Merge 4.0-rc7 into tty-next

We want the fixes in here as well, also to help out with merge issues.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

8 files changed, 63 insertions, 17 deletions

diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 498b6d967138..258990688a5e 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -212,11 +212,11 @@ static struct event_constraint intel_hsw_event_constraints[] = {
         INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
         INTEL_EVENT_CONSTRAINT(0xcd, 0x8), /* MEM_TRANS_RETIRED.LOAD_LATENCY */
         /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
-        INTEL_EVENT_CONSTRAINT(0x08a3, 0x4),
+        INTEL_UEVENT_CONSTRAINT(0x08a3, 0x4),
         /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
-        INTEL_EVENT_CONSTRAINT(0x0ca3, 0x4),
+        INTEL_UEVENT_CONSTRAINT(0x0ca3, 0x4),
         /* CYCLE_ACTIVITY.CYCLES_NO_EXECUTE */
-        INTEL_EVENT_CONSTRAINT(0x04a3, 0xf),
+        INTEL_UEVENT_CONSTRAINT(0x04a3, 0xf),
         EVENT_CONSTRAINT_END
 };
 
@@ -1649,11 +1649,11 @@ intel_get_event_constraints(struct cpu_hw_events *cpuc, struct perf_event *event
         if (c)
                 return c;
 
-        c = intel_pebs_constraints(event);
+        c = intel_shared_regs_constraints(cpuc, event);
         if (c)
                 return c;
 
-        c = intel_shared_regs_constraints(cpuc, event);
+        c = intel_pebs_constraints(event);
         if (c)
                 return c;
 
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1d74d161687c..f0095a76c182 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -364,12 +364,21 @@ system_call_fastpath:
  * Has incomplete stack frame and undefined top of stack.
  */
 ret_from_sys_call:
-        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
-        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
-
         LOCKDEP_SYS_EXIT
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
+
+        /*
+         * We must check ti flags with interrupts (or at least preemption)
+         * off because we must *never* return to userspace without
+         * processing exit work that is enqueued if we're preempted here.
+         * In particular, returning to userspace with any of the one-shot
+         * flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
+         * very bad.
+         */
+        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
+        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
+
         CFI_REMEMBER_STATE
         /*
          * sysretq will re-enable interrupts:
@@ -386,7 +395,7 @@ ret_from_sys_call:
 
 int_ret_from_sys_call_fixup:
         FIXUP_TOP_OF_STACK %r11, -ARGOFFSET
-        jmp int_ret_from_sys_call
+        jmp int_ret_from_sys_call_irqs_off
 
         /* Do syscall tracing */
 tracesys:
@@ -432,6 +441,7 @@ tracesys_phase2:
 GLOBAL(int_ret_from_sys_call)
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
+int_ret_from_sys_call_irqs_off:
         movl $_TIF_ALLWORK_MASK,%edi
         /* edi: mask to check */
 GLOBAL(int_with_check)
@@ -789,7 +799,21 @@ retint_swapgs:		/* return to user-space */
         cmpq %r11,(EFLAGS-ARGOFFSET)(%rsp)      /* R11 == RFLAGS */
         jne opportunistic_sysret_failed
 
-        testq $X86_EFLAGS_RF,%r11               /* sysret can't restore RF */
+        /*
+         * SYSRET can't restore RF.  SYSRET can restore TF, but unlike IRET,
+         * restoring TF results in a trap from userspace immediately after
+         * SYSRET.  This would cause an infinite loop whenever #DB happens
+         * with register state that satisfies the opportunistic SYSRET
+         * conditions.  For example, single-stepping this user code:
+         *
+         *           movq $stuck_here,%rcx
+         *           pushfq
+         *           popq %r11
+         *   stuck_here:
+         *
+         * would never get past 'stuck_here'.
+         */
+        testq $(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11
         jnz opportunistic_sysret_failed
 
         /* nothing to check for RSP */
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 7ec1d5f8d283..25ecd56cefa8 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -72,7 +72,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] =
         { "bx", 8, offsetof(struct pt_regs, bx) },
         { "cx", 8, offsetof(struct pt_regs, cx) },
         { "dx", 8, offsetof(struct pt_regs, dx) },
-        { "si", 8, offsetof(struct pt_regs, dx) },
+        { "si", 8, offsetof(struct pt_regs, si) },
         { "di", 8, offsetof(struct pt_regs, di) },
         { "bp", 8, offsetof(struct pt_regs, bp) },
         { "sp", 8, offsetof(struct pt_regs, sp) },
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index bae6c609888e..86db4bcd7ce5 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -183,6 +183,16 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                 },
         },
 
+        /* ASRock */
+        {       /* Handle problems with rebooting on ASRock Q1900DC-ITX */
+                .callback = set_pci_reboot,
+                .ident = "ASRock Q1900DC-ITX",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
+                        DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
+                },
+        },
+
         /* ASUS */
         {       /* Handle problems with rebooting on ASUS P4S800 */
                 .callback = set_bios_reboot,
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index b1947e0f3e10..46d4449772bc 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -422,6 +422,7 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                         struct kvm_ioapic *ioapic, int vector, int trigger_mode)
 {
         int i;
+        struct kvm_lapic *apic = vcpu->arch.apic;
 
         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
                 union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
@@ -443,7 +444,8 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
                 spin_lock(&ioapic->lock);
 
-                if (trigger_mode != IOAPIC_LEVEL_TRIG)
+                if (trigger_mode != IOAPIC_LEVEL_TRIG ||
+                    kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI)
                         continue;
 
                 ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index bd4e34de24c7..4ee827d7bf36 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -833,8 +833,7 @@ int kvm_apic_compare_prio(struct kvm_vcpu *vcpu1, struct kvm_vcpu *vcpu2)
 
 static void kvm_ioapic_send_eoi(struct kvm_lapic *apic, int vector)
 {
-        if (!(kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI) &&
-            kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
+        if (kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
                 int trigger_mode;
                 if (apic_test_vector(vector, apic->regs + APIC_TMR))
                         trigger_mode = IOAPIC_LEVEL_TRIG;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 10a481b7674d..ae4f6d35d19c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2479,8 +2479,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
         if (enable_ept) {
                 /* nested EPT: emulate EPT also to L1 */
                 vmx->nested.nested_vmx_secondary_ctls_high |=
-                        SECONDARY_EXEC_ENABLE_EPT |
-                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
+                        SECONDARY_EXEC_ENABLE_EPT;
                 vmx->nested.nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
                          VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
                          VMX_EPT_INVEPT_BIT;
@@ -2494,6 +2493,10 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
         } else
                 vmx->nested.nested_vmx_ept_caps = 0;
 
+        if (enable_unrestricted_guest)
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
+
         /* miscellaneous data */
         rdmsr(MSR_IA32_VMX_MISC,
                 vmx->nested.nested_vmx_misc_low,
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 9f93af56a5fc..b47124d4cd67 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -91,6 +91,12 @@ EXPORT_SYMBOL_GPL(xen_p2m_size);
 unsigned long xen_max_p2m_pfn __read_mostly;
 EXPORT_SYMBOL_GPL(xen_max_p2m_pfn);
 
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#else
+#define P2M_LIMIT 0
+#endif
+
 static DEFINE_SPINLOCK(p2m_update_lock);
 
 static unsigned long *p2m_mid_missing_mfn;
@@ -385,9 +391,11 @@ static void __init xen_rebuild_p2m_list(unsigned long *p2m)
 void __init xen_vmalloc_p2m_tree(void)
 {
         static struct vm_struct vm;
+        unsigned long p2m_limit;
 
+        p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE;
         vm.flags = VM_ALLOC;
-        vm.size = ALIGN(sizeof(unsigned long) * xen_max_p2m_pfn,
+        vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit),
                         PMD_SIZE * PMDS_PER_MID_PAGE);
         vm_area_register_early(&vm, PMD_SIZE * PMDS_PER_MID_PAGE);
         pr_notice("p2m virtual area at %p, size is %lx\n", vm.addr, vm.size);