1. 07 Apr, 2013 4 commits
  2. 02 Apr, 2013 12 commits
  3. 24 Mar, 2013 1 commit
  4. 22 Mar, 2013 7 commits
  5. 21 Mar, 2013 3 commits
    • Takuya Yoshikawa's avatar
      KVM: MMU: Rename kvm_mmu_free_some_pages() to make_mmu_pages_available() · 81f4f76b
      Takuya Yoshikawa authored
      The current name "kvm_mmu_free_some_pages" should be used for something
      that actually frees some shadow pages, as we expect from the name, but
      what the function is doing is to make some, KVM_MIN_FREE_MMU_PAGES,
      shadow pages available: it does nothing when there are enough.
      
      This patch changes the name to reflect this meaning better; while doing
      this renaming, the code in the wrapper function is inlined into the main
      body since the whole function will be inlined into the only caller now.
      Signed-off-by: default avatarTakuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      81f4f76b
    • Takuya Yoshikawa's avatar
      KVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page() · 7ddca7e4
      Takuya Yoshikawa authored
      What this function is doing is to ensure that the number of shadow pages
      does not exceed the maximum limit stored in n_max_mmu_pages: so this is
      placed at every code path that can reach kvm_mmu_alloc_page().
      
      Although it might have some sense to spread this function in each such
      code path when it could be called before taking mmu_lock, the rule was
      changed not to do so.
      
      Taking this background into account, this patch moves it into
      kvm_mmu_alloc_page() and simplifies the code.
      
      Note: the unlikely hint in kvm_mmu_free_some_pages() guarantees that the
      overhead of this function is almost zero except when we actually need to
      allocate some shadow pages, so we do not need to care about calling it
      multiple times in one path by doing kvm_mmu_get_page() a few times.
      Signed-off-by: default avatarTakuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      7ddca7e4
    • Marcelo Tosatti's avatar
      Merge remote-tracking branch 'upstream/master' into queue · 2ae33b38
      Marcelo Tosatti authored
      Merge reason:
      
      From: Alexander Graf <agraf@suse.de>
      
      "Just recently this really important patch got pulled into Linus' tree for 3.9:
      
      commit 1674400a
      Author: Anton Blanchard <anton <at> samba.org>
      Date:   Tue Mar 12 01:51:51 2013 +0000
      
      Without that commit, I can not boot my G5, thus I can't run automated tests on it against my queue.
      
      Could you please merge kvm/next against linus/master, so that I can base my trees against that?"
      
      * upstream/master: (653 commits)
        PCI: Use ROM images from firmware only if no other ROM source available
        sparc: remove unused "config BITS"
        sparc: delete "if !ULTRA_HAS_POPULATION_COUNT"
        KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
        KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
        KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)
        arm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS
        arm64: Do not select GENERIC_HARDIRQS_NO_DEPRECATED
        inet: limit length of fragment queue hash table bucket lists
        qeth: Fix scatter-gather regression
        qeth: Fix invalid router settings handling
        qeth: delay feature trace
        sgy-cts1000: Remove __dev* attributes
        KVM: x86: fix deadlock in clock-in-progress request handling
        KVM: allow host header to be included even for !CONFIG_KVM
        hwmon: (lm75) Fix tcn75 prefix
        hwmon: (lm75.h) Update header inclusion
        MAINTAINERS: Remove Mark M. Hoffman
        xfs: ensure we capture IO errors correctly
        xfs: fix xfs_iomap_eof_prealloc_initial_size type
        ...
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      2ae33b38
  6. 20 Mar, 2013 3 commits
  7. 19 Mar, 2013 10 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs · 10b38669
      Linus Torvalds authored
      Pull XFS fixes from Ben Myers:
      
       - Fix for a potential infinite loop which was introduced in commit
         4d559a3b ("xfs: limit speculative prealloc near ENOSPC
         thresholds")
      
       - Fix for the return type of xfs_iomap_eof_prealloc_initial_size from
         commit a1e16c26 ("xfs: limit speculative prealloc size on sparse
         files")
      
       - Fix for a failed buffer readahead causing subsequent callers to fail
         incorrectly
      
      * tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs:
        xfs: ensure we capture IO errors correctly
        xfs: fix xfs_iomap_eof_prealloc_initial_size type
        xfs: fix potential infinite loop in xfs_iomap_prealloc_size()
      10b38669
    • Matthew Garrett's avatar
      PCI: Use ROM images from firmware only if no other ROM source available · 547b5246
      Matthew Garrett authored
      Mantas Mikulėnas reported that his graphics hardware failed to
      initialise after commit f9a37be0 ("x86: Use PCI setup data").
      
      The aim of this commit was to ensure that ROM images were available on
      some Apple systems that don't expose the GPU ROM via any other source.
      In this case, UEFI appears to have provided a broken ROM image that we
      were using even though there was a perfectly valid ROM available via
      other sources.  The simplest way to handle this seems to be to just
      re-order pci_map_rom() and leave any firmare-supplied ROM to last.
      Signed-off-by: default avatarMatthew Garrett <matthew.garrett@nebula.com>
      Tested-by: default avatarMantas Mikulėnas <grawity@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      547b5246
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 5c7c3361
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "Just some minor fixups, a sunsu console setup panic cure, and
        recognition of a Fujitsu sun4v cpu."
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc: remove unused "config BITS"
        sparc: delete "if !ULTRA_HAS_POPULATION_COUNT"
        sparc64: correctly recognize SPARC64-X chips
        sparc,leon: fix GRPCI2 device0 PCI config space access
        sunsu: Fix panic in case of nonexistent port at "console=ttySY" cmdline option
      5c7c3361
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64 · e7489622
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Fix !SMP build error.
      
       - Fix padding computation in struct ucontext (no ABI change).
      
       - Minor clean-up after the signal patches (unused var).
      
       - Two old Kconfig options clean-up.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
        arm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS
        arm64: Do not select GENERIC_HARDIRQS_NO_DEPRECATED
        arm64: fix padding computation in struct ucontext
        arm64: Fix build error with !SMP
        arm64: Removed unused variable in compat_setup_rt_frame()
      e7489622
    • Paul Bolle's avatar
      sparc: remove unused "config BITS" · f58b20bd
      Paul Bolle authored
      sparc's asm/module.h got removed in commit
      786d35d4 ("Make most arch asm/module.h
      files use asm-generic/module.h"). That removed the only two uses of this
      Kconfig symbol. So we can remove its entry too.
      
      > >From arch/sparc/Makefile:
      >     ifeq ($(CONFIG_SPARC32),y)
      >     [...]
      >
      >     [...]
      >     export BITS    := 32
      >     [...]
      >
      >     else
      >     [...]
      >
      >     [...]
      >     export BITS   := 64
      >     [...]
      >
      > So $(BITS) is set depending on whether CONFIG_SPARC32 is set or not.
      > Using $(BITS) in sparc's Makefiles is not using CONFIG_BITS. That
      > doesn't count as usage of "config BITS".
      Signed-off-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Acked-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f58b20bd
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 7b1b3fd7
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix ARM BPF JIT handling of negative 'k' values, from Chen Gang.
      
       2) Insufficient space reserved for bridge netlink values, fix from
          Stephen Hemminger.
      
       3) Some dst_neigh_lookup*() callers don't interpret error pointer
          correctly, fix from Zhouyi Zhou.
      
       4) Fix transport match in SCTP active_path loops, from Xugeng Zhang.
      
       5) Fix qeth driver handling of multi-order SKB frags, from Frank
          Blaschka.
      
       6) fec driver is missing napi_disable() call, resulting in crashes on
          unload, from Georg Hofmann.
      
       7) Don't try to handle PMTU events on a listening socket, fix from Eric
          Dumazet.
      
       8) Fix timestamp location calculations in IP option processing, from
          David Ward.
      
       9) FIB_TABLE_HASHSZ setting is not controlled by the correct kconfig
          tests, from Denis V Lunev.
      
      10) Fix TX descriptor push handling in SFC driver, from Ben Hutchings.
      
      11) Fix isdn/hisax and tulip/de4x5 kconfig dependencies, from Arnd
          Bergmann.
      
      12) bnx2x statistics don't handle 4GB rollover correctly, fix from
          Maciej Żenczykowski.
      
      13) Openvswitch bug fixes for vport del/new error reporting, missing
          genlmsg_end() call in netlink processing, and mis-parsing of
          LLC/SNAP ethernet types.  From Rich Lane.
      
      14) SKB pfmemalloc state should only be propagated from the head page of
          a compound page, fix from Pavel Emelyanov.
      
      15) Fix link handling in tg3 driver for 5715 chips when autonegotation
          is disabled.  From Nithin Sujir.
      
      16) Fix inverted test of cpdma_check_free_tx_desc return value in
          davinci_emac driver, from Mugunthan V N.
      
      17) vlan_depth is incorrectly calculated in skb_network_protocol(), from
          Li RongQing.
      
      18) Fix probing of Gobi 1K devices in qmi_wwan driver, and fix NCM
          device mode backwards compat in cdc_ncm driver.  From Bjørn Mork.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
        inet: limit length of fragment queue hash table bucket lists
        qeth: Fix scatter-gather regression
        qeth: Fix invalid router settings handling
        qeth: delay feature trace
        tcp: dont handle MTU reduction on LISTEN socket
        bnx2x: fix occasional statistics off-by-4GB error
        vhost/net: fix heads usage of ubuf_info
        bridge: Add support for setting BR_ROOT_BLOCK flag.
        bnx2x: add missing napi deletion in error path
        drivers: net: ethernet: ti: davinci_emac: fix usage of cpdma_check_free_tx_desc()
        ethernet/tulip: DE4x5 needs VIRT_TO_BUS
        isdn: hisax: netjet requires VIRT_TO_BUS
        net: cdc_ncm, cdc_mbim: allow user to prefer NCM for backwards compatibility
        rtnetlink: Mask the rta_type when range checking
        Revert "ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally"
        Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug
        smsc75xx: configuration help incorrectly mentions smsc95xx
        net: fec: fix missing napi_disable call
        net: fec: restart the FEC when PHY speed changes
        skb: Propagate pfmemalloc on skb from head page only
        ...
      7b1b3fd7
    • Paul Bolle's avatar
      sparc: delete "if !ULTRA_HAS_POPULATION_COUNT" · e0b20296
      Paul Bolle authored
      Commit 2d78d4be ("[PATCH] bitops:
      sparc64: use generic bitops") made the default of GENERIC_HWEIGHT depend
      on !ULTRA_HAS_POPULATION_COUNT. But since there's no Kconfig symbol with
      that name, this always evaluates to true. Delete this dependency.
      Signed-off-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Acked-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0b20296
    • Andy Honig's avatar
      KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) · a2c118bf
      Andy Honig authored
      If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
      that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
      that request.  ioapic_read_indirect contains an
      ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
      non-debug builds.  In recent kernels this allows a guest to cause a kernel
      oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
      guest to read from large ranges of host memory.
      
      Tested: tested against apic unit tests.
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      a2c118bf
    • Andy Honig's avatar
      KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) · 0b79459b
      Andy Honig authored
      There is a potential use after free issue with the handling of
      MSR_KVM_SYSTEM_TIME.  If the guest specifies a GPA in a movable or removable
      memory such as frame buffers then KVM might continue to write to that
      address even after it's removed via KVM_SET_USER_MEMORY_REGION.  KVM pins
      the page in memory so it's unlikely to cause an issue, but if the user
      space component re-purposes the memory previously used for the guest, then
      the guest will be able to corrupt that memory.
      
      Tested: Tested against kvmclock unit test
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      0b79459b
    • Andy Honig's avatar
      KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) · c300aa64
      Andy Honig authored
      If the guest sets the GPA of the time_page so that the request to update the
      time straddles a page then KVM will write onto an incorrect page.  The
      write is done byusing kmap atomic to get a pointer to the page for the time
      structure and then performing a memcpy to that page starting at an offset
      that the guest controls.  Well behaved guests always provide a 32-byte aligned
      address, however a malicious guest could use this to corrupt host kernel
      memory.
      
      Tested: Tested against kvmclock unit test.
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      c300aa64