1. 10 Mar, 2016 11 commits
    • Andy Lutomirski's avatar
      x86/entry: Remove TIF_SINGLESTEP entry work · 392a6254
      Andy Lutomirski authored
      Now that SYSENTER with TF set puts X86_EFLAGS_TF directly into
      regs->flags, we don't need a TIF_SINGLESTEP fixup in the syscall
      entry code.  Remove it.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/2d15f24da52dafc9d2f0b8d76f55544f4779c517.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      392a6254
    • Andy Lutomirski's avatar
      x86/entry/32: Add and check a stack canary for the SYSENTER stack · 2a41aa4f
      Andy Lutomirski authored
      The first instruction of the SYSENTER entry runs on its own tiny
      stack.  That stack can be used if a #DB or NMI is delivered before
      the SYSENTER prologue switches to a real stack.
      
      We have code in place to prevent us from overflowing the tiny stack.
      For added paranoia, add a canary to the stack and check it in
      do_debug() -- that way, if something goes wrong with the #DB logic,
      we'll eventually notice.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/6ff9a806f39098b166dc2c41c1db744df5272f29.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      2a41aa4f
    • Andy Lutomirski's avatar
      x86/entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup · 7536656f
      Andy Lutomirski authored
      Right after SYSENTER, we can get a #DB or NMI.  On x86_32, there's no IST,
      so the exception handler is invoked on the temporary SYSENTER stack.
      
      Because the SYSENTER stack is very small, we have a fixup to switch
      off the stack quickly when this happens.  The old fixup had several issues:
      
       1. It checked the interrupt frame's CS and EIP.  This wasn't
          obviously correct on Xen or if vm86 mode was in use [1].
      
       2. In the NMI handler, it did some frightening digging into the
          stack frame.  I'm not convinced this digging was correct.
      
       3. The fixup didn't switch stacks and then switch back.  Instead, it
          synthesized a brand new stack frame that would redirect the IRET
          back to the SYSENTER code.  That frame was highly questionable.
          For one thing, if NMI nested inside #DB, we would effectively
          abort the #DB prologue, which was probably safe but was
          frightening.  For another, the code used PUSHFL to write the
          FLAGS portion of the frame, which was simply bogus -- by the time
          PUSHFL was called, at least TF, NT, VM, and all of the arithmetic
          flags were clobbered.
      
      Simplify this considerably.  Instead of looking at the saved frame
      to see where we came from, check the hardware ESP register against
      the SYSENTER stack directly.  Malicious user code cannot spoof the
      kernel ESP register, and by moving the check after SAVE_ALL, we can
      use normal PER_CPU accesses to find all the relevant addresses.
      
      With this patch applied, the improved syscall_nt_32 test finally
      passes on 32-bit kernels.
      
      [1] It isn't obviously correct, but it is nonetheless safe from vm86
          shenanigans as far as I can tell.  A user can't point EIP at
          entry_SYSENTER_32 while in vm86 mode because entry_SYSENTER_32,
          like all kernel addresses, is greater than 0xffff and would thus
          violate the CS segment limit.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/b2cdbc037031c07ecf2c40a96069318aec0e7971.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      7536656f
    • Andy Lutomirski's avatar
      x86/entry: Only allocate space for tss_struct::SYSENTER_stack if needed · 6dcc9414
      Andy Lutomirski authored
      The SYSENTER stack is only used on 32-bit kernels.  Remove it on 64-bit kernels.
      
      ( We may end up using it down the road on 64-bit kernels. If so,
        we'll re-enable it for CONFIG_IA32_EMULATION. )
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/9dbd18429f9ff61a76b6eda97a9ea20510b9f6ba.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      6dcc9414
    • Andy Lutomirski's avatar
      x86/entry: Vastly simplify SYSENTER TF (single-step) handling · f2b37575
      Andy Lutomirski authored
      Due to a blatant design error, SYSENTER doesn't clear TF (single-step).
      
      As a result, if a user does SYSENTER with TF set, we will single-step
      through the kernel until something clears TF.  There is absolutely
      nothing we can do to prevent this short of turning off SYSENTER [1].
      
      Simplify the handling considerably with two changes:
      
        1. We already sanitize EFLAGS in SYSENTER to clear NT and AC.  We can
           add TF to that list of flags to sanitize with no overhead whatsoever.
      
        2. Teach do_debug() to ignore single-step traps in the SYSENTER prologue.
      
      That's all we need to do.
      
      Don't get too excited -- our handling is still buggy on 32-bit
      kernels.  There's nothing wrong with the SYSENTER code itself, but
      the #DB prologue has a clever fixup for traps on the very first
      instruction of entry_SYSENTER_32, and the fixup doesn't work quite
      correctly.  The next two patches will fix that.
      
      [1] We could probably prevent it by forcing BTF on at all times and
          making sure we clear TF before any branches in the SYSENTER
          code.  Needless to say, this is a bad idea.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/a30d2ea06fe4b621fe6a9ef911b02c0f38feb6f2.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      f2b37575
    • Andy Lutomirski's avatar
      x86/entry/traps: Clear DR6 early in do_debug() and improve the comment · 8bb56436
      Andy Lutomirski authored
      Leaving any bits set in DR6 on return from a debug exception is
      asking for trouble.  Prevent it by writing zero right away and
      clarify the comment.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/3857676e1be8fb27db4b89bbb1e2052b7f435ff4.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      8bb56436
    • Andy Lutomirski's avatar
      x86/entry/traps: Clear TIF_BLOCKSTEP on all debug exceptions · 81edd9f6
      Andy Lutomirski authored
      The SDM says that debug exceptions clear BTF, and we need to keep
      TIF_BLOCKSTEP in sync with BTF.  Clear it unconditionally and improve
      the comment.
      
      I suspect that the fact that kmemcheck could cause TIF_BLOCKSTEP not
      to be cleared was just an oversight.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/fa86e55d196e6dde5b38839595bde2a292c52fdc.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      81edd9f6
    • Andy Lutomirski's avatar
      x86/entry/32: Restore FLAGS on SYSEXIT · c2c9b52f
      Andy Lutomirski authored
      We weren't restoring FLAGS at all on SYSEXIT.  Apparently no one cared.
      
      With this patch applied, native kernels should always honor
      task_pt_regs()->flags, which opens the door for some sys_iopl()
      cleanups.  I'll do those as a separate series, though, since getting
      it right will involve tweaking some paravirt ops.
      
      ( The short version is that, before this patch, sys_iopl(), invoked via
        SYSENTER, wasn't guaranteed to ever transfer the updated
        regs->flags, so sys_iopl() had to change the hardware flags register
        as well. )
      Reported-by: default avatarBrian Gerst <brgerst@gmail.com>
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/3f98b207472dc9784838eb5ca2b89dcc845ce269.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      c2c9b52f
    • Andy Lutomirski's avatar
      x86/entry/32: Filter NT and speed up AC filtering in SYSENTER · 67f590e8
      Andy Lutomirski authored
      This makes the 32-bit code work just like the 64-bit code.  It should
      speed up syscalls on 32-bit kernels on Skylake by something like 20
      cycles (by analogy to the 64-bit compat case).
      
      It also cleans up NT just like we do for the 64-bit case.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/07daef3d44bd1ed62a2c866e143e8df64edb40ee.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      67f590e8
    • Andy Lutomirski's avatar
      x86/entry/compat: In SYSENTER, sink AC clearing below the existing FLAGS test · e7860411
      Andy Lutomirski authored
      CLAC is slow, and the SYSENTER code already has an unlikely path
      that runs if unusual flags are set.  Drop the CLAC and instead rely
      on the unlikely path to clear AC.
      
      This seems to save ~24 cycles on my Skylake laptop.  (Hey, Intel,
      make this faster please!)
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/90d6db2189f9add83bc7bddd75a0c19ebbd676b2.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      e7860411
    • Andy Lutomirski's avatar
      selftests/x86: In syscall_nt, test NT|TF as well · a318beea
      Andy Lutomirski authored
      Setting TF prevents fastpath returns in most cases, which causes the
      test to fail on 32-bit kernels because 32-bit kernels do not, in
      fact, handle NT correctly on SYSENTER entries.
      
      The next patch will fix 32-bit kernels.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/bd4bb48af6b10c0dc84aec6dbcf487ed25683495.1457578375.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a318beea
  2. 08 Mar, 2016 2 commits
    • Andy Lutomirski's avatar
      x86/asm-offsets: Remove PARAVIRT_enabled · 0dd0036f
      Andy Lutomirski authored
      It no longer has any users.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Luis R. Rodriguez <mcgrof@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: boris.ostrovsky@oracle.com
      Cc: david.vrabel@citrix.com
      Cc: konrad.wilk@oracle.com
      Cc: lguest@lists.ozlabs.org
      Cc: xen-devel@lists.xensource.com
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      0dd0036f
    • Andy Lutomirski's avatar
      x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled · 58a5aac5
      Andy Lutomirski authored
      x86_64 has very clean espfix handling on paravirt: espfix64 is set
      up in native_iret, so paravirt systems that override iret bypass
      espfix64 automatically.  This is robust and straightforward.
      
      x86_32 is messier.  espfix is set up before the IRET paravirt patch
      point, so it can't be directly conditionalized on whether we use
      native_iret.  We also can't easily move it into native_iret without
      regressing performance due to a bizarre consideration.  Specifically,
      on 64-bit kernels, the logic is:
      
        if (regs->ss & 0x4)
                setup_espfix;
      
      On 32-bit kernels, the logic is:
      
        if ((regs->ss & 0x4) && (regs->cs & 0x3) == 3 &&
            (regs->flags & X86_EFLAGS_VM) == 0)
                setup_espfix;
      
      The performance of setup_espfix itself is essentially irrelevant, but
      the comparison happens on every IRET so its performance matters.  On
      x86_64, there's no need for any registers except flags to implement
      the comparison, so we fold the whole thing into native_iret.  On
      x86_32, we don't do that because we need a free register to
      implement the comparison efficiently.  We therefore do espfix setup
      before restoring registers on x86_32.
      
      This patch gets rid of the explicit paravirt_enabled check by
      introducing X86_BUG_ESPFIX on 32-bit systems and using an ALTERNATIVE
      to skip espfix on paravirt systems where iret != native_iret.  This is
      also messy, but it's at least in line with other things we do.
      
      This improves espfix performance by removing a branch, but no one
      cares.  More importantly, it removes a paravirt_enabled user, which is
      good because paravirt_enabled is ill-defined and is going away.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Luis R. Rodriguez <mcgrof@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: boris.ostrovsky@oracle.com
      Cc: david.vrabel@citrix.com
      Cc: konrad.wilk@oracle.com
      Cc: lguest@lists.ozlabs.org
      Cc: xen-devel@lists.xensource.com
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      58a5aac5
  3. 07 Mar, 2016 1 commit
  4. 06 Mar, 2016 10 commits
  5. 05 Mar, 2016 16 commits
    • Colin Ian King's avatar
      um: use %lx format specifiers for unsigned longs · ad32a1f3
      Colin Ian King authored
      static analysis from cppcheck detected %x being used for
      unsigned longs:
      
      [arch/x86/um/os-Linux/task_size.c:112]: (warning) %x in format
        string (no. 1) requires 'unsigned int' but the argument type
        is 'unsigned long'.
      
      Use %lx instead of %x
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      ad32a1f3
    • Richard Weinberger's avatar
      um: Export pm_power_off · 0834f9cc
      Richard Weinberger authored
      ...modules are using this symbol.
      Export it like all other archs to.
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      0834f9cc
    • Richard Weinberger's avatar
      Revert "um: Fix get_signal() usage" · 322740ef
      Richard Weinberger authored
      Commit db2f24dc
      was plain wrong. I did not realize the we are
      allowed to loop here.
      In fact we have to loop and must not return to userspace
      before all SIGSEGVs have been delivered.
      Other archs do this directly in their entry code, UML
      does it here.
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      322740ef
    • Richard Weinberger's avatar
      ubi: Fix out of bounds write in volume update code · e4f6daac
      Richard Weinberger authored
      ubi_start_leb_change() allocates too few bytes.
      ubi_more_leb_change_data() will write up to req->upd_bytes +
      ubi->min_io_size bytes.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Reviewed-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      e4f6daac
    • Linus Torvalds's avatar
      Merge tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 67944024
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "It's our tradition to get a high volume of fixes late at rc7: this
        time, X32 ABI breakage was found and this resulted in a high number
        LOCs.  The necessary changes to ALSA core codes were fairly
        straightforward, and more importantly, they are specific to X32, thus
        should be safe to apply.
      
        Other than that, rather a collection of small fixes:
         - Removal of the code that blocks too long at closing the OSS
           sequencer client (which was spotted by syzkaller, unsurprisingly)
         - Fixes races at HD-audio HDMI i915 audio binding
         - a few HDSP/HDPM zero-division fixes
         - Quirks for HD-audio and USB-audio as usual"
      
      * tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - hdmi defer to register acomp eld notifier
        ALSA: hda - hdmi add wmb barrier for audio component
        ALSA: hda - Fix mic issues on Acer Aspire E1-472
        ALSA: seq: oss: Don't drain at closing a client
        ALSA: usb-audio: Add a quirk for Plantronics DA45
        ALSA: hdsp: Fix wrong boolean ctl value accesses
        ALSA: hdspm: Fix zero-division
        ALSA: hdspm: Fix wrong boolean ctl value accesses
        ALSA: timer: Fix ioctls for X32 ABI
        ALSA: timer: Fix broken compat timer user status ioctl
        ALSA: rawmidi: Fix ioctls X32 ABI
        ALSA: rawmidi: Use comapt_put_timespec()
        ALSA: pcm: Fix ioctls for X32 ABI
        ALSA: ctl: Fix ioctls for X32 ABI
      67944024
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma · 40fea2ed
      Linus Torvalds authored
      Pull dmaengine fix from Vinod Koul:
       "One minor fix on pxa driver to fix the cyclic dma tranfers"
      
      * tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: pxa_dma: fix cyclic transfers
      40fea2ed
    • Linus Torvalds's avatar
      Merge tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · ee8f3955
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
        - some last time changes before we stablize the new entity function
          integer numbers at uAPI
        - probe: fix erroneous return value on i2c/adp1653 driver
        - fix tx 5v detect regression on adv7604 driver
        - fix missing unlock on error in vpfe_prepare_pipeline() on
          davinci_vpfe driver
      
      * tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] media: Sanitise the reserved fields of the G_TOPOLOGY IOCTL arguments
        [media] media.h: postpone connectors entities
        [media] media.h: use hex values for range offsets,  move connectors base up.
        [media] adv7604: fix tx 5v detect regression
        [media] media.h: get rid of MEDIA_ENT_F_CONN_TEST
        [media] [for,v4.5] media.h: increase the spacing between function ranges
        [media] media: i2c/adp1653: probe: fix erroneous return value
        [media] media: davinci_vpfe: fix missing unlock on error in vpfe_prepare_pipeline()
      ee8f3955
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · a7c9b603
      Linus Torvalds authored
      Pull libnvcimm fix from Dan Williams:
       "One straggling fix for NVDIMM support.
      
        The KVM/QEMU enabling for NVDIMMs has recently reached the point where
        it is able to accept some ACPI _DSM requests from a guest VM.  However
        they immediately found that the 4.5-rc kernel is unusable because the
        kernel's 'nfit' driver fails to load upon seeing a valid "not
        supported" response from the virtual BIOS for an address range scrub
        command.
      
        It is not mandatory that a platform implement address range scrubbing,
        so this fix from Vishal properly treats the 'not supported' response
        as 'skip scrubbing and continue loading the driver'"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        nfit: Continue init even if ARS commands are unimplemented
      a7c9b603
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · c12f83c3
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Two fairly simple fixes.
      
        One is a regression with ipr firmware loading caused by one of the
        trivial patches in the last merge window which failed to strip the \n
        from the file name string, so now the firmware loader no longer works
        leading to a lot of unhappy ipr users; fix by stripping the \n.
      
        The second is a memory leak within SCSI: the BLK_PREP_INVALID state
        was introduced a recent fix but we forgot to account for it correctly
        when freeing state, resulting in memory leakage.  Add the correct
        state freeing in scsi_prep_return()"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        ipr: Fix regression when loading firmware
        SCSI: Free resources when we return BLKPREP_INVALID
      c12f83c3
    • Linus Torvalds's avatar
      Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata · fab3e94a
      Linus Torvalds authored
      Pull libata fixes from Tejun Heo:
       "Assorted fixes for libata drivers.
      
         - Turns out HDIO_GET_32BIT ioctl was subtly broken all along.
      
         - Recent update to ahci external port handling was incorrectly
           marking hotpluggable ports as external making userland handle
           devices connected to those ports incorrectly.
      
         - ahci_xgene needs its own irq handler to work around a hardware
           erratum.  libahci updated to allow irq handler override.
      
         - Misc driver specific updates"
      
      * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
        ata: ahci: don't mark HotPlugCapable Ports as external/removable
        ahci: Workaround for ThunderX Errata#22536
        libata: Align ata_device's id on a cacheline
        Adding Intel Lewisburg device IDs for SATA
        pata-rb532-cf: get rid of the irq_to_gpio() call
        libata: fix HDIO_GET_32BIT ioctl
        ahci_xgene: Implement the workaround to fix the missing of the edge interrupt for the HOST_IRQ_STAT.
        ata: Remove the AHCI_HFLAG_EDGE_IRQ support from libahci.
        libahci: Implement the capability to override the generic ahci interrupt handler.
      fab3e94a
    • Linus Torvalds's avatar
      Merge branch 'for-linus2' of git://git.kernel.dk/linux-block · e5322c54
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Round 2 of this.  I cut back to the bare necessities, the patch is
        still larger than it usually would be at this time, due to the number
        of NVMe fixes in there.  This pull request contains:
      
         - The 4 core fixes from Ming, that fix both problems with exceeding
           the virtual boundary limit in case of merging, and the gap checking
           for cloned bio's.
      
         - NVMe fixes from Keith and Christoph:
      
              - Regression on larger user commands, causing problems with
                reading log pages (for instance). This touches both NVMe,
                and the block core since that is now generally utilized also
                for these types of commands.
      
              - Hot removal fixes.
      
              - User exploitable issue with passthrough IO commands, if !length
                is given, causing us to fault on writing to the zero
                page.
      
              - Fix for a hang under error conditions
      
         - And finally, the current series regression for umount with cgroup
           writeback, where the final flush would happen async and hence open
           up window after umount where the device wasn't consistent.  fsck
           right after umount would show this.  From Tejun"
      
      * 'for-linus2' of git://git.kernel.dk/linux-block:
        block: support large requests in blk_rq_map_user_iov
        block: fix blk_rq_get_max_sectors for driver private requests
        nvme: fix max_segments integer truncation
        nvme: set queue limits for the admin queue
        writeback: flush inode cgroup wb switches instead of pinning super_block
        NVMe: Fix 0-length integrity payload
        NVMe: Don't allow unsupported flags
        NVMe: Move error handling to failed reset handler
        NVMe: Simplify device reset failure
        NVMe: Fix namespace removal deadlock
        NVMe: Use IDA for namespace disk naming
        NVMe: Don't unmap controller registers on reset
        block: merge: get the 1st and last bvec via helpers
        block: get the 1st and last bvec via helpers
        block: check virt boundary in bio_will_gap()
        block: bio: introduce helpers to get the 1st and last bvec
      e5322c54
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · bdf9d297
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Additional 4.5-rc6 fixes.
      
        I have four patches today.  I had previously thought I had submitted
        two of them last week, but they were accidentally skipped :-(.
      
         - One fix to an error path in the core
         - One fix for RoCE in the core
         - Two related fixes for the core/mlx5"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/core: Use GRH when the path hop-limit > 0
        IB/{core, mlx5}: Fix input len in vendor part of create_qp/srq
        IB/mlx5: Avoid using user-index for SRQs
        IB/core: Fix missed clean call in registration path
      bdf9d297
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 638c201e
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This contains one i915 patch twice, as I merged it locally for
        testing, and then pulled some stuff in on top, and then Jani sent to
        me, I didn't think it was worth redoing all the merges of what I had
        tested.
      
        Summary:
      
         - amdgpu/radeon fixes for some more power management and VM races.
      
         - Two i915 fixes, one for the a recent regression, one another power
           management fix for skylake.
      
         - Two tegra dma mask fixes for a regression.
      
         - One ast fix for a typo I made transcribing the userspace driver,
           that I'd like to get into stable so I don't forget about it"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        gpu: host1x: Set DMA ops on device creation
        gpu: host1x: Set DMA mask
        drm/amdgpu: return from atombios_dp_get_dpcd only when error
        drm/amdgpu/cz: remove commented out call to enable vce pg
        drm/amdgpu/powerplay/cz: enable/disable vce dpm independent of vce pg
        drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled
        drm/amdgpu/gfx8: specify which engine to wait before vm flush
        drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well
        drm/amd/powerplay: send event to notify powerplay all modules are initialized.
        drm/amd/powerplay: export AMD_PP_EVENT_COMPLETE_INIT task to amdgpu.
        drm/radeon/pm: update current crtc info after setting the powerstate
        drm/amdgpu/pm: update current crtc info after setting the powerstate
        drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM)
        drm/i915/skl: Fix power domain suspend sequence
        drm/ast: Fix incorrect register check for DRAM width
        drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM)
      638c201e
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · b80e8e28
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
       "Two build fixes for cpufreq drivers (including one for breakage
        introduced recently) and a fix for a graph tracer crash when used over
        suspend-to-RAM on x86.
      
        Specifics:
      
         - Prevent the graph tracer from crashing when used over suspend-to-
           RAM on x86 by pausing it before invoking do_suspend_lowlevel() and
           un-pausing it when that function has returned (Todd Brandt).
      
         - Fix build issues in the qoriq and mediatek cpufreq drivers related
           to broken dependencies on THERMAL (Arnd Bergmann)"
      
      * tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / sleep / x86: Fix crash on graph trace through x86 suspend
        cpufreq: mediatek: allow building as a module
        cpufreq: qoriq: allow building as module with THERMAL=m
      b80e8e28
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · ed385c7a
      Linus Torvalds authored
      Pull arm64 fix from Will Deacon:
       "Arm64 fix for -rc7.  Without it, our struct page array can overflow
        the vmemmap region on systems with a large PHYS_OFFSET.
      
        Nothing else on the radar at the moment, so hopefully that's it for
        4.5 from us.
      
        Summary: Ensure struct page array fits within vmemmap area"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: vmemmap: use virtual projection of linear region
      ed385c7a
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd · c51797d2
      Linus Torvalds authored
      Pull jffs2 fixes from David Woodhouse:
       "This contains two important JFFS2 fixes marked for stable:
      
         - a lock ordering problem between the page lock and the internal
           f->sem mutex, which was causing occasional deadlocks in garbage
           collection
      
         - a scan failure causing moved directories to sometimes end up
           appearing to have hard links.
      
        There are also a couple of trivial MAINTAINERS file updates"
      
      * tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd:
        MAINTAINERS: add maintainer entry for FREESCALE GPMI NAND driver
        Fix directory hardlinks from deleted directories
        jffs2: Fix page lock / f->sem deadlock
        Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin"
        MAINTAINERS: update Han's email
      c51797d2