[PATCH 4.14 058/104] x86/KVM/VMX: Add L1D flush algorithm

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit a47dd5f06714c844b33f3b5f517b6f3e81ce57b5 upstream To mitigate the L1 Terminal Fault vulnerability it's required to flush L1D on VMENTER to prevent rogue guests from snoopi

[PATCH 4.14 055/104] cpu/hotplug: Boot HT siblings at least once

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 0cc3cd21657be04cb0559fe8063f2130493f92cf upstream Due to the way Machine Check Exceptions work on X86 hyperthreads it's required to boot up _all_ logical cores at least

[PATCH 4.14 061/104] x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 33966dd6b2d2c352fae55412db2ea8cfff5df13a upstream There is no semantic change but this change allows an unbalanced amount of MSRs to be loaded on VMEXIT and VMENTE

[PATCH 4.14 060/104] x86/KVM/VMX: Add L1D flush logic

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit c595ceee45707f00f64f61c54fb64ef0cc0b4e85 upstream Add the logic for flushing L1D on VMENTER. The flush depends on the static key being enabled and the new l1tf_flush_l1d f

[PATCH 4.14 034/104] x86/bugs: Move the l1tf function and define pr_fmt properly

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 56563f53d3066afa9e63d6c997bf67e76a8b05c0 upstream The pr_warn in l1tf_select_mitigation would have used the prior pr_fmt which was defined as "Spectre V2 : ". Mov

[PATCH 4.14 069/104] x86/l1tf: Handle EPT disabled state proper

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit a7b9020b06ec6d7c3f3b0d4ef1a9eba12654f4f7 upstream If Extended Page Tables (EPT) are disabled or not supported, no L1D flushing is required. The setup function can just a

[PATCH 4.14 062/104] x86/KVM/VMX: Add find_msr() helper function

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit ca83b4a7f2d068da79a029d323024aa45decb250 upstream .. to help find the MSR on either the guest or host MSR list. Signed-off-by: Konrad Rzeszutek Wilk Signed-off-b

[PATCH 4.14 067/104] x86/litf: Introduce vmx status variable

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 72c6d2db64fa18c996ece8f06e499509e6c9a37e upstream Store the effective mitigation of VMX in a status variable and use it to report the VMX state in the l1tf sysfs file.

[PATCH 4.14 063/104] x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 3190709335dd31fe1aeeebfe4ffb6c7624ef971f upstream This allows to load a different number of MSRs depending on the context: VMEXIT or VMENTER. Signed-off-by: Konra

[PATCH 4.14 064/104] x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 989e3992d2eca32c3f1404f2bc91acda3aa122d8 upstream The IA32_FLUSH_CMD MSR needs only to be written on VMENTER. Extend add_atomic_switch_msr() with an entry_only par

[PATCH 4.14 065/104] x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 390d975e0c4e60ce70d4157e0dd91ede37824603 upstream If the L1D flush module parameter is set to 'always' and the IA32_FLUSH_CMD MSR is available, optimize the VMENTE

[PATCH 4.14 038/104] cpu/hotplug: Make bringup/teardown of smp threads symmetric

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit c4de65696d865c225fda3b9913b31284ea65ea96 upstream The asymmetry caused a warning to trigger if the bootup was stopped in state CPUHP_AP_ONLINE_IDLE. The warning no longe

[PATCH 4.14 039/104] cpu/hotplug: Split do_cpu_down()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit cc1fe215e1efa406b03aa4389e6269b61342dec5 upstream Split out the inner workings of do_cpu_down() to allow reuse of that function for the upcoming SMT disabling mechanism.

[PATCH 4.14 040/104] cpu/hotplug: Provide knobs to control SMT

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 05736e4ac13c08a4a9b1ef2de26dd31a32cbee57 upstream Provide a command line and a sysfs knob to control SMT. The command line options are: 'nosmt': Enumerate secon

[PATCH 4.14 068/104] x86/kvm: Drop L1TF MSR list approach

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 2f055947ae5e2741fb2dc5bba1033c417ccf4faa upstream The VMX module parameter to control the L1D flush should become writeable. The MSR list is set up at VM init per guest

[PATCH 4.14 071/104] x86/kvm: Add static key for flush always

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 4c6523ec59fe895ea352a650218a6be0653910b1 upstream Avoid the conditional in the L1D flush control path. Signed-off-by: Thomas Gleixner Tested-by: Jiri Kosina Reviewed-

[PATCH 4.14 066/104] cpu/hotplug: Online siblings when SMT control is turned on

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 215af5499d9e2b55f111d2431ea20218115f29b3 upstream Writing 'off' to /sys/devices/system/cpu/smt/control offlines all SMT siblings. Writing 'on' merily enables the abilify

[PATCH 4.14 073/104] x86/kvm: Allow runtime control of L1D flush

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 895ae47f9918833c3a880fbccd41e0692b37e7d9 upstream All mitigation modes can be switched at run time with a static key now: - Use sysfs_streq() instead of strcmp() to ha

[PATCH 4.14 035/104] sched/smt: Update sched_smt_present at runtime

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit ba2591a5993eabcc8e874e30f361d8ffbb10d6d4 upstream The static key sched_smt_present is only updated at boot time when SMT siblings have been detected. Booting with maxcpus

[PATCH 4.14 072/104] x86/kvm: Serialize L1D flush parameter setter

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit dd4bfa739a72508b75760b393d129ed7b431daab upstream Writes to the parameter files are not serialized at the sysfs core level, so local serialization is required. Signed-o

[PATCH 4.14 037/104] x86/topology: Provide topology_smt_supported()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit f048c399e0f7490ab7296bc2c255d37eb14a9675 upstream Provide information whether SMT is supoorted by the CPUs. Preparatory patch for SMT control mechanism. Suggested-by: D

[PATCH 4.14 036/104] x86/smp: Provide topology_is_primary_thread()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 6a4d2657e048f096c7ffcad254010bd94891c8c0 upstream If the CPU is supporting SMT then the primary thread can be found by checking the lower APIC ID bits for zero. smp_num_

[PATCH 4.14 070/104] x86/kvm: Move l1tf setup function

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 7db92e165ac814487264632ab2624e832f20ae38 upstream In preparation of allowing run time control for L1D flushing, move the setup code to the module parameter handler. In

[PATCH 4.14 031/104] x86/speculation/l1tf: Add sysfs reporting for l1tf

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 17dbca119312b4e8173d4e25ff64262119fcef38 upstream L1TF core kernel workarounds are cheap and normally always enabled, However they still should be reported in sysfs if the sy

[PATCH 4.14 087/104] x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit ffcba43ff66c7dab34ec700debd491d2a4d319b4 upstream The last missing piece to having vmx_l1d_flush() take interrupts after VMEXIT into account is to set the kvm_cpu_l1tf_fl

[PATCH 4.14 086/104] x86: Dont include linux/irq.h from asm/hardirq.h

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 447ae316670230d7d29430e2cbf1f5db4f49d14c upstream The next patch in this series will have to make the definition of irq_cpustat_t available to entering_irq(). Inclusion

[PATCH 4.14 088/104] x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 18b57ce2eb8c8b9a24174a89250cf5f57c76ecdc upstream For VMEXITs caused by external interrupts, vmx_handle_external_intr() indirectly calls into the interrupt handlers throu

[PATCH 4.14 089/104] Documentation/l1tf: Remove Yonah processors from not vulnerable list

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 58331136136935c631c2b5f06daf4c3006416e91 upstream Dave reported, that it's not confirmed that Yonah processors are unaffected. Remove them from the list. Reported-by: a

[PATCH 4.14 096/104] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit 8e0b2b916662e09dd4d09e5271cdf214c6b80e62 upstream Bit 3 of ARCH_CAPABILITIES tells a hypervisor that L1D flush on vmentry is not needed. Add a new value to enum vmx_l1d_f

[PATCH 4.14 095/104] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit ea156d192f5257a5bf393d33910d3b481bf8a401 upstream Three changes to the content of the sysfs file: - If EPT is disabled, L1TF cannot be exploited even across threads on t

[PATCH 4.14 098/104] cpu/hotplug: Fix SMT supported evaluation

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit bc2d8d262cba5736332cbc866acb11b1c5748aa9 upstream Josh reported that the late SMT evaluation in cpu_smt_state_init() sets cpu_smt_control to CPU_SMT_NOT_SUPPORTED in cas

[PATCH 4.14 084/104] x86/irq: Demote irq_cpustat_t::__softirq_pending to u16

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 9aee5f8a7e30330d0a8f4c626dc924ca5590aba5 upstream An upcoming patch will extend KVM's L1TF mitigation in conditional mode to also cover interrupts after VMEXITs. For trac

[PATCH 4.14 101/104] x86/mm/pat: Make set_memory_np() L1TF safe

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 958f79b9ee55dfaf00c8106ed1c22a2919e0028b upstream set_memory_np() is used to mark kernel mappings not present, but it has it's own open coded mechanism which does not have th

[PATCH 4.14 097/104] KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit 5b76a3cff011df2dcb6186c965a2e4d809a05ad4 upstream When nested virtualization is in use, VMENTER operations from the nested hypervisor into the nested guest will always be

[PATCH 4.14 102/104] x86/mm/kmmio: Make the tracer robust against L1TF

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 1063711b57393c1999248cccb57bebfaf16739e7 upstream The mmio tracer sets io mapping PTEs and PMDs to non present when enabled without inverting the address bits, which makes th

[PATCH 4.14 075/104] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit fee0aede6f4739c87179eca76136f83210953b86 upstream The CPU_SMT_NOT_SUPPORTED state is set (if the processor does not support SMT) when the sysfs SMT control file is initi

[PATCH 4.14 094/104] KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit cd28325249a1ca0d771557ce823e0308ad629f98 upstream This lets userspace read the MSR_IA32_ARCH_CAPABILITIES and check that all requested features are available on the host.

[PATCH 4.14 076/104] x86/bugs, kvm: Introduce boot-time control of L1TF mitigations

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Kosina commit d90a7a0ec83fb86622cd7dae23255d3c50a99ec8 upstream Introduce the 'l1tf=' kernel command line option to allow for boot-time switching of mitigation that is used on processors

[PATCH 4.14 099/104] x86/speculation/l1tf: Invert all not present mappings

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit f22cc87f6c1f771b57c407555cfefd811cdd9507 upstream For kernel mappings PAGE_PROTNONE is not necessarily set for a non present mapping, but the inversion logic explicitely chec

[PATCH 4.14 085/104] x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 45b575c00d8e72d69d75dd8c112f044b7b01b069 upstream Part of the L1TF mitigation for vmx includes flushing the L1D cache upon VMENTRY. L1D flushes are costly and two modes

[PATCH 4.14 080/104] cpu/hotplug: detect SMT disabled by BIOS

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Josh Poimboeuf commit 73d5e2b472640b1fcdb61ae8be389912ef211bda upstream If SMT is disabled in BIOS, the CPU code doesn't properly detect it. The /sys/devices/system/cpu/smt/control file shows

[PATCH 4.14 078/104] x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 288d152c23dcf3c09da46c5c481903ca10ebfef7 upstream The slow path in vmx_l1d_flush() reads from vmx_l1d_flush_pages in order to evict the L1d cache. However, these pages a

[PATCH 4.14 081/104] x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 379fd0c7e6a391e5565336a646f19f218fb98c6c upstream vmx_l1d_flush() gets invoked only if l1tf_flush_l1d is true. There's no point in setting l1tf_flush_l1d to true from the

[PATCH 4.14 103/104] tools headers: Synchronise x86 cpufeatures.h for L1TF additions

4.14-stable review patch. If anyone has any objections, please let me know. -- From: David Woodhouse commit e24f14b0ff985f3e09e573ba1134bfdf42987e05 upstream Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman --- tools/arch/x86/include/asm/cpufeatures.h |3

[PATCH 4.14 104/104] x86/microcode: Allow late microcode loading with SMT disabled

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Josh Poimboeuf commit 07d981ad4cf1e78361c6db1c28ee5ba105f96cc1 upstream The kernel unnecessarily prevents late microcode loading when SMT is disabled. It should be safe to allow it if all the

[PATCH 4.14 100/104] x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 0768f91530ff46683e0b372df14fd79fe8d156e5 upstream Some cases in THP like: - MADV_FREE - mprotect - split mark the PMD non present for temporarily to prevent races. The

[PATCH 4.14 077/104] Documentation: Add section about CPU vulnerabilities

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 3ec8ce5d866ec6a08a9cfab82b62acf4a830b35f upstream Add documentation for the L1TF vulnerability and the mitigation mechanisms: - Explain the problem and risks - Docu

[PATCH 4.14 082/104] x86/KVM/VMX: Replace vmx_l1d_flush_always with vmx_l1d_flush_cond

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 427362a142441f08051369db6fbe7f61c73b3dca upstream The vmx_l1d_flush_always static key is only ever evaluated if vmx_l1d_should_flush is enabled. In that case however, the

[PATCH 4.14 083/104] x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit 5b6ccc6c3b1a477fbac9ec97a0b4c1c48e765209 upstream Currently, vmx_vcpu_run() checks if l1tf_flush_l1d is set and invokes vmx_l1d_flush() if so. This test is unncessary fo

[PATCH 4.14 074/104] cpu/hotplug: Expose SMT control init function

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Kosina commit 8e1b706b6e819bed215c0db16345568864660393 upstream The L1TF mitigation will gain a commend line parameter which allows to set a combination of hypervisor mitigation and SMT c

[PATCH 4.9 002/107] tpm: fix race condition in tpm_common_write()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tadeusz Struk commit 3ab2011ea368ec3433ad49e1b9e1c7b70d2e65df upstream. There is a race condition in tpm_common_write function allowing two threads on the same /dev/tpm, or two different applic

[PATCH 4.9 001/107] ext4: fix check to prevent initializing reserved inodes

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Theodore Ts'o commit 5012284700775a4e6e3fbe7eac4c543c4874b559 upstream. Commit 8844618d8aa7: "ext4: only look at the bg_flags field if it is valid" will complain if block group zero does not ha

[PATCH 4.9 003/107] parisc: Enable CONFIG_MLONGCALLS by default

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Helge Deller commit 66509a276c8c1d19ee3f661a41b418d101c57d29 upstream. Enable the -mlong-calls compiler option by default, because otherwise in most cases linking the vmlinux binary fails due t

[PATCH 4.9 005/107] kasan: add no_sanitize attribute for clang builds

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andrey Konovalov commit 12c8f25a016dff69ee284aa3338bebfd2cfcba33 upstream. KASAN uses the __no_sanitize_address macro to disable instrumentation of particular functions. Right now it's defined

[PATCH 4.9 009/107] scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Bart Van Assche commit 1214fd7b497400d200e3f4e64e2338b303a20949 upstream. Surround scsi_execute() calls with scsi_autopm_get_device() and scsi_autopm_put_device(). Note: removing sr_mutex prote

[PATCH 4.9 008/107] ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Hans de Goede commit fdcb613d49321b5bf5d5a1bd0fba8e7c241dcc70 upstream. The LPSS PWM device on on Bay Trail and Cherry Trail devices has a set of private registers at offset 0x800, the current

[PATCH 4.9 011/107] root dentries need RCU-delayed freeing

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 90bad5e05bcdb0308cfa3d3a60f5c0b9c8e2efb3 upstream. Since mountpoint crossing can happen without leaving lazy mode, root dentries do need the same protection against having their

[PATCH 4.9 020/107] mtd: nand: qcom: Add a NULL check for devm_kasprintf()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Fabio Estevam commit 069f05346d01e7298939f16533953cdf52370be3 upstream. devm_kasprintf() may fail, so we should better add a NULL check and propagate an error on failure. Signed-off-by: Fabio

[PATCH 4.9 023/107] x86/paravirt: Fix spectre-v2 mitigations for paravirt guests

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit 5800dc5c19f34e6e03b5adab1282535cb102fafd upstream. Nadav reported that on guests we're failing to rewrite the indirect calls to CALLEE_SAVE paravirt functions. In particul

[PATCH 4.9 007/107] xen/netfront: dont cache skb_shinfo()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Juergen Gross commit d472b3a6cf63cd31cae1ed61930f07e6cd6671b5 upstream. skb_shinfo() can change when calling __pskb_pull_tail(): Don't cache its return value. Cc: sta...@vger.kernel.org Signed

[PATCH 4.9 027/107] x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 50896e180c6aa3a9c61a26ced99e15d602666a4c upstream L1 Terminal Fault (L1TF) is a speculation related vulnerability. The CPU speculates on PTE entries which do not have the PRES

[PATCH 4.9 006/107] Mark HI and TASKLET softirq synchronous

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit 3c53776e29f81719efcf8f7a6e30cdf753bee94d upstream. Way back in 4.9, we committed 4cd13c21b207 ("softirq: Let ksoftirqd do its job"), and ever since we've had small nagging

[PATCH 4.9 029/107] x86/speculation/l1tf: Change order of offset/type in swap entry

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit bcd11afa7adad8d720e7ba5ef58bdcd9775cf45f upstream If pages are swapped out, the swap entry is stored in the corresponding PTE, which has the Present bit cleared. CPUs vuln

[PATCH 4.9 028/107] mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Naoya Horiguchi commit eee4818baac0f2b37848fdf90e4b16430dc536ac upstream _PAGE_PSE is used to distinguish between a truly non-present (_PAGE_PRESENT=0) PMD, and a PMD which is undergoing a THP

[PATCH 4.9 025/107] kprobes/x86: Fix %p uses in error messages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Masami Hiramatsu commit 0ea063306eecf300fcf06d2f5917474b580f666f upstream. Remove all %p uses in error messages in kprobes/x86. Signed-off-by: Masami Hiramatsu Cc: Ananth N Mavinakayanahalli

[PATCH 4.9 024/107] x86/speculation: Protect against userspace-userspace spectreRSB

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Kosina commit fdf82a7856b32d905c39afc85e34364491e46346 upstream. The article "Spectre Returns! Speculation Attacks using the Return Stack Buffer" [1] describes two new (sub-)variants of sp

[PATCH 4.9 022/107] ARM: dts: imx6sx: fix irq for pcie bridge

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Oleksij Rempel commit 1bcfe0564044be578841744faea1c2f46adc8178 upstream. Use the correct IRQ line for the MSI controller in the PCIe host controller. Apparently a different IRQ line is used com

[PATCH 4.9 000/107] 4.9.120-stable review

This is the start of the stable review cycle for the 4.9.120 release. There are 107 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Aug 16 17:14:53 UTC 2018. Anything recei

[PATCH 4.9 026/107] x86/irqflags: Provide a declaration for native_save_fl

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nick Desaulniers commit 208cbb32558907f68b3b2a081ca2337ac3744794 upstream. It was reported that the commit d0a8d9378d16 is causing users of gcc < 4.9 to observe -Werror=missing-prototypes error

[PATCH 4.9 021/107] IB/ocrdma: fix out of bounds access to local buffer

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Michael Mera commit 062d0f22a30c39840ea49b72cfcfc1aa4cc538fa upstream. In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is written at index 'count-1' where 'count' is the si

[PATCH 4.9 012/107] make sure that __dentry_kill() always invalidates d_seq, unhashed or not

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 4c0d7cd5c8416b1ef41534d19163cb07ffaa03ab upstream. RCU pathwalk relies upon the assumption that anything that changes ->d_inode of a dentry will invalidate its ->d_seq. That's a

[PATCH 4.9 030/107] x86/speculation/l1tf: Protect swap entries against L1TF

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit 2f22b4cd45b67b3496f4aa4c7180a1271c6452f6 upstream With L1 terminal fault the CPU speculates into unmapped PTEs, and resulting side effects allow to read the memory the PTE

[PATCH 4.9 032/107] x86/speculation/l1tf: Make sure the first page is always reserved

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 10a70416e1f067f6c4efda6ffd8ea96002ac4223 upstream The L1TF workaround doesn't make any attempt to mitigate speculate accesses to the first physical page for zeroed PTEs. Norma

[PATCH 4.9 013/107] fix mntput/mntput race

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 9ea0a46ca2c318fcc449c1e6b62a7230a17888f1 upstream. mntput_no_expire() does the calculation of total refcount under mount_lock; unfortunately, the decrement (as well as all increm

[PATCH 4.9 040/107] cpu/hotplug: Split do_cpu_down()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit cc1fe215e1efa406b03aa4389e6269b61342dec5 upstream Split out the inner workings of do_cpu_down() to allow reuse of that function for the upcoming SMT disabling mechanism.

[PATCH 4.9 042/107] x86/cpu: Remove the pointless CPU printout

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 55e6d279abd92cfd7576bba031e7589be8475edb upstream The value of this printout is dubious at best and there is no point in having it in two different places along with conv

[PATCH 4.9 034/107] x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 42e4089c7890725fcd32252dc489b72f2921 upstream For L1TF PROT_NONE mappings are protected by inverting the PFN in the page table entry. This sets the high bits in the CPU's

[PATCH 4.9 043/107] x86/cpu/AMD: Remove the pointless detect_ht() call

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 44ca36de56d1bf196dca2eb67cd753a46961ffe6 upstream Real 32bit AMD CPUs do not have SMT and the only value of the call was to reach the magic printout which got removed. S

[PATCH 4.9 039/107] cpu/hotplug: Make bringup/teardown of smp threads symmetric

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit c4de65696d865c225fda3b9913b31284ea65ea96 upstream The asymmetry caused a warning to trigger if the bootup was stopped in state CPUHP_AP_ONLINE_IDLE. The warning no longer

[PATCH 4.9 041/107] cpu/hotplug: Provide knobs to control SMT

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 05736e4ac13c08a4a9b1ef2de26dd31a32cbee57 upstream Provide a command line and a sysfs knob to control SMT. The command line options are: 'nosmt': Enumerate second

[PATCH 4.9 033/107] x86/speculation/l1tf: Add sysfs reporting for l1tf

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 17dbca119312b4e8173d4e25ff64262119fcef38 upstream L1TF core kernel workarounds are cheap and normally always enabled, However they still should be reported in sysfs if the sys

[PATCH 4.9 038/107] x86/topology: Provide topology_smt_supported()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit f048c399e0f7490ab7296bc2c255d37eb14a9675 upstream Provide information whether SMT is supoorted by the CPUs. Preparatory patch for SMT control mechanism. Suggested-by: Da

[PATCH 4.9 037/107] x86/smp: Provide topology_is_primary_thread()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 6a4d2657e048f096c7ffcad254010bd94891c8c0 upstream If the CPU is supporting SMT then the primary thread can be found by checking the lower APIC ID bits for zero. smp_num_s

[PATCH 4.9 036/107] x86/bugs: Move the l1tf function and define pr_fmt properly

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 56563f53d3066afa9e63d6c997bf67e76a8b05c0 upstream The pr_warn in l1tf_select_mitigation would have used the prior pr_fmt which was defined as "Spectre V2 : ". Move

[PATCH 4.9 031/107] x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 6b28baca9b1f0d4a42b865da7a05b1c81424bd5c upstream When PTEs are set to PROT_NONE the kernel just clears the Present bit and preserves the PFN, which creates attack surface for

[PATCH 4.9 035/107] x86/speculation/l1tf: Limit swap file size to MAX_PA/2

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 377eeaa8e11fe815b1d07c81c4a0e2843a8c15eb upstream For the L1TF workaround its necessary to limit the swap file size to below MAX_PA/2, so that the higher bits of the swap offs

[PATCH 4.9 044/107] x86/cpu/common: Provide detect_ht_early()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 545401f4448a807b963ff17b575e0a393e68b523 upstream To support force disabling of SMT it's required to know the number of thread siblings early. detect_ht() cannot be calle

[PATCH 4.9 045/107] x86/cpu/topology: Provide detect_extended_topology_early()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 95f3d39ccf7aaea79d1ffdac1c887c2e100ec1b6 upstream To support force disabling of SMT it's required to know the number of thread siblings early. detect_extended_topology()

[PATCH 4.9 046/107] x86/cpu/intel: Evaluate smp_num_siblings early

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 1910ad5624968f93be48e8e265513c54d66b897c upstream Make use of the new early detection function to initialize smp_num_siblings on the boot cpu before the MP-Table or ACPI/

[PATCH 4.9 014/107] fix __legitimize_mnt()/mntput() race

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 119e1ef80ecfe0d1deb6378d4ab41f5b71519de1 upstream. __legitimize_mnt() has two problems - one is that in case of success the check of mount_lock is not ordered wrt preceding incre

[PATCH 4.9 047/107] x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Borislav Petkov commit 119bff8a9c9bb00116a844ec68be7bc4b1c768f5 upstream Old code used to check whether CPUID ext max level is >= 0x8008 because that last leaf contains the number of cores

[PATCH 4.9 048/107] x86/cpu/AMD: Evaluate smp_num_siblings early

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 1e1d7e25fd759eddf96d8ab39d0a90a1979b2d8c upstream To support force disabling of SMT it's required to know the number of thread siblings early. amd_get_topology() cannot b

[PATCH 4.9 050/107] x86/speculation/l1tf: Extend 64bit swap file size limit

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vlastimil Babka commit 1a7ed1ba4bba6c075d5ad61bb75e3fbc870840d6 upstream The previous patch has limited swap file size so that large offsets cannot clear bits above MAX_PA/2 in the pte and inte

[PATCH 4.9 018/107] IB/core: Make testing MR flags for writability a static inline function

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jack Morgenstein commit 08bb558ac11ab944e0539e78619d7b4c356278bd upstream. Make the MR writability flags check, which is performed in umem.c, a static inline function in file ib_verbs.h This a

[PATCH 4.9 016/107] proc/sysctl: Dont grab i_lock under sysctl_lock.

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric W. Biederman commit ace0c791e6c3cf5ef37cad2df69f0d90ccc40ffb upstream. Konstantin Khlebnikov writes: > This patch has locking problem. I've got lockdep splat under LTP. > > [ 6633.115456]

[PATCH 4.17 91/97] x86/speculation/l1tf: Invert all not present mappings

4.17-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit f22cc87f6c1f771b57c407555cfefd811cdd9507 upstream For kernel mappings PAGE_PROTNONE is not necessarily set for a non present mapping, but the inversion logic explicitely chec

[PATCH 4.17 95/97] tools headers: Synchronize prctl.h ABI header

4.17-stable review patch. If anyone has any objections, please let me know. -- From: Arnaldo Carvalho de Melo commit 63b89a19cc9ef911dcc64d41b60930c346eee0c0 upstream To pick up changes from: $ git log --oneline -2 -i include/uapi/linux/prctl.h 356e4bfff2c5 prctl: Add for

[PATCH 4.17 93/97] x86/mm/pat: Make set_memory_np() L1TF safe

4.17-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen commit 958f79b9ee55dfaf00c8106ed1c22a2919e0028b upstream set_memory_np() is used to mark kernel mappings not present, but it has it's own open coded mechanism which does not have th

[PATCH 4.9 061/107] x86/KVM/VMX: Add L1D flush logic

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit c595ceee45707f00f64f61c54fb64ef0cc0b4e85 upstream Add the logic for flushing L1D on VMENTER. The flush depends on the static key being enabled and the new l1tf_flush_l1d fl

[PATCH 4.9 010/107] init: rename and re-order boot_cpu_state_init()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit b5b1404d0815894de0690de8a1ab58269e56eae6 upstream. This is purely a preparatory patch for upcoming changes during the 4.19 merge window. We have a function called "boot_c

<    1   2   3   4   5   6   7   8   9   >