1. 28 Nov, 2014 2 commits
  2. 26 Nov, 2014 13 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 3314bf6b
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
       "Last minute KVM/ARM fixes; even the generic change actually affects
        nothing but ARM"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn()
        arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
        arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
        arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI
        arm64: KVM: fix unmapping with 48-bit VAs
      3314bf6b
    • Mark Brown's avatar
    • Mark Brown's avatar
      13616c71
    • Ard Biesheuvel's avatar
      kvm: fix kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn() · d3fccc7e
      Ard Biesheuvel authored
      This reverts commit 85c8555f ("KVM: check for !is_zero_pfn() in
      kvm_is_mmio_pfn()") and renames the function to kvm_is_reserved_pfn.
      
      The problem being addressed by the patch above was that some ARM code
      based the memory mapping attributes of a pfn on the return value of
      kvm_is_mmio_pfn(), whose name indeed suggests that such pfns should
      be mapped as device memory.
      
      However, kvm_is_mmio_pfn() doesn't do quite what it says on the tin,
      and the existing non-ARM users were already using it in a way which
      suggests that its name should probably have been 'kvm_is_reserved_pfn'
      from the beginning, e.g., whether or not to call get_page/put_page on
      it etc. This means that returning false for the zero page is a mistake
      and the patch above should be reverted.
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      d3fccc7e
    • Ard Biesheuvel's avatar
      arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn() · bb55e9b1
      Ard Biesheuvel authored
      Instead of using kvm_is_mmio_pfn() to decide whether a host region
      should be stage 2 mapped with device attributes, add a new static
      function kvm_is_device_pfn() that disregards RAM pages with the
      reserved bit set, as those should usually not be mapped as device
      memory.
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      bb55e9b1
    • Christoffer Dall's avatar
      arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create() · 6b50f540
      Christoffer Dall authored
      If we detect another vCPU is running we just exit and return 0 as if we
      succesfully created the VGIC, but the VGIC wouldn't actual be created.
      
      This shouldn't break in-kernel behavior because the kernel will not
      observe the failed the attempt to create the VGIC, but userspace could
      be rightfully confused.
      
      Cc: Andre Przywara <andre.przywara@arm.com>
      Signed-off-by: default avatarChristoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      6b50f540
    • Christoffer Dall's avatar
      arm64: KVM: Handle traps of ICC_SRE_EL1 as RAZ/WI · db7dedd0
      Christoffer Dall authored
      When running on a system with a GICv3, we currenly don't allow the guest
      to access the system register interface of the GICv3.  We do this by
      clearing the ICC_SRE_EL2.Enable, which causes all guest accesses to
      ICC_SRE_EL1 to trap to EL2 and causes all guest accesses to other ICC_
      registers to cause an undefined exception in the guest.
      
      However, we currently don't handle the trap of guest accesses to
      ICC_SRE_EL1 and will spill out a warning.  The trap just needs to handle
      the access as RAZ/WI, and a guest that tries to prod this register and
      set ICC_SRE_EL1.SRE=1, must read back the value (which Linux already
      does) to see if it succeeded, and will thus observe that ICC_SRE_EL1.SRE
      was not set.
      
      Add the simple trap handler in the sorted table of the system registers.
      Signed-off-by: default avatarChristoffer Dall <christoffer.dall@linaro.org>
      [ardb: added cp15 handling]
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      db7dedd0
    • Mark Rutland's avatar
      arm64: KVM: fix unmapping with 48-bit VAs · 7cbb87d6
      Mark Rutland authored
      Currently if using a 48-bit VA, tearing down the hyp page tables (which
      can happen in the absence of a GICH or GICV resource) results in the
      rather nasty splat below, evidently becasue we access a table that
      doesn't actually exist.
      
      Commit 38f791a4 (arm64: KVM: Implement 48 VA support for KVM EL2
      and Stage-2) added a pgd_none check to __create_hyp_mappings to account
      for the additional level of tables, but didn't add a corresponding check
      to unmap_range, and this seems to be the source of the problem.
      
      This patch adds the missing pgd_none check, ensuring we don't try to
      access tables that don't exist.
      
      Original splat below:
      
      kvm [1]: Using HYP init bounce page @83fe94a000
      kvm [1]: Cannot obtain GICH resource
      Unable to handle kernel paging request at virtual address ffff7f7fff000000
      pgd = ffff800000770000
      [ffff7f7fff000000] *pgd=0000000000000000
      Internal error: Oops: 96000004 [#1] PREEMPT SMP
      Modules linked in:
      CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc2+ #89
      task: ffff8003eb500000 ti: ffff8003eb45c000 task.ti: ffff8003eb45c000
      PC is at unmap_range+0x120/0x580
      LR is at free_hyp_pgds+0xac/0xe4
      pc : [<ffff80000009b768>] lr : [<ffff80000009cad8>] pstate: 80000045
      sp : ffff8003eb45fbf0
      x29: ffff8003eb45fbf0 x28: ffff800000736000
      x27: ffff800000735000 x26: ffff7f7fff000000
      x25: 0000000040000000 x24: ffff8000006f5000
      x23: 0000000000000000 x22: 0000007fffffffff
      x21: 0000800000000000 x20: 0000008000000000
      x19: 0000000000000000 x18: ffff800000648000
      x17: ffff800000537228 x16: 0000000000000000
      x15: 000000000000001f x14: 0000000000000000
      x13: 0000000000000001 x12: 0000000000000020
      x11: 0000000000000062 x10: 0000000000000006
      x9 : 0000000000000000 x8 : 0000000000000063
      x7 : 0000000000000018 x6 : 00000003ff000000
      x5 : ffff800000744188 x4 : 0000000000000001
      x3 : 0000000040000000 x2 : ffff800000000000
      x1 : 0000007fffffffff x0 : 000000003fffffff
      
      Process swapper/0 (pid: 1, stack limit = 0xffff8003eb45c058)
      Stack: (0xffff8003eb45fbf0 to 0xffff8003eb460000)
      fbe0:                                     eb45fcb0 ffff8003 0009cad8 ffff8000
      fc00: 00000000 00000080 00736140 ffff8000 00736000 ffff8000 00000000 00007c80
      fc20: 00000000 00000080 006f5000 ffff8000 00000000 00000080 00743000 ffff8000
      fc40: 00735000 ffff8000 006d3030 ffff8000 006fe7b8 ffff8000 00000000 00000080
      fc60: ffffffff 0000007f fdac1000 ffff8003 fd94b000 ffff8003 fda47000 ffff8003
      fc80: 00502b40 ffff8000 ff000000 ffff7f7f fdec6000 00008003 fdac1630 ffff8003
      fca0: eb45fcb0 ffff8003 ffffffff 0000007f eb45fd00 ffff8003 0009b378 ffff8000
      fcc0: ffffffea 00000000 006fe000 ffff8000 00736728 ffff8000 00736120 ffff8000
      fce0: 00000040 00000000 00743000 ffff8000 006fe7b8 ffff8000 0050cd48 00000000
      fd00: eb45fd60 ffff8003 00096070 ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
      fd20: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00000000 00000000
      fd40: 00000ae0 00000000 006aa25c ffff8000 eb45fd60 ffff8003 0017ca44 00000002
      fd60: eb45fdc0 ffff8003 0009a33c ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
      fd80: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00735000 ffff8000
      fda0: 006d3090 ffff8000 006aa25c ffff8000 00735000 ffff8000 006d3030 ffff8000
      fdc0: eb45fdd0 ffff8003 000814c0 ffff8000 eb45fe50 ffff8003 006aaac4 ffff8000
      fde0: 006ddd90 ffff8000 00000006 00000000 006d3000 ffff8000 00000095 00000000
      fe00: 006a1e90 ffff8000 00735000 ffff8000 006d3000 ffff8000 006aa25c ffff8000
      fe20: 00735000 ffff8000 006d3030 ffff8000 eb45fe50 ffff8003 006fac68 ffff8000
      fe40: 00000006 00000006 fe293ee6 ffff8003 eb45feb0 ffff8003 004f8ee8 ffff8000
      fe60: 004f8ed4 ffff8000 00735000 ffff8000 00000000 00000000 00000000 00000000
      fe80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      fea0: 00000000 00000000 00000000 00000000 00000000 00000000 000843d0 ffff8000
      fec0: 004f8ed4 ffff8000 00000000 00000000 00000000 00000000 00000000 00000000
      fee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ff00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ff20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ff40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ff60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ff80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ffa0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000005 00000000
      ffe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      Call trace:
      [<ffff80000009b768>] unmap_range+0x120/0x580
      [<ffff80000009cad4>] free_hyp_pgds+0xa8/0xe4
      [<ffff80000009b374>] kvm_arch_init+0x268/0x44c
      [<ffff80000009606c>] kvm_init+0x24/0x260
      [<ffff80000009a338>] arm_init+0x18/0x24
      [<ffff8000000814bc>] do_one_initcall+0x88/0x1a0
      [<ffff8000006aaac0>] kernel_init_freeable+0x148/0x1e8
      [<ffff8000004f8ee4>] kernel_init+0x10/0xd4
      Code: 8b000263 92628479 d1000720 eb01001f (f9400340)
      ---[ end trace 3bc230562e926fa4 ]---
      Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
      Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Jungseok Lee <jungseoklee85@gmail.com>
      Acked-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Acked-by: default avatarChristoffer Dall <christoffer.dall@linaro.org>
      Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      7cbb87d6
    • Linus Torvalds's avatar
      Merge branch 'for-3.18' of git://linux-nfs.org/~bfields/linux · b914c5b2
      Linus Torvalds authored
      Pull nfsd bugfixes from Bruce Fields:
       "These fix one mishandling of the case when security labels are
        configured out, and two races in the 4.1 backchannel code"
      
      * 'for-3.18' of git://linux-nfs.org/~bfields/linux:
        nfsd: Fix slot wake up race in the nfsv4.1 callback code
        SUNRPC: Fix locking around callback channel reply receive
        nfsd: correctly define v4.2 support attributes
      b914c5b2
    • Linus Torvalds's avatar
      Merge git://git.kvack.org/~bcrl/aio-fixes · 277f850f
      Linus Torvalds authored
      Pull aio fix from Ben LaHaise:
       "Dirty page accounting fix for aio"
      
      * git://git.kvack.org/~bcrl/aio-fixes:
        aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer
      277f850f
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · d1ca0007
      Linus Torvalds authored
      Pull powerpc fixes from Ben Herrenschmidt:
       "This series fix a nasty issue with radeon adapters on powerpc servers,
        it's all CC'ed stable and has the relevant maintainers ack's/reviews.
      
        Basically, some (radeon) adapters have issues with MSI addresses above
        1T (only support 40-bits).  We had powerpc specific quirk but it only
        listed a specific revision of an adapter that we shipped with our
        machines and didn't properly handle the audio function which some
        distros enable nowadays.
      
        So we made the quirk generic and fixed both the graphic and audio
        drivers properly to use it.
      
        Without that, ppc64 server machines will crash at boot with a radeon
        adapter.
      
        Note: This has been brewing for a while, it just needed a last respin
        which got delayed due to us moving ozlabs to a new location in town
        and other such things taking priority"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/pci: Remove unused force_32bit_msi quirk
        powerpc/pseries: Honor the generic "no_64bit_msi" flag
        powerpc/powernv: Honor the generic "no_64bit_msi" flag
        sound/radeon: Move 64-bit MSI quirk from arch to driver
        gpu/radeon: Set flag to indicate broken 64-bit MSI
        PCI/MSI: Add device flag indicating that 64-bit MSIs don't work
        ALSA: hda - Limit 40bit DMA for AMD HDMI controllers
      d1ca0007
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v3.18-rc7' of... · a6e4a05a
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull a hwmon fix from Guenter Roeck:
       "Fix hwmon registration problem in g762 driver"
      
      * tag 'hwmon-for-linus-v3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (g762) fix call to devm_hwmon_device_register_with_groups()
      a6e4a05a
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux · a7e90924
      Linus Torvalds authored
      Pull clock fixes from Mike Turquette:
       "The fixes for the clock framework are all regressions in drivers, plus
        a single fix in one of the basic clock templates.  No fixes to the
        core this time around.
      
        As with most clock driver fixes these run the gamut from fixing a
        build warning to fixing wrecked memory timings, with a little USB
        tossed in for fun"
      
      * tag 'clk-fixes-for-linus' of https://git.linaro.org/people/mike.turquette/linux:
        clk: pxa: fix pxa27x CCCR bit usage
        clk-divider: Fix READ_ONLY when divider > 1
        clk: qcom: Fix duplicate rbcpr clock name
        clk: at91: usb: fix at91sam9x5 recalc, round and set rate
        clk: at91: usb: fix at91rm9200 round and set rate
      a7e90924
  3. 25 Nov, 2014 2 commits
  4. 24 Nov, 2014 7 commits
  5. 23 Nov, 2014 11 commits
    • Linus Torvalds's avatar
      Linux 3.18-rc6 · 5d01410f
      Linus Torvalds authored
      5d01410f
    • Andy Lutomirski's avatar
      uprobes, x86: Fix _TIF_UPROBE vs _TIF_NOTIFY_RESUME · 82975bc6
      Andy Lutomirski authored
      x86 call do_notify_resume on paranoid returns if TIF_UPROBE is set but
      not on non-paranoid returns.  I suspect that this is a mistake and that
      the code only works because int3 is paranoid.
      
      Setting _TIF_NOTIFY_RESUME in the uprobe code was probably a workaround
      for the x86 bug.  With that bug fixed, we can remove _TIF_NOTIFY_RESUME
      from the uprobes code.
      Reported-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarSrikar Dronamraju <srikar@linux.vnet.ibm.com>
      Acked-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      82975bc6
    • Thomas Gleixner's avatar
      sched: Provide update_curr callbacks for stop/idle scheduling classes · 90e362f4
      Thomas Gleixner authored
      Chris bisected a NULL pointer deference in task_sched_runtime() to
      commit 6e998916 'sched/cputime: Fix clock_nanosleep()/clock_gettime()
      inconsistency'.
      
      Chris observed crashes in atop or other /proc walking programs when he
      started fork bombs on his machine.  He assumed that this is a new exit
      race, but that does not make any sense when looking at that commit.
      
      What's interesting is that, the commit provides update_curr callbacks
      for all scheduling classes except stop_task and idle_task.
      
      While nothing can ever hit that via the clock_nanosleep() and
      clock_gettime() interfaces, which have been the target of the commit in
      question, the author obviously forgot that there are other code paths
      which invoke task_sched_runtime()
      
      do_task_stat(()
       thread_group_cputime_adjusted()
         thread_group_cputime()
           task_cputime()
             task_sched_runtime()
              if (task_current(rq, p) && task_on_rq_queued(p)) {
                update_rq_clock(rq);
                up->sched_class->update_curr(rq);
              }
      
      If the stats are read for a stomp machine task, aka 'migration/N' and
      that task is current on its cpu, this will happily call the NULL pointer
      of stop_task->update_curr.  Ooops.
      
      Chris observation that this happens faster when he runs the fork bomb
      makes sense as the fork bomb will kick migration threads more often so
      the probability to hit the issue will increase.
      
      Add the missing update_curr callbacks to the scheduler classes stop_task
      and idle_task.  While idle tasks cannot be monitored via /proc we have
      other means to hit the idle case.
      
      Fixes: 6e998916 'sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency'
      Reported-by: default avatarChris Mason <clm@fb.com>
      Reported-and-tested-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Stanislaw Gruszka <sgruszka@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      90e362f4
    • Linus Torvalds's avatar
      Merge branch 'x86-traps' (trap handling from Andy Lutomirski) · 00c89b2f
      Linus Torvalds authored
      Merge x86-64 iret fixes from Andy Lutomirski:
       "This addresses the following issues:
      
         - an unrecoverable double-fault triggerable with modify_ldt.
         - invalid stack usage in espfix64 failed IRET recovery from IST
           context.
         - invalid stack usage in non-espfix64 failed IRET recovery from IST
           context.
      
        It also makes a good but IMO scary change: non-espfix64 failed IRET
        will now report the correct error.  Hopefully nothing depended on the
        old incorrect behavior, but maybe Wine will get confused in some
        obscure corner case"
      
      * emailed patches from Andy Lutomirski <luto@amacapital.net>:
        x86_64, traps: Rework bad_iret
        x86_64, traps: Stop using IST for #SS
        x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
      00c89b2f
    • Andy Lutomirski's avatar
      x86_64, traps: Rework bad_iret · b645af2d
      Andy Lutomirski authored
      It's possible for iretq to userspace to fail.  This can happen because
      of a bad CS, SS, or RIP.
      
      Historically, we've handled it by fixing up an exception from iretq to
      land at bad_iret, which pretends that the failed iret frame was really
      the hardware part of #GP(0) from userspace.  To make this work, there's
      an extra fixup to fudge the gs base into a usable state.
      
      This is suboptimal because it loses the original exception.  It's also
      buggy because there's no guarantee that we were on the kernel stack to
      begin with.  For example, if the failing iret happened on return from an
      NMI, then we'll end up executing general_protection on the NMI stack.
      This is bad for several reasons, the most immediate of which is that
      general_protection, as a non-paranoid idtentry, will try to deliver
      signals and/or schedule from the wrong stack.
      
      This patch throws out bad_iret entirely.  As a replacement, it augments
      the existing swapgs fudge into a full-blown iret fixup, mostly written
      in C.  It's should be clearer and more correct.
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b645af2d
    • Andy Lutomirski's avatar
      x86_64, traps: Stop using IST for #SS · 6f442be2
      Andy Lutomirski authored
      On a 32-bit kernel, this has no effect, since there are no IST stacks.
      
      On a 64-bit kernel, #SS can only happen in user code, on a failed iret
      to user space, a canonical violation on access via RSP or RBP, or a
      genuine stack segment violation in 32-bit kernel code.  The first two
      cases don't need IST, and the latter two cases are unlikely fatal bugs,
      and promoting them to double faults would be fine.
      
      This fixes a bug in which the espfix64 code mishandles a stack segment
      violation.
      
      This saves 4k of memory per CPU and a tiny bit of code.
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6f442be2
    • Andy Lutomirski's avatar
      x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C · af726f21
      Andy Lutomirski authored
      There's nothing special enough about the espfix64 double fault fixup to
      justify writing it in assembly.  Move it to C.
      
      This also fixes a bug: if the double fault came from an IST stack, the
      old asm code would return to a partially uninitialized stack frame.
      
      Fixes: 3891a04aSigned-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af726f21
    • Linus Torvalds's avatar
      Merge tag 'armsoc-for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 27946315
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "A collection of fixes this week:
      
         - A set of clock fixes for shmobile platforms
         - A fix for tegra that moves serial port labels to be per board.
           We're choosing to merge this for 3.18 because the labels will start
           being parsed in 3.19, and without this change serial port numbers
           that used to be stable since the dawn of time will change numbers.
         - A few other DT tweaks for Tegra.
         - A fix for multi_v7_defconfig that makes it stop spewing cpufreq
           errors on Arndale (Exynos)"
      
      * tag 'armsoc-for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: multi_v7_defconfig: fix failure setting CPU voltage by enabling dependent I2C controller
        ARM: tegra: roth: Fix SD card VDD_IO regulator
        ARM: tegra: Remove eMMC vmmc property for roth/tn7
        ARM: dts: tegra: move serial aliases to per-board
        ARM: tegra: Add serial port labels to Tegra124 DT
        ARM: shmobile: kzm9g legacy: Set i2c clks_per_count to 2
        ARM: shmobile: r8a7740 dtsi: Correct IIC0 parent clock
        ARM: shmobile: r8a7790: Fix SD3CKCR address to device tree
        ARM: shmobile: r8a7740 legacy: Correct IIC0 parent clock
        ARM: shmobile: r8a7740 legacy: Add missing INTCA clock for irqpin module
        ARM: shmobile: r8a7790: Fix SD3CKCR address
        ARM: dts: sun6i: Re-parent ahb1_mux to pll6 as required by dma controller
      27946315
    • Linus Torvalds's avatar
      Merge branch 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu · 9f2e0f63
      Linus Torvalds authored
      Pull percpu fix from Tejun Heo:
       "This contains one patch to fix a race condition which can lead to
        percpu_ref using a percpu pointer which is corrupted with a set DEAD
        bit.  The bug was introduced while separating out the ATOMIC mode flag
        from the DEAD flag.  The fix is pretty straight forward.
      
        I just committed the patch to the percpu tree but am sending out the
        pull request early as I'll be on vacation for a week.  The patch
        should be fairly safe and while the latency will be higher I'll be
        checking emails"
      
      * 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
        percpu-ref: fix DEAD flag contamination of percpu pointer
      9f2e0f63
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · d038a63a
      Linus Torvalds authored
      Pull btrfs deadlock fix from Chris Mason:
       "This has a fix for a long standing deadlock that we've been trying to
        nail down for a while.  It ended up being a bad interaction with the
        fair reader/writer locks and the order btrfs reacquires locks in the
        btree"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs: fix lockups from btrfs_clear_path_blocking
      d038a63a
    • Tejun Heo's avatar
      percpu-ref: fix DEAD flag contamination of percpu pointer · 4aab3b5b
      Tejun Heo authored
      While decoupling ATOMIC and DEAD flags, f47ad457 ("percpu_ref:
      decouple switching to percpu mode and reinit") updated
      __ref_is_percpu() so that it only tests ATOMIC flag to determine
      whether the ref is in percpu mode or not; however, while DEAD implies
      ATOMIC, the two flags are set separately during percpu_ref_kill() and
      if __ref_is_percpu() races percpu_ref_kill(), it may see DEAD w/o
      ATOMIC.  Because __ref_is_percpu() returns @ref->percpu_count_ptr
      value verbatim as the percpu pointer after testing ATOMIC, the pointer
      may now be contaminated with the DEAD flag.
      
      This can be fixed by clearing the flag bits before returning the
      pointer which was the fix proposed by Shaohua; however, as DEAD
      implies ATOMIC, we can just test for both flags at once and avoid the
      explicit masking.
      
      Update __ref_is_percpu() so that it tests that both ATOMIC and DEAD
      are clear before returning @ref->percpu_count_ptr as the percpu
      pointer.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-and-Reviewed-by: default avatarShaohua Li <shli@kernel.org>
      Link: http://lkml.kernel.org/r/995deb699f5b873c45d667df4add3b06f73c2c25.1416638887.git.shli@kernel.org
      Fixes: f47ad457 ("percpu_ref: decouple switching to percpu mode and reinit")
      4aab3b5b
  6. 22 Nov, 2014 5 commits
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · cb954139
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single bugfix for an init order problem in the sun4i subarch
        clockevents code"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clockevent: sun4i: Fix race condition in the probe code
      cb954139
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · ecde0064
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Assorted fixes, most in overlayfs land"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        ovl: ovl_dir_fsync() cleanup
        ovl: update MAINTAINERS
        ovl: pass dentry into ovl_dir_read_merged()
        ovl: use lockless_dereference() for upperdentry
        ovl: allow filenames with comma
        ovl: fix race in private xattr checks
        ovl: fix remove/copy-up race
        ovl: rename filesystem type to "overlay"
        isofs: avoid unused function warning
        vfs: fix reference leak in d_prune_aliases()
      ecde0064
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8a84e01e
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix BUG when decrypting empty packets in mac80211, from Ronald Wahl.
      
       2) nf_nat_range is not fully initialized and this is copied back to
          userspace, from Daniel Borkmann.
      
       3) Fix read past end of b uffer in netfilter ipset, also from Dan
          Carpenter.
      
       4) Signed integer overflow in ipv4 address mask creation helper
          inet_make_mask(), from Vincent BENAYOUN.
      
       5) VXLAN, be2net, mlx4_en, and qlcnic need ->ndo_gso_check() methods to
          properly describe the device's capabilities, from Joe Stringer.
      
       6) Fix memory leaks and checksum miscalculations in openvswitch, from
          Pravin B SHelar and Jesse Gross.
      
       7) FIB rules passes back ambiguous error code for unreachable routes,
          making behavior confusing for userspace.  Fix from Panu Matilainen.
      
       8) ieee802154fake_probe() doesn't release resources properly on error,
          from Alexey Khoroshilov.
      
       9) Fix skb_over_panic in add_grhead(), from Daniel Borkmann.
      
      10) Fix access of stale slave pointers in bonding code, from Nikolay
          Aleksandrov.
      
      11) Fix stack info leak in PPP pptp code, from Mathias Krause.
      
      12) Cure locking bug in IPX stack, from Jiri Bohac.
      
      13) Revert SKB fclone memory freeing optimization that is racey and can
          allow accesses to freed up memory, from Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (71 commits)
        tcp: Restore RFC5961-compliant behavior for SYN packets
        net: Revert "net: avoid one atomic operation in skb_clone()"
        virtio-net: validate features during probe
        cxgb4 : Fix DCB priority groups being returned in wrong order
        ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
        openvswitch: Don't validate IPv6 label masks.
        pptp: fix stack info leak in pptp_getname()
        brcmfmac: don't include linux/unaligned/access_ok.h
        cxgb4i : Don't block unload/cxgb4 unload when remote closes TCP connection
        ipv6: delete protocol and unregister rtnetlink when cleanup
        net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
        bonding: fix curr_active_slave/carrier with loadbalance arp monitoring
        mac80211: minstrel_ht: fix a crash in rate sorting
        vxlan: Inline vxlan_gso_check().
        can: m_can: update to support CAN FD features
        can: m_can: fix incorrect error messages
        can: m_can: add missing delay after setting CCCR_INIT bit
        can: m_can: fix not set can_dlc for remote frame
        can: m_can: fix possible sleep in napi poll
        can: m_can: add missing message RAM initialization
        ...
      8a84e01e
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 928352e9
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Just two radeon and two intel fixes: endian and regression fixes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon: fix endian swapping in vbios fetch for tdp table
        drm/radeon: disable native backlight control on pre-r6xx asics (v2)
        drm/i915: Kick fbdev before vgacon
        drm/i915: drop WaSetupGtModeTdRowDispatch:snb
      928352e9
    • Linus Torvalds's avatar
      Merge tag 'sound-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 9a7e4f56
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This batch ended up as a relatively high volume due to pending ASoC
        fixes.  But most of fixes there are trivial and/or device- specific
        fixes and quirks, so safe to apply.  The only (ASoC) core fixes are
        the DPCM race fix and the machine-driver matching fix for
        componentization"
      
      * tag 'sound-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - fix the mic mute led problem for Latitude E5550
        ALSA: hda - move DELL_WMI_MIC_MUTE_LED to the tail in the quirk chain
        ASoC: wm_adsp: Avoid attempt to free buffers that might still be in use
        ALSA: usb-audio: Set the Control Selector to SU_SELECTOR_CONTROL for UAC2
        ALSA: usb-audio: Add ctrl message delay quirk for Marantz/Denon devices
        ASoC: sgtl5000: Fix SMALL_POP bit definition
        ASoC: cs42l51: re-hook of_match_table pointer
        ASoC: rt5670: change dapm routes of PLL connection
        ASoC: rt5670: correct the incorrect default values
        ASoC: samsung: Add MODULE_DEVICE_TABLE for Snow
        ASoC: max98090: Correct pclk divisor settings
        ASoC: dpcm: Fix race between FE/BE updates and trigger
        ASoC: Fix snd_soc_find_dai() matching component by name
        ASoC: rsnd: remove unsupported PAUSE flag
        ASoC: fsi: remove unsupported PAUSE flag
        ASoC: rt5645: Mark RT5645_TDM_CTRL_3 as readable
        ASoC: rockchip-i2s: fix infinite loop in rockchip_snd_rxctrl
        ASoC: es8328-i2c: Fix i2c_device_id name field in es8328_id
        ASoC: fsl_asrc: Add reg_defaults for regmap to fix kernel dump
      9a7e4f56