Skip to content

Commit 092af2f

Browse files
ethan-halsallethan-halsall
committed
Merge remote-tracking branch 'google/android-4.9-q' into ten-dev
Signed-off-by: Ethan Halsall <[email protected]>
2 parents 6230bb6 + 0f1687e commit 092af2f

File tree

191 files changed

+1592
-698
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

191 files changed

+1592
-698
lines changed

Diff for: ‎Documentation/ABI/testing/sysfs-devices-system-cpu

+1
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,7 @@ What: /sys/devices/system/cpu/vulnerabilities
358358
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
359359
/sys/devices/system/cpu/vulnerabilities/l1tf
360360
/sys/devices/system/cpu/vulnerabilities/mds
361+
/sys/devices/system/cpu/vulnerabilities/srbds
361362
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
362363
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
363364
Date: January 2018

Diff for: ‎Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt

+6
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ Required properties:
1616
Documentation/devicetree/bindings/graph.txt. This port should be connected
1717
to the input port of an attached HDMI or LVDS encoder chip.
1818

19+
Optional properties:
20+
- pinctrl-names: Contain "default" and "sleep".
21+
1922
Example:
2023

2124
dpi0: dpi@1401d000 {
@@ -26,6 +29,9 @@ dpi0: dpi@1401d000 {
2629
<&mmsys CLK_MM_DPI_ENGINE>,
2730
<&apmixedsys CLK_APMIXED_TVDPLL>;
2831
clock-names = "pixel", "engine", "pll";
32+
pinctrl-names = "default", "sleep";
33+
pinctrl-0 = <&dpi_pin_func>;
34+
pinctrl-1 = <&dpi_pin_idle>;
2935

3036
port {
3137
dpi0_out: endpoint {

Diff for: ‎Documentation/hw-vuln/index.rst

+2-1
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,5 @@ are configurable at compile, boot or run time.
1212
l1tf
1313
mds
1414
tsx_async_abort
15-
multihit.rst
15+
multihit
16+
special-register-buffer-data-sampling

Diff for: ‎Documentation/hw-vuln/special-register-buffer-data-sampling.rst

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
SRBDS - Special Register Buffer Data Sampling
4+
=============================================
5+
6+
SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to
7+
infer values returned from special register accesses. Special register
8+
accesses are accesses to off core registers. According to Intel's evaluation,
9+
the special register reads that have a security expectation of privacy are
10+
RDRAND, RDSEED and SGX EGETKEY.
11+
12+
When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved
13+
to the core through the special register mechanism that is susceptible
14+
to MDS attacks.
15+
16+
Affected processors
17+
--------------------
18+
Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may
19+
be affected.
20+
21+
A processor is affected by SRBDS if its Family_Model and stepping is
22+
in the following list, with the exception of the listed processors
23+
exporting MDS_NO while Intel TSX is available yet not enabled. The
24+
latter class of processors are only affected when Intel TSX is enabled
25+
by software using TSX_CTRL_MSR otherwise they are not affected.
26+
27+
============= ============ ========
28+
common name Family_Model Stepping
29+
============= ============ ========
30+
IvyBridge 06_3AH All
31+
32+
Haswell 06_3CH All
33+
Haswell_L 06_45H All
34+
Haswell_G 06_46H All
35+
36+
Broadwell_G 06_47H All
37+
Broadwell 06_3DH All
38+
39+
Skylake_L 06_4EH All
40+
Skylake 06_5EH All
41+
42+
Kabylake_L 06_8EH <= 0xC
43+
Kabylake 06_9EH <= 0xD
44+
============= ============ ========
45+
46+
Related CVEs
47+
------------
48+
49+
The following CVE entry is related to this SRBDS issue:
50+
51+
============== ===== =====================================
52+
CVE-2020-0543 SRBDS Special Register Buffer Data Sampling
53+
============== ===== =====================================
54+
55+
Attack scenarios
56+
----------------
57+
An unprivileged user can extract values returned from RDRAND and RDSEED
58+
executed on another core or sibling thread using MDS techniques.
59+
60+
61+
Mitigation mechanism
62+
-------------------
63+
Intel will release microcode updates that modify the RDRAND, RDSEED, and
64+
EGETKEY instructions to overwrite secret special register data in the shared
65+
staging buffer before the secret data can be accessed by another logical
66+
processor.
67+
68+
During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core
69+
accesses from other logical processors will be delayed until the special
70+
register read is complete and the secret data in the shared staging buffer is
71+
overwritten.
72+
73+
This has three effects on performance:
74+
75+
#. RDRAND, RDSEED, or EGETKEY instructions have higher latency.
76+
77+
#. Executing RDRAND at the same time on multiple logical processors will be
78+
serialized, resulting in an overall reduction in the maximum RDRAND
79+
bandwidth.
80+
81+
#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other
82+
logical processors that miss their core caches, with an impact similar to
83+
legacy locked cache-line-split accesses.
84+
85+
The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable
86+
the mitigation for RDRAND and RDSEED instructions executed outside of Intel
87+
Software Guard Extensions (Intel SGX) enclaves. On logical processors that
88+
disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not
89+
take longer to execute and do not impact performance of sibling logical
90+
processors memory accesses. The opt-out mechanism does not affect Intel SGX
91+
enclaves (including execution of RDRAND or RDSEED inside an enclave, as well
92+
as EGETKEY execution).
93+
94+
IA32_MCU_OPT_CTRL MSR Definition
95+
--------------------------------
96+
Along with the mitigation for this issue, Intel added a new thread-scope
97+
IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and
98+
RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL =
99+
9]==1. This MSR is introduced through the microcode update.
100+
101+
Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor
102+
disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX
103+
enclave on that logical processor. Opting out of the mitigation for a
104+
particular logical processor does not affect the RDRAND and RDSEED mitigations
105+
for other logical processors.
106+
107+
Note that inside of an Intel SGX enclave, the mitigation is applied regardless
108+
of the value of RNGDS_MITG_DS.
109+
110+
Mitigation control on the kernel command line
111+
---------------------------------------------
112+
The kernel command line allows control over the SRBDS mitigation at boot time
113+
with the option "srbds=". The option for this is:
114+
115+
============= =============================================================
116+
off This option disables SRBDS mitigation for RDRAND and RDSEED on
117+
affected platforms.
118+
============= =============================================================
119+
120+
SRBDS System Information
121+
-----------------------
122+
The Linux kernel provides vulnerability status information through sysfs. For
123+
SRBDS this can be accessed by the following sysfs file:
124+
/sys/devices/system/cpu/vulnerabilities/srbds
125+
126+
The possible values contained in this file are:
127+
128+
============================== =============================================
129+
Not affected Processor not vulnerable
130+
Vulnerable Processor vulnerable and mitigation disabled
131+
Vulnerable: No microcode Processor vulnerable and microcode is missing
132+
mitigation
133+
Mitigation: Microcode Processor is vulnerable and mitigation is in
134+
effect.
135+
Mitigation: TSX disabled Processor is only vulnerable when TSX is
136+
enabled while this system was booted with TSX
137+
disabled.
138+
Unknown: Dependent on
139+
hypervisor status Running on virtual guest processor that is
140+
affected but with no way to know if host
141+
processor is mitigated or vulnerable.
142+
============================== =============================================
143+
144+
SRBDS Default mitigation
145+
------------------------
146+
This new microcode serializes processor access during execution of RDRAND,
147+
RDSEED ensures that the shared buffer is overwritten before it is released for
148+
reuse. Use the "srbds=off" kernel command line to disable the mitigation for
149+
RDRAND and RDSEED.

Diff for: ‎Documentation/kernel-parameters.txt

+20
Original file line numberDiff line numberDiff line change
@@ -4295,6 +4295,26 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
42954295
spia_pedr=
42964296
spia_peddr=
42974297

4298+
srbds= [X86,INTEL]
4299+
Control the Special Register Buffer Data Sampling
4300+
(SRBDS) mitigation.
4301+
4302+
Certain CPUs are vulnerable to an MDS-like
4303+
exploit which can leak bits from the random
4304+
number generator.
4305+
4306+
By default, this issue is mitigated by
4307+
microcode. However, the microcode fix can cause
4308+
the RDRAND and RDSEED instructions to become
4309+
much slower. Among other effects, this will
4310+
result in reduced throughput from /dev/urandom.
4311+
4312+
The microcode mitigation can be disabled with
4313+
the following option:
4314+
4315+
off: Disable mitigation and remove
4316+
performance impact to RDRAND and RDSEED
4317+
42984318
ssbd= [ARM64,HW]
42994319
Speculative Store Bypass Disable control
43004320

Diff for: ‎Documentation/virtual/kvm/api.txt

+2
Original file line numberDiff line numberDiff line change
@@ -3534,9 +3534,11 @@ EOI was received.
35343534
#define KVM_EXIT_HYPERV_SYNIC 1
35353535
#define KVM_EXIT_HYPERV_HCALL 2
35363536
__u32 type;
3537+
__u32 pad1;
35373538
union {
35383539
struct {
35393540
__u32 msr;
3541+
__u32 pad2;
35403542
__u64 control;
35413543
__u64 evt_page;
35423544
__u64 msg_page;

Diff for: ‎Makefile

+9-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
VERSION = 4
22
PATCHLEVEL = 9
3-
SUBLEVEL = 226
3+
SUBLEVEL = 228
44
EXTRAVERSION =
55
NAME = Roaring Lionus
66

@@ -318,12 +318,8 @@ KBUILD_MODULES :=
318318
KBUILD_BUILTIN := 1
319319

320320
# If we have only "make modules", don't compile built-in objects.
321-
# When we're building modules with modversions, we need to consider
322-
# the built-in objects during the descend as well, in order to
323-
# make sure the checksums are up to date before we record them.
324-
325321
ifeq ($(MAKECMDGOALS),modules)
326-
KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1)
322+
KBUILD_BUILTIN :=
327323
endif
328324

329325
# If we have "make <whatever> modules", compile modules
@@ -1383,6 +1379,13 @@ ifdef CONFIG_MODULES
13831379

13841380
all: modules
13851381

1382+
# When we're building modules with modversions, we need to consider
1383+
# the built-in objects during the descend as well, in order to
1384+
# make sure the checksums are up to date before we record them.
1385+
ifdef CONFIG_MODVERSIONS
1386+
KBUILD_BUILTIN := 1
1387+
endif
1388+
13861389
# Build modules
13871390
#
13881391
# A module can be listed more than once in obj-m resulting in

Diff for: ‎arch/arc/kernel/setup.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <linux/root_dev.h>
1313
#include <linux/console.h>
1414
#include <linux/module.h>
15+
#include <linux/sizes.h>
1516
#include <linux/cpu.h>
1617
#include <linux/of_fdt.h>
1718
#include <linux/of.h>
@@ -333,12 +334,12 @@ static void arc_chk_core_config(void)
333334
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
334335
panic("Linux built with incorrect DCCM Base address\n");
335336

336-
if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
337+
if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
337338
panic("Linux built with incorrect DCCM Size\n");
338339
#endif
339340

340341
#ifdef CONFIG_ARC_HAS_ICCM
341-
if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
342+
if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
342343
panic("Linux built with incorrect ICCM Size\n");
343344
#endif
344345

Diff for: ‎arch/arm/kernel/ptrace.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -227,8 +227,8 @@ static struct undef_hook arm_break_hook = {
227227
};
228228

229229
static struct undef_hook thumb_break_hook = {
230-
.instr_mask = 0xffff,
231-
.instr_val = 0xde01,
230+
.instr_mask = 0xffffffff,
231+
.instr_val = 0x0000de01,
232232
.cpsr_mask = PSR_T_BIT,
233233
.cpsr_val = PSR_T_BIT,
234234
.fn = break_trap,

Diff for: ‎arch/arm/mach-tegra/tegra.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -137,8 +137,8 @@ static const char * const tegra_dt_board_compat[] = {
137137
};
138138

139139
DT_MACHINE_START(TEGRA_DT, "NVIDIA Tegra SoC (Flattened Device Tree)")
140-
.l2c_aux_val = 0x3c400001,
141-
.l2c_aux_mask = 0xc20fc3fe,
140+
.l2c_aux_val = 0x3c400000,
141+
.l2c_aux_mask = 0xc20fc3ff,
142142
.smp = smp_ops(tegra_smp_ops),
143143
.map_io = tegra_map_common_io,
144144
.init_early = tegra_init_early,

Diff for: ‎arch/arm/mm/proc-macros.S

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* VMA_VM_FLAGS
55
* VM_EXEC
66
*/
7+
#include <linux/const.h>
78
#include <asm/asm-offsets.h>
89
#include <asm/thread_info.h>
910

@@ -34,7 +35,7 @@
3435
* act_mm - get current->active_mm
3536
*/
3637
.macro act_mm, rd
37-
bic \rd, sp, #8128
38+
bic \rd, sp, #(THREAD_SIZE - 1) & ~63
3839
bic \rd, \rd, #63
3940
ldr \rd, [\rd, #TI_TASK]
4041
ldr \rd, [\rd, #TSK_ACTIVE_MM]

Diff for: ‎arch/arm64/include/asm/kvm_host.h

+4-2
Original file line numberDiff line numberDiff line change
@@ -290,8 +290,10 @@ struct kvm_vcpu_arch {
290290
* CP14 and CP15 live in the same array, as they are backed by the
291291
* same system registers.
292292
*/
293-
#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r)])
294-
#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r)])
293+
#define CPx_BIAS IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
294+
295+
#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS])
296+
#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS])
295297

296298
#ifdef CONFIG_CPU_BIG_ENDIAN
297299
#define vcpu_cp15_64_high(v,r) vcpu_cp15((v),(r))

Diff for: ‎arch/m68k/include/asm/mac_via.h

+1
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,7 @@ extern int rbv_present,via_alt_mapping;
256256

257257
struct irq_desc;
258258

259+
extern void via_l2_flush(int writeback);
259260
extern void via_register_interrupts(void);
260261
extern void via_irq_enable(int);
261262
extern void via_irq_disable(int);

Diff for: ‎arch/m68k/mac/config.c

+2-19
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ extern void iop_preinit(void);
6161
extern void iop_init(void);
6262
extern void via_init(void);
6363
extern void via_init_clock(irq_handler_t func);
64-
extern void via_flush_cache(void);
6564
extern void oss_init(void);
6665
extern void psc_init(void);
6766
extern void baboon_init(void);
@@ -132,21 +131,6 @@ int __init mac_parse_bootinfo(const struct bi_record *record)
132131
return unknown;
133132
}
134133

135-
/*
136-
* Flip into 24bit mode for an instant - flushes the L2 cache card. We
137-
* have to disable interrupts for this. Our IRQ handlers will crap
138-
* themselves if they take an IRQ in 24bit mode!
139-
*/
140-
141-
static void mac_cache_card_flush(int writeback)
142-
{
143-
unsigned long flags;
144-
145-
local_irq_save(flags);
146-
via_flush_cache();
147-
local_irq_restore(flags);
148-
}
149-
150134
void __init config_mac(void)
151135
{
152136
if (!MACH_IS_MAC)
@@ -179,9 +163,8 @@ void __init config_mac(void)
179163
* not.
180164
*/
181165

182-
if (macintosh_config->ident == MAC_MODEL_IICI
183-
|| macintosh_config->ident == MAC_MODEL_IIFX)
184-
mach_l2_flush = mac_cache_card_flush;
166+
if (macintosh_config->ident == MAC_MODEL_IICI)
167+
mach_l2_flush = via_l2_flush;
185168
}
186169

187170

0 commit comments

Comments
 (0)