Pull updates

.gitignore

@@ -133,6 +133,8 @@ all.config
 # Kdevelop4
 *.kdev4
 
+*.asn1.c
+*.asn1.h
 
 # own
 arch/arm/boot/zImage-dtb
@@ -143,3 +145,4 @@ u-boot/
 uboot/
 cryptodev/*.md5
 tools/spi/include/
+scripts/kconfig/zconf.hash.c

.travis.yml

@@ -1,28 +1,44 @@
 language: c
 compiler:
-- gcc
+    - gcc
 sudo: required
 dist: trusty
 cache: ccache
+
+git:
+  depth: false
+  quiet: false
+
+if: tag IS blank
+
+branches:
+  only:
+    - /^.*-main$/
+
 install:
-- sudo apt-add-repository 'deb http://archive.ubuntu.com/ubuntu xenial main'
-- sudo apt-get update -qq
-- sudo apt-get install -qq ccache libssl-dev u-boot-tools python-mako debhelper fakeroot gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu make
+    - sudo apt-add-repository 'deb http://archive.ubuntu.com/ubuntu xenial main'
+    - sudo apt-get update -qq
+    - sudo apt-get install -qq ccache libssl-dev u-boot-tools python-mako debhelper fakeroot gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu make
 script:
-- export PATH=/usr/lib/ccache:$PATH
-- bash build.sh importconfig
-- bash build.sh build 
-- bash build.sh cryptodev 
-- bash build.sh deb
+    - export PATH=/usr/lib/ccache:$PATH
+    - bash build.sh importconfig
+    - bash build.sh build 
+    - bash build.sh cryptodev 
+    - bash build.sh deb
+    - bash build.sh pack
+before_deploy:
+    # Set up git user name and tag this commit
+    - git config --local user.name "Frank Wunderlich"
+    - git config --local user.email "frank-w@public-files.de"
+    - git tag "CI-BUILD-$(date +'%Y%m%d%H%M%S')-$(git log --format=%h -1)"
 deploy:
-  skip_cleanup: true
-  provider: packagecloud
-  repository: "kernel"
-  username: "bpir2"
-  dist: "debian/jessie"
-  local-dir: debian
-  package_glob: '*.deb'
-  on:
-    all_branches: true 
-  token:
-    secure: WGMsYD6nRKB2fIs72s0/WBcWaa+U2AeByWwkWdb62Joy24FcWGpgY2+FTzMleeWNyU/tQsuB+1CL3n0RYcoinbNu6VeIPEuf8oibg2avtHs/vHqByTHs9bGgHkxknu2iew0uZlJPkRI2/j1fLhEZy7K5m/l/jnPk5COf/i5HmM1/M35Ojqc54+zkS1unAzZHdBs1N34av3vQb0KzgfrMihwyYr1jbWu6P4BcA5X+hY/mwfHEWV2lck87+XJubgYn05EEJpCAJXzxl3JHlbvd066eIZFaT1C56/acdgXDjK2YUvnwEPD03gvG+OVzjb8HmxZX/4y/AZbg4xKcV2Wv2ZTeuaw1gZW75TD1R0mqtU3L2uQ2G2k9vF7x+WVWGPoOqB3ZodQYc4JWmlFGuB/zlJoWJ4KzxmP9ReTTxDKQ24duIYjwhacoHU+f8gpwwdZjYDxCIewhuJa+zIT7upmS3aVXixpWh8B1ZIzKlk/rHmLFpfrn0gbRDpEo1qF/gU6u9rqA+cY7Rkk4T5RDQskBgZ4u9XbFtJ3P5vEOEWf9QN01A8VPMPRkCWOrGDPkYAroYuVh7tTlnl+phrCRCvcLWlkJll7vlFwPS/bT9f9ItsNcTM3LYiW5+trNfKSO9j0eVrCMF9UPNXHK703Tf9VcPm/QzHKZyFgkYr6McXUu8gU=
+    provider: releases
+    api_key: $GITHUB_TOKEN
+    file_glob: true
+    file:
+    - "debian/*"
+    - "../SD/*"
+    name: $TRAVIS_BRANCH-$(date +'%Y%m%d%H%M%S')
+    skip_cleanup: true
+    on:
+        all_branches: true

Documentation/ABI/testing/sysfs-class-cxl

@@ -69,7 +69,9 @@ Date:           September 2014
 Contact:        linuxppc-dev@lists.ozlabs.org
 Description:    read/write
                 Set the mode for prefaulting in segments into the segment table
-                when performing the START_WORK ioctl. Possible values:
+                when performing the START_WORK ioctl. Only applicable when
+                running under hashed page table mmu.
+                Possible values:
                         none: No prefaulting (default)
                         work_element_descriptor: Treat the work element
                                  descriptor as an effective address and

Documentation/ABI/testing/sysfs-devices-system-cpu

@@ -379,6 +379,7 @@ What:		/sys/devices/system/cpu/vulnerabilities
 		/sys/devices/system/cpu/vulnerabilities/spectre_v1
 		/sys/devices/system/cpu/vulnerabilities/spectre_v2
 		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+		/sys/devices/system/cpu/vulnerabilities/l1tf
 Date:		January 2018
 Contact:	Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:	Information about CPU vulnerabilities
@@ -390,3 +391,26 @@ Description:	Information about CPU vulnerabilities
 		"Not affected"	  CPU is not affected by the vulnerability
 		"Vulnerable"	  CPU is affected and no mitigation in effect
 		"Mitigation: $M"  CPU is affected and mitigation $M is in effect
+
+		Details about the l1tf file can be found in
+		Documentation/admin-guide/l1tf.rst
+
+What:		/sys/devices/system/cpu/smt
+		/sys/devices/system/cpu/smt/active
+		/sys/devices/system/cpu/smt/control
+Date:		June 2018
+Contact:	Linux kernel mailing list <linux-kernel@vger.kernel.org>
+Description:	Control Symetric Multi Threading (SMT)
+
+		active:  Tells whether SMT is active (enabled and siblings online)
+
+		control: Read/write interface to control SMT. Possible
+			 values:
+
+			 "on"		SMT is enabled
+			 "off"		SMT is disabled
+			 "forceoff"	SMT is force disabled. Cannot be changed.
+			 "notsupported" SMT is not supported by the CPU
+
+			 If control status is "forceoff" or "notsupported" writes
+			 are rejected.

Documentation/admin-guide/index.rst

@@ -17,6 +17,15 @@ etc.
    kernel-parameters
    devices
 
+This section describes CPU vulnerabilities and provides an overview of the
+possible mitigations along with guidance for selecting mitigations if they
+are configurable at compile, boot or run time.
+
+.. toctree::
+   :maxdepth: 1
+
+   l1tf
+
 Here is a set of documents aimed at users who are trying to track down
 problems and bugs in particular.
 

Documentation/admin-guide/kernel-parameters.txt

@@ -1888,10 +1888,84 @@
 			(virtualized real and unpaged mode) on capable
 			Intel chips. Default is 1 (enabled)
 
+	kvm-intel.vmentry_l1d_flush=[KVM,Intel] Mitigation for L1 Terminal Fault
+			CVE-2018-3620.
+
+			Valid arguments: never, cond, always
+
+			always: L1D cache flush on every VMENTER.
+			cond:	Flush L1D on VMENTER only when the code between
+				VMEXIT and VMENTER can leak host memory.
+			never:	Disables the mitigation
+
+			Default is cond (do L1 cache flush in specific instances)
+
 	kvm-intel.vpid=	[KVM,Intel] Disable Virtual Processor Identification
 			feature (tagged TLBs) on capable Intel chips.
 			Default is 1 (enabled)
 
+	l1tf=           [X86] Control mitigation of the L1TF vulnerability on
+			      affected CPUs
+
+			The kernel PTE inversion protection is unconditionally
+			enabled and cannot be disabled.
+
+			full
+				Provides all available mitigations for the
+				L1TF vulnerability. Disables SMT and
+				enables all mitigations in the
+				hypervisors, i.e. unconditional L1D flush.
+
+				SMT control and L1D flush control via the
+				sysfs interface is still possible after
+				boot.  Hypervisors will issue a warning
+				when the first VM is started in a
+				potentially insecure configuration,
+				i.e. SMT enabled or L1D flush disabled.
+
+			full,force
+				Same as 'full', but disables SMT and L1D
+				flush runtime control. Implies the
+				'nosmt=force' command line option.
+				(i.e. sysfs control of SMT is disabled.)
+
+			flush
+				Leaves SMT enabled and enables the default
+				hypervisor mitigation, i.e. conditional
+				L1D flush.
+
+				SMT control and L1D flush control via the
+				sysfs interface is still possible after
+				boot.  Hypervisors will issue a warning
+				when the first VM is started in a
+				potentially insecure configuration,
+				i.e. SMT enabled or L1D flush disabled.
+
+			flush,nosmt
+
+				Disables SMT and enables the default
+				hypervisor mitigation.
+
+				SMT control and L1D flush control via the
+				sysfs interface is still possible after
+				boot.  Hypervisors will issue a warning
+				when the first VM is started in a
+				potentially insecure configuration,
+				i.e. SMT enabled or L1D flush disabled.
+
+			flush,nowarn
+				Same as 'flush', but hypervisors will not
+				warn when a VM is started in a potentially
+				insecure configuration.
+
+			off
+				Disables hypervisor mitigations and doesn't
+				emit any warnings.
+
+			Default is 'flush'.
+
+			For details see: Documentation/admin-guide/l1tf.rst
+
 	l2cr=		[PPC]
 
 	l3cr=		[PPC]
@@ -2595,6 +2669,10 @@
 	nosmt		[KNL,S390] Disable symmetric multithreading (SMT).
 			Equivalent to smt=1.
 
+			[KNL,x86] Disable symmetric multithreading (SMT).
+			nosmt=force: Force disable SMT, cannot be undone
+				     via the sysfs control file.
+
 	nospectre_v2	[X86] Disable all mitigations for the Spectre variant 2
 			(indirect branch prediction) vulnerability. System may
 			allow data leaks with this option, which is equivalent
@@ -3997,6 +4075,23 @@
 			expediting.  Set to zero to disable automatic
 			expediting.
 
+	ssbd=		[ARM64,HW]
+			Speculative Store Bypass Disable control
+
+			On CPUs that are vulnerable to the Speculative
+			Store Bypass vulnerability and offer a
+			firmware based mitigation, this parameter
+			indicates how the mitigation should be used:
+
+			force-on:  Unconditionally enable mitigation for
+				   for both kernel and userspace
+			force-off: Unconditionally disable mitigation for
+				   for both kernel and userspace
+			kernel:    Always enable mitigation in the
+				   kernel, and offer a prctl interface
+				   to allow userspace to register its
+				   interest in being mitigated too.
+
 	stack_guard_gap=	[MM]
 			override the default stack gap protection. The value
 			is in page units and it defines how many pages prior