1. 08 Mar, 2016 4 commits
    • David Hildenbrand's avatar
      KVM: s390: correct fprs on SIGP (STOP AND) STORE STATUS · 9522b37f
      David Hildenbrand authored
      With MACHINE_HAS_VX, we convert the floating point registers from the
      vector registeres when storing the status. For other VCPUs, these are
      stored to vcpu->run->s.regs.vrs, but we are using current->thread.fpu.vxrs,
      which resolves to the currently loaded VCPU.
      
      So kvm_s390_store_status_unloaded() currently writes the wrong floating
      point registers (converted from the vector registers) when called from
      another VCPU on a z13.
      
      This is only the case for old user space not handling SIGP STORE STATUS and
      SIGP STOP AND STORE STATUS, but relying on the kernel implementation. All
      other calls come from the loaded VCPU via kvm_s390_store_status().
      
      Fixes: 9abc2a08 (KVM: s390: fix memory overwrites when vx is disabled)
      Reviewed-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Cc: stable@vger.kernel.org # v4.4+
      Signed-off-by: default avatarDavid Hildenbrand <dahi@linux.vnet.ibm.com>
      Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      9522b37f
    • Paolo Bonzini's avatar
      Merge branch 'kvm-ppc-fixes' of... · 8bb9b9cc
      Paolo Bonzini authored
      Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD
      8bb9b9cc
    • Radim Krčmář's avatar
      KVM: VMX: disable PEBS before a guest entry · 7099e2e1
      Radim Krčmář authored
      Linux guests on Haswell (and also SandyBridge and Broadwell, at least)
      would crash if you decided to run a host command that uses PEBS, like
        perf record -e 'cpu/mem-stores/pp' -a
      
      This happens because KVM is using VMX MSR switching to disable PEBS, but
      SDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it
      isn't safe:
        When software needs to reconfigure PEBS facilities, it should allow a
        quiescent period between stopping the prior event counting and setting
        up a new PEBS event. The quiescent period is to allow any latent
        residual PEBS records to complete its capture at their previously
        specified buffer address (provided by IA32_DS_AREA).
      
      There might not be a quiescent period after the MSR switch, so a CPU
      ends up using host's MSR_IA32_DS_AREA to access an area in guest's
      memory.  (Or MSR switching is just buggy on some models.)
      
      The guest can learn something about the host this way:
      If the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results
      in #PF where we leak host's MSR_IA32_DS_AREA through CR2.
      
      After that, a malicious guest can map and configure memory where
      MSR_IA32_DS_AREA is pointing and can therefore get an output from
      host's tracing.
      
      This is not a critical leak as the host must initiate with PEBS tracing
      and I have not been able to get a record from more than one instruction
      before vmentry in vmx_vcpu_run() (that place has most registers already
      overwritten with guest's).
      
      We could disable PEBS just few instructions before vmentry, but
      disabling it earlier shouldn't affect host tracing too much.
      We also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that
      optimization isn't worth its code, IMO.
      
      (If you are implementing PEBS for guests, be sure to handle the case
       where both host and guest enable PEBS, because this patch doesn't.)
      
      Fixes: 26a4f3c0 ("perf/x86: disable PEBS on a guest entry.")
      Cc: <stable@vger.kernel.org>
      Reported-by: default avatarJiří Olša <jolsa@redhat.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      7099e2e1
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit · ccec4456
      Paul Mackerras authored
      Thomas Huth discovered that a guest could cause a hard hang of a
      host CPU by setting the Instruction Authority Mask Register (IAMR)
      to a suitable value.  It turns out that this is because when the
      code was added to context-switch the new special-purpose registers
      (SPRs) that were added in POWER8, we forgot to add code to ensure
      that they were restored to a sane value on guest exit.
      
      This adds code to set those registers where a bad value could
      compromise the execution of the host kernel to a suitable neutral
      value on guest exit.
      
      Cc: stable@vger.kernel.org # v3.14+
      Fixes: b005255eReported-by: default avatarThomas Huth <thuth@redhat.com>
      Reviewed-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      ccec4456
  2. 06 Mar, 2016 10 commits
  3. 05 Mar, 2016 19 commits
    • Colin Ian King's avatar
      um: use %lx format specifiers for unsigned longs · ad32a1f3
      Colin Ian King authored
      static analysis from cppcheck detected %x being used for
      unsigned longs:
      
      [arch/x86/um/os-Linux/task_size.c:112]: (warning) %x in format
        string (no. 1) requires 'unsigned int' but the argument type
        is 'unsigned long'.
      
      Use %lx instead of %x
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      ad32a1f3
    • Richard Weinberger's avatar
      um: Export pm_power_off · 0834f9cc
      Richard Weinberger authored
      ...modules are using this symbol.
      Export it like all other archs to.
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      0834f9cc
    • Richard Weinberger's avatar
      Revert "um: Fix get_signal() usage" · 322740ef
      Richard Weinberger authored
      Commit db2f24dc
      was plain wrong. I did not realize the we are
      allowed to loop here.
      In fact we have to loop and must not return to userspace
      before all SIGSEGVs have been delivered.
      Other archs do this directly in their entry code, UML
      does it here.
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      322740ef
    • Richard Weinberger's avatar
      ubi: Fix out of bounds write in volume update code · e4f6daac
      Richard Weinberger authored
      ubi_start_leb_change() allocates too few bytes.
      ubi_more_leb_change_data() will write up to req->upd_bytes +
      ubi->min_io_size bytes.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Reviewed-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      e4f6daac
    • Linus Torvalds's avatar
      Merge tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 67944024
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "It's our tradition to get a high volume of fixes late at rc7: this
        time, X32 ABI breakage was found and this resulted in a high number
        LOCs.  The necessary changes to ALSA core codes were fairly
        straightforward, and more importantly, they are specific to X32, thus
        should be safe to apply.
      
        Other than that, rather a collection of small fixes:
         - Removal of the code that blocks too long at closing the OSS
           sequencer client (which was spotted by syzkaller, unsurprisingly)
         - Fixes races at HD-audio HDMI i915 audio binding
         - a few HDSP/HDPM zero-division fixes
         - Quirks for HD-audio and USB-audio as usual"
      
      * tag 'sound-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - hdmi defer to register acomp eld notifier
        ALSA: hda - hdmi add wmb barrier for audio component
        ALSA: hda - Fix mic issues on Acer Aspire E1-472
        ALSA: seq: oss: Don't drain at closing a client
        ALSA: usb-audio: Add a quirk for Plantronics DA45
        ALSA: hdsp: Fix wrong boolean ctl value accesses
        ALSA: hdspm: Fix zero-division
        ALSA: hdspm: Fix wrong boolean ctl value accesses
        ALSA: timer: Fix ioctls for X32 ABI
        ALSA: timer: Fix broken compat timer user status ioctl
        ALSA: rawmidi: Fix ioctls X32 ABI
        ALSA: rawmidi: Use comapt_put_timespec()
        ALSA: pcm: Fix ioctls for X32 ABI
        ALSA: ctl: Fix ioctls for X32 ABI
      67944024
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma · 40fea2ed
      Linus Torvalds authored
      Pull dmaengine fix from Vinod Koul:
       "One minor fix on pxa driver to fix the cyclic dma tranfers"
      
      * tag 'dmaengine-fix-4.5-rc7' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: pxa_dma: fix cyclic transfers
      40fea2ed
    • Linus Torvalds's avatar
      Merge tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · ee8f3955
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
        - some last time changes before we stablize the new entity function
          integer numbers at uAPI
        - probe: fix erroneous return value on i2c/adp1653 driver
        - fix tx 5v detect regression on adv7604 driver
        - fix missing unlock on error in vpfe_prepare_pipeline() on
          davinci_vpfe driver
      
      * tag 'media/v4.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] media: Sanitise the reserved fields of the G_TOPOLOGY IOCTL arguments
        [media] media.h: postpone connectors entities
        [media] media.h: use hex values for range offsets,  move connectors base up.
        [media] adv7604: fix tx 5v detect regression
        [media] media.h: get rid of MEDIA_ENT_F_CONN_TEST
        [media] [for,v4.5] media.h: increase the spacing between function ranges
        [media] media: i2c/adp1653: probe: fix erroneous return value
        [media] media: davinci_vpfe: fix missing unlock on error in vpfe_prepare_pipeline()
      ee8f3955
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · a7c9b603
      Linus Torvalds authored
      Pull libnvcimm fix from Dan Williams:
       "One straggling fix for NVDIMM support.
      
        The KVM/QEMU enabling for NVDIMMs has recently reached the point where
        it is able to accept some ACPI _DSM requests from a guest VM.  However
        they immediately found that the 4.5-rc kernel is unusable because the
        kernel's 'nfit' driver fails to load upon seeing a valid "not
        supported" response from the virtual BIOS for an address range scrub
        command.
      
        It is not mandatory that a platform implement address range scrubbing,
        so this fix from Vishal properly treats the 'not supported' response
        as 'skip scrubbing and continue loading the driver'"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        nfit: Continue init even if ARS commands are unimplemented
      a7c9b603
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · c12f83c3
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Two fairly simple fixes.
      
        One is a regression with ipr firmware loading caused by one of the
        trivial patches in the last merge window which failed to strip the \n
        from the file name string, so now the firmware loader no longer works
        leading to a lot of unhappy ipr users; fix by stripping the \n.
      
        The second is a memory leak within SCSI: the BLK_PREP_INVALID state
        was introduced a recent fix but we forgot to account for it correctly
        when freeing state, resulting in memory leakage.  Add the correct
        state freeing in scsi_prep_return()"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        ipr: Fix regression when loading firmware
        SCSI: Free resources when we return BLKPREP_INVALID
      c12f83c3
    • Linus Torvalds's avatar
      Merge branch 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata · fab3e94a
      Linus Torvalds authored
      Pull libata fixes from Tejun Heo:
       "Assorted fixes for libata drivers.
      
         - Turns out HDIO_GET_32BIT ioctl was subtly broken all along.
      
         - Recent update to ahci external port handling was incorrectly
           marking hotpluggable ports as external making userland handle
           devices connected to those ports incorrectly.
      
         - ahci_xgene needs its own irq handler to work around a hardware
           erratum.  libahci updated to allow irq handler override.
      
         - Misc driver specific updates"
      
      * 'for-4.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
        ata: ahci: don't mark HotPlugCapable Ports as external/removable
        ahci: Workaround for ThunderX Errata#22536
        libata: Align ata_device's id on a cacheline
        Adding Intel Lewisburg device IDs for SATA
        pata-rb532-cf: get rid of the irq_to_gpio() call
        libata: fix HDIO_GET_32BIT ioctl
        ahci_xgene: Implement the workaround to fix the missing of the edge interrupt for the HOST_IRQ_STAT.
        ata: Remove the AHCI_HFLAG_EDGE_IRQ support from libahci.
        libahci: Implement the capability to override the generic ahci interrupt handler.
      fab3e94a
    • Linus Torvalds's avatar
      Merge branch 'for-linus2' of git://git.kernel.dk/linux-block · e5322c54
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Round 2 of this.  I cut back to the bare necessities, the patch is
        still larger than it usually would be at this time, due to the number
        of NVMe fixes in there.  This pull request contains:
      
         - The 4 core fixes from Ming, that fix both problems with exceeding
           the virtual boundary limit in case of merging, and the gap checking
           for cloned bio's.
      
         - NVMe fixes from Keith and Christoph:
      
              - Regression on larger user commands, causing problems with
                reading log pages (for instance). This touches both NVMe,
                and the block core since that is now generally utilized also
                for these types of commands.
      
              - Hot removal fixes.
      
              - User exploitable issue with passthrough IO commands, if !length
                is given, causing us to fault on writing to the zero
                page.
      
              - Fix for a hang under error conditions
      
         - And finally, the current series regression for umount with cgroup
           writeback, where the final flush would happen async and hence open
           up window after umount where the device wasn't consistent.  fsck
           right after umount would show this.  From Tejun"
      
      * 'for-linus2' of git://git.kernel.dk/linux-block:
        block: support large requests in blk_rq_map_user_iov
        block: fix blk_rq_get_max_sectors for driver private requests
        nvme: fix max_segments integer truncation
        nvme: set queue limits for the admin queue
        writeback: flush inode cgroup wb switches instead of pinning super_block
        NVMe: Fix 0-length integrity payload
        NVMe: Don't allow unsupported flags
        NVMe: Move error handling to failed reset handler
        NVMe: Simplify device reset failure
        NVMe: Fix namespace removal deadlock
        NVMe: Use IDA for namespace disk naming
        NVMe: Don't unmap controller registers on reset
        block: merge: get the 1st and last bvec via helpers
        block: get the 1st and last bvec via helpers
        block: check virt boundary in bio_will_gap()
        block: bio: introduce helpers to get the 1st and last bvec
      e5322c54
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · bdf9d297
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Additional 4.5-rc6 fixes.
      
        I have four patches today.  I had previously thought I had submitted
        two of them last week, but they were accidentally skipped :-(.
      
         - One fix to an error path in the core
         - One fix for RoCE in the core
         - Two related fixes for the core/mlx5"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/core: Use GRH when the path hop-limit > 0
        IB/{core, mlx5}: Fix input len in vendor part of create_qp/srq
        IB/mlx5: Avoid using user-index for SRQs
        IB/core: Fix missed clean call in registration path
      bdf9d297
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 638c201e
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This contains one i915 patch twice, as I merged it locally for
        testing, and then pulled some stuff in on top, and then Jani sent to
        me, I didn't think it was worth redoing all the merges of what I had
        tested.
      
        Summary:
      
         - amdgpu/radeon fixes for some more power management and VM races.
      
         - Two i915 fixes, one for the a recent regression, one another power
           management fix for skylake.
      
         - Two tegra dma mask fixes for a regression.
      
         - One ast fix for a typo I made transcribing the userspace driver,
           that I'd like to get into stable so I don't forget about it"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        gpu: host1x: Set DMA ops on device creation
        gpu: host1x: Set DMA mask
        drm/amdgpu: return from atombios_dp_get_dpcd only when error
        drm/amdgpu/cz: remove commented out call to enable vce pg
        drm/amdgpu/powerplay/cz: enable/disable vce dpm independent of vce pg
        drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled
        drm/amdgpu/gfx8: specify which engine to wait before vm flush
        drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well
        drm/amd/powerplay: send event to notify powerplay all modules are initialized.
        drm/amd/powerplay: export AMD_PP_EVENT_COMPLETE_INIT task to amdgpu.
        drm/radeon/pm: update current crtc info after setting the powerstate
        drm/amdgpu/pm: update current crtc info after setting the powerstate
        drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM)
        drm/i915/skl: Fix power domain suspend sequence
        drm/ast: Fix incorrect register check for DRAM width
        drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM)
      638c201e
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · b80e8e28
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
       "Two build fixes for cpufreq drivers (including one for breakage
        introduced recently) and a fix for a graph tracer crash when used over
        suspend-to-RAM on x86.
      
        Specifics:
      
         - Prevent the graph tracer from crashing when used over suspend-to-
           RAM on x86 by pausing it before invoking do_suspend_lowlevel() and
           un-pausing it when that function has returned (Todd Brandt).
      
         - Fix build issues in the qoriq and mediatek cpufreq drivers related
           to broken dependencies on THERMAL (Arnd Bergmann)"
      
      * tag 'pm+acpi-4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / sleep / x86: Fix crash on graph trace through x86 suspend
        cpufreq: mediatek: allow building as a module
        cpufreq: qoriq: allow building as module with THERMAL=m
      b80e8e28
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · ed385c7a
      Linus Torvalds authored
      Pull arm64 fix from Will Deacon:
       "Arm64 fix for -rc7.  Without it, our struct page array can overflow
        the vmemmap region on systems with a large PHYS_OFFSET.
      
        Nothing else on the radar at the moment, so hopefully that's it for
        4.5 from us.
      
        Summary: Ensure struct page array fits within vmemmap area"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: vmemmap: use virtual projection of linear region
      ed385c7a
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd · c51797d2
      Linus Torvalds authored
      Pull jffs2 fixes from David Woodhouse:
       "This contains two important JFFS2 fixes marked for stable:
      
         - a lock ordering problem between the page lock and the internal
           f->sem mutex, which was causing occasional deadlocks in garbage
           collection
      
         - a scan failure causing moved directories to sometimes end up
           appearing to have hard links.
      
        There are also a couple of trivial MAINTAINERS file updates"
      
      * tag 'for-linus-20160304' of git://git.infradead.org/linux-mtd:
        MAINTAINERS: add maintainer entry for FREESCALE GPMI NAND driver
        Fix directory hardlinks from deleted directories
        jffs2: Fix page lock / f->sem deadlock
        Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin"
        MAINTAINERS: update Han's email
      c51797d2
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 2cdcb2b5
      Linus Torvalds authored
      Pull btrfs fix from Chris Mason:
       "Filipe nailed down a problem where tree log replay would do some work
        that orphan code wasn't expecting to be done yet, leading to BUG_ON"
      
      * 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix loading of orphan roots leading to BUG_ON
      2cdcb2b5
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-v4.5-rc6' of... · 78baab7a
      Linus Torvalds authored
      Merge tag 'trace-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fix from Steven Rostedt:
       "A feature was added in 4.3 that allowed users to filter trace points
        on a tasks "comm" field.  But this prevented filtering on a comm field
        that is within a trace event (like sched_migrate_task).
      
        When trying to filter on when a program migrated, this change
        prevented the filtering of the sched_migrate_task.
      
        To fix this, the event fields are examined first, and then the extra
        fields like "comm" and "cpu" are examined.  Also, instead of testing
        to assign the comm filter function based on the field's name, the
        generic comm field is given a new filter type (FILTER_COMM).  When
        this field is used to filter the type is checked.  The same is done
        for the cpu filter field.
      
        Two new special filter types are added: "COMM" and "CPU".  This allows
        users to still filter the tasks comm for events that have "comm" as
        one of their fields, in cases that users would like to filter
        sched_migrate_task on the comm of the task that called the event, and
        not the comm of the task that is being migrated"
      
      * tag 'trace-fixes-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Do not have 'comm' filter override event 'comm' field
      78baab7a
    • Vishal Verma's avatar
      nfit: Continue init even if ARS commands are unimplemented · 6e2452df
      Vishal Verma authored
      If firmware doesn't implement any of the ARS commands, take that to
      mean that ARS is unsupported, and continue to initialize regions without
      bad block lists. We cannot make the assumption that ARS commands will be
      unconditionally supported on all NVDIMMs.
      Reported-by: default avatarHaozhong Zhang <haozhong.zhang@intel.com>
      Signed-off-by: default avatarVishal Verma <vishal.l.verma@intel.com>
      Acked-by: default avatarXiao Guangrong <guangrong.xiao@linux.intel.com>
      Tested-by: default avatarHaozhong Zhang <haozhong.zhang@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      6e2452df
  4. 04 Mar, 2016 7 commits