Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1319401 > unrolled thread

[PATCH 4.3 000/157] 4.3.5-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2016-01-27 20:10 +0100
Last post2016-01-28 03:20 +0100
Articles 20 on this page of 28 — 4 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 4.3 000/157] 4.3.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
    [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
      Re: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by  default on modern CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:30 +0100
      Re: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by  default on modern CPUs Donald Parsons <dparsons@brightdsl.net> - 2016-01-27 23:30 +0100
    [PATCH 4.3 052/157] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
    [PATCH 4.3 046/157] ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
    [PATCH 4.3 010/157] KVM: svm: unconditionally intercept #DB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
    [PATCH 4.3 155/157] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
    [PATCH 4.3 154/157] fix the regression from "direct-io: Fix negative return from dio read beyond eof" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
    [PATCH 4.3 126/157] powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
    [PATCH 4.3 135/157] arm64: cmpxchg_dbl: fix return value type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
    [PATCH 4.3 134/157] arm64: bpf: fix mod-by-zero case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
    [PATCH 4.3 044/157] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 128/157] powerpc: Make value-returning atomics fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 157/157] arm64: KVM: Add workaround for Cortex-A57 erratum 834220 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 131/157] powerpc/module: Handle R_PPC64_ENTRY relocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 129/157] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 133/157] arm64: bpf: fix div-by-zero case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 156/157] arm64: restore bogomips information in /proc/cpuinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 147/157] parisc iommu: fix panic due to trying to allocate too large region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 132/157] recordmcount: arm64: Replace the ignored mcount call into nop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 148/157] HID: wacom: Tie cached HID_DG_CONTACTCOUNT indices to report ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 150/157] HID: core: Avoid uninitialized buffer access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 149/157] HID: wacom: Expect touch_max touches if HID_DG_CONTACTCOUNT not present Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 130/157] scripts/recordmcount.pl: support data in text section on powerpc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    [PATCH 4.3 153/157] direct-io: Fix negative return from dio read beyond eof Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
    Re: [PATCH 4.3 000/157] 4.3.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-28 00:30 +0100
    Re: [PATCH 4.3 000/157] 4.3.5-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-28 03:20 +0100

Page 1 of 2  [1] 2  Next page →


#1319401 — [PATCH 4.3 000/157] 4.3.5-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 000/157] 4.3.5-stable review
Message-ID<qVCRc-7CM-17@gated-at.bofh.it>
-------------------------
NOTE:
  There are still a lot of pending stable patches in the queue, well
  over 400 of them to be specific, so some of your favorite/pet patches
  might not be included in these releases.  Please be patient as I dig
  out from this backlog over the next few weeks.  If there are specific
  patches that you just _must_ have included in a stable release soon,
  please let me know.
-------------------------

This is the start of the stable review cycle for the 4.3.5 release.
There are 157 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri Jan 29 18:08:09 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.3.5-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.3.5-rc1

Marc Zyngier <marc.zyngier@arm.com>
    arm64: KVM: Add workaround for Cortex-A57 erratum 834220

Yang Shi <yang.shi@linaro.org>
    arm64: restore bogomips information in /proc/cpuinfo

Guenter Roeck <linux@roeck-us.net>
    mn10300: Select CONFIG_HAVE_UID16 to fix build failure

Al Viro <viro@zeniv.linux.org.uk>
    fix the regression from "direct-io: Fix negative return from dio read beyond eof"

Jan Kara <jack@suse.cz>
    direct-io: Fix negative return from dio read beyond eof

Salva Peiró <speirofr@gmail.com>
    media/vivid-osd: fix info leak in ioctl

Al Viro <viro@ZenIV.linux.org.uk>
    staging: lustre: echo_copy.._lsm() dereferences userland pointers directly

Richard Purdie <richard.purdie@linuxfoundation.org>
    HID: core: Avoid uninitialized buffer access

Jason Gerecke <killertofu@gmail.com>
    HID: wacom: Expect 'touch_max' touches if HID_DG_CONTACTCOUNT not present

Jason Gerecke <killertofu@gmail.com>
    HID: wacom: Tie cached HID_DG_CONTACTCOUNT indices to report ID

Mikulas Patocka <mpatocka@redhat.com>
    parisc iommu: fix panic due to trying to allocate too large region

David Woodhouse <David.Woodhouse@intel.com>
    iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints

Will Deacon <will.deacon@arm.com>
    iommu/arm-smmu: Fix error checking for ASID and VMID allocation

Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    arm64: kernel: enforce pmuserenr_el0 initialization and restore

Will Deacon <will.deacon@arm.com>
    arm64: mm: ensure that the zero page is visible to the page table walker

John Blackwood <john.blackwood@ccur.com>
    arm64: Clear out any singlestep state on a ptrace detach operation

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    ARM/arm64: KVM: correct PTE uncachedness check

Arnd Bergmann <arnd@arndb.de>
    arm64: fix building without CONFIG_UID16

Marc Zyngier <marc.zyngier@arm.com>
    arm64: KVM: Fix AArch32 to AArch64 register mapping

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    ARM/arm64: KVM: test properly for a PTE's uncachedness

Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    arm64: kernel: pause/unpause function graph tracer in cpu_suspend()

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    arm64: mm: use correct mapping granularity under DEBUG_RODATA

Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    arm64: cmpxchg_dbl: fix return value type

Zi Shen Lim <zlim.lnx@gmail.com>
    arm64: bpf: fix mod-by-zero case

Zi Shen Lim <zlim.lnx@gmail.com>
    arm64: bpf: fix div-by-zero case

Li Bin <huawei.libin@huawei.com>
    recordmcount: arm64: Replace the ignored mcount call into nop

Ulrich Weigand <ulrich.weigand@de.ibm.com>
    powerpc/module: Handle R_PPC64_ENTRY relocations

Ulrich Weigand <ulrich.weigand@de.ibm.com>
    scripts/recordmcount.pl: support data in text section on powerpc

Boqun Feng <boqun.feng@gmail.com>
    powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered

Boqun Feng <boqun.feng@gmail.com>
    powerpc: Make value-returning atomics fully ordered

Stewart Smith <stewart@linux.vnet.ibm.com>
    powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type

Alistair Popple <alistair@popple.id.au>
    powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"

Alistair Popple <alistair@popple.id.au>
    powerpc/opal-irqchip: Fix double endian conversion

Michael Neuling <mikey@neuling.org>
    powerpc/tm: Check for already reclaimed tasks

Michael Neuling <mikey@neuling.org>
    powerpc/tm: Block signal return setting invalid MSR state

Dan Streetman <dan.streetman@canonical.com>
    xfrm: dst_entries_init() per-net dst_ops

Ido Schimmel <idosch@mellanox.com>
    team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

Doron Tsur <doront@mellanox.com>
    net/mlx5_core: Fix trimming down IRQ number

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate orig_node free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_hard_iface free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate neigh_ifinfo free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_neigh_node free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_orig_ifinfo free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Avoid recursive call_rcu for batadv_nc_node

Sven Eckelmann <sven@narfation.org>
    batman-adv: Avoid recursive call_rcu for batadv_bla_claim

Ben Hutchings <ben@decadent.org.uk>
    ppp, slip: Validate VJ compression slot parameters completely

Ben Hutchings <ben@decadent.org.uk>
    isdn_ppp: Add checks for allocation failure in isdn_ppp_open()

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    bridge: fix lockdep addr_list_lock false positive splat

Eric Dumazet <edumazet@google.com>
    ipv6: update skb->csum when CE mark is propagated

Rabin Vincent <rabin@rab.in>
    net: bpf: reject invalid shifts

Eric Dumazet <edumazet@google.com>
    phonet: properly unshare skbs in phonet_rcv()

Lars Persson <lars.persson@axis.com>
    dwc_eth_qos: Fix dma address for multi-fragment skbs

Karl Heiss <kheiss@gmail.com>
    bonding: Prevent IPv6 link local address on enslaved devices

Konstantin Khlebnikov <koct9i@gmail.com>
    net: preserve IP control block during GSO segmentation

Michal Kubeček <mkubecek@suse.cz>
    udp: disallow UFO for sockets with SO_NO_CHECK option

John Fastabend <john.fastabend@gmail.com>
    net: pktgen: fix null ptr deref in skb allocation

Jamal Hadi Salim <jhs@mojatatu.com>
    sched,cls_flower: set key address type when present

Neal Cardwell <ncardwell@google.com>
    tcp_yeah: don't set ssthresh below 2

Eric Dumazet <edumazet@google.com>
    ipv6: tcp: add rcu locking in tcp_v6_send_synack()

Sasha Levin <sasha.levin@oracle.com>
    net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    vxlan: fix test which detect duplicate vxlan iface

Yuchung Cheng <ycheng@google.com>
    tcp: fix zero cwnd in tcp_cwnd_reduction

Francesco Ruggeri <fruggeri@aristanetworks.com>
    net: possible use after free in dst_release

John Fastabend <john.fastabend@gmail.com>
    net: sched: fix missing free per cpu on qstats

Rabin Vincent <rabin@rab.in>
    net: filter: make JITs zero A for SKF_AD_ALU_XOR_X

Hannes Frederic Sowa <hannes@stressinduktion.org>
    bridge: Only call /sbin/bridge-stp for the initial network namespace

willy tarreau <w@1wt.eu>
    unix: properly account for FDs passed over unix sockets

Rainer Weikusat <rweikusat@mobileactivedefense.com>
    af_unix: Fix splice-bind deadlock

Florian Westphal <fw@strlen.de>
    connector: bump skb->users before callback invocation

Xin Long <lucien.xin@gmail.com>
    sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close

Bjørn Mork <bjorn@mork.no>
    net: cdc_ncm: avoid changing RX/TX buffers on MTU changes

WANG Cong <xiyou.wangcong@gmail.com>
    addrconf: always initialize sysctl table data

Andrey Ryabinin <aryabinin@virtuozzo.com>
    ipv6/addrlabel: fix ip6addrlbl_get()

Vijay Pandurangan <vijayp@vijayp.ca>
    veth: don’t modify ip_summed; doing so treats packets with bad checksums as good.

Simon Horman <simon.horman@netronome.com>
    openvswitch: correct encoding of set tunnel action attributes

Oliver Neukum <oneukum@suse.com>
    xhci: refuse loading if nousb is used

Lu Baolu <baolu.lu@linux.intel.com>
    usb: core: lpm: fix usb3_hardware_lpm sysfs node

Oliver Freyermuth <o.freyermuth@googlemail.com>
    USB: cp210x: add ID for ELV Marble Sound Board 1

Dan Carpenter <dan.carpenter@oracle.com>
    USB: ipaq.c: fix a timeout loop

Alan Stern <stern@rowland.harvard.edu>
    USB: fix invalid memory access in hub_activate()

Antti Palosaari <crope@iki.fi>
    airspy: increase USB control message buffer size

Chunfeng Yun <chunfeng.yun@mediatek.com>
    usb: xhci: fix config fail of FS hub behind a HS hub with MTT

Vinod Koul <vinod.koul@intel.com>
    ASoC: compress: Fix compress device direction check

Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    ASoC: wm5110: Fix PGA clear when disabling DRE

Nikesh Oswal <Nikesh.Oswal@cirrus.com>
    ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx

Mans Rullgard <mans@mansr.com>
    ASoC: wm8974: set cache type for regmap

John Keeping <john@metanate.com>
    ASoC: es8328: Fix deemphasis values

Sachin Pandhare <sachinpandhare@gmail.com>
    ASoC: wm8962: correct addresses for HPF_C_0/1

Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    ASoC: rsnd: fixup SCU_SYS_INT_EN1 address

Axel Lin <axel.lin@ingics.com>
    ASoC: rt286: Fix run time error while modifying const data

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Handle disconnection more safely

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Flush the pending probe work at remove

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix bass pin fixup for ASUS N550JX

Takashi Iwai <tiwai@suse.de>
    ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0

Takashi Iwai <tiwai@suse.de>
    ALSA: hrtimer: Fix stall by hrtimer_cancel()

Nicolas Boichat <drinkcat@chromium.org>
    ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode

Nicolas Boichat <drinkcat@chromium.org>
    ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Add fixup for Dell Latitidue E6540

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix double unlink of active_list

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix race among timer ioctls

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - fix the headset mic detection problem for a Dell laptop

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Harden slave timer list handling

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix white noise on Dell Latitude E5550

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix race at timer setup and close

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix missing NULL check at remove_events ioctl

David Henningsson <david.henningsson@canonical.com>
    ALSA: hda - Fixup inverted internal mic for Lenovo E50-80

Jurgen Kramer <gtmkramer@xs4all.nl>
    ALSA: usb: Add native DSD support for Oppo HA-1

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Add keycode map for alc input device

Kailang <kailang@realtek.com>
    ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO

Mario Kleiner <mario.kleiner.de@gmail.com>
    ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)

Xiong Zhang <xiong.y.zhang@intel.com>
    ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()

Anssi Hannula <anssi.hannula@iki.fi>
    ALSA: usb-audio: Add sample rate inquiry quirk for AudioQuest DragonFly

Anssi Hannula <anssi.hannula@iki.fi>
    ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Set codec to D3 at reboot/shutdown on Thinkpads

David Henningsson <david.henningsson@canonical.com>
    ALSA: hda - Fix headphone mic input on a few Dell ALC293 machines

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Apply click noise workaround for Thinkpads generically

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd

Gabriele Martino <g.martino@gmx.com>
    ALSA: hda/ca0132 - quirk for Alienware 17 2015

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix noise problems on Thinkpad T440s

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Fixing speaker noise on the two latest thinkpad models

David Henningsson <david.henningsson@canonical.com>
    ALSA: hda - Add inverted dmic for Packard Bell DOTS

Takashi Iwai <tiwai@suse.de>
    ALSA: rme96: Fix unexpected volume reset after rate changes

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Skip ELD notification during system suspend

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix noise on Gigabyte Z170X mobo

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Fix headphone noise after Dell XPS 13 resume back from S3

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Add fixup for Acer Aspire One Cloudbook 14

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix noise on Dell Latitude E6440

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Apply HP headphone fixups more generically

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: fireworks/bebob/oxfw/dice: enable to make as built-in

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Apply pin fixup for HP ProBook 6550b

Alexandra Yates <alexandra.yates@linux.intel.com>
    ALSA: hda - Add Intel Lewisburg device IDs Audio

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix lost 4k BDL boundary workaround

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Disable 64bit address for Creative HDA controllers

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Dell XPS one ALC3260 speaker no sound after resume back

Jan Stancek <jstancek@redhat.com>
    ipmi: move timer init to before irq is setup

Corey Minyard <cminyard@mvista.com>
    ipmi: Start the timer and thread on internal msgs

Tejun Heo <tj@kernel.org>
    timers: Use proper base migration in add_timer_on()

Andy Lutomirski <luto@kernel.org>
    x86/mm: Improve switch_mm() barrier comments

Andy Lutomirski <luto@kernel.org>
    x86/mm: Add barriers and document switch_mm()-vs-flush synchronization

H.J. Lu <hjl.tools@gmail.com>
    x86/boot: Double BOOT_HEAP_SIZE to 64KB

Mario Kleiner <mario.kleiner.de@gmail.com>
    x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: correctly print #AC in traces

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: expose MSR_TSC_AUX to userspace

Paul Mackerras <paulus@ozlabs.org>
    KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR

Paolo Bonzini <pbonzini@redhat.com>
    KVM: svm: unconditionally intercept #DB

Paul Mackerras <paulus@samba.org>
    KVM: PPC: Book3S HV: Don't dynamically split core when already split

Radim Krčmář <rkrcmar@redhat.com>
    KVM: VMX: fix SMEP and SMAP without EPT

Ouyang Zhaowei (Charles) <ouyangzhaowei@huawei.com>
    x86/xen: don't reset vcpu_info on a cancelled suspend

Boris Ostrovsky <boris.ostrovsky@oracle.com>
    xen/gntdev: Grant maps should not be subject to NUMA balancing

Ashok Raj <ashok.raj@intel.com>
    x86/mce: Ensure offline CPUs don't participate in rendezvous process

David Vrabel <david.vrabel@citrix.com>
    x86/paravirt: Prevent rtc_cmos platform device init on PV guests

Dmitry V. Levin <ldv@altlinux.org>
    x86/signal: Fix restart_syscall number for x32 tasks

Dave Hansen <dave.hansen@linux.intel.com>
    x86/mpx: Fix instruction decoder condition

Len Brown <len.brown@intel.com>
    x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs


-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-usb            |  16 +-
 Documentation/usb/power-management.txt             |  11 +-
 Makefile                                           |   4 +-
 arch/arm/kvm/mmu.c                                 |  15 +-
 arch/arm/net/bpf_jit_32.c                          |  16 +-
 arch/arm64/Kconfig                                 |  21 ++
 arch/arm64/include/asm/atomic_ll_sc.h              |   2 +-
 arch/arm64/include/asm/atomic_lse.h                |   2 +-
 arch/arm64/include/asm/cpufeature.h                |   3 +-
 arch/arm64/include/asm/kvm_emulate.h               |   8 +-
 arch/arm64/kernel/cpu_errata.c                     |   9 +
 arch/arm64/kernel/perf_event.c                     |   3 -
 arch/arm64/kernel/ptrace.c                         |   6 +
 arch/arm64/kernel/setup.c                          |   4 +
 arch/arm64/kernel/suspend.c                        |  10 +
 arch/arm64/kvm/hyp.S                               |   6 +
 arch/arm64/kvm/inject_fault.c                      |   2 +-
 arch/arm64/mm/mmu.c                                |  15 +-
 arch/arm64/mm/proc.S                               |   2 +
 arch/arm64/net/bpf_jit.h                           |   3 +-
 arch/arm64/net/bpf_jit_comp.c                      |  54 +++--
 arch/mips/net/bpf_jit.c                            |  16 +-
 arch/mn10300/Kconfig                               |   4 +-
 arch/powerpc/include/asm/cmpxchg.h                 |  16 +-
 arch/powerpc/include/asm/reg.h                     |   1 +
 arch/powerpc/include/asm/synch.h                   |   2 +-
 arch/powerpc/include/uapi/asm/elf.h                |   2 +
 arch/powerpc/kernel/module_64.c                    |  27 +++
 arch/powerpc/kernel/process.c                      |  18 ++
 arch/powerpc/kernel/signal_32.c                    |  14 +-
 arch/powerpc/kernel/signal_64.c                    |   4 +
 arch/powerpc/kvm/book3s_hv.c                       |   8 +-
 arch/powerpc/net/bpf_jit_comp.c                    |  13 +-
 arch/powerpc/platforms/powernv/opal-irqchip.c      |  64 +++---
 arch/powerpc/platforms/powernv/opal.c              |   2 +-
 arch/sparc/net/bpf_jit_comp.c                      |  17 +-
 arch/x86/include/asm/boot.h                        |   2 +-
 arch/x86/include/asm/mmu_context.h                 |  34 +++-
 arch/x86/include/asm/paravirt.h                    |   6 +
 arch/x86/include/asm/paravirt_types.h              |   5 +
 arch/x86/include/asm/processor.h                   |   1 +
 arch/x86/kernel/cpu/mcheck/mce.c                   |  11 +
 arch/x86/kernel/reboot.c                           |   8 +
 arch/x86/kernel/rtc.c                              |   3 +
 arch/x86/kernel/signal.c                           |  17 +-
 arch/x86/kernel/smpboot.c                          |   9 +-
 arch/x86/kvm/svm.c                                 |  14 +-
 arch/x86/kvm/trace.h                               |   2 +-
 arch/x86/kvm/vmx.c                                 |  19 +-
 arch/x86/kvm/x86.c                                 |  11 +-
 arch/x86/lguest/boot.c                             |   1 +
 arch/x86/mm/mpx.c                                  |   6 +-
 arch/x86/mm/tlb.c                                  |  29 ++-
 arch/x86/xen/enlighten.c                           |   4 +-
 arch/x86/xen/suspend.c                             |   3 +-
 drivers/char/ipmi/ipmi_si_intf.c                   |  81 +++++---
 drivers/connector/connector.c                      |  11 +-
 drivers/hid/hid-core.c                             |   2 +-
 drivers/hid/wacom_wac.c                            |  28 ++-
 drivers/hid/wacom_wac.h                            |   1 +
 drivers/infiniband/hw/mlx5/cq.c                    |   2 +-
 drivers/iommu/arm-smmu-v3.c                        |   9 +-
 drivers/iommu/intel-iommu.c                        |   9 +-
 drivers/isdn/i4l/isdn_ppp.c                        |  12 +-
 drivers/media/platform/vivid/vivid-osd.c           |   1 +
 drivers/media/usb/airspy/airspy.c                  |   2 +-
 drivers/net/bonding/bond_main.c                    |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   3 +-
 drivers/net/ethernet/synopsys/dwc_eth_qos.c        |   2 +-
 drivers/net/ppp/ppp_generic.c                      |   6 +-
 drivers/net/slip/slhc.c                            |  12 +-
 drivers/net/slip/slip.c                            |   2 +-
 drivers/net/team/team.c                            |   6 +-
 drivers/net/usb/cdc_mbim.c                         |   2 +-
 drivers/net/usb/cdc_ncm.c                          |  31 +++
 drivers/net/veth.c                                 |   6 -
 drivers/net/vxlan.c                                |  12 +-
 drivers/parisc/iommu-helpers.h                     |  15 +-
 .../staging/lustre/lustre/obdecho/echo_client.c    |  20 +-
 drivers/usb/core/hub.c                             |  61 ++++--
 drivers/usb/core/sysfs.c                           |  31 ++-
 drivers/usb/host/xhci.c                            |  12 ++
 drivers/usb/serial/cp210x.c                        |   1 +
 drivers/usb/serial/ipaq.c                          |   3 +-
 drivers/xen/gntdev.c                               |   2 +-
 fs/direct-io.c                                     |  11 +-
 include/linux/filter.h                             |  19 ++
 include/linux/mlx5/cq.h                            |   2 +-
 include/linux/mlx5/driver.h                        |   5 +-
 include/linux/sched.h                              |   1 +
 include/linux/skbuff.h                             |   3 +-
 include/linux/syscalls.h                           |   2 +-
 include/linux/types.h                              |   2 +-
 include/linux/usb.h                                |   4 +
 include/linux/usb/cdc_ncm.h                        |   1 +
 include/net/inet_ecn.h                             |  19 +-
 kernel/bpf/verifier.c                              |  10 +
 kernel/time/timer.c                                |  22 +-
 net/batman-adv/bridge_loop_avoidance.c             |  10 +-
 net/batman-adv/hard-interface.h                    |  12 --
 net/batman-adv/network-coding.c                    |  19 +-
 net/batman-adv/originator.c                        | 149 ++++++--------
 net/batman-adv/originator.h                        |   1 -
 net/batman-adv/translation-table.c                 |  28 ++-
 net/bridge/br_device.c                             |   8 +
 net/bridge/br_stp_if.c                             |   5 +-
 net/core/dev.c                                     |   5 +
 net/core/dst.c                                     |   3 +-
 net/core/filter.c                                  |   5 +
 net/core/pktgen.c                                  |   4 +-
 net/ipv4/ip_output.c                               |   3 +-
 net/ipv4/tcp_input.c                               |   3 +
 net/ipv4/tcp_yeah.c                                |   2 +-
 net/ipv4/xfrm4_policy.c                            |  46 ++++-
 net/ipv6/addrconf.c                                |  11 +-
 net/ipv6/addrlabel.c                               |   2 +-
 net/ipv6/ip6_output.c                              |   2 +-
 net/ipv6/tcp_ipv6.c                                |   2 +
 net/ipv6/xfrm6_mode_tunnel.c                       |   2 +-
 net/ipv6/xfrm6_policy.c                            |  53 +++--
 net/openvswitch/datapath.c                         |   5 +-
 net/openvswitch/flow_netlink.c                     |   4 +-
 net/phonet/af_phonet.c                             |   4 +
 net/sched/cls_flower.c                             |  10 +-
 net/sched/sch_generic.c                            |   4 +-
 net/sctp/sm_statefuns.c                            |   6 +-
 net/sctp/socket.c                                  |   3 +-
 net/sctp/sysctl.c                                  |   2 +-
 net/unix/af_unix.c                                 |  90 ++++++---
 net/unix/garbage.c                                 |  13 +-
 net/xfrm/xfrm_output.c                             |   2 +
 net/xfrm/xfrm_policy.c                             |  38 ----
 scripts/recordmcount.c                             |  24 ++-
 scripts/recordmcount.pl                            |   3 +-
 sound/core/control.c                               |   2 +
 sound/core/hrtimer.c                               |   3 +-
 sound/core/pcm_compat.c                            |  13 +-
 sound/core/seq/seq_clientmgr.c                     |   2 +-
 sound/core/seq/seq_compat.c                        |   9 +-
 sound/core/seq/seq_queue.c                         |   2 +
 sound/core/timer.c                                 | 100 +++++++--
 sound/firewire/bebob/Makefile                      |   2 +-
 sound/firewire/dice/Makefile                       |   2 +-
 sound/firewire/fireworks/Makefile                  |   2 +-
 sound/firewire/oxfw/Makefile                       |   2 +-
 sound/pci/hda/hda_controller.c                     |   3 +
 sound/pci/hda/hda_intel.c                          |  52 ++++-
 sound/pci/hda/patch_ca0132.c                       |   3 +-
 sound/pci/hda/patch_hdmi.c                         |   6 +
 sound/pci/hda/patch_realtek.c                      | 225 ++++++++++++++++++---
 sound/pci/hda/patch_sigmatel.c                     |  46 +++--
 sound/pci/rme96.c                                  |  41 ++--
 sound/soc/codecs/arizona.c                         |   2 +-
 sound/soc/codecs/es8328.c                          |  25 ++-
 sound/soc/codecs/es8328.h                          |   1 +
 sound/soc/codecs/rt286.c                           |   8 +-
 sound/soc/codecs/wm5110.c                          |   8 +-
 sound/soc/codecs/wm8962.c                          |   4 +-
 sound/soc/codecs/wm8974.c                          |   1 +
 sound/soc/davinci/davinci-mcasp.c                  |   4 +-
 sound/soc/sh/rcar/gen.c                            |   2 +-
 sound/soc/soc-compress.c                           |  23 ++-
 sound/usb/card.c                                   |   2 +
 sound/usb/mixer.c                                  |   2 +
 sound/usb/mixer_maps.c                             |  12 --
 sound/usb/mixer_quirks.c                           |  39 +++-
 sound/usb/mixer_quirks.h                           |   4 +
 sound/usb/quirks.c                                 |   2 +
 169 files changed, 1611 insertions(+), 728 deletions(-)

[toc] | [next] | [standalone]


#1319402 — [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs
Message-ID<qVDDB-8gU-45@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Len Brown <len.brown@intel.com>

commit 656279a1f3b210cf48ccc572fd7c6b8e2250be77 upstream.

commit f1ccd249319e allowed the cmdline "cpu_init_udelay=" to work
with all values, including the default of 10000.

But in setting the default of 10000, it over-rode the code that sets
the delay 0 on modern processors.

Also, tidy up use of INT/UINT.

Fixes: f1ccd249319e "x86/smpboot: Fix cpu_init_udelay=10000 corner case boot parameter misbehavior"
Reported-by: Shane <shrybman@teksavvy.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: dparsons@brightdsl.net
Link: http://lkml.kernel.org/r/9082eb809ef40dad02db714759c7aaf618c518d4.1448232494.git.len.brown@intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/smpboot.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -509,7 +509,7 @@ void __inquire_remote_apic(int apicid)
  */
 #define UDELAY_10MS_DEFAULT 10000
 
-static unsigned int init_udelay = INT_MAX;
+static unsigned int init_udelay = UINT_MAX;
 
 static int __init cpu_init_udelay(char *str)
 {
@@ -522,14 +522,15 @@ early_param("cpu_init_udelay", cpu_init_
 static void __init smp_quirk_init_udelay(void)
 {
 	/* if cmdline changed it from default, leave it alone */
-	if (init_udelay != INT_MAX)
+	if (init_udelay != UINT_MAX)
 		return;
 
 	/* if modern processor, use no delay */
 	if (((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) && (boot_cpu_data.x86 == 6)) ||
-	    ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && (boot_cpu_data.x86 >= 0xF)))
+	    ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && (boot_cpu_data.x86 >= 0xF))) {
 		init_udelay = 0;
-
+		return;
+	}
 	/* else, use legacy delay */
 	init_udelay = UDELAY_10MS_DEFAULT;
 }

[toc] | [prev] | [next] | [standalone]


#1320083 — Re: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 23:30 +0100
SubjectRe: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs
Message-ID<qVGL8-25Q-17@gated-at.bofh.it>
In reply to#1319402
On Wed, Jan 27, 2016 at 05:02:45PM -0500, Donald Parsons wrote:
> On Wed, 2016-01-27 at 10:11 -0800, Greg Kroah-Hartman wrote:
> 
> Tested with old Core 2 6600 Intel CPU and works still properly.
>    (email written under linux-4.3.5-rc1)

Great, thanks for testing and letting us know.

greg k-h

[toc] | [prev] | [next] | [standalone]


#1320086 — Re: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs

FromDonald Parsons <dparsons@brightdsl.net>
Date2016-01-27 23:30 +0100
SubjectRe: [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs
Message-ID<qVGL8-25Q-19@gated-at.bofh.it>
In reply to#1319402
On Wed, 2016-01-27 at 10:11 -0800, Greg Kroah-Hartman wrote:

Tested with old Core 2 6600 Intel CPU and works still properly.
   (email written under linux-4.3.5-rc1)

Don

[toc] | [prev] | [next] | [standalone]


#1319406 — [PATCH 4.3 052/157] ALSA: seq: Fix race at timer setup and close

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 052/157] ALSA: seq: Fix race at timer setup and close
Message-ID<qVDDC-8gU-63@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/seq/seq_queue.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(i
 static void queue_delete(struct snd_seq_queue *q)
 {
 	/* stop and release the timer */
+	mutex_lock(&q->timer_mutex);
 	snd_seq_timer_stop(q->timer);
 	snd_seq_timer_close(q);
+	mutex_unlock(&q->timer_mutex);
 	/* wait until access free */
 	snd_use_lock_sync(&q->use_lock);
 	/* release resources... */

[toc] | [prev] | [next] | [standalone]


#1319411 — [PATCH 4.3 046/157] ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 046/157] ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO
Message-ID<qVDDC-8gU-73@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kailang <kailang@realtek.com>

commit 3694cb2947db50753caf432db067487eafae7b9b upstream.

The Lenovo ThinkCenter AIO uses Line2 (NID 0x1b) to implement the
micmute hotkey, here we register an input device and use Line2 unsol
event to collect the hotkey pressing or releasing.

In the meanwhile, the micmute led is controlled by GPIO2, so we
use an existing function alc_fixup_gpio_mic_mute_hook() to control
the led.

[Hui: And there are two places to register the input device, to make
the code simple and clean, move the two same code sections into a
function.]

Signed-off-by: Kailang <kailang@realtek.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   84 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 71 insertions(+), 13 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3478,6 +3478,29 @@ static void gpio2_mic_hotkey_event(struc
 	input_sync(spec->kb_dev);
 }
 
+static int alc_register_micmute_input_device(struct hda_codec *codec)
+{
+	struct alc_spec *spec = codec->spec;
+
+	spec->kb_dev = input_allocate_device();
+	if (!spec->kb_dev) {
+		codec_err(codec, "Out of memory (input_allocate_device)\n");
+		return -ENOMEM;
+	}
+	spec->kb_dev->name = "Microphone Mute Button";
+	spec->kb_dev->evbit[0] = BIT_MASK(EV_KEY);
+	spec->kb_dev->keybit[BIT_WORD(KEY_MICMUTE)] = BIT_MASK(KEY_MICMUTE);
+
+	if (input_register_device(spec->kb_dev)) {
+		codec_err(codec, "input_register_device failed\n");
+		input_free_device(spec->kb_dev);
+		spec->kb_dev = NULL;
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
 static void alc280_fixup_hp_gpio2_mic_hotkey(struct hda_codec *codec,
 					     const struct hda_fixup *fix, int action)
 {
@@ -3495,20 +3518,8 @@ static void alc280_fixup_hp_gpio2_mic_ho
 	struct alc_spec *spec = codec->spec;
 
 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-		spec->kb_dev = input_allocate_device();
-		if (!spec->kb_dev) {
-			codec_err(codec, "Out of memory (input_allocate_device)\n");
-			return;
-		}
-		spec->kb_dev->name = "Microphone Mute Button";
-		spec->kb_dev->evbit[0] = BIT_MASK(EV_KEY);
-		spec->kb_dev->keybit[BIT_WORD(KEY_MICMUTE)] = BIT_MASK(KEY_MICMUTE);
-		if (input_register_device(spec->kb_dev)) {
-			codec_err(codec, "input_register_device failed\n");
-			input_free_device(spec->kb_dev);
-			spec->kb_dev = NULL;
+		if (alc_register_micmute_input_device(codec) != 0)
 			return;
-		}
 
 		snd_hda_add_verbs(codec, gpio_init);
 		snd_hda_codec_write_cache(codec, codec->core.afg, 0,
@@ -3538,6 +3549,47 @@ static void alc280_fixup_hp_gpio2_mic_ho
 	}
 }
 
+static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec,
+					     const struct hda_fixup *fix, int action)
+{
+	/* Line2 = mic mute hotkey
+	   GPIO2 = mic mute LED */
+	static const struct hda_verb gpio_init[] = {
+		{ 0x01, AC_VERB_SET_GPIO_MASK, 0x04 },
+		{ 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x04 },
+		{}
+	};
+
+	struct alc_spec *spec = codec->spec;
+
+	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+		if (alc_register_micmute_input_device(codec) != 0)
+			return;
+
+		snd_hda_add_verbs(codec, gpio_init);
+		snd_hda_jack_detect_enable_callback(codec, 0x1b,
+						    gpio2_mic_hotkey_event);
+
+		spec->gen.cap_sync_hook = alc_fixup_gpio_mic_mute_hook;
+		spec->gpio_led = 0;
+		spec->mute_led_polarity = 0;
+		spec->gpio_mic_led_mask = 0x04;
+		return;
+	}
+
+	if (!spec->kb_dev)
+		return;
+
+	switch (action) {
+	case HDA_FIXUP_ACT_PROBE:
+		spec->init_amp = ALC_INIT_DEFAULT;
+		break;
+	case HDA_FIXUP_ACT_FREE:
+		input_unregister_device(spec->kb_dev);
+		spec->kb_dev = NULL;
+	}
+}
+
 static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
 				const struct hda_fixup *fix, int action)
 {
@@ -4638,6 +4690,7 @@ enum {
 	ALC275_FIXUP_DELL_XPS,
 	ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
 	ALC293_FIXUP_LENOVO_SPK_NOISE,
+	ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5247,6 +5300,10 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC269_FIXUP_THINKPAD_ACPI
 	},
+	[ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc233_fixup_lenovo_line2_mic_hotkey,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5396,6 +5453,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),

[toc] | [prev] | [next] | [standalone]


#1319414 — [PATCH 4.3 010/157] KVM: svm: unconditionally intercept #DB

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 010/157] KVM: svm: unconditionally intercept #DB
Message-ID<qVDDC-8gU-79@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <pbonzini@redhat.com>

commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream.

This is needed to avoid the possibility that the guest triggers
an infinite stream of #DB exceptions (CVE-2015-8104).

VMX is not affected: because it does not save DR6 in the VMCS,
it already intercepts #DB unconditionally.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/svm.c |   14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1108,6 +1108,7 @@ static void init_vmcb(struct vcpu_svm *s
 	set_exception_intercept(svm, UD_VECTOR);
 	set_exception_intercept(svm, MC_VECTOR);
 	set_exception_intercept(svm, AC_VECTOR);
+	set_exception_intercept(svm, DB_VECTOR);
 
 	set_intercept(svm, INTERCEPT_INTR);
 	set_intercept(svm, INTERCEPT_NMI);
@@ -1642,20 +1643,13 @@ static void svm_set_segment(struct kvm_v
 	mark_dirty(svm->vmcb, VMCB_SEG);
 }
 
-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
-	clr_exception_intercept(svm, DB_VECTOR);
 	clr_exception_intercept(svm, BP_VECTOR);
 
-	if (svm->nmi_singlestep)
-		set_exception_intercept(svm, DB_VECTOR);
-
 	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
-		if (vcpu->guest_debug &
-		    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
-			set_exception_intercept(svm, DB_VECTOR);
 		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
 			set_exception_intercept(svm, BP_VECTOR);
 	} else
@@ -1761,7 +1755,6 @@ static int db_interception(struct vcpu_s
 		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
 			svm->vmcb->save.rflags &=
 				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
-		update_db_bp_intercept(&svm->vcpu);
 	}
 
 	if (svm->vcpu.guest_debug &
@@ -3761,7 +3754,6 @@ static void enable_nmi_window(struct kvm
 	 */
 	svm->nmi_singlestep = true;
 	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
-	update_db_bp_intercept(vcpu);
 }
 
 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
@@ -4383,7 +4375,7 @@ static struct kvm_x86_ops svm_x86_ops =
 	.vcpu_load = svm_vcpu_load,
 	.vcpu_put = svm_vcpu_put,
 
-	.update_db_bp_intercept = update_db_bp_intercept,
+	.update_db_bp_intercept = update_bp_intercept,
 	.get_msr = svm_get_msr,
 	.set_msr = svm_set_msr,
 	.get_segment_base = svm_get_segment_base,

[toc] | [prev] | [next] | [standalone]


#1319415 — [PATCH 4.3 155/157] mn10300: Select CONFIG_HAVE_UID16 to fix build failure

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 20:10 +0100
Subject[PATCH 4.3 155/157] mn10300: Select CONFIG_HAVE_UID16 to fix build failure
Message-ID<qVDDC-8gU-83@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit c86576ea114a9a881cf7328dc7181052070ca311 upstream.

mn10300 builds fail with

fs/stat.c: In function 'cp_old_stat':
fs/stat.c:163:2: error: 'old_uid_t' undeclared

ipc/util.c: In function 'ipc64_perm_to_ipc_perm':
ipc/util.c:540:2: error: 'old_uid_t' undeclared

Select CONFIG_HAVE_UID16 and remove local definition of CONFIG_UID16
to fix the problem.

Fixes: fbc416ff8618 ("arm64: fix building without CONFIG_UID16")
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mn10300/Kconfig |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -1,6 +1,7 @@
 config MN10300
 	def_bool y
 	select HAVE_OPROFILE
+	select HAVE_UID16
 	select GENERIC_IRQ_SHOW
 	select ARCH_WANT_IPC_PARSE_VERSION
 	select HAVE_ARCH_TRACEHOOK
@@ -37,9 +38,6 @@ config HIGHMEM
 config NUMA
 	def_bool n
 
-config UID16
-	def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
 	def_bool y
 

[toc] | [prev] | [next] | [standalone]


#1319643 — [PATCH 4.3 154/157] fix the regression from "direct-io: Fix negative return from dio read beyond eof"

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:20 +0100
Subject[PATCH 4.3 154/157] fix the regression from "direct-io: Fix negative return from dio read beyond eof"
Message-ID<qVEJl-A1-31@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit 2d4594acbf6d8f75a27f3578476b6a27d8b13ebb upstream.

Sure, it's better to bail out of past-the-eof read and return 0 than return
a bogus negative value on such.  Only we'd better make sure we are bailing out
with 0 and not -ENOMEM...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/direct-io.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1167,6 +1167,7 @@ do_blockdev_direct_IO(struct kiocb *iocb
 		if (dio->flags & DIO_LOCKING)
 			mutex_unlock(&inode->i_mutex);
 		kmem_cache_free(dio_cache, dio);
+		retval = 0;
 		goto out;
 	}
 

[toc] | [prev] | [next] | [standalone]


#1319644 — [PATCH 4.3 126/157] powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:20 +0100
Subject[PATCH 4.3 126/157] powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"
Message-ID<qVEJl-A1-27@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alistair Popple <alistair@popple.id.au>

commit 036592fbbe753d236402a0ae68148e7c143a0f0e upstream.

Commit 25642e1459ac ("powerpc/opal-irqchip: Fix double endian
conversion") fixed an endian bug by calling opal_handle_events() in
opal_event_unmask().

However this introduced a deadlock if we find an event is active
during unmasking and call opal_handle_events() again. The bad call
sequence is:

  opal_interrupt()
  -> opal_handle_events()
     -> generic_handle_irq()
        -> handle_level_irq()
           -> raw_spin_lock(&desc->lock)
              handle_irq_event(desc)
              unmask_irq(desc)
              -> opal_event_unmask()
                 -> opal_handle_events()
                    -> generic_handle_irq()
                       -> handle_level_irq()
                          -> raw_spin_lock(&desc->lock)	(BOOM)

When generating multiple opal events in quick succession this would lead
to the following stall warnings:

EEH: Fenced PHB#0 detected, location: U78C9.001.WZS09XA-P1-C32
INFO: rcu_sched detected stalls on CPUs/tasks:

         12-...: (1 GPs behind) idle=68f/140000000000001/0 softirq=860/861 fqs=2065
         15-...: (1 GPs behind) idle=be5/140000000000001/0 softirq=1142/1143 fqs=2065
         (detected by 13, t=2102 jiffies, g=1325, c=1324, q=602)
NMI watchdog: BUG: soft lockup - CPU#18 stuck for 22s! [irqbalance:2696]
INFO: rcu_sched detected stalls on CPUs/tasks:
         12-...: (1 GPs behind) idle=68f/140000000000001/0 softirq=860/861 fqs=8371
         15-...: (1 GPs behind) idle=be5/140000000000001/0 softirq=1142/1143 fqs=8371
         (detected by 20, t=8407 jiffies, g=1325, c=1324, q=1290)

This patch corrects the problem by queuing the work if an event is
active during unmasking, which is similar to the pre-endian fix
behaviour.

Fixes: 25642e1459ac ("powerpc/opal-irqchip: Fix double endian conversion")
Signed-off-by: Alistair Popple <alistair@popple.id.au>
Reported-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/opal-irqchip.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -83,7 +83,19 @@ static void opal_event_unmask(struct irq
 	set_bit(d->hwirq, &opal_event_irqchip.mask);
 
 	opal_poll_events(&events);
-	opal_handle_events(be64_to_cpu(events));
+	last_outstanding_events = be64_to_cpu(events);
+
+	/*
+	 * We can't just handle the events now with opal_handle_events().
+	 * If we did we would deadlock when opal_event_unmask() is called from
+	 * handle_level_irq() with the irq descriptor lock held, because
+	 * calling opal_handle_events() would call generic_handle_irq() and
+	 * then handle_level_irq() which would try to take the descriptor lock
+	 * again. Instead queue the events for later.
+	 */
+	if (last_outstanding_events & opal_event_irqchip.mask)
+		/* Need to retrigger the interrupt */
+		irq_work_queue(&opal_event_irq_work);
 }
 
 static int opal_event_set_type(struct irq_data *d, unsigned int flow_type)

[toc] | [prev] | [next] | [standalone]


#1319661 — [PATCH 4.3 135/157] arm64: cmpxchg_dbl: fix return value type

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:20 +0100
Subject[PATCH 4.3 135/157] arm64: cmpxchg_dbl: fix return value type
Message-ID<qVEJn-A1-67@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>

commit 57a65667991aaddef730b0c910111ab76a1ff245 upstream.

The current arm64 __cmpxchg_double{_mb} implementations carry out the
compare exchange by first comparing the old values passed in to the
values read from the pointer provided and by stashing the cumulative
bitwise difference in a 64-bit register.

By comparing the register content against 0, it is possible to detect if
the values read differ from the old values passed in, so that the compare
exchange detects whether it has to bail out or carry on completing the
operation with the exchange.

Given the current implementation, to detect the cmpxchg operation
status, the __cmpxchg_double{_mb} functions should return the 64-bit
stashed bitwise difference so that the caller can detect cmpxchg failure
by comparing the return value content against 0. The current implementation
declares the return value as an int, which means that the 64-bit
value stashing the bitwise difference is truncated before being
returned to the __cmpxchg_double{_mb} callers, which means that
any bitwise difference present in the top 32 bits goes undetected,
triggering false positives and subsequent kernel failures.

This patch fixes the issue by declaring the arm64 __cmpxchg_double{_mb}
return values as a long, so that the bitwise difference is
properly propagated on failure, restoring the expected behaviour.

Fixes: e9a4b795652f ("arm64: cmpxchg_dbl: patch in lse instructions when supported by the CPU")
Cc: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/atomic_ll_sc.h |    2 +-
 arch/arm64/include/asm/atomic_lse.h   |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm64/include/asm/atomic_ll_sc.h
+++ b/arch/arm64/include/asm/atomic_ll_sc.h
@@ -211,7 +211,7 @@ __CMPXCHG_CASE( ,  , mb_8, dmb ish, l, "
 #undef __CMPXCHG_CASE
 
 #define __CMPXCHG_DBL(name, mb, rel, cl)				\
-__LL_SC_INLINE int							\
+__LL_SC_INLINE long							\
 __LL_SC_PREFIX(__cmpxchg_double##name(unsigned long old1,		\
 				      unsigned long old2,		\
 				      unsigned long new1,		\
--- a/arch/arm64/include/asm/atomic_lse.h
+++ b/arch/arm64/include/asm/atomic_lse.h
@@ -348,7 +348,7 @@ __CMPXCHG_CASE(x,  , mb_8, al, "memory")
 #define __LL_SC_CMPXCHG_DBL(op)	__LL_SC_CALL(__cmpxchg_double##op)
 
 #define __CMPXCHG_DBL(name, mb, cl...)					\
-static inline int __cmpxchg_double##name(unsigned long old1,		\
+static inline long __cmpxchg_double##name(unsigned long old1,		\
 					 unsigned long old2,		\
 					 unsigned long new1,		\
 					 unsigned long new2,		\

[toc] | [prev] | [next] | [standalone]


#1319665 — [PATCH 4.3 134/157] arm64: bpf: fix mod-by-zero case

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:20 +0100
Subject[PATCH 4.3 134/157] arm64: bpf: fix mod-by-zero case
Message-ID<qVEJn-A1-75@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zi Shen Lim <zlim.lnx@gmail.com>

commit 14e589ff4aa3f28a5424e92b6495ecb8950080f7 upstream.

Turns out in the case of modulo by zero in a BPF program:
	A = A % X;  (X == 0)
the expected behavior is to terminate with return value 0.

The bug in JIT is exposed by a new test case [1].

[1] https://lkml.org/lkml/2015/11/4/499

Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
Reported-by: Yang Shi <yang.shi@linaro.org>
Reported-by: Xi Wang <xi.wang@gmail.com>
CC: Alexei Starovoitov <ast@plumgrid.com>
Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/net/bpf_jit_comp.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -269,6 +269,8 @@ static int build_insn(const struct bpf_i
 		break;
 	case BPF_ALU | BPF_DIV | BPF_X:
 	case BPF_ALU64 | BPF_DIV | BPF_X:
+	case BPF_ALU | BPF_MOD | BPF_X:
+	case BPF_ALU64 | BPF_MOD | BPF_X:
 	{
 		const u8 r0 = bpf2a64[BPF_REG_0];
 
@@ -281,16 +283,19 @@ static int build_insn(const struct bpf_i
 		check_imm26(jmp_offset);
 		emit(A64_B(jmp_offset), ctx);
 		/* else */
-		emit(A64_UDIV(is64, dst, dst, src), ctx);
+		switch (BPF_OP(code)) {
+		case BPF_DIV:
+			emit(A64_UDIV(is64, dst, dst, src), ctx);
+			break;
+		case BPF_MOD:
+			ctx->tmp_used = 1;
+			emit(A64_UDIV(is64, tmp, dst, src), ctx);
+			emit(A64_MUL(is64, tmp, tmp, src), ctx);
+			emit(A64_SUB(is64, dst, dst, tmp), ctx);
+			break;
+		}
 		break;
 	}
-	case BPF_ALU | BPF_MOD | BPF_X:
-	case BPF_ALU64 | BPF_MOD | BPF_X:
-		ctx->tmp_used = 1;
-		emit(A64_UDIV(is64, tmp, dst, src), ctx);
-		emit(A64_MUL(is64, tmp, tmp, src), ctx);
-		emit(A64_SUB(is64, dst, dst, tmp), ctx);
-		break;
 	case BPF_ALU | BPF_LSH | BPF_X:
 	case BPF_ALU64 | BPF_LSH | BPF_X:
 		emit(A64_LSLV(is64, dst, dst, src), ctx);

[toc] | [prev] | [next] | [standalone]


#1319667 — [PATCH 4.3 044/157] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 044/157] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
Message-ID<qVESZ-FR-1@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xiong Zhang <xiong.y.zhang@intel.com>

commit 3e6db33aaf1d42a30339f831ec4850570d6cc7a3 upstream.

It takes three minutes to enter into hibernation on some OEM SKL
machines and we see many codec spurious response after thaw() opertion.
This is because HDA is still in D0 state after freeze() call and
pci_pm_freeze/pci_pm_freeze_noirq() don't set D3 hot in pci_bus driver.
It seems bios still access HDA when system enter into freeze state,
HDA will receive codec response interrupt immediately after thaw() call.
Because of this unexpected interrupt, HDA enter into a abnormal
state and slow down the system enter into hibernation.

In this patch, we put HDA into D3 hot state in azx_freeze_noirq() and
put HDA into D0 state in azx_thaw_noirq().

V2: Only apply this fix to SKL+
    Fix compile error when CONFIG_PM_SLEEP isn't defined

[Yet another fix for CONFIG_PM_SLEEP ifdef and the additional comment
 by tiwai]

Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_intel.c |   34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -927,6 +927,36 @@ static int azx_resume(struct device *dev
 }
 #endif /* CONFIG_PM_SLEEP || SUPPORT_VGA_SWITCHEROO */
 
+#ifdef CONFIG_PM_SLEEP
+/* put codec down to D3 at hibernation for Intel SKL+;
+ * otherwise BIOS may still access the codec and screw up the driver
+ */
+#define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170)
+#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)
+#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci))
+
+static int azx_freeze_noirq(struct device *dev)
+{
+	struct pci_dev *pci = to_pci_dev(dev);
+
+	if (IS_SKL_PLUS(pci))
+		pci_set_power_state(pci, PCI_D3hot);
+
+	return 0;
+}
+
+static int azx_thaw_noirq(struct device *dev)
+{
+	struct pci_dev *pci = to_pci_dev(dev);
+
+	if (IS_SKL_PLUS(pci))
+		pci_set_power_state(pci, PCI_D0);
+
+	return 0;
+}
+#endif /* CONFIG_PM_SLEEP */
+
 #ifdef CONFIG_PM
 static int azx_runtime_suspend(struct device *dev)
 {
@@ -1036,6 +1066,10 @@ static int azx_runtime_idle(struct devic
 
 static const struct dev_pm_ops azx_pm = {
 	SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume)
+#ifdef CONFIG_PM_SLEEP
+	.freeze_noirq = azx_freeze_noirq,
+	.thaw_noirq = azx_thaw_noirq,
+#endif
 	SET_RUNTIME_PM_OPS(azx_runtime_suspend, azx_runtime_resume, azx_runtime_idle)
 };
 

[toc] | [prev] | [next] | [standalone]


#1319669 — [PATCH 4.3 128/157] powerpc: Make value-returning atomics fully ordered

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 128/157] powerpc: Make value-returning atomics fully ordered
Message-ID<qVET0-FR-5@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boqun Feng <boqun.feng@gmail.com>

commit 49e9cf3f0c04bf76ffa59242254110309554861d upstream.

According to memory-barriers.txt:

> Any atomic operation that modifies some state in memory and returns
> information about the state (old or new) implies an SMP-conditional
> general memory barrier (smp_mb()) on each side of the actual
> operation ...

Which mean these operations should be fully ordered. However on PPC,
PPC_ATOMIC_ENTRY_BARRIER is the barrier before the actual operation,
which is currently "lwsync" if SMP=y. The leading "lwsync" can not
guarantee fully ordered atomics, according to Paul Mckenney:

https://lkml.org/lkml/2015/10/14/970

To fix this, we define PPC_ATOMIC_ENTRY_BARRIER as "sync" to guarantee
the fully-ordered semantics.

This also makes futex atomics fully ordered, which can avoid possible
memory ordering problems if userspace code relies on futex system call
for fully ordered semantics.

Fixes: b97021f85517 ("powerpc: Fix atomic_xxx_return barrier semantics")
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/synch.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/synch.h
+++ b/arch/powerpc/include/asm/synch.h
@@ -44,7 +44,7 @@ static inline void isync(void)
 	MAKE_LWSYNC_SECTION_ENTRY(97, __lwsync_fixup);
 #define PPC_ACQUIRE_BARRIER	 "\n" stringify_in_c(__PPC_ACQUIRE_BARRIER)
 #define PPC_RELEASE_BARRIER	 stringify_in_c(LWSYNC) "\n"
-#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(LWSYNC) "\n"
+#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(sync) "\n"
 #define PPC_ATOMIC_EXIT_BARRIER	 "\n" stringify_in_c(sync) "\n"
 #else
 #define PPC_ACQUIRE_BARRIER

[toc] | [prev] | [next] | [standalone]


#1319671 — [PATCH 4.3 157/157] arm64: KVM: Add workaround for Cortex-A57 erratum 834220

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 157/157] arm64: KVM: Add workaround for Cortex-A57 erratum 834220
Message-ID<qVET0-FR-9@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 498cd5c32be6e32bc0f8efcad48ab094bb2bfdf3 upstream.

Cortex-A57 parts up to r1p2 can misreport Stage 2 translation faults
when a Stage 1 permission fault or device alignment fault should
have been reported.

This patch implements the workaround (which is to validate that the
Stage-1 translation actually succeeds) by using code patching.

Reviewed-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/Kconfig                  |   21 +++++++++++++++++++++
 arch/arm64/include/asm/cpufeature.h |    3 ++-
 arch/arm64/kernel/cpu_errata.c      |    9 +++++++++
 arch/arm64/kvm/hyp.S                |    6 ++++++
 4 files changed, 38 insertions(+), 1 deletion(-)

--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -311,6 +311,27 @@ config ARM64_ERRATUM_832075
 
 	  If unsure, say Y.
 
+config ARM64_ERRATUM_834220
+	bool "Cortex-A57: 834220: Stage 2 translation fault might be incorrectly reported in presence of a Stage 1 fault"
+	depends on KVM
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 834220 on Cortex-A57 parts up to r1p2.
+
+	  Affected Cortex-A57 parts might report a Stage 2 translation
+	  fault as a the result of a Stage 1 fault for a load crossing
+	  a page boundary when there is a Stage 1 permission or device
+	  memory alignment fault and a Stage 2 translation fault
+
+	  The workaround is to verify that the Stage-1 translation
+	  doesn't generate a fault before handling the Stage-2 fault.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
 config ARM64_ERRATUM_845719
 	bool "Cortex-A53: 845719: a load might read incorrect data"
 	depends on COMPAT
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -27,8 +27,9 @@
 #define ARM64_HAS_SYSREG_GIC_CPUIF		3
 #define ARM64_HAS_PAN				4
 #define ARM64_HAS_LSE_ATOMICS			5
+#define ARM64_WORKAROUND_834220			6
 
-#define ARM64_NCAPS				6
+#define ARM64_NCAPS				7
 
 #ifndef __ASSEMBLY__
 
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -74,6 +74,15 @@ const struct arm64_cpu_capabilities arm6
 			   (1 << MIDR_VARIANT_SHIFT) | 2),
 	},
 #endif
+#ifdef CONFIG_ARM64_ERRATUM_834220
+	{
+	/* Cortex-A57 r0p0 - r1p2 */
+		.desc = "ARM erratum 834220",
+		.capability = ARM64_WORKAROUND_834220,
+		MIDR_RANGE(MIDR_CORTEX_A57, 0x00,
+			   (1 << MIDR_VARIANT_SHIFT) | 2),
+	},
+#endif
 #ifdef CONFIG_ARM64_ERRATUM_845719
 	{
 	/* Cortex-A53 r0p[01234] */
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -1007,9 +1007,15 @@ el1_trap:
 	b.ne	1f		// Not an abort we care about
 
 	/* This is an abort. Check for permission fault */
+alternative_if_not ARM64_WORKAROUND_834220
 	and	x2, x1, #ESR_ELx_FSC_TYPE
 	cmp	x2, #FSC_PERM
 	b.ne	1f		// Not a permission fault
+alternative_else
+	nop			// Force a Stage-1 translation to occur
+	nop			// and return to the guest if it failed
+	nop
+alternative_endif
 
 	/*
 	 * Check for Stage-1 page table walk, which is guaranteed

[toc] | [prev] | [next] | [standalone]


#1319673 — [PATCH 4.3 131/157] powerpc/module: Handle R_PPC64_ENTRY relocations

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 131/157] powerpc/module: Handle R_PPC64_ENTRY relocations
Message-ID<qVET0-FR-13@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ulrich Weigand <ulrich.weigand@de.ibm.com>

commit a61674bdfc7c2bf909c4010699607b62b69b7bec upstream.

GCC 6 will include changes to generated code with -mcmodel=large,
which is used to build kernel modules on powerpc64le.  This was
necessary because the large model is supposed to allow arbitrary
sizes and locations of the code and data sections, but the ELFv2
global entry point prolog still made the unconditional assumption
that the TOC associated with any particular function can be found
within 2 GB of the function entry point:

func:
	addis r2,r12,(.TOC.-func)@ha
	addi  r2,r2,(.TOC.-func)@l
	.localentry func, .-func

To remove this assumption, GCC will now generate instead this global
entry point prolog sequence when using -mcmodel=large:

	.quad .TOC.-func
func:
	.reloc ., R_PPC64_ENTRY
	ld    r2, -8(r12)
	add   r2, r2, r12
	.localentry func, .-func

The new .reloc triggers an optimization in the linker that will
replace this new prolog with the original code (see above) if the
linker determines that the distance between .TOC. and func is in
range after all.

Since this new relocation is now present in module object files,
the kernel module loader is required to handle them too.  This
patch adds support for the new relocation and implements the
same optimization done by the GNU linker.

Signed-off-by: Ulrich Weigand <ulrich.weigand@de.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/uapi/asm/elf.h |    2 ++
 arch/powerpc/kernel/module_64.c     |   27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

--- a/arch/powerpc/include/uapi/asm/elf.h
+++ b/arch/powerpc/include/uapi/asm/elf.h
@@ -295,6 +295,8 @@ do {									\
 #define R_PPC64_TLSLD		108
 #define R_PPC64_TOCSAVE		109
 
+#define R_PPC64_ENTRY		118
+
 #define R_PPC64_REL16		249
 #define R_PPC64_REL16_LO	250
 #define R_PPC64_REL16_HI	251
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -635,6 +635,33 @@ int apply_relocate_add(Elf64_Shdr *sechd
 			 */
 			break;
 
+		case R_PPC64_ENTRY:
+			/*
+			 * Optimize ELFv2 large code model entry point if
+			 * the TOC is within 2GB range of current location.
+			 */
+			value = my_r2(sechdrs, me) - (unsigned long)location;
+			if (value + 0x80008000 > 0xffffffff)
+				break;
+			/*
+			 * Check for the large code model prolog sequence:
+		         *	ld r2, ...(r12)
+			 *	add r2, r2, r12
+			 */
+			if ((((uint32_t *)location)[0] & ~0xfffc)
+			    != 0xe84c0000)
+				break;
+			if (((uint32_t *)location)[1] != 0x7c426214)
+				break;
+			/*
+			 * If found, replace it with:
+			 *	addis r2, r12, (.TOC.-func)@ha
+			 *	addi r2, r12, (.TOC.-func)@l
+			 */
+			((uint32_t *)location)[0] = 0x3c4c0000 + PPC_HA(value);
+			((uint32_t *)location)[1] = 0x38420000 + PPC_LO(value);
+			break;
+
 		case R_PPC64_REL16_HA:
 			/* Subtract location pointer */
 			value -= (unsigned long)location;

[toc] | [prev] | [next] | [standalone]


#1319675 — [PATCH 4.3 129/157] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 129/157] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
Message-ID<qVET0-FR-21@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boqun Feng <boqun.feng@gmail.com>

commit 81d7a3294de7e9828310bbf986a67246b13fa01e upstream.

According to memory-barriers.txt, xchg*, cmpxchg* and their atomic_
versions all need to be fully ordered, however they are now just
RELEASE+ACQUIRE, which are not fully ordered.

So also replace PPC_RELEASE_BARRIER and PPC_ACQUIRE_BARRIER with
PPC_ATOMIC_ENTRY_BARRIER and PPC_ATOMIC_EXIT_BARRIER in
__{cmp,}xchg_{u32,u64} respectively to guarantee fully ordered semantics
of atomic{,64}_{cmp,}xchg() and {cmp,}xchg(), as a complement of commit
b97021f85517 ("powerpc: Fix atomic_xxx_return barrier semantics")

This patch depends on patch "powerpc: Make value-returning atomics fully
ordered" for PPC_ATOMIC_ENTRY_BARRIER definition.

Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/cmpxchg.h |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/arch/powerpc/include/asm/cmpxchg.h
+++ b/arch/powerpc/include/asm/cmpxchg.h
@@ -18,12 +18,12 @@ __xchg_u32(volatile void *p, unsigned lo
 	unsigned long prev;
 
 	__asm__ __volatile__(
-	PPC_RELEASE_BARRIER
+	PPC_ATOMIC_ENTRY_BARRIER
 "1:	lwarx	%0,0,%2 \n"
 	PPC405_ERR77(0,%2)
 "	stwcx.	%3,0,%2 \n\
 	bne-	1b"
-	PPC_ACQUIRE_BARRIER
+	PPC_ATOMIC_EXIT_BARRIER
 	: "=&r" (prev), "+m" (*(volatile unsigned int *)p)
 	: "r" (p), "r" (val)
 	: "cc", "memory");
@@ -61,12 +61,12 @@ __xchg_u64(volatile void *p, unsigned lo
 	unsigned long prev;
 
 	__asm__ __volatile__(
-	PPC_RELEASE_BARRIER
+	PPC_ATOMIC_ENTRY_BARRIER
 "1:	ldarx	%0,0,%2 \n"
 	PPC405_ERR77(0,%2)
 "	stdcx.	%3,0,%2 \n\
 	bne-	1b"
-	PPC_ACQUIRE_BARRIER
+	PPC_ATOMIC_EXIT_BARRIER
 	: "=&r" (prev), "+m" (*(volatile unsigned long *)p)
 	: "r" (p), "r" (val)
 	: "cc", "memory");
@@ -151,14 +151,14 @@ __cmpxchg_u32(volatile unsigned int *p,
 	unsigned int prev;
 
 	__asm__ __volatile__ (
-	PPC_RELEASE_BARRIER
+	PPC_ATOMIC_ENTRY_BARRIER
 "1:	lwarx	%0,0,%2		# __cmpxchg_u32\n\
 	cmpw	0,%0,%3\n\
 	bne-	2f\n"
 	PPC405_ERR77(0,%2)
 "	stwcx.	%4,0,%2\n\
 	bne-	1b"
-	PPC_ACQUIRE_BARRIER
+	PPC_ATOMIC_EXIT_BARRIER
 	"\n\
 2:"
 	: "=&r" (prev), "+m" (*p)
@@ -197,13 +197,13 @@ __cmpxchg_u64(volatile unsigned long *p,
 	unsigned long prev;
 
 	__asm__ __volatile__ (
-	PPC_RELEASE_BARRIER
+	PPC_ATOMIC_ENTRY_BARRIER
 "1:	ldarx	%0,0,%2		# __cmpxchg_u64\n\
 	cmpd	0,%0,%3\n\
 	bne-	2f\n\
 	stdcx.	%4,0,%2\n\
 	bne-	1b"
-	PPC_ACQUIRE_BARRIER
+	PPC_ATOMIC_EXIT_BARRIER
 	"\n\
 2:"
 	: "=&r" (prev), "+m" (*p)

[toc] | [prev] | [next] | [standalone]


#1319679 — [PATCH 4.3 133/157] arm64: bpf: fix div-by-zero case

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 133/157] arm64: bpf: fix div-by-zero case
Message-ID<qVET1-FR-31@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zi Shen Lim <zlim.lnx@gmail.com>

commit 251599e1d6906621f49218d7b474ddd159e58f3b upstream.

In the case of division by zero in a BPF program:
	A = A / X;  (X == 0)
the expected behavior is to terminate with return value 0.

This is confirmed by the test case introduced in commit 86bf1721b226
("test_bpf: add tests checking that JIT/interpreter sets A and X to 0.").

Reported-by: Yang Shi <yang.shi@linaro.org>
Tested-by: Yang Shi <yang.shi@linaro.org>
CC: Xi Wang <xi.wang@gmail.com>
CC: Alexei Starovoitov <ast@plumgrid.com>
CC: linux-arm-kernel@lists.infradead.org
CC: linux-kernel@vger.kernel.org
Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/net/bpf_jit.h      |    3 ++-
 arch/arm64/net/bpf_jit_comp.c |   37 +++++++++++++++++++++++++------------
 2 files changed, 27 insertions(+), 13 deletions(-)

--- a/arch/arm64/net/bpf_jit.h
+++ b/arch/arm64/net/bpf_jit.h
@@ -1,7 +1,7 @@
 /*
  * BPF JIT compiler for ARM64
  *
- * Copyright (C) 2014 Zi Shen Lim <zlim.lnx@gmail.com>
+ * Copyright (C) 2014-2015 Zi Shen Lim <zlim.lnx@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -35,6 +35,7 @@
 	aarch64_insn_gen_comp_branch_imm(0, offset, Rt, A64_VARIANT(sf), \
 		AARCH64_INSN_BRANCH_COMP_##type)
 #define A64_CBZ(sf, Rt, imm19) A64_COMP_BRANCH(sf, Rt, (imm19) << 2, ZERO)
+#define A64_CBNZ(sf, Rt, imm19) A64_COMP_BRANCH(sf, Rt, (imm19) << 2, NONZERO)
 
 /* Conditional branch (immediate) */
 #define A64_COND_BRANCH(cond, offset) \
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -1,7 +1,7 @@
 /*
  * BPF JIT compiler for ARM64
  *
- * Copyright (C) 2014 Zi Shen Lim <zlim.lnx@gmail.com>
+ * Copyright (C) 2014-2015 Zi Shen Lim <zlim.lnx@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -225,6 +225,17 @@ static int build_insn(const struct bpf_i
 	u8 jmp_cond;
 	s32 jmp_offset;
 
+#define check_imm(bits, imm) do {				\
+	if ((((imm) > 0) && ((imm) >> (bits))) ||		\
+	    (((imm) < 0) && (~(imm) >> (bits)))) {		\
+		pr_info("[%2d] imm=%d(0x%x) out of range\n",	\
+			i, imm, imm);				\
+		return -EINVAL;					\
+	}							\
+} while (0)
+#define check_imm19(imm) check_imm(19, imm)
+#define check_imm26(imm) check_imm(26, imm)
+
 	switch (code) {
 	/* dst = src */
 	case BPF_ALU | BPF_MOV | BPF_X:
@@ -258,8 +269,21 @@ static int build_insn(const struct bpf_i
 		break;
 	case BPF_ALU | BPF_DIV | BPF_X:
 	case BPF_ALU64 | BPF_DIV | BPF_X:
+	{
+		const u8 r0 = bpf2a64[BPF_REG_0];
+
+		/* if (src == 0) return 0 */
+		jmp_offset = 3; /* skip ahead to else path */
+		check_imm19(jmp_offset);
+		emit(A64_CBNZ(is64, src, jmp_offset), ctx);
+		emit(A64_MOVZ(1, r0, 0, 0), ctx);
+		jmp_offset = epilogue_offset(ctx);
+		check_imm26(jmp_offset);
+		emit(A64_B(jmp_offset), ctx);
+		/* else */
 		emit(A64_UDIV(is64, dst, dst, src), ctx);
 		break;
+	}
 	case BPF_ALU | BPF_MOD | BPF_X:
 	case BPF_ALU64 | BPF_MOD | BPF_X:
 		ctx->tmp_used = 1;
@@ -393,17 +417,6 @@ emit_bswap_uxt:
 		emit(A64_ASR(is64, dst, dst, imm), ctx);
 		break;
 
-#define check_imm(bits, imm) do {				\
-	if ((((imm) > 0) && ((imm) >> (bits))) ||		\
-	    (((imm) < 0) && (~(imm) >> (bits)))) {		\
-		pr_info("[%2d] imm=%d(0x%x) out of range\n",	\
-			i, imm, imm);				\
-		return -EINVAL;					\
-	}							\
-} while (0)
-#define check_imm19(imm) check_imm(19, imm)
-#define check_imm26(imm) check_imm(26, imm)
-
 	/* JUMP off */
 	case BPF_JMP | BPF_JA:
 		jmp_offset = bpf2a64_offset(i + off, i, ctx);

[toc] | [prev] | [next] | [standalone]


#1319682 — [PATCH 4.3 156/157] arm64: restore bogomips information in /proc/cpuinfo

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 156/157] arm64: restore bogomips information in /proc/cpuinfo
Message-ID<qVET1-FR-43@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yang Shi <yang.shi@linaro.org>

commit 92e788b749862ebe9920360513a718e5dd4da7a9 upstream.

As previously reported, some userspace applications depend on bogomips
showed by /proc/cpuinfo. Although there is much less legacy impact on
aarch64 than arm, it does break libvirt.

This patch reverts commit 326b16db9f69 ("arm64: delay: don't bother
reporting bogomips in /proc/cpuinfo"), but with some tweak due to
context change and without the pr_info().

Fixes: 326b16db9f69 ("arm64: delay: don't bother reporting bogomips in /proc/cpuinfo")
Signed-off-by: Yang Shi <yang.shi@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org> # 3.12+
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/setup.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -558,6 +558,10 @@ static int c_show(struct seq_file *m, vo
 		 */
 		seq_printf(m, "processor\t: %d\n", i);
 
+		seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+			   loops_per_jiffy / (500000UL/HZ),
+			   loops_per_jiffy / (5000UL/HZ) % 100);
+
 		/*
 		 * Dump out the common processor features in a single line.
 		 * Userspace should read the hwcaps with getauxval(AT_HWCAP)

[toc] | [prev] | [next] | [standalone]


#1319683 — [PATCH 4.3 147/157] parisc iommu: fix panic due to trying to allocate too large region

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-01-27 21:30 +0100
Subject[PATCH 4.3 147/157] parisc iommu: fix panic due to trying to allocate too large region
Message-ID<qVET1-FR-45@gated-at.bofh.it>
In reply to#1319401
4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit e46e31a3696ae2d66f32c207df3969613726e636 upstream.

When using the Promise TX2+ SATA controller on PA-RISC, the system often
crashes with kernel panic, for example just writing data with the dd
utility will make it crash.

Kernel panic - not syncing: drivers/parisc/sba_iommu.c: I/O MMU @ 000000000000a000 is out of mapping resources

CPU: 0 PID: 18442 Comm: mkspadfs Not tainted 4.4.0-rc2 #2
Backtrace:
 [<000000004021497c>] show_stack+0x14/0x20
 [<0000000040410bf0>] dump_stack+0x88/0x100
 [<000000004023978c>] panic+0x124/0x360
 [<0000000040452c18>] sba_alloc_range+0x698/0x6a0
 [<0000000040453150>] sba_map_sg+0x260/0x5b8
 [<000000000c18dbb4>] ata_qc_issue+0x264/0x4a8 [libata]
 [<000000000c19535c>] ata_scsi_translate+0xe4/0x220 [libata]
 [<000000000c19a93c>] ata_scsi_queuecmd+0xbc/0x320 [libata]
 [<0000000040499bbc>] scsi_dispatch_cmd+0xfc/0x130
 [<000000004049da34>] scsi_request_fn+0x6e4/0x970
 [<00000000403e95a8>] __blk_run_queue+0x40/0x60
 [<00000000403e9d8c>] blk_run_queue+0x3c/0x68
 [<000000004049a534>] scsi_run_queue+0x2a4/0x360
 [<000000004049be68>] scsi_end_request+0x1a8/0x238
 [<000000004049de84>] scsi_io_completion+0xfc/0x688
 [<0000000040493c74>] scsi_finish_command+0x17c/0x1d0

The cause of the crash is not exhaustion of the IOMMU space, there is
plenty of free pages. The function sba_alloc_range is called with size
0x11000, thus the pages_needed variable is 0x11. The function
sba_search_bitmap is called with bits_wanted 0x11 and boundary size is
0x10 (because dma_get_seg_boundary(dev) returns 0xffff).

The function sba_search_bitmap attempts to allocate 17 pages that must not
cross 16-page boundary - it can't satisfy this requirement
(iommu_is_span_boundary always returns true) and fails even if there are
many free entries in the IOMMU space.

How did it happen that we try to allocate 17 pages that don't cross
16-page boundary? The cause is in the function iommu_coalesce_chunks. This
function tries to coalesce adjacent entries in the scatterlist. The
function does several checks if it may coalesce one entry with the next,
one of those checks is this:

	if (startsg->length + dma_len > max_seg_size)
		break;

When it finishes coalescing adjacent entries, it allocates the mapping:

sg_dma_len(contig_sg) = dma_len;
dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
sg_dma_address(contig_sg) =
	PIDE_FLAG
	| (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)
	| dma_offset;

It is possible that (startsg->length + dma_len > max_seg_size) is false
(we are just near the 0x10000 max_seg_size boundary), so the funcion
decides to coalesce this entry with the next entry. When the coalescing
succeeds, the function performs
	dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
And now, because of non-zero dma_offset, dma_len is greater than 0x10000.
iommu_alloc_range (a pointer to sba_alloc_range) is called and it attempts
to allocate 17 pages for a device that must not cross 16-page boundary.

To fix the bug, we must make sure that dma_len after addition of
dma_offset and alignment doesn't cross the segment boundary. I.e. change
	if (startsg->length + dma_len > max_seg_size)
		break;
to
	if (ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > max_seg_size)
		break;

This patch makes this change (it precalculates max_seg_boundary at the
beginning of the function iommu_coalesce_chunks). I also added a check
that the mapping length doesn't exceed dma_get_seg_boundary(dev) (it is
not needed for Promise TX2+ SATA, but it may be needed for other devices
that have dma_get_seg_boundary lower than dma_get_max_seg_size).

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/parisc/iommu-helpers.h |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, s
 	struct scatterlist *contig_sg;	   /* contig chunk head */
 	unsigned long dma_offset, dma_len; /* start/len of DMA stream */
 	unsigned int n_mappings = 0;
-	unsigned int max_seg_size = dma_get_max_seg_size(dev);
+	unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
+					(unsigned)DMA_CHUNK_SIZE);
+	unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
+	if (max_seg_boundary)	/* check if the addition above didn't overflow */
+		max_seg_size = min(max_seg_size, max_seg_boundary);
 
 	while (nents > 0) {
 
@@ -138,14 +142,11 @@ iommu_coalesce_chunks(struct ioc *ioc, s
 
 			/*
 			** First make sure current dma stream won't
-			** exceed DMA_CHUNK_SIZE if we coalesce the
+			** exceed max_seg_size if we coalesce the
 			** next entry.
 			*/   
-			if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
-					    IOVP_SIZE) > DMA_CHUNK_SIZE))
-				break;
-
-			if (startsg->length + dma_len > max_seg_size)
+			if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
+				     max_seg_size))
 				break;
 
 			/*

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.kernel


csiph-web