1. 31 Jul, 2015 2 commits
    • Andy Lutomirski's avatar
      x86/xen: Probe target addresses in set_aliased_prot() before the hypercall · aa1acff3
      Andy Lutomirski authored
      The update_va_mapping hypercall can fail if the VA isn't present
      in the guest's page tables.  Under certain loads, this can
      result in an OOPS when the target address is in unpopulated vmap
      space.
      
      While we're at it, add comments to help explain what's going on.
      
      This isn't a great long-term fix.  This code should probably be
      changed to use something like set_memory_ro.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Cooper <andrew.cooper3@citrix.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: David Vrabel <dvrabel@cantab.net>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Jan Beulich <jbeulich@suse.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: security@kernel.org <security@kernel.org>
      Cc: <stable@vger.kernel.org>
      Cc: xen-devel <xen-devel@lists.xen.org>
      Link: http://lkml.kernel.org/r/0b0e55b995cda11e7829f140b833ef932fcabe3a.1438291540.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      aa1acff3
    • Ingo Molnar's avatar
      Merge tag 'efi-urgent' of... · 1adb9123
      Ingo Molnar authored
      Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent
      
      Pull EFI fixes from Matt Fleming:
      
       * Fix an EFI boot issue preventing a Parallels virtual machine from
         booting because the upper 32-bits of the EFI memmap pointer were
         being discarded in setup_e820(). (Dmitry Skorodumov)
      
       * Validate that the "efi" kernel parameter gets used with an argument,
         otherwise we will oops. (Ricardo Neri)
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      1adb9123
  2. 30 Jul, 2015 3 commits
    • Jiang Liu's avatar
      x86/irq: Use the caller provided polarity setting in mp_check_pin_attr() · 646c4b75
      Jiang Liu authored
      Commit d32932d0 ("x86/irq: Convert IOAPIC to use hierarchical
      irqdomain interfaces") introduced a regression which causes
      malfunction of interrupt lines.
      
      The reason is that the conversion of mp_check_pin_attr() missed to
      update the polarity selection of the interrupt pin with the caller
      provided setting and instead uses a stale attribute value. That in
      turn results in chosing the wrong interrupt flow handler.
      
      Use the caller supplied setting to configure the pin correctly which
      also choses the correct interrupt flow handler.
      
      This restores the original behaviour and on the affected
      machine/driver (Surface Pro 3, i2c controller) all IOAPIC IRQ
      configuration are identical to v4.1.
      
      Fixes: d32932d0 ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
      Reported-and-tested-by: default avatarMatt Fleming <matt@codeblueprint.co.uk>
      Reported-and-tested-by: default avatarChen Yu <yu.c.chen@intel.com>
      Signed-off-by: default avatarJiang Liu <jiang.liu@linux.intel.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Chen Yu <yu.c.chen@intel.com>
      Cc: Yinghai Lu <yinghai@kernel.org>
      Link: http://lkml.kernel.org/r/1438242695-23531-1-git-send-email-jiang.liu@linux.intel.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      646c4b75
    • Ricardo Neri's avatar
      efi: Check for NULL efi kernel parameters · 9115c758
      Ricardo Neri authored
      Even though it is documented how to specifiy efi parameters, it is
      possible to cause a kernel panic due to a dereference of a NULL pointer when
      parsing such parameters if "efi" alone is given:
      
      PANIC: early exception 0e rip 10:ffffffff812fb361 error 0 cr2 0
      [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.2.0-rc1+ #450
      [ 0.000000]  ffffffff81fe20a9 ffffffff81e03d50 ffffffff8184bb0f 00000000000003f8
      [ 0.000000]  0000000000000000 ffffffff81e03e08 ffffffff81f371a1 64656c62616e6520
      [ 0.000000]  0000000000000069 000000000000005f 0000000000000000 0000000000000000
      [ 0.000000] Call Trace:
      [ 0.000000]  [<ffffffff8184bb0f>] dump_stack+0x45/0x57
      [ 0.000000]  [<ffffffff81f371a1>] early_idt_handler_common+0x81/0xae
      [ 0.000000]  [<ffffffff812fb361>] ? parse_option_str+0x11/0x90
      [ 0.000000]  [<ffffffff81f4dd69>] arch_parse_efi_cmdline+0x15/0x42
      [ 0.000000]  [<ffffffff81f376e1>] do_early_param+0x50/0x8a
      [ 0.000000]  [<ffffffff8106b1b3>] parse_args+0x1e3/0x400
      [ 0.000000]  [<ffffffff81f37a43>] parse_early_options+0x24/0x28
      [ 0.000000]  [<ffffffff81f37691>] ? loglevel+0x31/0x31
      [ 0.000000]  [<ffffffff81f37a78>] parse_early_param+0x31/0x3d
      [ 0.000000]  [<ffffffff81f3ae98>] setup_arch+0x2de/0xc08
      [ 0.000000]  [<ffffffff8109629a>] ? vprintk_default+0x1a/0x20
      [ 0.000000]  [<ffffffff81f37b20>] start_kernel+0x90/0x423
      [ 0.000000]  [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
      [ 0.000000]  [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
      [ 0.000000] RIP 0xffffffff81ba2efc
      
      This panic is not reproducible with "efi=" as this will result in a non-NULL
      zero-length string.
      
      Thus, verify that the pointer to the parameter string is not NULL. This is
      consistent with other parameter-parsing functions which check for NULL pointers.
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Cc: Dave Young <dyoung@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
      9115c758
    • Dmitry Skorodumov's avatar
      x86/efi: Use all 64 bit of efi_memmap in setup_e820() · 7cc03e48
      Dmitry Skorodumov authored
      The efi_info structure stores low 32 bits of memory map
      in efi_memmap and high 32 bits in efi_memmap_hi.
      
      While constructing pointer in the setup_e820(), need
      to take into account all 64 bit of the pointer.
      
      It is because on 64bit machine the function
      efi_get_memory_map() may return full 64bit pointer and before
      the patch that pointer was truncated.
      
      The issue is triggered on Parallles virtual machine and
      fixed with this patch.
      Signed-off-by: default avatarDmitry Skorodumov <sdmitry@parallels.com>
      Cc: Denis V. Lunev <den@openvz.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
      7cc03e48
  3. 26 Jul, 2015 9 commits
    • Linus Torvalds's avatar
      Linux 4.2-rc4 · cbfe8fa6
      Linus Torvalds authored
      cbfe8fa6
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2579d019
      Linus Torvalds authored
      Pull perf fix from Thomas Gleixner:
       "A single fix for the intel cqm perf facility to prevent IPIs from
        interrupt context"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel/cqm: Return cached counter value from IRQ context
      2579d019
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 28003486
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "This update contains:
      
         - the manual revert of the SYSCALL32 changes which caused a
           regression
      
         - a fix for the MPX vma handling
      
         - three fixes for the ioremap 'is ram' checks.
      
         - PAT warning fixes
      
         - a trivial fix for the size calculation of TLB tracepoints
      
         - handle old EFI structures gracefully
      
        This also contains a PAT fix from Jan plus a revert thereof.  Toshi
        explained why the code is correct"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/mm/pat: Revert 'Adjust default caching mode translation tables'
        x86/asm/entry/32: Revert 'Do not use R9 in SYSCALL32' commit
        x86/mm: Fix newly introduced printk format warnings
        mm: Fix bugs in region_is_ram()
        x86/mm: Remove region_is_ram() call from ioremap
        x86/mm: Move warning from __ioremap_check_ram() to the call site
        x86/mm/pat, drivers/media/ivtv: Move the PAT warning and replace WARN() with pr_warn()
        x86/mm/pat, drivers/infiniband/ipath: Replace WARN() with pr_warn()
        x86/mm/pat: Adjust default caching mode translation tables
        x86/fpu: Disable dependent CPU features on "noxsave"
        x86/mpx: Do not set ->vm_ops on MPX VMAs
        x86/mm: Add parenthesis for TLB tracepoint size calculation
        efi: Handle memory error structures produced based on old versions of standard
      28003486
    • Thomas Gleixner's avatar
      x86/mm/pat: Revert 'Adjust default caching mode translation tables' · 1a4e8795
      Thomas Gleixner authored
      Toshi explains:
      
      "No, the default values need to be set to the fallback types,
       i.e. minimal supported mode.  For WC and WT, UC is the fallback type.
      
       When PAT is disabled, pat_init() does update the tables below to
       enable WT per the default BIOS setup.  However, when PAT is enabled,
       but CPU has PAT -errata, WT falls back to UC per the default values."
      
      Revert: ca1fec58 'x86/mm/pat: Adjust default caching mode translation tables'
      Requested-by: default avatarToshi Kani <toshi.kani@hp.com>
      Cc: Jan Beulich <jbeulich@suse.de>
      Link: http://lkml.kernel.org/r/1437577776.3214.252.camel@hp.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      1a4e8795
    • Matt Fleming's avatar
      perf/x86/intel/cqm: Return cached counter value from IRQ context · 2c534c0d
      Matt Fleming authored
      Peter reported the following potential crash which I was able to
      reproduce with his test program,
      
      [  148.765788] ------------[ cut here ]------------
      [  148.765796] WARNING: CPU: 34 PID: 2840 at kernel/smp.c:417 smp_call_function_many+0xb6/0x260()
      [  148.765797] Modules linked in:
      [  148.765800] CPU: 34 PID: 2840 Comm: perf Not tainted 4.2.0-rc1+ #4
      [  148.765803]  ffffffff81cdc398 ffff88085f105950 ffffffff818bdfd5 0000000000000007
      [  148.765805]  0000000000000000 ffff88085f105990 ffffffff810e413a 0000000000000000
      [  148.765807]  ffffffff82301080 0000000000000022 ffffffff8107f640 ffffffff8107f640
      [  148.765809] Call Trace:
      [  148.765810]  <NMI>  [<ffffffff818bdfd5>] dump_stack+0x45/0x57
      [  148.765818]  [<ffffffff810e413a>] warn_slowpath_common+0x8a/0xc0
      [  148.765822]  [<ffffffff8107f640>] ? intel_cqm_stable+0x60/0x60
      [  148.765824]  [<ffffffff8107f640>] ? intel_cqm_stable+0x60/0x60
      [  148.765825]  [<ffffffff810e422a>] warn_slowpath_null+0x1a/0x20
      [  148.765827]  [<ffffffff811613f6>] smp_call_function_many+0xb6/0x260
      [  148.765829]  [<ffffffff8107f640>] ? intel_cqm_stable+0x60/0x60
      [  148.765831]  [<ffffffff81161748>] on_each_cpu_mask+0x28/0x60
      [  148.765832]  [<ffffffff8107f6ef>] intel_cqm_event_count+0x7f/0xe0
      [  148.765836]  [<ffffffff811cdd35>] perf_output_read+0x2a5/0x400
      [  148.765839]  [<ffffffff811d2e5a>] perf_output_sample+0x31a/0x590
      [  148.765840]  [<ffffffff811d333d>] ? perf_prepare_sample+0x26d/0x380
      [  148.765841]  [<ffffffff811d3497>] perf_event_output+0x47/0x60
      [  148.765843]  [<ffffffff811d36c5>] __perf_event_overflow+0x215/0x240
      [  148.765844]  [<ffffffff811d4124>] perf_event_overflow+0x14/0x20
      [  148.765847]  [<ffffffff8107e7f4>] intel_pmu_handle_irq+0x1d4/0x440
      [  148.765849]  [<ffffffff811d07a6>] ? __perf_event_task_sched_in+0x36/0xa0
      [  148.765853]  [<ffffffff81219bad>] ? vunmap_page_range+0x19d/0x2f0
      [  148.765854]  [<ffffffff81219d11>] ? unmap_kernel_range_noflush+0x11/0x20
      [  148.765859]  [<ffffffff814ce6fe>] ? ghes_copy_tofrom_phys+0x11e/0x2a0
      [  148.765863]  [<ffffffff8109e5db>] ? native_apic_msr_write+0x2b/0x30
      [  148.765865]  [<ffffffff8109e44d>] ? x2apic_send_IPI_self+0x1d/0x20
      [  148.765869]  [<ffffffff81065135>] ? arch_irq_work_raise+0x35/0x40
      [  148.765872]  [<ffffffff811c8d86>] ? irq_work_queue+0x66/0x80
      [  148.765875]  [<ffffffff81075306>] perf_event_nmi_handler+0x26/0x40
      [  148.765877]  [<ffffffff81063ed9>] nmi_handle+0x79/0x100
      [  148.765879]  [<ffffffff81064422>] default_do_nmi+0x42/0x100
      [  148.765880]  [<ffffffff81064563>] do_nmi+0x83/0xb0
      [  148.765884]  [<ffffffff818c7c0f>] end_repeat_nmi+0x1e/0x2e
      [  148.765886]  [<ffffffff811d07a6>] ? __perf_event_task_sched_in+0x36/0xa0
      [  148.765888]  [<ffffffff811d07a6>] ? __perf_event_task_sched_in+0x36/0xa0
      [  148.765890]  [<ffffffff811d07a6>] ? __perf_event_task_sched_in+0x36/0xa0
      [  148.765891]  <<EOE>>  [<ffffffff8110ab66>] finish_task_switch+0x156/0x210
      [  148.765898]  [<ffffffff818c1671>] __schedule+0x341/0x920
      [  148.765899]  [<ffffffff818c1c87>] schedule+0x37/0x80
      [  148.765903]  [<ffffffff810ae1af>] ? do_page_fault+0x2f/0x80
      [  148.765905]  [<ffffffff818c1f4a>] schedule_user+0x1a/0x50
      [  148.765907]  [<ffffffff818c666c>] retint_careful+0x14/0x32
      [  148.765908] ---[ end trace e33ff2be78e14901 ]---
      
      The CQM task events are not safe to be called from within interrupt
      context because they require performing an IPI to read the counter value
      on all sockets. And performing IPIs from within IRQ context is a
      "no-no".
      
      Make do with the last read counter value currently event in
      event->count when we're invoked in this context.
      Reported-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vikas Shivappa <vikas.shivappa@intel.com>
      Cc: Kanaka Juvva <kanaka.d.juvva@intel.com>
      Cc: Will Auld <will.auld@intel.com>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/1437490509-15373-1-git-send-email-matt@codeblueprint.co.ukSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      2c534c0d
    • Linus Torvalds's avatar
      Merge tag 'usb-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 26ae19a3
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here's a few USB and PHY fixes for 4.2-rc4.
      
        Nothing major, the shortlog has the full details.
      
        All of these have been in linux-next successfully"
      
      * tag 'usb-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits)
        USB: OHCI: fix bad #define in ohci-tmio.c
        cdc-acm: Destroy acm_minors IDR on module exit
        usb-storage: Add ignore-device quirk for gm12u320 based usb mini projectors
        usb-storage: ignore ZTE MF 823 card reader in mode 0x1225
        USB: OHCI: Fix race between ED unlink and URB submission
        usb: core: lpm: set lpm_capable for root hub device
        xhci: do not report PLC when link is in internal resume state
        xhci: prevent bus_suspend if SS port resuming in phase 1
        xhci: report U3 when link is in resume state
        xhci: Calculate old endpoints correctly on device reset
        usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
        xhci: Workaround to get D3 working in Intel xHCI
        xhci: call BIOS workaround to enable runtime suspend on Intel Braswell
        usb: dwc3: Reset the transfer resource index on SET_INTERFACE
        usb: gadget: udc: core: Fix argument of dma_map_single for IOMMU
        usb: gadget: mv_udc_core: fix phy_regs I/O memory leak
        usb: ulpi: ulpi_init should be executed in subsys_initcall
        phy: berlin-usb: fix divider for BG2
        phy: berlin-usb: fix divider for BG2CD
        phy/pxa: add HAS_IOMEM dependency
        ...
      26ae19a3
    • Linus Torvalds's avatar
      Merge tag 'tty-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 82b35f37
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are a number of small serial and tty fixes for reported issues.
      
        All have been in linux-next successfully"
      
      * tag 'tty-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()
        serial: core: Fix crashes while echoing when closing
        m32r: Add ioreadXX/iowriteXX big-endian mmio accessors
        Revert "serial: imx: initialized DMA w/o HW flow enabled"
        sc16is7xx: fix FIFO address of secondary UART
        sc16is7xx: fix Kconfig dependencies
        serial: etraxfs-uart: Fix release etraxfs_uart_ports
        tty/vt: Fix the memory leak in visual_init
        serial: amba-pl011: Fix devm_ioremap_resource return value check
        n_tty: signal and flush atomically
      82b35f37
    • Linus Torvalds's avatar
      Merge tag 'staging-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · b0de415a
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are a number of iio and staging driver fixes for reported issues
        for 4.2-rc4.
      
        All have been in linux-next for a while with no problems"
      
      * tag 'staging-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (34 commits)
        iio:light:stk3310: make endianness independent of host
        iio:light:stk3310: move device register to end of probe
        iio: mma8452: use iio event type IIO_EV_TYPE_MAG
        iio: mcp320x: Fix NULL pointer dereference
        iio: adc: vf610: fix the adc register read fail issue
        iio: mlx96014: Replace offset sign
        iio: magnetometer: mmc35240: fix SET/RESET sequence
        iio: magnetometer: mmc35240: Fix SET/RESET mask
        iio: magnetometer: mmc35240: Fix crash in pm suspend
        iio:magnetometer:bmc150_magn: output intended variable
        iio:magnetometer:bmc150_magn: add regmap dependency
        staging: vt6656: check ieee80211_bss_conf bssid not NULL
        staging: vt6655: check ieee80211_bss_conf bssid not NULL
        iio: tmp006: Check channel info on write
        iio: sx9500: Add missing init in sx9500_buffer_pre{en,dis}able()
        iio:light:ltr501: fix regmap dependency
        iio:light:ltr501: fix variable in ltr501_init
        iio: sx9500: fix bug in compensation code
        iio: sx9500: rework error handling of raw readings
        iio: magnetometer: mmc35240: fix available sampling frequencies
        ...
      b0de415a
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · e433b656
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some char and misc driver fixes for reported issues.
      
        One parport patch is reverted as it was incorrect, thanks to testing
        by the 0-day bot"
      
      * tag 'char-misc-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        parport: Revert "parport: fix memory leak"
        mei: prevent unloading mei hw modules while the device is opened.
        misc: mic: scif bug fix for vmalloc_to_page crash
        parport: fix freeing freed memory
        parport: fix memory leak
        parport: fix error handling
      e433b656
  4. 25 Jul, 2015 7 commits
  5. 24 Jul, 2015 19 commits