{"push_id":2980566823,"size":294,"distinct_size":13,"ref":"refs/heads/standard/xilinx-zynqmp","head":"eae8f16a0aab776b5ae007f04650396e9b2a3952","before":"6c140cce0bb449a3009c59a5af6f47d1f4607b52","commits":[{"sha":"b17732ca83d9917069429e0b829db8a88c08043a","author":{"name":"Rui Wang","email":"5520b64c3217afc10cb881636dce6d49816c0d83@windriver.com"},"message":"pci: fix wrong end calculated by pci_resource_to_user\n\nSome special archs such as mips, ppc and sparc, use a specified\npci_resource_to_user function to calculate the start and the end\nof pci resource. But the function has a bug when calculating the\nend value. It first gets the resource size by \"end - start + 1\",\nwhich is all right. Then it uses the return value of fixup_bigphys_addr\nas the start of resource, this only matters to Alchemy platforms,\non other platforms fixup_bigphys_addr is just an identidy mapping.\nFinally, it sets the end value to \"start + size\", which is obviously\nwrong, because the value becomes \"end + 1\".\n\nSigned-off-by: Rui Wang <rui.wang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/b17732ca83d9917069429e0b829db8a88c08043a"},{"sha":"1549a62618b92b8ddbe3cfaa1fc3734037339b5b","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"tcp: avoid collapses in tcp_prune_queue() if possible\n\ncommit f4a3313d8e2ca9fd8d8f45e40a2903ba782607e7 upstream\n\nRight after a TCP flow is created, receiving tiny out of order\npackets allways hit the condition :\n\nif (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)\n\ttcp_clamp_window(sk);\n\ntcp_clamp_window() increases sk_rcvbuf to match sk_rmem_alloc\n(guarded by tcp_rmem[2])\n\nCalling tcp_collapse_ofo_queue() in this case is not useful,\nand offers a O(N^2) surface attack to malicious peers.\n\nBetter not attempt anything before full queue capacity is reached,\nforcing attacker to spend lots of resource and allow us to more\neasily detect the abuse.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Soheil Hassas Yeganeh <soheil@google.com>\nAcked-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zhang Xiao <xiao.zhang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/1549a62618b92b8ddbe3cfaa1fc3734037339b5b"},{"sha":"d1d923ffe0ed7065acfae389a0adb2526b7df5f4","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"tcp: detect malicious patterns in tcp_collapse_ofo_queue()\n\ncommit 3d4bf93ac12003f9b8e1e2de37fe27983deebdcf upstream\n\nIn case an attacker feeds tiny packets completely out of order,\ntcp_collapse_ofo_queue() might scan the whole rb-tree, performing\nexpensive copies, but not changing socket memory usage at all.\n\n1) Do not attempt to collapse tiny skbs.\n2) Add logic to exit early when too many tiny skbs are detected.\n\nWe prefer not doing aggressive collapsing (which copies packets)\nfor pathological flows, and revert to tcp_prune_ofo_queue() which\nwill be less expensive.\n\nIn the future, we might add the possibility of terminating flows\nthat are proven to be malicious.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zhang Xiao <xiao.zhang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/d1d923ffe0ed7065acfae389a0adb2526b7df5f4"},{"sha":"b95edfeef25a61be9bbd790d663536d32dfda3c8","author":{"name":"Haiqing Bai","email":"9cd7412e18beade2b148a9345ad86de669920552@windriver.com"},"message":"posix-timer: Properly check sigevent->sigev_notify\n\ncommit cef31d9af908243421258f1df35a4a644604efbe upstream\n\ntimer_create() specifies via sigevent->sigev_notify the signal delivery for\nthe new timer. The valid modes are SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD\nand (SIGEV_SIGNAL | SIGEV_THREAD_ID).\n\nThe sanity check in good_sigevent() is only checking the valid combination\nfor the SIGEV_THREAD_ID bit, i.e. SIGEV_SIGNAL, but if SIGEV_THREAD_ID is\nnot set it accepts any random value.\n\nThis has no real effects on the posix timer and signal delivery code, but\nit affects show_timer() which handles the output of /proc/$PID/timers. That\nfunction uses a string array to pretty print sigev_notify. The access to\nthat array has no bound checks, so random sigev_notify cause access beyond\nthe array bounds.\n\nAdd proper checks for the valid notify modes and remove the SIGEV_THREAD_ID\nmasking from various code pathes as SIGEV_NONE can never be set in\ncombination with SIGEV_THREAD_ID.\n\nReported-by: Eric Biggers <ebiggers3@gmail.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nReported-by: Alexey Dobriyan <adobriyan@gmail.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: John Stultz <john.stultz@linaro.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/b95edfeef25a61be9bbd790d663536d32dfda3c8"},{"sha":"8533ac5fd63737cd2a0c9048e7a586539d3e335b","author":{"name":"Li Wang","email":"e2f900292c908df0f5b6797ccb03ffb07ac87ff2@windriver.com"},"message":"infiniband: fix a possible use-after-free bug\n\ncommit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 upstream\n\nucma_process_join() will free the new allocated \"mc\" struct,\nif there is any error after that, especially the copy_to_user().\n\nBut in parallel, ucma_leave_multicast() could find this \"mc\"\nthrough idr_find() before ucma_process_join() frees it, since it\nis already published.\n\nSo \"mc\" could be used in ucma_leave_multicast() after it is been\nallocated and freed in ucma_process_join(), since we don't refcnt\nit.\n\nFix this by separating \"publish\" from ID allocation, so that we\ncan get an ID first and publish it later after copy_to_user().\n\nFixes: c8f6a362bf3e (\"RDMA/cma: Add multicast communication support\")\nReported-by: Noam Rathaus <noamr@beyondsecurity.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Jason Gunthorpe <jgg@mellanox.com>\nSigned-off-by: Li Wang <li.wang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/8533ac5fd63737cd2a0c9048e7a586539d3e335b"},{"sha":"1e6828afa001432cb44673c8d0d70718e3ba76cf","author":{"name":"Arend Van Spriel","email":"a0aa8d56e4733e1f148eaed044b3a5ceb8fafe4b@broadcom.com"},"message":"brcmfmac: add length check in brcmf_cfg80211_escan_handler()\n\ncommit 17df6453d4be17910456e99c5a85025aa1b7a246 upstream\n\nUpon handling the firmware notification for scans the length was\nchecked properly and may result in corrupting kernel heap memory\ndue to buffer overruns. This fix addresses CVE-2017-0786.\n\nCc: stable@vger.kernel.org # v4.0.x\nCc: Kevin Cernekee <cernekee@chromium.org>\nReviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>\nReviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>\nReviewed-by: Franky Lin <franky.lin@broadcom.com>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Jibin Xu <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/1e6828afa001432cb44673c8d0d70718e3ba76cf"},{"sha":"9fb98046e26c31d29d687c38817d2abc6cab7893","author":{"name":"Yue Tao","email":"efc047639ba8c71536184282000fe2228c6f62ae@windriver.com"},"message":"Merge branch 'standard/base' into standard/xilinx-zynqmp","distinct":true,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/9fb98046e26c31d29d687c38817d2abc6cab7893"},{"sha":"3c00e3efe7da60e9d6a7e6fe057e74ba05af9bba","author":{"name":"Paolo Bonzini","email":"69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com"},"message":"KVM: x86: fix singlestepping over syscall\n\ncommit c8401dda2f0a00cd25c0af6a95ed50e478d25de4 upstream\n\nTF is handled a bit differently for syscall and sysret, compared\nto the other instructions: TF is checked after the instruction completes,\nso that the OS can disable #DB at a syscall by adding TF to FMASK.\nWhen the sysret is executed the #DB is taken \"as if\" the syscall insn\njust completed.\n\nKVM emulates syscall so that it can trap 32-bit syscall on Intel processors.\nFix the behavior, otherwise you could get #DB on a user stack which is not\nnice.  This does not affect Linux guests, as they use an IST or task gate\nfor #DB.\n\nThis fixes CVE-2017-7518.\n\nCc: stable@vger.kernel.org\nReported-by: Andy Lutomirski <luto@kernel.org>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\n[Change or drop some codes to apply it into our tree.]\nSigned-off-by: Wenlin Kang <wenlin.kang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3c00e3efe7da60e9d6a7e6fe057e74ba05af9bba"},{"sha":"986c63599484f0882059b0b126a869a3f95c7175","author":{"name":"Li Wang","email":"e2f900292c908df0f5b6797ccb03ffb07ac87ff2@windriver.com"},"message":"x86/entry/64: Remove %ebx handling from error_entry/exit\n\ncommit b3681dd548d06deb2e1573890829dff4b15abf46 upstream\n\nerror_entry and error_exit communicate the user vs. kernel status of\nthe frame using %ebx.  This is unnecessary -- the information is in\nregs->cs.  Just use regs->cs.\n\nThis makes error_entry simpler and makes error_exit more robust.\n\nIt also fixes a nasty bug.  Before all the Spectre nonsense, the\nxen_failsafe_callback entry point returned like this:\n\n        ALLOC_PT_GPREGS_ON_STACK\n        SAVE_C_REGS\n        SAVE_EXTRA_REGS\n        ENCODE_FRAME_POINTER\n        jmp     error_exit\n\nAnd it did not go through error_entry.  This was bogus: RBX\ncontained garbage, and error_exit expected a flag in RBX.\n\nFortunately, it generally contained *nonzero* garbage, so the\ncorrect code path was used.  As part of the Spectre fixes, code was\nadded to clear RBX to mitigate certain speculation attacks.  Now,\ndepending on kernel configuration, RBX got zeroed and, when running\nsome Wine workloads, the kernel crashes.  This was introduced by:\n\n    commit 3ac6d8c787b8 (\"x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface\")\n\nWith this patch applied, RBX is no longer needed as a flag, and the\nproblem goes away.\n\nI suspect that malicious userspace could use this bug to crash the\nkernel even without the offending patch applied, though.\n\n[ Historical note: I wrote this patch as a cleanup before I was aware\n  of the bug it fixed. ]\n\n[ Note to stable maintainers: this should probably get applied to all\n  kernels.  If you're nervous about that, a more conservative fix to\n  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should\n  also fix the problem. ]\n\nReported-and-tested-by: M. Vefa Bicakci <m.v.b@runbox.com>\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Dave Hansen <dave.hansen@linux.intel.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: Dominik Brodowski <linux@dominikbrodowski.net>\nCc: Greg KH <gregkh@linuxfoundation.org>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Juergen Gross <jgross@suse.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nCc: xen-devel@lists.xenproject.org\nFixes: 3ac6d8c787b8 (\"x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface\")\nLink: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Li Wang <li.wang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/986c63599484f0882059b0b126a869a3f95c7175"},{"sha":"522a29b3dff5872c390eb0c0b9114c91e76733d5","author":{"name":"Mel Gorman","email":"39ea6a09710987173e32e37c86918024a0f441c1@suse.de"},"message":"futex: Remove unnecessary warning from get_futex_key\n\ncommit 48fb6f4db940e92cfb16cd878cddd59ea6120d06 upstream\n\nCommit 65d8fc777f6d (\"futex: Remove requirement for lock_page() in\nget_futex_key()\") removed an unnecessary lock_page() with the\nside-effect that page->mapping needed to be treated very carefully.\n\nTwo defensive warnings were added in case any assumption was missed and\nthe first warning assumed a correct application would not alter a\nmapping backing a futex key.  Since merging, it has not triggered for\nany unexpected case but Mark Rutland reported the following bug\ntriggering due to the first warning.\n\n  kernel BUG at kernel/futex.c:679!\n  Internal error: Oops - BUG: 0 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 0 PID: 3695 Comm: syz-executor1 Not tainted 4.13.0-rc3-00020-g307fec773ba3 #3\n  Hardware name: linux,dummy-virt (DT)\n  task: ffff80001e271780 task.stack: ffff000010908000\n  PC is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679\n  LR is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679\n  pc : [<ffff00000821ac14>] lr : [<ffff00000821ac14>] pstate: 80000145\n\nThe fact that it's a bug instead of a warning was due to an unrelated\narm64 problem, but the warning itself triggered because the underlying\nmapping changed.\n\nThis is an application issue but from a kernel perspective it's a\nrecoverable situation and the warning is unnecessary so this patch\nremoves the warning.  The warning may potentially be triggered with the\nfollowing test program from Mark although it may be necessary to adjust\nNR_FUTEX_THREADS to be a value smaller than the number of CPUs in the\nsystem.\n\n    #include <linux/futex.h>\n    #include <pthread.h>\n    #include <stdio.h>\n    #include <stdlib.h>\n    #include <sys/mman.h>\n    #include <sys/syscall.h>\n    #include <sys/time.h>\n    #include <unistd.h>\n\n    #define NR_FUTEX_THREADS 16\n    pthread_t threads[NR_FUTEX_THREADS];\n\n    void *mem;\n\n    #define MEM_PROT  (PROT_READ | PROT_WRITE)\n    #define MEM_SIZE  65536\n\n    static int futex_wrapper(int *uaddr, int op, int val,\n                             const struct timespec *timeout,\n                             int *uaddr2, int val3)\n    {\n        syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3);\n    }\n\n    void *poll_futex(void *unused)\n    {\n        for (;;) {\n            futex_wrapper(mem, FUTEX_CMP_REQUEUE_PI, 1, NULL, mem + 4, 1);\n        }\n    }\n\n    int main(int argc, char *argv[])\n    {\n        int i;\n\n        mem = mmap(NULL, MEM_SIZE, MEM_PROT,\n               MAP_SHARED | MAP_ANONYMOUS, -1, 0);\n\n        printf(\"Mapping @ %p\\n\", mem);\n\n        printf(\"Creating futex threads...\\n\");\n\n        for (i = 0; i < NR_FUTEX_THREADS; i++)\n            pthread_create(&threads[i], NULL, poll_futex, NULL);\n\n        printf(\"Flipping mapping...\\n\");\n        for (;;) {\n            mmap(mem, MEM_SIZE, MEM_PROT,\n                 MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0);\n        }\n\n        return 0;\n    }\n\nReported-and-tested-by: Mark Rutland <mark.rutland@arm.com>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: stable@vger.kernel.org # 4.7+\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Li Zhou <li.zhou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/522a29b3dff5872c390eb0c0b9114c91e76733d5"},{"sha":"41e8d36d71a1a9ca1fe70faa0b64aab4a2144a81","author":{"name":"Liu Haitao","email":"3208435a4e24055bcaae9c1207b6b1d9ab60b03d@windriver.com"},"message":"hfsplus: fix NULL dereference in hfsplus_lookup()\n\ncommit bfa2d20c143e1a5b7203195ad81d462d45a6961d upstream\n\nAn HFS+ filesystem can be mounted read-only without having a metadata\ndirectory, which is needed to support hardlinks. But if the catalog data\nis corrupted, a directory lookup may still find dentries claiming to be\nhardlinks.\n\nhfsplus_lookup() does check that ->hidden_dir is not NULL in such a situation,\nbut mistakenly does so after dereferencing it for the first time. Reorder\nthis check to prevent a crash.\n\nThis happens when looking up corrupted catalog data (dentry) on a filesystem with\nno metadata directory (this could only ever happen on a read-only mount). Wen Xu\nsent the replication steps in detail to the fsdevel list:\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200297\n\nLink: http://lkml.kernel.org/r/20180712215344.q44dyrhymm4ajkao@eaf\nSigned-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>\nReported-by: Wen Xu <wen.xu@gatech.edu>\nCc: Viacheslav Dubeyko <slava@dubeyko.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Stephen Rothwell <sfr@canb.auug.org.au>\n[hl:update the patch to adjust for 4.1, 4.8 and 4.12 context]\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/41e8d36d71a1a9ca1fe70faa0b64aab4a2144a81"},{"sha":"83c6c9dffcfe25c88385458d3d631683d9d544b2","author":{"name":"Yue Tao","email":"efc047639ba8c71536184282000fe2228c6f62ae@windriver.com"},"message":"Merge branch 'standard/base' into standard/xilinx-zynqmp","distinct":true,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/83c6c9dffcfe25c88385458d3d631683d9d544b2"},{"sha":"989001cc1eaf52966a0602b63d4d57a204ecd48f","author":{"name":"Jim Mattson","email":"69e6c825ffb81c81b96935a61b79166dbc1f7a9d@google.com"},"message":"kvm: nVMX: VMCLEAR an active shadow VMCS after last use\n\nAfter a successful VM-entry with the \"VMCS shadowing\" VM-execution\ncontrol set, the shadow VMCS referenced by the VMCS link pointer field\nin the current VMCS becomes active on the logical processor.\n\nA VMCS that is made active on more than one logical processor may become\ncorrupted. Therefore, before an active VMCS can be migrated to another\nlogical processor, the first logical processor must execute a VMCLEAR\nfor the active VMCS. VMCLEAR both ensures that all VMCS data are written\nto memory and makes the VMCS inactive.\n\nSigned-off-by: Jim Mattson <jmattson@google.com>\nReviewed-By: David Matlack <dmatlack@google.com>\nMessage-Id: <1477668579-22555-1-git-send-email-jmattson@google.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/989001cc1eaf52966a0602b63d4d57a204ecd48f"},{"sha":"55901f50f41e14b1ff99c8157d70ba43f295145a","author":{"name":"Jim Mattson","email":"69e6c825ffb81c81b96935a61b79166dbc1f7a9d@google.com"},"message":"KVM: nVMX: Eliminate vmcs02 pool\n\ncommit de3a0021a60635de96aa92713c1a31a96747d72c upstream\n\nThe potential performance advantages of a vmcs02 pool have never been\nrealized. To simplify the code, eliminate the pool. Instead, a single\nvmcs02 is allocated per VCPU when the VCPU enters VMX operation.\n\nCc: stable@vger.kernel.org       # prereq for Spectre mitigation\nSigned-off-by: Jim Mattson <jmattson@google.com>\nSigned-off-by: Mark Kanda <mark.kanda@oracle.com>\nReviewed-by: Ameya More <ameya.more@oracle.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/55901f50f41e14b1ff99c8157d70ba43f295145a"},{"sha":"6fde27e9ae54b3806f58a37b683430a119c6fb20","author":{"name":"Paolo Bonzini","email":"69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com"},"message":"KVM: VMX: introduce alloc_loaded_vmcs\n\ncommit f21f165ef922c2146cc5bdc620f542953c41714b upstream\n\nGroup together the calls to alloc_vmcs and loaded_vmcs_init.  Soon we'll also\nallocate an MSR bitmap there.\n\nCc: stable@vger.kernel.org       # prereq for Spectre mitigation\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/6fde27e9ae54b3806f58a37b683430a119c6fb20"},{"sha":"bf0ca3168a077fe7c7cb62b555735d39f086426c","author":{"name":"Paolo Bonzini","email":"69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com"},"message":"KVM: VMX: make MSR bitmaps per-VCPU\n\n(cherry picked from commit 904e14fb7cb96401a7dc803ca2863fd5ba32ffe6)\n\nPlace the MSR bitmap in struct loaded_vmcs, and update it in place\nevery time the x2apic or APICv state can change.  This is rare and\nthe loop can handle 64 MSRs per iteration, in a similar fashion as\nnested_vmx_prepare_msr_bitmap.\n\nThis prepares for choosing, on a per-VM basis, whether to intercept\nthe SPEC_CTRL and PRED_CMD MSRs.\n\nCc: stable@vger.kernel.org       # prereq for Spectre mitigation\nSuggested-by: Jim Mattson <jmattson@google.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/bf0ca3168a077fe7c7cb62b555735d39f086426c"},{"sha":"1471c6a2745a9f35f0a419b809efc28564c84717","author":{"name":"Ashok Raj","email":"82fba5000eac076d0784a0a40de3c3bd46526953@intel.com"},"message":"KVM/x86: Add IBPB support\n\ncommit 15d45071523d89b3fb7372e2135fbd72f6af9506 upstream\n\nThe Indirect Branch Predictor Barrier (IBPB) is an indirect branch\ncontrol mechanism. It keeps earlier branches from influencing\nlater ones.\n\nUnlike IBRS and STIBP, IBPB does not define a new mode of operation.\nIt's a command that ensures predicted branch targets aren't used after\nthe barrier. Although IBRS and IBPB are enumerated by the same CPUID\nenumeration, IBPB is very different.\n\nIBPB helps mitigate against three potential attacks:\n\n* Mitigate guests from being attacked by other guests.\n  - This is addressed by issing IBPB when we do a guest switch.\n\n* Mitigate attacks from guest/ring3->host/ring3.\n  These would require a IBPB during context switch in host, or after\n  VMEXIT. The host process has two ways to mitigate\n  - Either it can be compiled with retpoline\n  - If its going through context switch, and has set !dumpable then\n    there is a IBPB in that path.\n    (Tim's patch: https://patchwork.kernel.org/patch/10192871)\n  - The case where after a VMEXIT you return back to Qemu might make\n    Qemu attackable from guest when Qemu isn't compiled with retpoline.\n  There are issues reported when doing IBPB on every VMEXIT that resulted\n  in some tsc calibration woes in guest.\n\n* Mitigate guest/ring0->host/ring0 attacks.\n  When host kernel is using retpoline it is safe against these attacks.\n  If host kernel isn't using retpoline we might need to do a IBPB flush on\n  every VMEXIT.\n\nEven when using retpoline for indirect calls, in certain conditions 'ret'\ncan use the BTB on Skylake-era CPUs. There are other mitigations\navailable like RSB stuffing/clearing.\n\n* IBPB is issued only for SVM during svm_free_vcpu().\n  VMX has a vmclear and SVM doesn't.  Follow discussion here:\n  https://lkml.org/lkml/2018/1/15/146\n\nPlease refer to the following spec for more details on the enumeration\nand control.\n\nRefer here to get documentation about mitigations.\n\nhttps://software.intel.com/en-us/side-channel-security-support\n\n[peterz: rebase and changelog rewrite]\n[karahmed: - rebase\n           - vmx: expose PRED_CMD if guest has it in CPUID\n           - svm: only pass through IBPB if guest has it in CPUID\n           - vmx: support !cpu_has_vmx_msr_bitmap()]\n           - vmx: support nested]\n[dwmw2: Expose CPUID bit too (AMD IBPB only for now as we lack IBRS)\n        PRED_CMD is a write-only MSR]\n\nSigned-off-by: Ashok Raj <ashok.raj@intel.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: KarimAllah Ahmed <karahmed@amazon.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Andi Kleen <ak@linux.intel.com>\nCc: kvm@vger.kernel.org\nCc: Asit Mallick <asit.k.mallick@intel.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Arjan Van De Ven <arjan.van.de.ven@intel.com>\nCc: Greg KH <gregkh@linuxfoundation.org>\nCc: Jun Nakajima <jun.nakajima@intel.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Dan Williams <dan.j.williams@intel.com>\nCc: Tim Chen <tim.c.chen@linux.intel.com>\nLink: http://lkml.kernel.org/r/1515720739-43819-6-git-send-email-ashok.raj@intel.com\nLink: https://lkml.kernel.org/r/1517522386-18410-3-git-send-email-karahmed@amazon.de\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/1471c6a2745a9f35f0a419b809efc28564c84717"},{"sha":"90f0b98ea170ed36e7dd1aba569da3f4e11ca465","author":{"name":"KarimAllah Ahmed","email":"558cc378579f2fcab9c4d24e2576c3762d4edbef@amazon.de"},"message":"KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES\n\ncommit 28c1c9fabf48d6ad596273a11c46e0d0da3e14cd upstream\n\nIntel processors use MSR_IA32_ARCH_CAPABILITIES MSR to indicate RDCL_NO\n(bit 0) and IBRS_ALL (bit 1). This is a read-only MSR. By default the\ncontents will come directly from the hardware, but user-space can still\noverride it.\n\n[dwmw2: The bit in kvm_cpuid_7_0_edx_x86_features can be unconditional]\n\nSigned-off-by: KarimAllah Ahmed <karahmed@amazon.de>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nReviewed-by: Darren Kenny <darren.kenny@oracle.com>\nReviewed-by: Jim Mattson <jmattson@google.com>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Andi Kleen <ak@linux.intel.com>\nCc: Jun Nakajima <jun.nakajima@intel.com>\nCc: kvm@vger.kernel.org\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Asit Mallick <asit.k.mallick@intel.com>\nCc: Arjan Van De Ven <arjan.van.de.ven@intel.com>\nCc: Greg KH <gregkh@linuxfoundation.org>\nCc: Dan Williams <dan.j.williams@intel.com>\nCc: Tim Chen <tim.c.chen@linux.intel.com>\nCc: Ashok Raj <ashok.raj@intel.com>\nLink: https://lkml.kernel.org/r/1517522386-18410-4-git-send-email-karahmed@amazon.de\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/90f0b98ea170ed36e7dd1aba569da3f4e11ca465"},{"sha":"ca22a963d6bfa1ba6f47d106150152ca65d9dd10","author":{"name":"KarimAllah Ahmed","email":"558cc378579f2fcab9c4d24e2576c3762d4edbef@amazon.de"},"message":"KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL\n\ncommit b2ac58f90540e39324e7a29a7ad471407ae0bf48 upstream\n\n[ Based on a patch from Paolo Bonzini <pbonzini@redhat.com> ]\n\n... basically doing exactly what we do for VMX:\n\n- Passthrough SPEC_CTRL to guests (if enabled in guest CPUID)\n- Save and restore SPEC_CTRL around VMExit and VMEntry only if the guest\n  actually used it.\n\nSigned-off-by: KarimAllah Ahmed <karahmed@amazon.de>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nReviewed-by: Darren Kenny <darren.kenny@oracle.com>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Andi Kleen <ak@linux.intel.com>\nCc: Jun Nakajima <jun.nakajima@intel.com>\nCc: kvm@vger.kernel.org\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Tim Chen <tim.c.chen@linux.intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Asit Mallick <asit.k.mallick@intel.com>\nCc: Arjan Van De Ven <arjan.van.de.ven@intel.com>\nCc: Greg KH <gregkh@linuxfoundation.org>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Dan Williams <dan.j.williams@intel.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Ashok Raj <ashok.raj@intel.com>\nLink: https://lkml.kernel.org/r/1517669783-20732-1-git-send-email-karahmed@amazon.de\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/ca22a963d6bfa1ba6f47d106150152ca65d9dd10"},{"sha":"5f696515c3e1b01e26dc69132f2c684b31920ae7","author":{"name":"KarimAllah Ahmed","email":"558cc378579f2fcab9c4d24e2576c3762d4edbef@amazon.de"},"message":"KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL\n\ncommit d28b387fb74da95d69d2615732f50cceb38e9a4d upstream\n\n[ Based on a patch from Ashok Raj <ashok.raj@intel.com> ]\n\nAdd direct access to MSR_IA32_SPEC_CTRL for guests. This is needed for\nguests that will only mitigate Spectre V2 through IBRS+IBPB and will not\nbe using a retpoline+IBPB based approach.\n\nTo avoid the overhead of saving and restoring the MSR_IA32_SPEC_CTRL for\nguests that do not actually use the MSR, only start saving and restoring\nwhen a non-zero is written to it.\n\nNo attempt is made to handle STIBP here, intentionally. Filtering STIBP\nmay be added in a future patch, which may require trapping all writes\nif we don't want to pass it through directly to the guest.\n\n[dwmw2: Clean up CPUID bits, save/restore manually, handle reset]\n\nSigned-off-by: KarimAllah Ahmed <karahmed@amazon.de>\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nReviewed-by: Darren Kenny <darren.kenny@oracle.com>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nReviewed-by: Jim Mattson <jmattson@google.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Andi Kleen <ak@linux.intel.com>\nCc: Jun Nakajima <jun.nakajima@intel.com>\nCc: kvm@vger.kernel.org\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Tim Chen <tim.c.chen@linux.intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Asit Mallick <asit.k.mallick@intel.com>\nCc: Arjan Van De Ven <arjan.van.de.ven@intel.com>\nCc: Greg KH <gregkh@linuxfoundation.org>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Dan Williams <dan.j.williams@intel.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Ashok Raj <ashok.raj@intel.com>\nLink: https://lkml.kernel.org/r/1517522386-18410-5-git-send-email-karahmed@amazon.de\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/5f696515c3e1b01e26dc69132f2c684b31920ae7"}]}
{"actor":{"display_login":"mseaster-wr"}}