ...6-Fix-backwards-on-off-logic-about-Y.patch |  38 ++
 24 files changed, 2768 insertions(+), 1 deletion(-)
 create mode 100644 
patches/kernel/0013-init-Provide-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0014-x86-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0015-ARM-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0016-ia64-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0017-m68k-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0018-mips-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0019-sh-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0020-sparc-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 
patches/kernel/0021-um-cpu-Switch-to-arch_cpu_finalize_init.patch
 create mode 100644 patches/kernel/0022-init-Remove-check_bugs-leftovers.patch
 create mode 100644 
patches/kernel/0023-init-Invoke-arch_cpu_finalize_init-earlier.patch
 create mode 100644 
patches/kernel/0024-init-x86-Move-mem_encrypt_init-into-arch_cpu_finaliz.patch
 create mode 100644 
patches/kernel/0025-x86-init-Initialize-signal-frame-size-late.patch
 create mode 100644 
patches/kernel/0026-x86-fpu-Remove-cpuinfo-argument-from-init-functions.patch
 create mode 100644 patches/kernel/0027-x86-fpu-Mark-init-functions-__init.patch
 create mode 100644 
patches/kernel/0028-x86-fpu-Move-FPU-initialization-into-arch_cpu_finali.patch
 create mode 100644 
patches/kernel/0029-x86-mem_encrypt-Unbreak-the-AMD_MEM_ENCRYPT-n-build.patch
 create mode 100644 
patches/kernel/0030-x86-xen-Fix-secondary-processors-FPU-initialization.patch
 create mode 100644 
patches/kernel/0031-x86-speculation-Add-Gather-Data-Sampling-mitigation.patch
 create mode 100644 
patches/kernel/0032-x86-speculation-Add-force-option-to-GDS-mitigation.patch
 create mode 100644 
patches/kernel/0033-x86-speculation-Add-Kconfig-option-for-GDS.patch
 create mode 100644 patches/kernel/0034-KVM-Add-GDS_NO-support-to-KVM.patch
 create mode 100644 
patches/kernel/0035-Documentation-x86-Fix-backwards-on-off-logic-about-Y.patch

-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-kernel 2/2] d/rules: enable mitigation config-options

2023-08-11 Thread Stoiko Ivanov
CONFIG_ARCH_HAS_CPU_FINALIZE_INIT and CONFIG_GDS_FORCE_MITIGATION
follows commit 3edbe24ed004516bd910f6e97fbd4b62cf589239
in ubuntu-upstream/master-next

Signed-off-by: Stoiko Ivanov 
---
 debian/rules | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index b4bfb5c14e20..9a26a0bf4317 100755
--- a/debian/rules
+++ b/debian/rules
@@ -96,7 +96,9 @@ PMX_CONFIG_OPTS= \
 -e CONFIG_SECURITY_LOCKDOWN_LSM \
 -e CONFIG_SECURITY_LOCKDOWN_LSM_EARLY \
 --set-str CONFIG_LSM lockdown,yama,integrity,apparmor \
--e CONFIG_PAGE_TABLE_ISOLATION
+-e CONFIG_PAGE_TABLE_ISOLATION \
+-e CONFIG_ARCH_HAS_CPU_FINALIZE_INIT \
+-e CONFIG_GDS_FORCE_MITIGATION
 
 debian/control: $(wildcard debian/*.in)
sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel.prerm.in > 
debian/$(PMX_KERNEL_PKG).prerm
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] applied-series: [PATCH common/access-control/manager v3 0/4] ldap: check bind connection on realm add/update

2023-08-11 Thread Wolfgang Bumiller
applied series, thanks


___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



Re: [pve-devel] [PATCH v6 many 00/30] fix #4156: introduce new notification system

2023-08-11 Thread Dominik Csapak

did not look through the api/backend part, but the gui part is now ok from my 
side,
so consider the manger ui patches (15-22) and the wt patches (25-29)

Reviewed-by: Dominik Csapak 


___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH dab-pve-appliances] dab.conf: update external links to www.proxmox.com

2023-08-11 Thread Christian Ebner
During the redesign of www.proxmox.com the menu structure and therefore
some url changed. Update the external link in order to avoid an
unneccessary redirect.

Signed-off-by: Christian Ebner 
---
 archive/debian-10-buster-pmg-64/dab.conf | 2 +-
 archive/debian-9.0-pmg-64/dab.conf   | 2 +-
 debian-11-bullseye-pmg-7-64/dab.conf | 2 +-
 debian-12-bookworm-pmg-8-64/dab.conf | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/archive/debian-10-buster-pmg-64/dab.conf 
b/archive/debian-10-buster-pmg-64/dab.conf
index 63ff5a4..d8dd650 100644
--- a/archive/debian-10-buster-pmg-64/dab.conf
+++ b/archive/debian-10-buster-pmg-64/dab.conf
@@ -9,7 +9,7 @@ Name: proxmox-mailgateway-6.4-standard
 Version: 6.4-1
 Section: mail
 Maintainer: Proxmox Support Team 
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 6.4
  A full featured mail proxy for spam and virus filtering, optimized for
  container environment.
diff --git a/archive/debian-9.0-pmg-64/dab.conf 
b/archive/debian-9.0-pmg-64/dab.conf
index 6ddd5ea..84dd151 100644
--- a/archive/debian-9.0-pmg-64/dab.conf
+++ b/archive/debian-9.0-pmg-64/dab.conf
@@ -9,7 +9,7 @@ Name: proxmox-mailgateway-5.2-standard
 Version: 5.2-1
 Section: mail
 Maintainer: Proxmox Support Team 
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 5.2
  A full featured mail proxy for spam and virus filtering, optimized for
  container environment.
diff --git a/debian-11-bullseye-pmg-7-64/dab.conf 
b/debian-11-bullseye-pmg-7-64/dab.conf
index de2bd62..2209fe9 100644
--- a/debian-11-bullseye-pmg-7-64/dab.conf
+++ b/debian-11-bullseye-pmg-7-64/dab.conf
@@ -9,7 +9,7 @@ Name: proxmox-mailgateway-7.3-standard
 Version: 7.3-1
 Section: mail
 Maintainer: Proxmox Support Team 
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 7.3
  A full featured mail proxy for spam and virus filtering, optimized for
  container environment.
diff --git a/debian-12-bookworm-pmg-8-64/dab.conf 
b/debian-12-bookworm-pmg-8-64/dab.conf
index dca3153..166dbd4 100644
--- a/debian-12-bookworm-pmg-8-64/dab.conf
+++ b/debian-12-bookworm-pmg-8-64/dab.conf
@@ -9,7 +9,7 @@ Name: proxmox-mailgateway-8.0-standard
 Version: 8.0-1
 Section: mail
 Maintainer: Proxmox Support Team 
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 8.0
  A full featured mail proxy for spam and virus filtering, optimized for
  container environment.
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-manager] website: update external links to www.proxmox.com

2023-08-11 Thread Christian Ebner
During the redesign of www.proxmox.com the menu structure and therefore
some url changed. Update the external link in order to avoid an
unneccessary redirect

Signed-off-by: Christian Ebner 
---
 PVE/API2/Subscription.pm | 2 +-
 aplinfo/aplinfo.dat  | 4 ++--
 www/manager6/Utils.js| 2 +-
 www/manager6/dc/Summary.js   | 2 +-
 www/mobile/WidgetToolkitUtils.js | 1 -
 5 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/PVE/API2/Subscription.pm b/PVE/API2/Subscription.pm
index c7b81ee9..96fcd4e5 100644
--- a/PVE/API2/Subscription.pm
+++ b/PVE/API2/Subscription.pm
@@ -128,7 +128,7 @@ __PACKAGE__->register_method ({
my $has_permission = $rpcenv->check($authuser, "/nodes/$node", 
['Sys.Audit'], 1);
 
my $server_id = PVE::API2Tools::get_hwaddress();
-   my $url = "https://www.proxmox.com/proxmox-ve/pricing;;
+   my $url = 
"https://www.proxmox.com/en/proxmox-virtual-environment/pricing;;
 
my $info = read_etc_subscription();
if (!$info) {
diff --git a/aplinfo/aplinfo.dat b/aplinfo/aplinfo.dat
index 95a8be5a..8382bd7d 100644
--- a/aplinfo/aplinfo.dat
+++ b/aplinfo/aplinfo.dat
@@ -135,7 +135,7 @@ Architecture: amd64
 Location: mail/proxmox-mailgateway-7.3-standard_7.3-1_amd64.tar.zst
 md5sum: 6c130003f9880ae66dca0603d7b7ca87
 sha512sum: 
2fdf1dc24306bbaa2ef9a0f322416ca15b97b7d19f84b83743c7afc896095c398241fbc2eb41a33a69f3f275ce4c4cb6425edc5538831b4650d39a5e44fdbc25
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 7.3
  A full featured mail proxy for spam and virus filtering, optimized for 
container environment.
 
@@ -149,7 +149,7 @@ Architecture: amd64
 Location: mail/proxmox-mailgateway-8.0-standard_8.0-1_amd64.tar.zst
 md5sum: 7d321e5dfc6e1005231586d1871e3625
 sha512sum: 
be5efcb8ee97f2bb1c638360191eda19f49e2063acb88da55c948c90c091063972cc9ea29e6aeaa4a85733e0fb2c99ea905d665ac693cb2bf06b091c4baf781f
-Infopage: https://www.proxmox.com/de/proxmox-mail-gateway
+Infopage: https://www.proxmox.com/en/proxmox-mail-gateway/overview
 Description: Proxmox Mailgateway 8.0
  A full featured mail proxy for spam and virus filtering, optimized for 
container environment.
 
diff --git a/www/manager6/Utils.js b/www/manager6/Utils.js
index 4e094213..6d4842df 100644
--- a/www/manager6/Utils.js
+++ b/www/manager6/Utils.js
@@ -34,7 +34,7 @@ Ext.define('PVE.Utils', {
 },
 
 noSubKeyHtml: 'You do not have a valid subscription for this server. 
Please visit '
-  +'https://www.proxmox.com/products/proxmox-ve/subscription-service-plans;>'
+  +'https://www.proxmox.com/en/proxmox-virtual-environment/pricing;>'
   +'www.proxmox.com to get a list of available options.',
 
 getClusterSubscriptionLevel: async function() {
diff --git a/www/manager6/dc/Summary.js b/www/manager6/dc/Summary.js
index 371c8980..efb44dae 100644
--- a/www/manager6/dc/Summary.js
+++ b/www/manager6/dc/Summary.js
@@ -64,7 +64,7 @@ Ext.define('PVE.dc.Summary', {
element: 'el',
click: function() {
if (this.component.userCls === 'pointer') {
-   
window.open('https://www.proxmox.com/en/proxmox-ve/pricing', '_blank');
+   
window.open('https://www.proxmox.com/en/proxmox-virtual-environment/pricing', 
'_blank');
}
},
},
diff --git a/www/mobile/WidgetToolkitUtils.js b/www/mobile/WidgetToolkitUtils.js
index e11aa89e..b292fcd5 100644
--- a/www/mobile/WidgetToolkitUtils.js
+++ b/www/mobile/WidgetToolkitUtils.js
@@ -115,7 +115,6 @@ utilities: {
 },
 
 getNoSubKeyHtml: function(url) {
-   // url 
http://www.proxmox.com/products/proxmox-ve/subscription-service-plans
return Ext.String.format('You do not have a valid subscription for this 
server. Please visit www.proxmox.com to get a 
list of available options.', url || 'https://www.proxmox.com');
 },
 
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH proxmox-widget-toolkit] utils: Remove outdated url in comment

2023-08-11 Thread Christian Ebner
Signed-off-by: Christian Ebner 
---
 src/Utils.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/Utils.js b/src/Utils.js
index 2c27ece..d8c2f3c 100644
--- a/src/Utils.js
+++ b/src/Utils.js
@@ -151,7 +151,6 @@ utilities: {
 },
 
 getNoSubKeyHtml: function(url) {
-   // url 
http://www.proxmox.com/products/proxmox-ve/subscription-service-plans
return Ext.String.format('You do not have a valid subscription for this 
server. Please visit www.proxmox.com to get a 
list of available options.', url || 'https://www.proxmox.com');
 },
 
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] [PATCH pve-docs] website: update external links to www.proxmox.com

2023-08-11 Thread Christian Ebner
During the redesign of www.proxmox.com the menu structure and therefore
some url changed. Update the external link in order to avoid an
unneccessary redirect.

Signed-off-by: Christian Ebner 
---

These should be backported to stable-7 as well.

 getting-help.adoc   | 2 +-
 pve-installation-media.adoc | 2 +-
 pve-package-repos.adoc  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/getting-help.adoc b/getting-help.adoc
index 4b20956..28b23ee 100644
--- a/getting-help.adoc
+++ b/getting-help.adoc
@@ -41,7 +41,7 @@ Commercial Support
 ~~
 
 {proxmoxGmbh} also offers enterprise support available as
-https://www.proxmox.com/en/proxmox-ve/pricing[{pve} Subscription Service 
Plans].
+https://www.proxmox.com/en/proxmox-virtual-environment/pricing[{pve} 
Subscription Service Plans].
 All users with a subscription get access to the {pve}
 <>, and--with a Basic, Standard
 or Premium subscription--also to the Proxmox Customer Portal. The customer
diff --git a/pve-installation-media.adoc b/pve-installation-media.adoc
index 0e6bb37..7560635 100644
--- a/pve-installation-media.adoc
+++ b/pve-installation-media.adoc
@@ -5,7 +5,7 @@ ifdef::wiki[]
 :pve-toplevel:
 endif::wiki[]
 
-Download the installer ISO image from: 
{website}en/downloads/category/iso-images-pve
+Download the installer ISO image from: 
{website}en/downloads/proxmox-virtual-environment/iso
 
 The {pve} installation media is a hybrid ISO image. It works in two ways:
 
diff --git a/pve-package-repos.adoc b/pve-package-repos.adoc
index d861708..983b8ca 100644
--- a/pve-package-repos.adoc
+++ b/pve-package-repos.adoc
@@ -71,7 +71,7 @@ The `root@pam` user is notified via email about available 
updates. Click the
 
 You need a valid subscription key to access the `pve-enterprise` repository.
 Different support levels are available. Further details can be found at
-https://www.proxmox.com/en/proxmox-ve/pricing.
+https://www.proxmox.com/en/proxmox-virtual-environment/pricing.
 
 NOTE: You can disable this repository by commenting out the above line using a
 `#` (at the start of the line). This prevents error messages if your host does
-- 
2.39.2



___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] applied: [PATCH v4 qemu-server] fix #3963: Skip TPM startup for template VMs

2023-08-11 Thread Wolfgang Bumiller
applied, thanks


___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel



[pve-devel] applied-series: [PATCH-SERIES librados2-perl] improve fork behavior

2023-08-11 Thread Wolfgang Bumiller
applied series, thanks


___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel