Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-862.OL7]
- Oracle Linux certificates (Alexey Petrenko)
- Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
- Update x509.genkey [bug 24817676]

[3.10.0-862]
- [netdrv] i40e: Fix attach VF to VM issue (Stefan Assmann) [1528123]
- [netdrv] ixgbevf: Add check for ixgbe_mbox_api_13 to ixgbevf_probe when setting max_mtu (Ken Cox) [1556696]
- [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1557849]
- [x86] pti: Disable PTI user page table update in EFI virtual mode (Waiman Long) [1540061]

[3.10.0-861]
- [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1554590]
- [nvme] validate admin queue before unquiesce (David Milburn) [1549733]

[3.10.0-860]
- [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
- [fs] gfs2: fixes to 'implement iomap for block_map' (Andreas Grunbacher) [1542594]
- [x86] kvm: svm: disable virtual GIF and VMLOAD/VMSAVE (Paolo Bonzini) [1552090]

[3.10.0-859]
- [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430] {CVE-2017-13166}
- [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
- [fs] Revert dcache_readdir back to ->readdir() ('Eric W. Biederman') [1525541]
- [md] dm-raid: fix incorrect sync_ratio when degraded (Mike Snitzer) [1547979]
- [mm] page_alloc: fix memmap_init_zone pageblock alignment (Daniel Vacek) [1525121]
- [mm] revert kvmalloc: stress the vmalloc path in the debugging kernel (Jeff Moyer) [1550094]
- [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1543067]
- [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1543067]
- [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1543067]
- [x86] kvm: vmx: Cache IA32_DEBUGCTL in memory (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: avoid rmb() on full retpoline kernels (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: replace boot_cpu_has with a static key for IBRS checks (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: actually use static key for retpolines (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: optimize IBRS handling at vmenter/vmexit (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: mark RDMSR path as unlikely (Paolo Bonzini) [1537379]
- [x86] kvm: use native_read_msr to read SPEC_CTRL (Paolo Bonzini) [1537379]
- [x86] kvm/nvmx: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap (Paolo Bonzini) [1537379]
- [x86] nvmx: Properly set spec_ctrl and pred_cmd before merging MSRs (Paolo Bonzini) [1537379]
- [x86] kvm/vmx: Allow direct access to MSR_IA32_SPEC_CTRL (Paolo Bonzini) [1537379]
- [x86] kvm: Add IBPB support (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: make MSR bitmaps per-VCPU (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: Do not disable intercepts for BNDCFGS (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: introduce alloc_loaded_vmcs (Paolo Bonzini) [1537379]
- [x86] kvm: nvmx: Eliminate vmcs02 pool (Paolo Bonzini) [1537379]
- [x86] kvm: nvmx: single function for switching between vmcs (Paolo Bonzini) [1537379]
- [x86] kvm: Update the reverse_cpuid list to include CPUID_7_EDX (Paolo Bonzini) [1537379]
- [x86] cpuid: Fix up 'virtual' IBRS/IBPB/STIBP feature bits on Intel (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add Intel feature bits for Speculation Control (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add AMD feature bits for Speculation Control (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Paolo Bonzini) [1537379]
- [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Paolo Bonzini) [1537379]

[3.10.0-858]
- [tools] revert perf: Fix swap for samples with raw data (Jiri Olsa) [1458228]
- [netdrv] ibmvnic: Fix early release of login buffer (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Clean RX pool buffers during device close (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Free RX socket buffer in case of adapter error (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Fix NAPI structures memory leak (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Fix login buffer memory leaks (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Wait until reset is complete to set carrier on (Desnes Augusto Nunes do Rosario) [1545578]
- [block] disable runtime-pm for blk-mq (Ming Lei) [1548269]
- [mm] revert memcontrol: fix cgroup creation failure after many small jobs (Aristeu Rozanski) [1548593 1517028]
- [mm] revert cgroup: kill css_id (Aristeu Rozanski) [1548593 1517028]

[3.10.0-857]
- [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
- [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381] {CVE-2017-15265}
- [gpu] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE (Rob Clark) [1546022]
- [edac] disable only ghes_edac by default (Aristeu Rozanski) [1543078]
- [edac] ghes: Model a single, logical memory controller (Aristeu Rozanski) [1543078]
- [fs] cifs: release cifs root_cred after exit_cifs (Leif Sahlberg) [1525874]
- [fs] gfs2: Fix fallocate chunk size (Andreas Grunbacher) [1545329]
- [fs] gfs2: Fixes to 'Implement iomap for block_map' (Andreas Grunbacher) [1542594]
- [fs] gfs2: Clean up (lookup,fillup)_metapath (Andreas Grunbacher) [1542594]
- [fs] iomap: warn on zero-length mappings (Andreas Grunbacher) [1542594]
- [md] raid0: remove blank line printk from dump_zones() (John Pittman) [1534272]
- [md] dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl (Mike Snitzer) [1513037]
- [mm] kvmalloc: stress the vmalloc path in the debugging kernel (Mikulas Patocka) [1523567]
- [mm] fs: rework do_invalidatepage (Eric Sandeen) [1546079]
- [net] netfilter: fix NULL ptr dereference in nf_send_rese