The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/05afdd8630c181e5e062042200fa6557f634c090

commit 05afdd8630c181e5e062042200fa6557f634c090
Author: Guenter Roeck <groeck@chromium.org>
Date: Fri Jul 27 14:51:49 2018

CHROMIUM: Merge 'v4.4.144' into chromeos-4.4

Merge of v4.4.144 into chromeos-4.4

Conflicts:
    kernel/sys.c
    kernel/seccomp.c
    include/uapi/linux/prctl.h
    arch/x86/kernel/process.c

Changes applied on top of 'v4.4.144' prior to merge:
    0fb62040c4ab CHROMIUM: Revert "x86/paravirt: Make native_save_fl() extern inline"

Changelog:
----------------------------------------------------------------
Alan Jenkins (1):
      block: do not use interruptible wait anywhere

Alexander Sergeyev (1):
      x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist

Alexey Brodkin (1):
      ARC: Fix CONFIG_SWAP

Andy Lutomirski (2):
      x86/mm: Give each mm TLB flush generation a unique ID
      x86/cpu: Re-apply forced caps every time CPU caps are re-read

Andy Shevchenko (1):
      x86/cpu: Rename Merrifield2 to Moorefield

Arnd Bergmann (1):
      x86/pti: Mark constant arrays as __initconst

Borislav Petkov (4):
      Documentation/spec_ctrl: Do some minor cleanups
      x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
      x86/cpu/AMD: Fix erratum 1076 (CPB bit)
      x86/bugs: Unify x86_spec_ctrl_{set_guest, restore_host}

Colin Ian King (1):
      ipv6: fix useless rol32 call on hash

Dan Williams (2):
      x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
      x86/speculation: Fix up array_index_nospec_mask() asm constraint

Dave Hansen (1):
      x86/mm: Factor out LDT init from context init

David Ahern (1):
      net/ipv4: Set oif in fib_compute_spec_dst

David Woodhouse (14):
      x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
      x86/cpufeatures: Add Intel feature bits for Speculation Control
      x86/cpufeatures: Add AMD feature bits for Speculation Control
      x86/msr: Add definitions for new speculation control MSRs
      x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
      x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
      x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
      x86/cpufeatures: Clean up Spectre v2 related CPUID flags
      x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
      x86/speculation: Update Speculation Control microcode blacklist
      x86/speculation: Correct Speculation Control microcode blacklist again
      x86/speculation: Use IBRS if available before calling into firmware
      x86/amd: don't set X86_BUG_SYSRET_SS_ATTRS when running under Xen
      x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested

Davidlohr Bueso (1):
      lib/rhashtable: consider param->min_size when setting initial table size

Denys Vlasenko (1):
      x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs

Dewet Thibaut (1):
      x86/MCE: Remove min interval polling limitation

Greg Kroah-Hartman (1):
      Linux 4.4.144

Guenter Roeck (2):
      CHROMIUM: Revert "x86/paravirt: Make native_save_fl() extern inline"
      Merge remote-tracking branch 'origin/linux/v4.4.144' into merge/chromeos-4.4-v4.4.144

Gustavo A. R. Silva (1):
      ptp: fix missing break in switch

Heiner Kallweit (1):
      net: phy: fix flag masking in __set_phy_supported

Ingo Molnar (2):
      x86/speculation: Clean up various Spectre related details
      x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP

Jim Mattson (1):
      x86/cpu: Make alternative_msr_write work for 32-bit code

Jing Xia (1):
      mm: memcg: fix use after free in mem_cgroup_iter()

Jiri Kosina (2):
      x86/bugs: Fix __ssb_select_mitigation() return type
      x86/bugs: Make cpu_show_common() static

Juergen Gross (3):
      x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
      xen: set cpu capabilities from xen_start_kernel()
      x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths

Kees Cook (5):
      nospec: Allow getting/setting on non-current task
      proc: Provide details on speculation flaw mitigations
      seccomp: Enable speculation flaw mitigations
      seccomp: Add filter flag to opt-out of SSB mitigation
      x86/speculation: Make "seccomp" the default mode for Speculative Store Bypass

Konrad Rzeszutek Wilk (14):
      x86/spectre_v2: Don't check microcode versions when running under hypervisors
      x86/bugs: Concentrate bug detection into a separate function
      x86/bugs: Concentrate bug reporting into a separate function
      x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits
      x86/bugs, KVM: Support the combination of guest and host IBRS
      x86/bugs: Expose /sys/../spec_store_bypass
      x86/cpufeatures: Add X86_FEATURE_RDS
      x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation
      x86/bugs/intel: Set proper CPU features and setup RDS
      x86/bugs: Whitelist allowed SPEC_CTRL MSR values
      x86/bugs: Rename _RDS to _SSBD
      proc: Use underscores for SSBD in 'status'
      x86/bugs: Fix the parameters alignment and missing void
      x86/bugs: Rename SSBD_NO to SSB_NO

Kyle Huey (2):
      x86/process: Optimize TIF checks in __switch_to_xtra()
      x86/process: Correct and optimize TIF_BLOCKSTEP switch

Lan Tianyu (1):
      KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in parallel.

Linus Torvalds (1):
      x86/nospec: Simplify alternative_msr_write()

Lucas Stach (1):
      clk: tegra: Fix PLL_U post divider and initial rate on Tegra30

Mathias Nyman (1):
      xhci: Fix perceived dead host due to runtime suspend race with event handler

Mickaël Salaün (2):
      selftest/seccomp: Fix the flag name SECCOMP_FILTER_FLAG_TSYNC
      selftest/seccomp: Fix the seccomp(2) signature

Nick Desaulniers (1):
      x86/paravirt: Make native_save_fl() extern inline

OGAWA Hirofumi (1):
      fat: fix memory allocation failure handling of match_strdup()

Peter Zijlstra (1):
      x86/speculation: Add <asm/msr-index.h> dependency

Piotr Luc (1):
      x86/cpu/intel: Add Knights Mill to Intel family

Richard Weinberger (5):
      ubi: Introduce vol_ignored()
      ubi: Rework Fastmap attach base code
      ubi: Be more paranoid while seaching for the most recent Fastmap
      ubi: Fix races around ubi_refill_pools()
      ubi: Fix Fastmap's update_vol()

Sanjeev Bansal (1):
      tg3: Add higher cpu clock for 5762.

Sascha Hauer (1):
      ubi: fastmap: Erase outdated anchor PEBs during attach

Stefano Brivio (2):
      net: Don't copy pfmemalloc flag in __copy_skb_header()
      skbuff: Unconditionally copy pfmemalloc in __skb_clone()

Takashi Iwai (1):
      ALSA: rawmidi: Change resized buffers atomically

Thomas Gleixner (18):
      x86/speculation: Create spec-ctrl.h to avoid include hell
      prctl: Add speculation control prctls
      x86/process: Optimize TIF_NOTSC switch
      x86/process: Allow runtime control of Speculative Store Bypass
      x86/speculation: Add prctl for Speculative Store Bypass mitigation
      prctl: Add force disable speculation
      seccomp: Use PR_SPEC_FORCE_DISABLE
      seccomp: Move speculation migitation control to arch code
      x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS
      x86/cpufeatures: Disentangle SSBD enumeration
      x86/cpufeatures: Add FEATURE_ZEN
      x86/speculation: Handle HT correctly on AMD
      x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
      x86/speculation: Rework speculative_store_bypass_update()
      x86/bugs: Expose x86_spec_ctrl_base directly
      x86/bugs: Remove x86_spec_ctrl_set()
      x86/bugs: Rework spec_ctrl base and mask logic
      x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG

Tim Chen (1):
      x86/speculation: Use Indirect Branch Prediction Barrier in context switch

Tom Lendacky (1):
      x86/speculation: Add virtualized speculative store bypass disable support

Tyler Hicks (1):
      ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns

Vineet Gupta (1):
      ARC: mm: allow mprotect to make stack mappings executable

 Documentation/ABI/testing/sysfs-devices-system-cpu |   1 +
 Documentation/kernel-parameters.txt                |  45 +++
 Documentation/spec_ctrl.txt                        |  94 +++++
 Makefile                                           |   2 +-
 arch/arc/include/asm/page.h                        |   2 +-
 arch/arc/include/asm/pgtable.h                     |   2 +-
 arch/x86/entry/entry_64_compat.S                   |  75 ++--
 arch/x86/include/asm/apm.h                         |   6 +
 arch/x86/include/asm/barrier.h                     |   2 +-
 arch/x86/include/asm/cpufeature.h                  |   7 +-
 arch/x86/include/asm/cpufeatures.h                 |  37 +-
 arch/x86/include/asm/disabled-features.h           |   3 +-
 arch/x86/include/asm/efi.h                         |   7 +
 arch/x86/include/asm/intel-family.h                |  10 +-
 arch/x86/include/asm/mmu.h                         |  15 +-
 arch/x86/include/asm/mmu_context.h                 |  25 +-
 arch/x86/include/asm/msr-index.h                   |  22 ++
 arch/x86/include/asm/nospec-branch.h               |  54 +++
 arch/x86/include/asm/required-features.h           |   3 +-
 arch/x86/include/asm/spec-ctrl.h                   |  80 ++++
 arch/x86/include/asm/thread_info.h                 |   6 +-
 arch/x86/include/asm/tlbflush.h                    |  12 +
 arch/x86/kernel/cpu/amd.c                          |  38 +-
 arch/x86/kernel/cpu/bugs.c                         | 427 +++++++++++++++++++--
 arch/x86/kernel/cpu/common.c                       | 121 +++++-
 arch/x86/kernel/cpu/cpu.h                          |   3 +
 arch/x86/kernel/cpu/intel.c                        |  73 ++++
 arch/x86/kernel/cpu/mcheck/mce.c                   |   3 -
 arch/x86/kernel/ldt.c                              |   4 +-
 arch/x86/kernel/process.c                          | 224 +++++++++--
 arch/x86/kernel/smpboot.c                          |   5 +
 arch/x86/kvm/svm.c                                 |   2 +-
 arch/x86/kvm/vmx.c                                 |   2 +-
 arch/x86/mm/tlb.c                                  |  33 ++
 arch/x86/platform/efi/efi_64.c                     |   3 +
 arch/x86/xen/enlighten.c                           |  16 +-
 arch/x86/xen/smp.c                                 |   5 +
 arch/x86/xen/suspend.c                             |  16 +
 block/blk-core.c                                   |  10 +-
 drivers/base/cpu.c                                 |   8 +
 drivers/clk/tegra/clk-tegra30.c                    |  11 +-
 drivers/mtd/ubi/attach.c                           | 139 +++++--
 drivers/mtd/ubi/eba.c                              |   4 +-
 drivers/mtd/ubi/fastmap-wl.c                       |   6 +-
 drivers/mtd/ubi/fastmap.c                          |  51 ++-
 drivers/mtd/ubi/ubi.h                              |  46 ++-
 drivers/mtd/ubi/wl.c                               | 114 ++++--
 drivers/net/ethernet/broadcom/tg3.c                |   9 +
 drivers/net/phy/phy_device.c                       |   7 +-
 drivers/ptp/ptp_chardev.c                          |   1 +
 drivers/usb/host/xhci.c                            |  40 +-
 drivers/usb/host/xhci.h                            |   4 +
 fs/fat/inode.c                                     |  20 +-
 fs/proc/array.c                                    |  26 ++
 include/linux/cpu.h                                |   2 +
 include/linux/nospec.h                             |  10 +
 include/linux/sched.h                              |   9 +
 include/linux/seccomp.h                            |   3 +-
 include/linux/skbuff.h                             |  12 +-
 include/net/ipv6.h                                 |   2 +-
 include/uapi/linux/prctl.h                         |  12 +
 include/uapi/linux/seccomp.h                       |   4 +-
 kernel/seccomp.c                                   |  21 +-
 kernel/sys.c                                       |  21 +
 lib/rhashtable.c                                   |  17 +-
 mm/memcontrol.c                                    |   2 +-
 net/core/skbuff.c                                  |   1 +
 net/ipv4/fib_frontend.c                            |   1 +
 net/ipv4/sysctl_net_ipv4.c                         |   5 +-
 sound/core/rawmidi.c                               |  20 +-
 tools/testing/selftests/seccomp/seccomp_bpf.c      |  98 ++++-
 virt/kvm/eventfd.c                                 |   6 +-
 72 files changed, 1953 insertions(+), 274 deletions(-)
 create mode 100644 Documentation/spec_ctrl.txt
 create mode 100644 arch/x86/include/asm/spec-ctrl.h

BUG= chromium:867709 
TEST=Build and test on various affected systems

Change-Id: I60bdaaa8b8cbed3d2b9e8aca4a6596eb2b9a9f0c
Signed-off-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/05afdd8630c181e5e062042200fa6557f634c090/kernel/sys.c
[modify] https://crrev.com/05afdd8630c181e5e062042200fa6557f634c090/include/uapi/linux/prctl.h
[modify] https://crrev.com/05afdd8630c181e5e062042200fa6557f634c090/kernel/seccomp.c
[modify] https://crrev.com/05afdd8630c181e5e062042200fa6557f634c090/arch/x86/kernel/process.c

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b1688860f7c68f37022cec14f189f88219d3b17c

commit b1688860f7c68f37022cec14f189f88219d3b17c
Author: Guenter Roeck <groeck@chromium.org>
Date: Sat Jul 28 02:11:03 2018

Revert "UPSTREAM: compiler, clang: suppress warning for unused static inline functions"

This reverts commit 0f7d32f16eac6bb5ac6eb41002a1978de2bd7862.

Reverted upstream with commit 'compiler, clang: always inline when
CONFIG_OPTIMIZE_INLINING is disabled'.

BUG= chromium:867709 
TEST=Build and test on various affected systems

Change-Id: I37df294a300f5253d25e129b5c06d98ea5b48774
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1153557
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>

[modify] https://crrev.com/b1688860f7c68f37022cec14f189f88219d3b17c/include/linux/compiler-clang.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/c7af8bbdd2318e8890365ee05e6bdd8700efd081

commit c7af8bbdd2318e8890365ee05e6bdd8700efd081
Author: Nick Desaulniers <ndesaulniers@google.com>
Date: Sat Jul 28 02:11:04 2018

UPSTREAM: x86/paravirt: Make native_save_fl() extern inline

commit d0a8d9378d16eb3c69bd8e6d23779fbdbee3a8c7 upstream.

native_save_fl() is marked static inline, but by using it as
a function pointer in arch/x86/kernel/paravirt.c, it MUST be outlined.

paravirt's use of native_save_fl() also requires that no GPRs other than
%rax are clobbered.

Compilers have different heuristics which they use to emit stack guard
code, the emittance of which can break paravirt's callee saved assumption
by clobbering %rcx.

Marking a function definition extern inline means that if this version
cannot be inlined, then the out-of-line version will be preferred. By
having the out-of-line version be implemented in assembly, it cannot be
instrumented with a stack protector, which might violate custom calling
conventions that code like paravirt rely on.

The semantics of extern inline has changed since gnu89. This means that
folks using GCC versions >= 5.1 may see symbol redefinition errors at
link time for subdirs that override KBUILD_CFLAGS (making the C standard
used implicit) regardless of this patch. This has been cleaned up
earlier in the patch set, but is left as a note in the commit message
for future travelers.

Reports:
 https://lkml.org/lkml/2018/5/7/534
 https://github.com/ClangBuiltLinux/linux/issues/16

Discussion:
 https://bugs.llvm.org/show_bug.cgi?id=37512
 https://lkml.org/lkml/2018/5/24/1371

Thanks to the many folks that participated in the discussion.

[Backport for 4.4. 4.4 is missing commit 784d5699eddc "x86: move exports to
actual definitions" which doesn't apply cleanly, and not really worth
backporting IMO. It's simpler to change this patch from upstream:
  + #include <asm-generic/export.h>
rather than
  + #include <asm/export.h>]

Debugged-by: Alistair Strachan <astrachan@google.com>
Debugged-by: Matthias Kaehlcke <mka@chromium.org>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: H. Peter Anvin <hpa@zytor.com>
Suggested-by: Tom Stellar <tstellar@redhat.com>
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Acked-by: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: acme@redhat.com
Cc: akataria@vmware.com
Cc: akpm@linux-foundation.org
Cc: andrea.parri@amarulasolutions.com
Cc: ard.biesheuvel@linaro.org
Cc: aryabinin@virtuozzo.com
Cc: astrachan@google.com
Cc: boris.ostrovsky@oracle.com
Cc: brijesh.singh@amd.com
Cc: caoj.fnst@cn.fujitsu.com
Cc: geert@linux-m68k.org
Cc: ghackmann@google.com
Cc: gregkh@linuxfoundation.org
Cc: jan.kiszka@siemens.com
Cc: jarkko.sakkinen@linux.intel.com
Cc: joe@perches.com
Cc: jpoimboe@redhat.com
Cc: keescook@google.com
Cc: kirill.shutemov@linux.intel.com
Cc: kstewart@linuxfoundation.org
Cc: linux-efi@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org
Cc: manojgupta@google.com
Cc: mawilcox@microsoft.com
Cc: michal.lkml@markovi.net
Cc: mjg59@google.com
Cc: mka@chromium.org
Cc: pombredanne@nexb.com
Cc: rientjes@google.com
Cc: rostedt@goodmis.org
Cc: thomas.lendacky@amd.com
Cc: tweek@google.com
Cc: virtualization@lists.linux-foundation.org
Cc: will.deacon@arm.com
Cc: yamada.masahiro@socionext.com
Link: http://lkml.kernel.org/r/20180621162324.36656-4-ndesaulniers@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit f868639bf8896908ad45adf1e7c1f786bb3568cc)

BUG= chromium:867709 
TEST=Build and test on various affected systems

Change-Id: I06a42096396a1d621c55582f4dbd29db44c6875e
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1153558
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>

[modify] https://crrev.com/c7af8bbdd2318e8890365ee05e6bdd8700efd081/arch/x86/kernel/Makefile
[add] https://crrev.com/c7af8bbdd2318e8890365ee05e6bdd8700efd081/arch/x86/kernel/irqflags.S
[modify] https://crrev.com/c7af8bbdd2318e8890365ee05e6bdd8700efd081/arch/x86/include/asm/irqflags.h