{"push_id":1094500279,"size":364,"distinct_size":0,"ref":"refs/heads/caf/3.10/caf/linaro/linux-linaro-stable/linux-linaro-lsk-v3.18-android","head":"a79bee58f4fc3cc237fc86667edf2d0b9dce0173","before":"864b6e70253ae07b58bb126d29a35be22f50f453","commits":[{"sha":"3cd0bea64f469daaad760b8c05ced3494e44a893","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"wext: fix message delay/ordering\n\n[ Upstream commit 8bf862739a7786ae72409220914df960a0aa80d8 ]\n\nBeniamino reported that he was getting an RTM_NEWLINK message for a\ngiven interface, after the RTM_DELLINK for it. It turns out that the\nmessage is a wireless extensions message, which was sent because the\ninterface had been connected and disconnection while it was deleted\ncaused a wext message.\n\nFor its netlink messages, wext uses RTM_NEWLINK, but the message is\nwithout all the regular rtnetlink attributes, so \"ip monitor link\"\nprints just rudimentary information:\n\n5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\nDeleted 5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\n5: wlan1: <BROADCAST,MULTICAST,UP>\n    link/ether\n(from my hwsim reproduction)\n\nThis can cause userspace to get confused since it doesn't expect an\nRTM_NEWLINK message after RTM_DELLINK.\n\nThe reason for this is that wext schedules a worker to send out the\nmessages, and the scheduling delay can cause the messages to get out\nto userspace in different order.\n\nTo fix this, have wext register a netdevice notifier and flush out\nany pending messages when netdevice state changes. This fixes any\nordering whenever the original message wasn't sent by a notifier\nitself.\n\nCc: stable@vger.kernel.org\nReported-by: Beniamino Galvani <bgalvani@redhat.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/3cd0bea64f469daaad760b8c05ced3494e44a893"},{"sha":"103ed77bd8c215adf4894160ced9e92430b793ab","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"cfg80211/wext: fix message ordering\n\n[ Upstream commit cb150b9d23be6ee7f3a0fff29784f1c5b5ac514d ]\n\nSince cfg80211 frequently takes actions from its netdev notifier\ncall, wireless extensions messages could still be ordered badly\nsince the wext netdev notifier, since wext is built into the\nkernel, runs before the cfg80211 netdev notifier. For example,\nthe following can happen:\n\n5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\n5: wlan1: <BROADCAST,MULTICAST,UP>\n    link/ether\n\nwhen setting the interface down causes the wext message.\n\nTo also fix this, export the wireless_nlevent_flush() function\nand also call it from the cfg80211 notifier.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/103ed77bd8c215adf4894160ced9e92430b793ab"},{"sha":"9fea93e6f0ffb4b9f9f852e66720852a3a8cf06d","author":{"email":"127a166a10ede851f230a37146bc5ea8eb3dfca9@gmail.com","name":"Chris Bainbridge"},"message":"mac80211: fix use of uninitialised values in RX aggregation\n\n[ Upstream commit f39ea2690bd61efec97622c48323f40ed6e16317 ]\n\nUse kzalloc instead of kmalloc for struct tid_ampdu_rx to\ninitialize the \"removed\" field (all others are initialized\nmanually). That fixes:\n\nUBSAN: Undefined behaviour in net/mac80211/rx.c:932:29\nload of value 2 is not a valid value for type '_Bool'\nCPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265\nWorkqueue: phy0 rt2x00usb_work_rxdone\n 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007\n ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500\n ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032\nCall Trace:\n [<ffffffff8181d866>] dump_stack+0x45/0x5f\n [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40\n [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70\n [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730\n [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00\n [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750\n [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990\n\nWhile at it, convert to use sizeof(*tid_agg_rx) instead.\n\nFixes: 788211d81bfdf (\"mac80211: fix RX A-MPDU session reorder timer deletion\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>\n[reword commit message, use sizeof(*tid_agg_rx)]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/9fea93e6f0ffb4b9f9f852e66720852a3a8cf06d"},{"sha":"8d6519ee0630070cdde63df5f75e2b5d4c83ea9e","author":{"email":"30d0a3ea07b25a90f61a738417c75a14d6abc5ff@intel.com","name":"Liad Kaufman"},"message":"iwlwifi: mvm: inc pending frames counter also when txing non-sta\n\n[ Upstream commit fb896c44f88a75843a072cd6961b1615732f7811 ]\n\nUntil this patch, when TXing non-sta the pending_frames counter\nwasn't increased, but it WAS decreased in\niwl_mvm_rx_tx_cmd_single(), what makes it negative in certain\nconditions. This in turn caused much trouble when we need to\nremove the station since we won't be waiting forever until\npending_frames gets 0. In certain cases, we were exhausting\nthe station table even in BSS mode, because we had a lot of\nstale stations.\n\nIncrease the counter also in iwl_mvm_tx_skb_non_sta() after a\nsuccessful TX to avoid this outcome.\n\nCC: <stable@vger.kernel.org> [3.18+]\nSigned-off-by: Liad Kaufman <liad.kaufman@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8d6519ee0630070cdde63df5f75e2b5d4c83ea9e"},{"sha":"cd9cd1897ee4a25d347f487931d79d2d8694e52f","author":{"email":"118ed6118e893d16e8c6e0776e0ebc290952c897@openwrt.org","name":"Felix Fietkau"},"message":"mac80211: minstrel_ht: set default tx aggregation timeout to 0\n\n[ Upstream commit 7a36b930e6ed4702c866dc74a5ad07318a57c688 ]\n\nThe value 5000 was put here with the addition of the timeout field to\nieee80211_start_tx_ba_session. It was originally added in mac80211 to\nsave resources for drivers like iwlwifi, which only supports a limited\nnumber of concurrent aggregation sessions.\n\nSince iwlwifi does not use minstrel_ht and other drivers don't need\nthis, 0 is a better default - especially since there have been\nrecent reports of aggregation setup related issues reproduced with\nath9k. This should improve stability without causing any adverse\neffects.\n\nCc: stable@vger.kernel.org\nAcked-by: Avery Pennarun <apenwarr@gmail.com>\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/cd9cd1897ee4a25d347f487931d79d2d8694e52f"},{"sha":"bb431546329c853234bd5e2c5be83bbbcfbbdf45","author":{"email":"0706025b2bbcec1ed8d64822f4eccd96314938d0@schneidersoft.net","name":"Maximilain Schneider"},"message":"can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()\n\n[ Upstream commit e9a2d81b1761093386a0bb8a4f51642ac785ef63 ]\n\ngs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is\nallocated through alloc_candev() and should instead be freed using\nfree_candev() alone.\n\nThe inappropriate use of kfree() causes the kernel to hang when\ngs_destroy_candev() is called.\n\nOnly the struct gs_usb * which is allocated through kzalloc() should be freed\nusing kfree() when the device is disconnected.\n\nSigned-off-by: Maximilian Schneider <max@schneidersoft.net>\nCc: linux-stable <stable@vger.kernel.org>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/bb431546329c853234bd5e2c5be83bbbcfbbdf45"},{"sha":"d6a1481f7411425041271c3084f3c2e399dc6526","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ASoC: wm8958: Fix enum ctl accesses in a wrong type\n\n[ Upstream commit d0784829ae3b0beeb69b476f017d5c8a2eb95198 ]\n\n\"MBC Mode\", \"VSS Mode\", \"VSS HPF Mode\" and \"Enhanced EQ Mode\" ctls in\nwm8958 codec driver are enum, while the current driver accesses\nwrongly via value.integer.value[].  They have to be via\nvalue.enumerated.item[] instead.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/d6a1481f7411425041271c3084f3c2e399dc6526"},{"sha":"8ace594ea7c69d8da65f0d056030a0cb6fdc4c81","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ASoC: wm8994: Fix enum ctl accesses in a wrong type\n\n[ Upstream commit 8019c0b37cd5a87107808300a496388b777225bf ]\n\nThe DRC Mode like \"AIF1DRC1 Mode\" and EQ Mode like \"AIF1.1 EQ Mode\" in\nwm8994 codec driver are enum ctls, while the current driver accesses\nwrongly via value.integer.value[].  They have to be via\nvalue.enumerated.item[] instead.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8ace594ea7c69d8da65f0d056030a0cb6fdc4c81"},{"sha":"0e774b0d3d6c8f2c85b7e66bb7fdacdf065da7ee","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ASoC: wm_adsp: Fix enum ctl accesses in a wrong type\n\n[ Upstream commit 15c665700bf6f4543f003ac0fbb1e9ec692e93f2 ]\n\nThe firmware ctls like \"DSP1 Firmware\" in wm_adsp codec driver are\nenum, while the current driver accesses wrongly via\nvalue.integer.value[].  They have to be via value.enumerated.item[]\ninstead.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/0e774b0d3d6c8f2c85b7e66bb7fdacdf065da7ee"},{"sha":"1c767580d56097105f1e45bc9b71582599ea5638","author":{"email":"60fc0a3d472aaa2d436c869c504a67f76c906ae8@qca.qualcomm.com","name":"Jouni Malinen"},"message":"mac80211: Fix Public Action frame RX in AP mode\n\n[ Upstream commit 1ec7bae8bec9b72e347e01330c745ab5cdd66f0e ]\n\nPublic Action frames use special rules for how the BSSID field (Address\n3) is set. A wildcard BSSID is used in cases where the transmitter and\nrecipient are not members of the same BSS. As such, we need to accept\nPublic Action frames with wildcard BSSID.\n\nCommit db8e17324553 (\"mac80211: ignore frames between TDLS peers when\noperating as AP\") added a rule that drops Action frames to TDLS-peers\nbased on an Action frame having different DA (Address 1) and BSSID\n(Address 3) values. This is not correct since it misses the possibility\nof BSSID being a wildcard BSSID in which case the Address 1 would not\nnecessarily match.\n\nFix this by allowing mac80211 to accept wildcard BSSID in an Action\nframe when in AP mode.\n\nFixes: db8e17324553 (\"mac80211: ignore frames between TDLS peers when operating as AP\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jouni Malinen <jouni@qca.qualcomm.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/1c767580d56097105f1e45bc9b71582599ea5638"},{"sha":"c190fea9a4f9669b424b6cbacc8b463574dd754f","author":{"email":"dfad0e692183c1ae7d422bbf3a74e00f039f360a@intel.com","name":"Rui Wang"},"message":"ovl: fix getcwd() failure after unsuccessful rmdir\n\n[ Upstream commit ce9113bbcbf45a57c082d6603b9a9f342be3ef74 ]\n\novl_remove_upper() should do d_drop() only after it successfully\nremoves the dir, otherwise a subsequent getcwd() system call will\nfail, breaking userspace programs.\n\nThis is to fix: https://bugzilla.kernel.org/show_bug.cgi?id=110491\n\nSigned-off-by: Rui Wang <rui.y.wang@intel.com>\nReviewed-by: Konstantin Khlebnikov <koct9i@gmail.com>\nSigned-off-by: Miklos Szeredi <miklos@szeredi.hu>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/c190fea9a4f9669b424b6cbacc8b463574dd754f"},{"sha":"a91db6218af2ecc7ae69ec6e40b9f53edb816577","author":{"email":"313328defca653cd422fb17d20c38cc0fb4b890b@gmail.com","name":"Konstantin Khlebnikov"},"message":"ovl: copy new uid/gid into overlayfs runtime inode\n\n[ Upstream commit b81de061fa59f17d2730aabb1b84419ef3913810 ]\n\nOverlayfs must update uid/gid after chown, otherwise functions\nlike inode_owner_or_capable() will check user against stale uid.\nCatched by xfstests generic/087, it chowns file and calls utimes.\n\nSigned-off-by: Konstantin Khlebnikov <koct9i@gmail.com>\nSigned-off-by: Miklos Szeredi <miklos@szeredi.hu>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/a91db6218af2ecc7ae69ec6e40b9f53edb816577"},{"sha":"a302f98efd169ea0df9ee876b92cebcfcc0a8e4f","author":{"email":"978acd1567d5598152161fdf8bf3ca568f950c9b@linux-iscsi.org","name":"Nicholas Bellinger"},"message":"target: Drop incorrect ABORT_TASK put for completed commands\n\n[ Upstream commit 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d ]\n\nThis patch fixes a recent ABORT_TASK regression associated\nwith commit febe562c, where a left-over target_put_sess_cmd()\nwould still be called when __target_check_io_state() detected\na command has already been completed, and explicit ABORT must\nbe avoided.\n\nNote commit febe562c dropped the local kref_get_unless_zero()\ncheck in core_tmr_abort_task(), but did not drop this extra\ncorresponding target_put_sess_cmd() in the failure path.\n\nSo go ahead and drop this now bogus target_put_sess_cmd(),\nand avoid this potential use-after-free.\n\nReported-by: Dan Lane <dracodan@gmail.com>\nCc: Quinn Tran <quinn.tran@qlogic.com>\nCc: Himanshu Madhani <himanshu.madhani@qlogic.com>\nCc: Sagi Grimberg <sagig@mellanox.com>\nCc: Christoph Hellwig <hch@lst.de>\nCc: Hannes Reinecke <hare@suse.de>\nCc: Andy Grover <agrover@redhat.com>\nCc: Mike Christie <mchristi@redhat.com>\nCc: stable@vger.kernel.org # 3.14+\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/a302f98efd169ea0df9ee876b92cebcfcc0a8e4f"},{"sha":"2497fc12b9810c7afac1c8c7e019079dd0bd632b","author":{"email":"c5344daf2e7bda9dbffd8e6718db2d989f7f4819@ti.com","name":"Mugunthan V N"},"message":"ARM: dts: dra7: Add CPSW and MDIO module nodes for dra7\n\n[ Upstream commit ef9c5b690079233a042887cd07279aac5ec692a8 ]\n\nAdd CPSW and MDIO related device tree data for DRA7XX and made as status\ndisabled. Phy-id, pinmux for active and sleep state needs to be added in\nboard dts files and enable the CPSW device.\n\nSigned-off-by: Mugunthan V N <mugunthanvnm@ti.com>\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/2497fc12b9810c7afac1c8c7e019079dd0bd632b"},{"sha":"05ec9a3e09d5d076f028ff491d20dde6bd679ccb","author":{"email":"c5344daf2e7bda9dbffd8e6718db2d989f7f4819@ti.com","name":"Mugunthan V N"},"message":"ARM: dts: dra7: do not gate cpsw clock due to errata i877\n\n[ Upstream commit 0f514e690740e54815441a87708c3326f8aa8709 ]\n\nErrata id: i877\n\nDescription:\n------------\nThe RGMII 1000 Mbps Transmit timing is based on the output clock\n(rgmiin_txc) being driven relative to the rising edge of an internal\nclock and the output control/data (rgmiin_txctl/txd) being driven relative\nto the falling edge of an internal clock source. If the internal clock\nsource is allowed to be static low (i.e., disabled) for an extended period\nof time then when the clock is actually enabled the timing delta between\nthe rising edge and falling edge can change over the lifetime of the\ndevice. This can result in the device switching characteristics degrading\nover time, and eventually failing to meet the Data Manual Delay Time/Skew\nspecs.\nTo maintain RGMII 1000 Mbps IO Timings, SW should minimize the\nduration that the Ethernet internal clock source is disabled. Note that\nthe device reset state for the Ethernet clock is \"disabled\".\nOther RGMII modes (10 Mbps, 100Mbps) are not affected\n\nWorkaround:\n-----------\nIf the SoC Ethernet interface(s) are used in RGMII mode at 1000 Mbps,\nSW should minimize the time the Ethernet internal clock source is disabled\nto a maximum of 200 hours in a device life cycle. This is done by enabling\nthe clock as early as possible in IPL (QNX) or SPL/u-boot (Linux/Android)\nby setting the register CM_GMAC_CLKSTCTRL[1:0]CLKTRCTRL = 0x2:SW_WKUP.\n\nSo, do not allow to gate the cpsw clocks using ti,no-idle property in\ncpsw node assuming 1000 Mbps is being used all the time. If someone does\nnot need 1000 Mbps and wants to gate clocks to cpsw, this property needs\nto be deleted in their respective board files.\n\nSigned-off-by: Mugunthan V N <mugunthanvnm@ti.com>\nSigned-off-by: Grygorii Strashko <grygorii.strashko@ti.com>\nSigned-off-by: Lokesh Vutla <lokeshvutla@ti.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Paul Walmsley <paul@pwsan.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/05ec9a3e09d5d076f028ff491d20dde6bd679ccb"},{"sha":"c518a1b39eda7356aebfd514cd8164ed909d995f","author":{"email":"19a0ba370c443ba08d20b5061586430ab449ee8c@samba.org","name":"Paul Mackerras"},"message":"KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit\n\n[ Upstream commit ccec44563b18a0ce90e2d4f332784b3cb25c8e9c ]\n\nThomas Huth discovered that a guest could cause a hard hang of a\nhost CPU by setting the Instruction Authority Mask Register (IAMR)\nto a suitable value.  It turns out that this is because when the\ncode was added to context-switch the new special-purpose registers\n(SPRs) that were added in POWER8, we forgot to add code to ensure\nthat they were restored to a sane value on guest exit.\n\nThis adds code to set those registers where a bad value could\ncompromise the execution of the host kernel to a suitable neutral\nvalue on guest exit.\n\nCc: stable@vger.kernel.org # v3.14+\nFixes: b005255e12a3\nReported-by: Thomas Huth <thuth@redhat.com>\nReviewed-by: David Gibson <david@gibson.dropbear.id.au>\nSigned-off-by: Paul Mackerras <paulus@samba.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/c518a1b39eda7356aebfd514cd8164ed909d995f"},{"sha":"306cc4da64fe0782ab5a984e888e7476be268d6d","author":{"email":"e4aea3f2c531804c57884e1d444a6744efb5af4d@redhat.com","name":"Radim Krčmář"},"message":"KVM: VMX: disable PEBS before a guest entry\n\n[ Upstream commit 7099e2e1f4d9051f31bbfa5803adf954bb5d76ef ]\n\nLinux guests on Haswell (and also SandyBridge and Broadwell, at least)\nwould crash if you decided to run a host command that uses PEBS, like\n  perf record -e 'cpu/mem-stores/pp' -a\n\nThis happens because KVM is using VMX MSR switching to disable PEBS, but\nSDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it\nisn't safe:\n  When software needs to reconfigure PEBS facilities, it should allow a\n  quiescent period between stopping the prior event counting and setting\n  up a new PEBS event. The quiescent period is to allow any latent\n  residual PEBS records to complete its capture at their previously\n  specified buffer address (provided by IA32_DS_AREA).\n\nThere might not be a quiescent period after the MSR switch, so a CPU\nends up using host's MSR_IA32_DS_AREA to access an area in guest's\nmemory.  (Or MSR switching is just buggy on some models.)\n\nThe guest can learn something about the host this way:\nIf the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results\nin #PF where we leak host's MSR_IA32_DS_AREA through CR2.\n\nAfter that, a malicious guest can map and configure memory where\nMSR_IA32_DS_AREA is pointing and can therefore get an output from\nhost's tracing.\n\nThis is not a critical leak as the host must initiate with PEBS tracing\nand I have not been able to get a record from more than one instruction\nbefore vmentry in vmx_vcpu_run() (that place has most registers already\noverwritten with guest's).\n\nWe could disable PEBS just few instructions before vmentry, but\ndisabling it earlier shouldn't affect host tracing too much.\nWe also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that\noptimization isn't worth its code, IMO.\n\n(If you are implementing PEBS for guests, be sure to handle the case\n where both host and guest enable PEBS, because this patch doesn't.)\n\nFixes: 26a4f3c08de4 (\"perf/x86: disable PEBS on a guest entry.\")\nCc: <stable@vger.kernel.org>\nReported-by: Jiří Olša <jolsa@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/306cc4da64fe0782ab5a984e888e7476be268d6d"},{"sha":"a077ab0b8d5e9da786a89667ce7ae7e396655b56","author":{"email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com","name":"Alex Deucher"},"message":"Revert \"drm/radeon/pm: adjust display configuration after powerstate\"\n\n[ Upstream commit d74e766e1916d0e09b86e4b5b9d0f819628fd546 ]\n\nThis reverts commit 39d4275058baf53e89203407bf3841ff2c74fa32.\n\nThis caused a regression on some older hardware.\n\nbug:\nhttps://bugzilla.kernel.org/show_bug.cgi?id=113891\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/a077ab0b8d5e9da786a89667ce7ae7e396655b56"},{"sha":"3a4377e41c203bd62b26c2962d3b0bec2c8d1ed9","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt (Red Hat)"},"message":"tracing: Fix check for cpu online when event is disabled\n\n[ Upstream commit dc17147de328a74bbdee67c1bf37d2f1992de756 ]\n\nCommit f37755490fe9b (\"tracepoints: Do not trace when cpu is offline\") added\na check to make sure that tracepoints only get called when the cpu is\nonline, as it uses rcu_read_lock_sched() for protection.\n\nCommit 3a630178fd5f3 (\"tracing: generate RCU warnings even when tracepoints\nare disabled\") added lockdep checks (including rcu checks) for events that\nare not enabled to catch possible RCU issues that would only be triggered if\na trace event was enabled. Commit f37755490fe9b only stopped the warnings\nwhen the trace event was enabled but did not prevent warnings if the trace\nevent was called when disabled.\n\nTo fix this, the cpu online check is moved to where the condition is added\nto the trace event. This will place the cpu online check in all places that\nit may be used now and in the future.\n\nCc: stable@vger.kernel.org # v3.18+\nFixes: f37755490fe9b (\"tracepoints: Do not trace when cpu is offline\")\nFixes: 3a630178fd5f3 (\"tracing: generate RCU warnings even when tracepoints are disabled\")\nReported-by: Sudeep Holla <sudeep.holla@arm.com>\nTested-by: Sudeep Holla <sudeep.holla@arm.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/3a4377e41c203bd62b26c2962d3b0bec2c8d1ed9"},{"sha":"5a5e080e815ec7f2d4ffb7568e23c13dd39093a6","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"ld-version: Fix awk regex compile failure\n\n[ Upstream commit 4b7b1ef2c2f83d702272555e8adb839a50ba0f8e ]\n\nThe ld-version.sh script fails on some versions of awk with the\nfollowing error, resulting in build failures for MIPS:\n\nawk: scripts/ld-version.sh: line 4: regular expression compile failed (missing '(')\n\nThis is due to the regular expression \".*)\", meant to strip off the\nbeginning of the ld version string up to the close bracket, however\nbrackets have a meaning in regular expressions, so lets escape it so\nthat awk doesn't expect a corresponding open bracket.\n\nFixes: ccbef1674a15 (\"Kbuild, lto: add ld-version and ld-ifversion ...\")\nReported-by: Geert Uytterhoeven <geert@linux-m68k.org>\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nTested-by: Michael S. Tsirkin <mst@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nTested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>\nCc: Michal Marek <mmarek@suse.com>\nCc: Andi Kleen <ak@linux.intel.com>\nCc: Geert Uytterhoeven <geert@linux-m68k.org>\nCc: linux-mips@linux-mips.org\nCc: linux-kbuild@vger.kernel.org\nCc: linux-kernel@vger.kernel.org\nCc: stable@vger.kernel.org # 4.4.x-\nPatchwork: https://patchwork.linux-mips.org/patch/12838/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/5a5e080e815ec7f2d4ffb7568e23c13dd39093a6"}]}