Pull MIPS fixes from Ralf Baechle:
- Fix bitrot in __get_user_unaligned()
- EVA userspace accessor bug fixes.
- Fix for build issues with certain toolchains.
- Fix build error for VDSO with particular toolchain versions.
- Fix build error due to a variable that should have been removed by an
earlier patch
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
MIPS: Fix bitrot in __get_user_unaligned()
MIPS: Fix build error due to unused variables.
MIPS: VDSO: Fix build error
MIPS: CPS: drop .set mips64r2 directives
MIPS: uaccess: Take EVA into account in [__]clear_user
MIPS: uaccess: Take EVA into account in __copy_from_user()
MIPS: uaccess: Fix strlen_user with EVA
A handful of fixes for OMAP, i.MX, Allwinner and Tegra:
- A clock rate and a PHY setup fix for i.MX6Q/DL
- A couple of fixes for the reduced serial bus (sunxi-rsb) on Allwinner
- UART wakeirq fix for an OMAP4 board, timer config fixes for AM43XX.
- Suspend fix for Tegra124 Chromebooks
- Fix for missing implicit include that's different between ARM/ARM64
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWgDAQAAoJEIwa5zzehBx3muAP/RJD+oERDw/XiBSCl4k4kvTZ
M4ep2ExO/GPXewKXyK7rlbNWMitBwttdT5OmXuuxT7BA/ODAGk90uvZSebIHRxkh
bqnt+3njeR3M6FrTp6Np+yCh3I0hLYJoRInV3Vh8XQcml0LobIIq2BbdahIg/2JO
sSDLAzJSR15CfnnKOSexvfRFoslLaKG0ffbxmR32HiMgnbq8ZfkRr7fANsrXTzoX
oHxEV0uQXBY0d1TQ71rT/4KdTKN9QsdJI6xAjUGH95MYu+ZE0DEnW/wodd/f4e+p
dyV+qoS2LHJnhYgJho3r19icM0iyNRm0Yt0GqP7ERN/y5GGa41slE9eThMG7WQ4h
Ot5DEF2GmP7tSYhp4pqEeLqHnfou9+WzxxNP6wxGceqlg9EPuPRtzdCPStZYW4rD
6+SQCvFs0vHZlEbbAfQLhRgDpvr9enGjCcWm6ntUcgwxFy0CPmRV9g5gIeipZOwi
QfJM233tudUkDQxJYrCEgKxHy3a7T3K9LgYMM0VO1JRAEpaPIBmxZ0A+Y84WJbTE
7r+r3eDC8RFF3bLbNRb/Ogt5OHOQUdElhRXcyz/BYA/X4HOT4wyVNM12aBlmW9uN
aDB4HWE2lKV/h2pxWRR1Hem1NHYRUpcdVzkwRvncDHnxCAmb82BE2x1Ub3+fqa0v
f0eO7GjUDRdPsQXn0zZn
=kNRV
-----END PGP SIGNATURE-----
Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Olof Johansson:
"A smallish set of fixes that we've been sitting on for a while now,
flushing the queue here so they go in. Summary:
A handful of fixes for OMAP, i.MX, Allwinner and Tegra:
- A clock rate and a PHY setup fix for i.MX6Q/DL
- A couple of fixes for the reduced serial bus (sunxi-rsb) on
Allwinner
- UART wakeirq fix for an OMAP4 board, timer config fixes for AM43XX.
- Suspend fix for Tegra124 Chromebooks
- Fix for missing implicit include that's different between
ARM/ARM64"
* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
ARM: tegra: Fix suspend hang on Tegra124 Chromebooks
bus: sunxi-rsb: Fix peripheral IC mapping runtime address
bus: sunxi-rsb: Fix primary PMIC mapping hardware address
ARM: dts: Fix UART wakeirq for omap4 duovero parlor
ARM: OMAP2+: AM43xx: select ARM TWD timer
ARM: OMAP2+: am43xx: enable GENERIC_CLOCKEVENTS_BROADCAST
fsl-ifc: add missing include on ARM64
ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dl
bus: sunxi-rsb: unlock on error in sunxi_rsb_read()
ARM: dts: sunxi: sun6i-a31s-primo81.dts: add touchscreen axis swapping property
Fix a double mutex_unlock() issue where acpi_initialize_debugger() is
called with the mutex already unlocked.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The copy_to/from_user() functions don't return error codes, they return
the number of bytes remaining. We had intended to return -EFUALT here.
We actually have already checked access_ok() in an earlier function so
I don't think these functions will fail but let's fix it anyway.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
"count" is unsigned so checking for less than zero here causes a static
checker warning. And really it's better to let the access_ok() check
fail if the user passes in a NULL "buf" pointer because -EFAULT is the
correct error code.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
There is one line of code, executed out of locking due to rebase mistakes.
This patch fixes this issue.
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
- Fix a thermal management issue introduced by an ACPI processor
driver change made during the 4.3 development cycle that failed
to return 0 from a function on success which triggered an error
cleanup path every time it had been called that deleted useful
data structures created previously (Srinivas Pandruvada).
- Fix a variable data type issue in the arm_big_little cpufreq
driver's SCPI support code added recently that prevents error
handling in there from working correctly (Dan Carpenter).
/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABCAAGBQJWfw6ZAAoJEILEb/54YlRx77gQAIvjyqOhl/r/mRHsYuOvgh/G
wjpgg93K+/95auN+qldD24h228eBP3y/QEJK/aO5ZATXHXOmkBU5vEXIGzWx6bph
BZUMWsY4h/hY86tUrWrJTMkYe8HXvxZnZZ1QUtxz/+XpoaqRvl+X0v0ERcW/RWsC
04zX9cNKWZd6ya7aDZJPEDC7R2JkvD1Ok/LCwPWVQf/M0k+kv2n9LeZ8IglMigjI
9/Qy7vh0ybcqgXYPAVOPrEOQT5+jqpQ0VB6nqeDJAym7NALxYQGUq09uBfXGm/Bd
AKhXBqiR12A4PlslwMGRTFj7YVTsm+tNP1uJNQ1jXmMAnKPURdm0OAfEUj3FQlpd
1JXcqZv5UdMnoh9XIPkEMvnNUKWCr43OZieRVJxQJb/vszRxcANRO7hSERopCEg5
imnT/MgcezIpydYIgD2t1TXE14vmBszOehcP5MBW8a9EoiRHR2rvqM2/GymJPaEo
IMNqodEffXQPmDrdtrn4T8Av2RTHyYNldr8c9TENUETxucY72hOYSSjrwI5ALHMm
u83z2ZdhiPAw3LYqF3azx1wsr+hUrA36H/8ATuE0gJNdQwhO/m1iChQaG3QYG1iZ
7y9HRA16tJhu8hCYWjtQeZ9PN8MpZA9nh0WNYnymImN6icEAzNwe83OGWJi2tpTm
kbvt2QkdTDBZDlPX6VP1
=s+R5
-----END PGP SIGNATURE-----
Merge tag 'pm+acpi-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management and ACPI fixes from Rafael Wysocki:
"These fix an ACPI processor driver regression introduced during the
4.3 cycle and a mistake in the recently added SCPI support in the
arm_big_little cpufreq driver.
Specifics:
- Fix a thermal management issue introduced by an ACPI processor
driver change made during the 4.3 development cycle that failed to
return 0 from a function on success which triggered an error
cleanup path every time it had been called that deleted useful data
structures created previously (Srinivas Pandruvada).
- Fix a variable data type issue in the arm_big_little cpufreq
driver's SCPI support code added recently that prevents error
handling in there from working correctly (Dan Carpenter)"
* tag 'pm+acpi-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
cpufreq: scpi-cpufreq: signedness bug in scpi_get_dvfs_info()
ACPI / processor: Fix thermal cooling device regression
Fix a regression which causes reshape to not start properly
sometimes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJWe2M0AAoJEDnsnt1WYoG5NmEQAIUUMJ632WW98bWzWiuD3tWe
698jML87O/5JZ796RPF2xVmYqQsJXj8i0157/ncHhmxnszI+yu7iHMnbt5LEesOG
5/p4dnKXxjao6NnTFHdIWT4SAamj9KsLDb9M+ZCkYZIHJpeNC8uLO7mZB5cszOuy
rXC5WLs4s4GrkZirnUlYLux89ZG7Xwp/1K7ccYrilbCJGk3mDqk/cLO2Jid6wUHD
QbK2gw1sg2TK8jy5RX3+BMnk46P/Tlp061eoBjyHeI5oJZiwHuHQKbJ236py7u/k
erjpfzrWNddrqbsBzVf1xw56KwvxpGoivvXLn4gGDogfeZ0eKarG5PrZ3zN9K6Ij
gIz1gfIwZYq4N+46wDJpdG+By4tg8BGYzn8YiEHnI8Ouvfts85i/KdmfeeUBQEv1
sk7yC75duKQOL5xyEPBorouVb/5C5sUpYl8c4B0F+baRYfh+aepD5Jn40dWTzvUC
eA65NFuvSOe7IYpNdzQZOzcwxLMu4gLqQOpoAzmVJI6s9NLA+f+EHhpHNuTqwWbm
G5mwnnFyZiwN21AC+ix+Otr/7+WIRvblmcuNqqk/t5QX0yGIGIvykBN1YQ10Cstk
f2RHGZCtcl0vOhyFwXm4j5rpinkJLoDMU14G1hAYGRJMvItuuDDeG+Vl9KaxKPtE
t7owWN5Tam5WsQd3qZ+y
=koo+
-----END PGP SIGNATURE-----
Merge tag 'md/4.4-rc6-fix' of git://neil.brown.name/md
Pull md bugfix from Neil Brown:
"One more md fix for 4.4-rc
Fix a regression which causes reshape to not start properly sometimes"
* tag 'md/4.4-rc6-fix' of git://neil.brown.name/md:
md: remove check for MD_RECOVERY_NEEDED in action_store.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABAgAGBQJWenfTAAoJEEtJtSqsAOnWmYwQAMd4R4/OwBvNgKKYyBW4D/yv
wku0ToGnmdcJ6d85eHuMVSwx/5ATAdom4W12LVxyifA4UxF2OkwMnU/hQEYFsAXJ
gWv4O9Hj6d+hv4EVMRvH5/Q9Oqp8cMDyM9GcbR6vJ6jDWn9KM6VXnaydvpWmGgLN
Zi+0YJIgHENuieQ66VNVUT+WdQ2DgkUEdZBNc5YaRGbzBrCzGF4tATWw1rZ8P0v2
tRtcY0NykoCkxRnnsa/RQfuojkzAB2vVFRl2iFg2//5rkFjo/zFyGal/VPl8hSyk
frZgZUiJRo0AEr4eZGSPc3IRliKqtdFdVrNaxIqwzG5R7YCDHjmuNq4FlLGvXpkt
xf6WgIxNrtfXMVLBizHHy5QivcsHLxW0TKq+oFQymO0L8D3IoU/9zBXLS1TcvCxL
cLn3SqxG/b7MWsq6PfVl2jI338O0uJhKAvnWhj9HsH4tgnP7Bfkn6RF8Dwy6HtJ9
SIerXqjnkw9R1KydOrVFRm4bJ4M6VxI8G/+CiUpQuSgihWvrjgqQ6HXc/nAPRGUt
6nasEuDWa4lIujACNQjgT+TgsLhiuERllI5aA0zp8LlP2jwxGFtDsAD7eaubQ7TM
xazdglGJoIDh7C+CdZBmG070uWgQlNNb5CEWrc3cF4OAmTHvXgpYv04EWpiAVec7
2j7u2+zqHGhjQ29KEJac
=84oS
-----END PGP SIGNATURE-----
Merge tag 'upstream-4.4-rc7' of git://git.infradead.org/linux-ubifs
Pull UBI bug fixes from Richard Weinberger:
"This contains four bug fixes for UBI"
* tag 'upstream-4.4-rc7' of git://git.infradead.org/linux-ubifs:
mtd: ubi: don't leak e if schedule_erase() fails
mtd: ubi: fixup error correction in do_sync_erase()
UBI: fix use of "VID" vs. "EC" in header self-check
UBI: fix return error code
with ftrace enabled. With some investigation it was discovered that it
was his compile setup. He was using ccache with hard links, which allowed
recordmcount to process the same .o twice. When this happens, recordmcount
will detect that it was already done and give a warning about it.
Russell fixed this by having recordmcount detect that the object file
has more than one hard link, and if it does, it unlinks the object file
after it maps it and processes then. This appears to fix the issue.
As you did not like the fact that recordmcount modified the file in place
and thought that it should do the modifications in memory and then write
it out to disk and move it over the old file to prevent other more subtle
issues like the one above, a second patch is added on top of Russell's to
do just that. Luckily the original code had write and lseek wrappers that
I was able to modify to not do inplace writes, but simply keep track
of the changes made in memory. When a write is made, a "update" flag is
set, and at the end of processing, if the update is set, then it writes
the file with changes out to a new file, and then renames it over the
original one.
The file descriptor is still passed to the write and lseek wrappers because
removing that would cause the change to be more intrusive. That can be
removed in a follow up cleanup patch that can wait till the next merge
window.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJWerqKAAoJEKKk/i67LK/80W0H/jbzBL4siTTenA0eZLmsxT8k
nbAM4fpdylpqUc6ku3QwjqqvbYxaLhiQsDtsVgXEoV7eelDgBedOSvCCrpZXn5co
y1VEunRfOIWMKLmoAdFUagWxdX25Pu9V6g74kdUwaiNnMtCy7+Ds7x8OwqASyd7t
e1WAhQ63ovslN88hHpkQVxCApYaocyPgU1lysBpN9dmvUS7Vkt/Bl4xhlVclnQKS
3QbPWXtS/alCOOYj/Fa71Lfi2GhDx41Z6KPq6hFgph//oPHOSIvceNnimfT+ejjw
1dKzM5EN386PhF3R27P+I0ovXnLNlCKmMZQUCUvlU/CjOOHHcIQNj8WHw9XB20k=
=5TS2
-----END PGP SIGNATURE-----
Merge tag 'trace-v4.4-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull ftrace/recordmcount fix from Steven Rostedt:
"Russell King was reporting lots of warnings when he compiled his
kernel with ftrace enabled. With some investigation it was discovered
that it was his compile setup. He was using ccache with hard links,
which allowed recordmcount to process the same .o twice. When this
happens, recordmcount will detect that it was already done and give a
warning about it.
Russell fixed this by having recordmcount detect that the object file
has more than one hard link, and if it does, it unlinks the object
file after it maps it and processes then. This appears to fix the
issue.
As you did not like the fact that recordmcount modified the file in
place and thought that it should do the modifications in memory and
then write it out to disk and move it over the old file to prevent
other more subtle issues like the one above, a second patch is added
on top of Russell's to do just that. Luckily the original code had
write and lseek wrappers that I was able to modify to not do inplace
writes, but simply keep track of the changes made in memory. When a
write is made, a "update" flag is set, and at the end of processing,
if the update is set, then it writes the file with changes out to a
new file, and then renames it over the original one.
The file descriptor is still passed to the write and lseek wrappers
because removing that would cause the change to be more intrusive.
That can be removed in a follow up cleanup patch that can wait till
the next merge window"
* tag 'trace-v4.4-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace/scripts: Have recordmcount copy the object file
scripts: recordmcount: break hardlinks
- Unwinder rework (A revert followed by better fix)
- Build errors: MMUv2, modules with -Os
- highmem section mismatch build splat
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWfjpNAAoJEGnX8d3iisJeC08P+wRkkvtK0R5iZPqfTdSUaxFz
CYoVM8mAMF+non+b7a4bWHChDJ+HlHxqsQWbq2A/EsET/TOXmnr28KquC/qfplwd
p2I38xxsCSHK0hU1+x47VdxZdtO5VNdp+fsq7CQbHLUwg9TMCK4t8OpslrA3IbOG
W+YlHQ+7Wwgu1GbHhWOHDTPb/yqX0WByX211HomURlo9Ppi3Xv3W6xK7uGn0wUxS
DKp0pEWhLs8UQh6zGAf3zFJVjuuWpJHwAoXmQgfEeXYkA/ZOBCEh8sf+/fFZMxuK
RAItN1ZTV3HwIYh3ykJyap877MBksb7nsCE5R0l+LQW0nV485omfJgWvo2hFUL5D
Nrr93bcu8msn/mKfYtBaaQdohwlGsNY5GFaRGEv6TgKZWifFX+uUOBnZnbr2RLvn
3/cDeeK/24sYvxaHGvBs3tjnJkwWPpofr9ZHCnQT+X8MgxjHQhcBesDq/8lb90m6
G2RRqXQomdKkMBacejpKyvnulTEwMrU9itpxyIT7wfxCVGKxfdWHNHLW8KNtXsDn
02Ae7XUyuciV6RIF9lXyGa+I73T/4/ut02b4Qq7PrdfLQucwZKjIQ9nj1Om9+taV
1nSdm+VttO/Nqu2PoMKluxNHBpS1kxzEVFZWa/mXfFs+qmwRMLyKqjz0Tog+hBCv
O7951Yzp3J88HTQIwUMD
=h2pT
-----END PGP SIGNATURE-----
Merge tag 'arc-4.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc
Pull ARC fixes from Vineet Gupta:
"Sorry for this late pull request, but these are all important fixes
for code introduced/updated in this release which we will otherwise
end up back porting.
- Unwinder rework (A revert followed by better fix)
- Build errors: MMUv2, modules with -Os
- highmem section mismatch build splat"
* tag 'arc-4.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
ARC: dw2 unwind: Catch Dwarf SNAFUs early
ARC: dw2 unwind: Don't bail for CIE.version != 1
Revert "ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing"
ARC: Fix linking errors with CONFIG_MODULE + CONFIG_CC_OPTIMIZE_FOR_SIZE
ARC: mm: fix building for MMU v2
ARC: mm: HIGHMEM: Fix section mismatch splat
Pull parisc system call restart fix from Helge Deller:
"The architectural design of parisc always uses two instructions to
call kernel syscalls (delayed branch feature). This means that the
instruction following the branch (located in the delay slot of the
branch instruction) is executed before control passes to the branch
destination.
Depending on which assembler instruction and how it is used in
usersapce in the delay slot, this sometimes made restarted syscalls
like futex() and poll() failing with -ENOSYS"
* 'parisc-4.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
parisc: Fix syscall restarts
Pull sparc fixes from David Miller:
1) Finally make perf stack backtraces stable on sparc, several problems
(mostly due to the context in which the user copies from the stack
are done) contributed to this.
From Rob Gardner.
2) Export ADI capability if the cpu supports it.
3) Hook up userfaultfd system call.
4) When faults happen during user copies we really have to clean up and
restore the FPU state fully. Also from Rob Gardner
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
tty/serial: Skip 'NULL' char after console break when sysrq enabled
sparc64: fix FP corruption in user copy functions
sparc64: Perf should save/restore fault info
sparc64: Ensure perf can access user stacks
sparc64: Don't set %pil in rtrap_nmi too early
sparc64: Add ADI capability to cpu capabilities
tty: serial: constify sunhv_ops structs
sparc: Hook up userfaultfd system call
When sysrq is triggered from console, serial driver for SUN hypervisor
console receives a console break and enables the sysrq. It expects a valid
sysrq char following with break. Meanwhile if driver receives 'NULL'
ASCII char then it disables sysrq and sysrq handler will never be invoked.
This fix skips calling uart sysrq handler when 'NULL' is received while
sysrq is enabled.
Signed-off-by: Vijay Kumar <vijay.ac.kumar@oracle.com>
Acked-by: Karl Volz <karl.volz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Short story: Exception handlers used by some copy_to_user() and
copy_from_user() functions do not diligently clean up floating point
register usage, and this can result in a user process seeing invalid
values in floating point registers. This sometimes makes the process
fail.
Long story: Several cpu-specific (NG4, NG2, U1, U3) memcpy functions
use floating point registers and VIS alignaddr/faligndata to
accelerate data copying when source and dest addresses don't align
well. Linux uses a lazy scheme for saving floating point registers; It
is not done upon entering the kernel since it's a very expensive
operation. Rather, it is done only when needed. If the kernel ends up
not using FP regs during the course of some trap or system call, then
it can return to user space without saving or restoring them.
The various memcpy functions begin their FP code with VISEntry (or a
variation thereof), which saves the FP regs. They conclude their FP
code with VISExit (or a variation) which essentially marks the FP regs
"clean", ie, they contain no unsaved values. fprs.FPRS_FEF is turned
off so that a lazy restore will be triggered when/if the user process
accesses floating point regs again.
The bug is that the user copy variants of memcpy, copy_from_user() and
copy_to_user(), employ an exception handling mechanism to detect faults
when accessing user space addresses, and when this handler is invoked,
an immediate return from the function is forced, and VISExit is not
executed, thus leaving the fprs register in an indeterminate state,
but often with fprs.FPRS_FEF set and one or more dirty bits. This
results in a return to user space with invalid values in the FP regs,
and since fprs.FPRS_FEF is on, no lazy restore occurs.
This bug affects copy_to_user() and copy_from_user() for NG4, NG2,
U3, and U1. All are fixed by using a new exception handler for those
loads and stores that are done during the time between VISEnter and
VISExit.
n.b. In NG4memcpy, the problematic code can be triggered by a copy
size greater than 128 bytes and an unaligned source address. This bug
is known to be the cause of random user process memory corruptions
while perf is running with the callgraph option (ie, perf record -g).
This occurs because perf uses copy_from_user() to read user stacks,
and may fault when it follows a stack frame pointer off to an
invalid page. Validation checks on the stack address just obscure
the underlying problem.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
There have been several reports of random processes being killed with
a bus error or segfault during userspace stack walking in perf. One
of the root causes of this problem is an asynchronous modification to
thread_info fault_address and fault_code, which stems from a perf
counter interrupt arriving during kernel processing of a "benign"
fault, such as a TSB miss. Since perf_callchain_user() invokes
copy_from_user() to read user stacks, a fault is not only possible,
but probable. Validity checks on the stack address merely cover up the
problem and reduce its frequency.
The solution here is to save and restore fault_address and fault_code
in perf_callchain_user() so that the benign fault handler is not
disturbed by a perf interrupt.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When an interrupt (such as a perf counter interrupt) is delivered
while executing in user space, the trap entry code puts ASI_AIUS in
%asi so that copy_from_user() and copy_to_user() will access the
correct memory. But if a perf counter interrupt is delivered while the
cpu is already executing in kernel space, then the trap entry code
will put ASI_P in %asi, and this will prevent copy_from_user() from
reading any useful stack data in either of the perf_callchain_user_X
functions, and thus no user callgraph data will be collected for this
sample period. An additional problem is that a fault is guaranteed
to occur, and though it will be silently covered up, it wastes time
and could perturb state.
In perf_callchain_user(), we ensure that %asi contains ASI_AIUS
because we know for a fact that the subsequent calls to
copy_from_user() are intended to read the user's stack.
[ Use get_fs()/set_fs() -DaveM ]
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit 28a1f53 delays setting %pil to avoid potential
hardirq stack overflow in the common rtrap_irq path.
Setting %pil also needs to be delayed in the rtrap_nmi
path for the same reason.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Add ADI (Application Data Integrity) capability to cpu capabilities list.
ADI capability allows virtual addresses to be encoded with a tag in
bits 63-60. This tag serves as an access control key for the regions
of virtual address with ADI enabled and a key set on them. Hypervisor
encodes this capability as "adp" in "hwcap-list" property in machine
description.
Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Constifies sunhv_ops structures in tty's serial
driver since they are not modified after their
initialization.
Detected and found using Coccinelle.
Suggested-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Aya Mahfouz <mahfouz.saif.elyazal@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The "domain" variable needs to be signed for the error handling to work.
Fixes: 8def31034d (cpufreq: arm_big_little: add SCPI interface driver)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
After hooking up system call, userfaultfd selftest was successful for
both 32 and 64 bit version of test.
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This shouldn't be a nightmare before Christmas: just a handful
small device-specific fixes for various ASoC and HD-audio drivers.
Most of them are stable fixes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJWeq2LAAoJEGwxgFQ9KSmkxpsQAIhERdXPVKSM6WhBA45lsblD
2dqfxGCpCw0ta0GEWuvZODxDk3N21LQ+OMH4NWnS//qYATIaQMAq1d1/gGF7IibZ
8HpHxtbHknGrzcdDhG1M2hWLQbl2psyz8CvPJ8GuGt9BSEEMLu2oCxdovvqMEanz
WFW06622XO52+giH+lelqBtS/yIypUuovEx96wiwKUX0pKqzPBlS1+fBjIxiQGx6
aEuD1wdjRwlP+P7UjrrpaNy+b7BVlodVRrOVFQzs+MouAhpoyumzD1IM4bmL65ra
1M3WYbsgYmoCTpsQGBl2BAarc1AJRaJvDoRSd+b/7gqroLjrUIldLMlqm3AQSlP8
a7+VSsIgtmrvYv2GM8B0N17av2+vY2TdE/Uf9znlz0SyMm6fiKqfjSUQWUq5sqFr
fGYdZWv513afeiQIYA31FPX3wQKd32EQzfeP/No+hjwitzZ15q+NHylZnSySL13G
Rm824cCAKrte8OZjgSIxOrFDpZj2/6Qk8kmT+dOnjIGBxn/k8ALKt7UY48TBMzKI
jvHIFEPXitIx5RZhjvWNa3mn0mveWZ69YXJsAXxZGL6W4/bBoEh/MbXgMKwwvaTo
nbDssWg/w1TfsgWxC3nFb0iso/8L1kH7bU9397kJ5vtIygj8fdSUZr4FyqZFKAN4
XuQ/WlEk1vj8GIfbFWdG
=z4qE
-----END PGP SIGNATURE-----
Merge tag 'sound-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"This shouldn't be a nightmare before Christmas: just a handful small
device-specific fixes for various ASoC and HD-audio drivers. Most of
them are stable fixes"
* tag 'sound-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
ASoC: fsl_sai: fix no frame clk in master mode
ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
ASoC: sgtl5000: fix VAG power up timing
ASoC: rockchip: spdif: Set transmit data level to 16 samples
ASoC: wm8974: set cache type for regmap
ASoC: es8328: Fix shifts for mixer switches
ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx
ASoC: es8328: Fix deemphasis values
Pull i915 drm fixes from Jani Nikula:
"Here's a batch of i915 fixes all around. It may be slightly bigger
than one would hope for at this stage, but they've all been through
testing in our -next before being picked up for v4.4. Also, I missed
Dave's fixes pull earlier today just because I wanted an extra testing
round on this. So I'm fairly confident.
Wishing you all the things it is customary to wish this time of the
year"
* tag 'drm-intel-fixes-2015-12-23' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Correct max delay for HDMI hotplug live status checking
drm/i915: mdelay(10) considered harmful
drm/i915: Kill intel_crtc->cursor_bo
drm/i915: Workaround CHV pipe C cursor fail
drm/i915: Only spin whilst waiting on the current request
drm/i915: Limit the busy wait on requests to 5us not 10ms!
drm/i915: Break busywaiting for requests on pending signals
drm/i915: Disable primary plane if we fail to reconstruct BIOS fb (v2)
drm/i915: Set the map-and-fenceable flag for preallocated objects
drm/i915: Drop the broken cursor base==0 special casing
Pull drm fixes from Dave Airlie:
"Not much happening, should have dequeued this lot earlier.
One amdgpu, one nouveau and one exynos fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/exynos: atomic check only enabled crtc states
drm/nouveau/bios/fan: hardcode the fan mode to linear
drm/amdgpu: fix user fence handling
A collection of small driver specific fixes here, nothing that'll affect
users who don't have the devices concerned. At least the wm8974 bug
indicates that there's not too many users of some of these devices.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJWeeoEAAoJECTWi3JdVIfQ0eEH/000bDIgbs/HSCgtd+M2ANSg
TJc/y+a3x/w/83tBaauZGFf4Tv+N9UNoIxP5dYwL/pnG1NtzYsoaF9ATIzAf+vuz
ux8q0+QTMzlOuBx4UdG1k7JXFVzbS62otc+hATnm6bdHYUuscTGk4zp9Iigq7M9r
zaFKoUrbfC/Gg7iCX1bhxFu8O0jaFYJVOjVIbTxpoZo0T0h/EVNYfB/Rla/MTTa/
qQLkdJX1uUINs2GGwvLrlHnH6JQbcc8FA4qOBJGEtyWXxplH/fErP5336a/bIDqR
pHCFKM8u4YZRniGROty/S2GjdPeRK6VHcU2IduFgU71N8o3J/dpC2dLqrc8I6iU=
=T8CL
-----END PGP SIGNATURE-----
Merge tag 'asoc-fix-v4.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v4.4
A collection of small driver specific fixes here, nothing that'll affect
users who don't have the devices concerned. At least the wm8974 bug
indicates that there's not too many users of some of these devices.
Pull block layer fixes from Jens Axboe:
"Three small fixes for 4.4 final. Specifically:
- The segment issue fix from Junichi, where the old IO path does a
bio limit split before potentially bouncing the pages. We need to
do that in the right order, to ensure that limitations are met.
- A NVMe surprise removal IO hang fix from Keith.
- A use-after-free in null_blk, introduced by a previous patch in
this series. From Mike Krinkin"
* 'for-linus' of git://git.kernel.dk/linux-block:
null_blk: fix use-after-free error
block: ensure to split after potentially bouncing a bio
NVMe: IO ending fixes on surprise removal
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWeF4NAAoJECebzXlCjuG+PvcQAL3AvxDzDnaNFhZJgWZMnRyC
OlXlPE4clfiFXSB7C39xNBcn7eCJYLkINCQLu4ywAS+y7/22sX7unCTt7UXL99K3
GffV/QvxOatSssik+CtS9gIMkRLW9Fs6fuQZ4k5w+UtveISpyFoRfw8hbISABL1w
NtgGIESXL8WXO+OSbVF/wRV8g1+FVi/gXWAOAoUtHBzyUho2JfECXO1XYz6mQ44M
HN4Bvx75dU3SieECHRKsq8yRbkPYHP9ron/+MskBZm7VkV/6mboFlFfivNncid0Y
ivpjeYP5xTj4KoXPlQ3feA9AbADNVshAKeDQYpDxRJimMjr6VVRFVDpzbKJc+5ou
if9AjZUiX02mHZShKMDsJR3kHBu+OzWLtQIDJUtLTIAaeb+V/2NEScnCyCIibXv7
l52zqJ7upEYFuUGFYIZgsEKZgOAm7e3appIAtGG5Nt9ejUVR1LVPfsa8u2xXhUgp
FN1TLmeQw6ZLRXcXa7vHcyQh/gJbPsm3PH514QYS+G3nMyXG8XnYKlMe98uhReno
A3MH5MxfgyiuUITJopVpZfKoEFpYcid21osmVqiZfawoxr4iTocogDArETW7prCL
QjN9sF+drlG70m/unDBKpQMPI0fhlmjY/VrK9YNlgvNaYKsJFVJnVFE1rCOuzj01
ekT3egZmGUR7kX94DuTt
=UJhV
-----END PGP SIGNATURE-----
Merge tag 'nfsd-4.4-1' of git://linux-nfs.org/~bfields/linux
Pull nfsd fix from Bruce Fields:
"Just one fix for a NFSv4 callback bug introduced in 4.4"
* tag 'nfsd-4.4-1' of git://linux-nfs.org/~bfields/linux:
nfsd: don't hold ls_mutex across a layout recall
- A series of fixes to the MTRR emulation, tested in the BZ by several users
so they should be safe this late
- A fix for a division by zero
- Two very simple ARM and PPC fixes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQEcBAABAgAGBQJWeV/6AAoJEL/70l94x66DqzsH/05YnLi2GsX5WeZHMfIUgzgT
S/GoIkA7A4E2eXVoGg824MWppSViUzZkWgYFQTG4+KY9WPXzm9z2ij7DIlUHCD6n
QfevgQx1kIu1obyhm6bYM2xUdM3f7NCsQgw9bXZObB0ay+b/+GjR9/RbCbx60EO5
K1P+kveK6PFlS9/hc0PLztu6WkPV9BCO1RJUbeAEdnrMbpuQfHC+coR7MHRCiv2V
iy8f1CqrGaO5YPm9/3GbdH1xMKew4OZShOxTXwtvUThdrLkks2c8sk6FoLzqkznH
LMHVIpkm4mrIgThZG7VqZMXOrWvBtsCt04Vr9MzCM6QetB02b/Uz0xKvMYx2kZQ=
=pmYz
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
- A series of fixes to the MTRR emulation, tested in the BZ by several
users so they should be safe this late
- A fix for a division by zero
- Two very simple ARM and PPC fixes
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: Reload pit counters for all channels when restoring state
KVM: MTRR: treat memory as writeback if MTRR is disabled in guest CPUID
KVM: MTRR: observe maxphyaddr from guest CPUID, not host
KVM: MTRR: fix fixed MTRR segment look up
KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
KVM: arm/arm64: vgic: Fix kvm_vgic_map_is_active's dist check
kvm: x86: move tracepoints outside extended quiescent state
KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
Pull s390 fixes from Martin Schwidefsky:
"Two late bug fixes for kernel 4.4.
Merry Christmas"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/dis: Fix handling of format specifiers
s390/zcrypt: Fix AP queue handling if queue is full
Enabling CPUFreq support for Tegra124 Chromebooks is causing the Tegra124
to hang when resuming from suspend.
When CPUFreq is enabled, the CPU clock is changed from the PLLX clock to
the DFLL clock during kernel boot. When resuming from suspend the CPU
clock is temporarily changed back to the PLLX clock before switching back
to the DFLL. If the DFLL is operating at a much lower frequency than the
PLLX when we enter suspend, and so the CPU voltage rail is at a voltage
too low for the CPUs to operate at the PLLX frequency, then the device
will hang.
Please note that the PLLX is used in the resume sequence to switch the CPU
clock from the very slow 32K clock to a faster clock during early resume
to speed up the resume sequence before the DFLL is resumed.
Ideally, we should fix this by setting the suspend frequency so that it
matches the PLLX frequency, however, that would be a bigger change. For
now simply disable CPUFreq support for Tegra124 Chromebooks to avoid the
hang when resuming from suspend.
Fixes: 9a0baee960 ("ARM: tegra: Enable CPUFreq support for Tegra124
Chromebooks")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
This includes a single fix for virtio ccw error handling.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJWdmeoAAoJECgfDbjSjVRpArwIAKuaWLdfu6Aj25QkiENb5PFu
JghRoy8P1SdGTqNdjbvG1XkxI072rWfrvU+cmVx9GbeZgusWtbeiTeBNT/jXnH/5
hodG9YdUEZOh2WhROQ+Fo7t1vzqvBWHuU9YdrBnHDbdFQ8300CgNTOsdih2rlEfT
t5/R3BEE0DXGTXTc3vO35+DVXzX8PA2FD18W7trrAjN7M5DdhCu98Q2VcvMZY/D6
aSBDPMJZxR0YcRPE97w0dZMLePCYkfmoLryVCVVXm5VZq6zXc7Dhm6ND0/oH+0DB
f4jxjapNUy+RAmE378ACsVwT992TTk49ZGZjbt4ttGOfFYDTrErrDkCq9QaZX7o=
=xgGU
-----END PGP SIGNATURE-----
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fix from Michael Tsirkin:
"This includes a single fix for virtio ccw error handling"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
virtio/s390: handle error values in irb
Fix a pointer cast typo introduced in v4.4-rc5 especially visible for
the i386 subarchitecture where it results in a kernel crash.
[ Also removed pointless cast as per Al Viro - Linus ]
Fixes: 8090bfd2bb ("um: Fix fpstate handling")
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Cc: Jeff Dike <jdike@addtoit.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
CPU_IDLE and ARM TWD timer. This is probably a common configuration setup
for people making products with these SoCs so let's make sure it works.
Also a wakeirq fix for duovero parlor making my life a bit easier as that
allows me to run basic PM regression tests on it.
It would be nice to have these in v4.4, but if it gets too late for that
because of the holidays, it is not super critical if these get merged for
v4.5.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWeGJhAAoJEBvUPslcq6VzU4wQAJqyWnzl5+frGf8TeTJTwAD2
yDXbiTDYAZAZ4ajFY5aocrAvQfd/z9zU4ar6liylfAMzOM3S4HRDTaUYc2jbr42s
+uNNRY3EGMRzbLuRfyZZRgui0aImBpIDXhBhK1njQoYWt9wWIVxNCv2I9pImWm+n
kyZBDK7xIunQTndgMIMTk8MPVQ5tbPrFbkOWUAZT2bIOmhhhjf/fdMpVL47tbssc
5XuS5YmyglT3spdaYzrAfZbxf19+CMVmTh2KD9FZOCv4OZPXvPOJ3JkqrJeARvPI
Idt6DjitznShJ7wQuIuRH+uS7N2fEDviZR3Of1kZBawBxt7ig58O7TizZLRUtTk+
Uj2QuXfccw8qu122chdpCI1eV5oOok157V3Yhsm7Oyi12H/eu5WMee2boJh6cz9R
KIih+5/FX6yUCgfHow7XR6vpQ2A50BJoU55+EB3yb81hsy/t4eHxbFaJfUcs7DNg
yLjtAxL1tO96VNFF+Kdgps69AOaHbo7/rNYgRvRZ4uxdSkE+YJhnHfcu6m59lFSR
k7Ybw+CCvZ+jH3IE+aGLumPguL10ntytv16G2UDwCzuvCaq59fUPUOCdxuBf+RNB
3Bd1NCkcsi8xPSypf7YXa3AfNM2XkNprHVZJadM57EBE3bVZ19+1OiBtf2gn+YAE
72gzwGGPixUNr8OjZNX0
=tGjX
-----END PGP SIGNATURE-----
Merge tag 'omap-for-v4.4/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
Few fixes for omaps to allow am437x only builds to boot properly with
CPU_IDLE and ARM TWD timer. This is probably a common configuration setup
for people making products with these SoCs so let's make sure it works.
Also a wakeirq fix for duovero parlor making my life a bit easier as that
allows me to run basic PM regression tests on it.
It would be nice to have these in v4.4, but if it gets too late for that
because of the holidays, it is not super critical if these get merged for
v4.5.
* tag 'omap-for-v4.4/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: dts: Fix UART wakeirq for omap4 duovero parlor
ARM: OMAP2+: AM43xx: select ARM TWD timer
ARM: OMAP2+: am43xx: enable GENERIC_CLOCKEVENTS_BROADCAST
Signed-off-by: Olof Johansson <olof@lixom.net>
- Fix Ethernet PHY mode on i.MX6 Ventana boards, which can result in
a non-functional Ethernet when Marvell phy driver rather than generic
phy driver is selected.
- Fix an assigned-clock configuration bug on imx6qdl-sabreauto board
which was introduced by commit ed339363de ("ARM: dts:
imx6qdl-sabreauto: Allow HDMI and LVDS to work simultaneously").
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJWcnPzAAoJEFBXWFqHsHzOvfAIALZo+lVpA3c89ZuDJn0bKfsI
hsV2wfMW1N5BhLN0AGjNIk/nk/YWhZ57gZyQ8miMdz2VeQRSgcjRaFFfEGRGOGop
OrrKpgmRKmUNxMrvztLlMmb1hGxpHOO7z/CXO3UrzDRIiw9lzxYymt0Re2UHiE1u
+tekMe7xBdimfMVmcM8RX/FOZC81tUjH3W8fyPbbzTTgrAnLPmXcfjtHkXy2VPw0
5ikWCJhFWB9ODnmKHbdA7YsNh52JAe5BieWiLXzLj33XJNDBbiFBbBltbo+BJZnp
ZaIek/fGHbq7ouCSLdRq7SEQn6ZbjpHhlic/okqNX0ux29QpY2GKTbiq8fLmcLU=
=wMKP
-----END PGP SIGNATURE-----
Merge tag 'imx-fixes-4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes
The i.MX fixes for 4.4, 3rd round:
- Fix Ethernet PHY mode on i.MX6 Ventana boards, which can result in
a non-functional Ethernet when Marvell phy driver rather than generic
phy driver is selected.
- Fix an assigned-clock configuration bug on imx6qdl-sabreauto board
which was introduced by commit ed339363de ("ARM: dts:
imx6qdl-sabreauto: Allow HDMI and LVDS to work simultaneously").
* tag 'imx-fixes-4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dl
0x4e is the runtime address normally associated with perihperal ICs.
0x45 is not a valid runtime address.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
The primary PMICs use 0x3a3 as their hardware address, not 0x3e3.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
blk_end_request_all may free request, so we need to save
request_queue pointer before blk_end_request_all call.
The problem was introduced in commit cf8ecc5a84
("null_blk: guarantee device restart in all irq modes")
and causes general protection fault with slab poisoning
enabled.
Fixes: cf8ecc5a84 ("null_blk: guarantee device
restart in all irq modes")
Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
blk_queue_bio() does split then bounce, which makes the segment
counting based on pages before bouncing and could go wrong. Move
the split to after bouncing, like we do for blk-mq, and the we
fix the issue of having the bio count for segments be wrong.
Fixes: 54efd50bfd ("block: make generic_make_request handle arbitrarily sized bios")
Cc: stable@vger.kernel.org
Tested-by: Artem S. Tashkinov <t.artem@lycos.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
This patch fixes a lost request discovered during IO + hot removal.
The driver's pci removal deletes gendisks prior to shutting down the
controller to allow dirty data to sync. Dirty data can not be synced on
a surprise removal, though, and would potentially block indefinitely.
The driver previously had marked the queue as dying in this scenario
to prevent new requests from attempting, however it will still block
for requests that already entered the queue. This patch fixes this by
quiescing IO first, then aborting the requeued requests before deleting
disks.
Reported-by: Sujith Pandel <sujith_pandel@dell.com>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Tested-by: Sujith Pandel <sujith_pandel@dell.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Currently if userspace restores the pit counters with a count of 0
on channels 1 or 2 and the guest attempts to read the count on those
channels, then KVM will perform a mod of 0 and crash. This will ensure
that 0 values are converted to 65536 as per the spec.
This is CVE-2015-7513.
Signed-off-by: Andy Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Virtual machines can be run with CPUID such that there are no MTRRs.
In that case, the firmware will never enable MTRRs and it is obviously
undesirable to run the guest entirely with UC memory. Check out guest
CPUID, and use WB memory if MTRR do not exist.
Cc: qemu-stable@nongnu.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Conversion of MTRRs to ranges used the maxphyaddr from the boot CPU.
This is wrong, because var_mtrr_range's mask variable then is discontiguous
(like FF00FFFF000, where the first run of 0s corresponds to the bits
between host and guest maxphyaddr). Instead always set up the masks
to be full 64-bit values---we know that the reserved bits at the top
are zero, and we can restore them when reading the MSR. This way
var_mtrr_range gets a mask that just works.
Fixes: a13842dc66
Cc: qemu-stable@nongnu.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This fixes the slow-down of VM running with pci-passthrough, since some MTRR
range changed from MTRR_TYPE_WRBACK to MTRR_TYPE_UNCACHABLE. Memory in the
0K-640K range was incorrectly treated as uncacheable.
Fixes: f7bfb57b3e
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
Cc: qemu-stable@nongnu.org
Signed-off-by: Alexis Dambricourt <alexis.dambricourt@gmail.com>
[Use correct BZ for "Fixes" annotation. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
c861519fcf ("MIPS: Fix delay loops which may
be removed by GCC.") which made it upstream was an outdated version of the
patch and is lacking some the removal of two variables that became unused
thus resulting in further warnings and build breakage. The commit
from ae878615d7cee5d7346946cf1ae1b60e427013c2 was correct however.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
