We should always have proper privileges when requesting kernel
data.
Signed-off-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/20130503121256.230745028@chello.nl
[ Fix build error reported by fengguang.wu@intel.com, propagate error code back. ]
Signed-off-by: NIngo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/n/tip-v0x9ky3ahzr6nm3c6ilwrili@git.kernel.org

Cc: vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

This is needed because when scan_of_devices finds the GAISLER_GPTIMER
core that corresponds to the SMP "ticker" timer, the previously set
proper irq flow handler gets overwritten with an incorrect one. This
leads to very flaky timer interrupt handling on some hardware. Proper
updates to handlers can still be done using leon_update_virq_handling.
Signed-off-by: NAndreas Larsson <andreas@gaisler.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The vio_remove() function uses device_find_child() but it does not drop
the reference of the retrieved child.
Signed-off-by: NFederico Vaga <federico.vaga@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

The LBR 'from' adddress is under full userspace control; ensure
we validate it before reading from it.

Note: is_module_text_address() can potentially be quite
expensive; for those running into that with high overhead
in modules optimize it using an RCU backed rb-tree.
Reported-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/20130503121256.158211806@chello.nlSigned-off-by: NIngo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/n/tip-mk8i82ffzax01cnqo829iy1q@git.kernel.org

Errata BV98 states that all MEM_*_RETIRED events corrupt the
counter value of the SMT sibling's counters. Blacklist these
events
Reported-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/20130503121256.083340271@chello.nlSigned-off-by: NIngo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/n/tip-jwra43mujrv1oq9xk6mfe57v@git.kernel.org

With VMX, enable_irq_window can now return -EBUSY, in which case an
immediate exit shall be requested before entering the guest. Account for
this also in enable_nmi_window which uses enable_irq_window in absence
of vnmi support, e.g.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

s5p_register_gpio_interrupt() returns 0 or positive for success, and
-ve for errors, so just use the standard >= 0 test.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

device_register() returns -ve values for errors, and zero for success.
There's no need to obfuscate the code with IS_ERR_VALUE().
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Consistently check errors using the usual method used in the kernel
for much of its history.  For instance:

int gpmc_cs_set_timings(int cs, const struct gpmc_timings *t)
{
	int div;
	div = gpmc_calc_divider(t->sync_clk);
	if (div < 0)
		return div;
static int gpmc_set_async_mode(int cs, struct gpmc_timings *t)
{
...
	return gpmc_cs_set_timings(cs, t);

.....
	ret = gpmc_set_async_mode(gpmc_onenand_data->cs, &t);
	if (IS_ERR_VALUE(ret))
		return ret;

So, gpmc_cs_set_timings() thinks any negative return value is an error,
but where we check that in higher levels, only a limited range are
errors...

There is only _one_ use of IS_ERR_VALUE() in arch/arm which is really
appropriate, and that is in arch/arm/include/asm/syscall.h:

static inline long syscall_get_error(struct task_struct *task,
				     struct pt_regs *regs)
{
	unsigned long error = regs->ARM_r0;
	return IS_ERR_VALUE(error) ? error : 0;
}

because this function really does have to differentiate between error
return values and addresses which look like negative numbers (eg, from
mmap()).

So, here's a patch to remove them from OMAP, except for the above.
Acked-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

omap_hwmod_lookup() only returns NULL on error, never an error pointer.
Checking the returned pointer using IS_ERR_OR_NULL() is needless
overhead.  Use a simple !ptr check instead.

OMAP devices (oh->od) always have a valid platform device attached (see
omap_device_alloc()) so there's no point validating the platform device
pointer (we will have already oopsed long before if this is not the
case here.)

Lastly, oh->od is only ever NULL or a valid omap device pointer - 'oh'
comes from the statically declared hwmod tables, and the pointer is
only filled in by omap_device_alloc() at a point where the omap device
pointer must be valid.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

During early init, we would incorrectly set the NX bit even if the NX
feature was not supported.  Instead, only set this bit if NX is
actually available and enabled.  We already do very early detection of
the NX bit to enable it in EFER, this simply extends this detection to
the early page table mask.
Reported-by: NFernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1367476850.5660.2.camel@nexus
Cc: <stable@vger.kernel.org> v3.9

The git commite7a5cd06
("x86-64, gdt: Store/load GDT for ACPI S3 or hibernate/resume path
is not needed.") assumes that for the hibernate path the booting
kernel and the resuming kernel MUST be the same. That is certainly
the case for a 32-bit kernel (see check_image_kernel and
CONFIG_ARCH_HIBERNATION_HEADER config option).

However for 64-bit kernels it is OK to have a different kernel
version (and size of the image) of the booting and resuming kernels.
Hence the above mentioned git commit introduces an regression.

This patch fixes it by introducing a 'struct desc_ptr gdt_desc'
back in the 'struct saved_context'. However instead of having in the
'save_processor_state' and 'restore_processor_state' the
store/load_gdt calls, we are only saving the GDT in the
save_processor_state.

For the restore path the lgdt operation is done in
hibernate_asm_[32|64].S in the 'restore_registers' path.

The apt reader of this description will recognize that only 64-bit
kernels need this treatment, not 32-bit. This patch adds the logic
in the 32-bit path to be more similar to 64-bit so that in the future
the unification process can take advantage of this.

[ hpa: this also reverts an inadvertent on-disk format change ]
Suggested-by: N"H. Peter Anvin" <hpa@zytor.com>
Acked-by: N"Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Link: http://lkml.kernel.org/r/1367459610-9656-2-git-send-email-konrad.wilk@oracle.comSigned-off-by: NH. Peter Anvin <hpa@linux.intel.com>

This adds the API for userspace to instantiate an XICS device in a VM
and connect VCPUs to it.  The API consists of a new device type for
the KVM_CREATE_DEVICE ioctl, a new capability KVM_CAP_IRQ_XICS, which
functions similarly to KVM_CAP_IRQ_MPIC, and the KVM_IRQ_LINE ioctl,
which is used to assert and deassert interrupt inputs of the XICS.

The XICS device has one attribute group, KVM_DEV_XICS_GRP_SOURCES.
Each attribute within this group corresponds to the state of one
interrupt source.  The attribute number is the same as the interrupt
source number.

This does not support irq routing or irqfd yet.
Signed-off-by: NPaul Mackerras <paulus@samba.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add the missing unlock before return from function set_base_addr()
when disables the mapping.

Introduced by commit 5df554ad
(kvm/ppc/mpic: in-kernel MPIC emulation)
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NAlexander Graf <agraf@suse.de>

These functions do an srcu_dereference without acquiring the srcu lock
themselves.
Signed-off-by: NScott Wood <scottwood@freescale.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This is an unused (no pun intended) leftover from when this code did
reference counting.
Signed-off-by: NScott Wood <scottwood@freescale.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Keeping a linked list of statically defined objects doesn't work
very well when we have multiple guests. :-P

Switch to an array of constant objects.  This fixes a hang when
multiple guests are used.
Signed-off-by: NScott Wood <scottwood@freescale.com>
[agraf: remove struct list_head from mem_reg]
Signed-off-by: NAlexander Graf <agraf@suse.de>

The full mcpm layer is not likely to be relevant to v6 based
platforms, so a multiplatform kernel won't use that code if booted
on v6 hardware.

This patch modifies the AFLAGS for affected mcpm .S files to
specify armv7-a explicitly for that code.
Signed-off-by: NDave Martin <dave.martin@linaro.org>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NNicolas Pitre <nico@linaro.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

We moved the definition of shift_to_mmu_psize and mmu_psize_to_shift
out of hugetlbpage.c in patch "powerpc: New hugepage directory format".

These functions are not related to hugetlbpage and we want to use them
outside hugetlbpage.c We missed a definition for book3e when we moved
these functions. Add similar functions to mmu-book3e.h
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

This context switches the new Event Based Branching (EBB) SPRs.  The three new
SPRs are:
  - Event Based Branch Handler Register (EBBHR)
  - Event Based Branch Return Register (EBBRR)
  - Branch Event Status and Control Register (BESCR)
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NMatt Evans <matt@ozlabs.org>
Signed-off-by: NMichael Neuling <mikey@neuling.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

This turns Event Based Branching (EBB) on in the Hypervisor Facility Status and
Control Register (HFSCR) and Facility Status and Control Register (FSCR).
Signed-off-by: NMichael Neuling <mikey@neuling.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

We are getting low on cpu feature bits. So rather than add a separate bit for
every new Power8 feature, add a bit for arch 2.07 server catagory and use that
instead.

Hijack the value we had for BCTAR, but swap the value with CFAR so that all the
ARCH defines are together.

Note we don't touch CPU_FTR_TM, because it is conditionally enabled if
the kernel is built with TM support.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NMichael Neuling <mikey@neuling.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Make BHRB instructions available in problem and privileged states.
Signed-off-by: NAnshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

We do not want to take single step and branch-taken debug exception
in kernel exception code. But the address range check was not covering
all kernel exception handlers address range.

With this patch we defined the interrupt_end label which defines the
end on kernel exception code. So now we check interrupt_base to
interrupt_end range for not handling debug exception in kernel
exception entry.
Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Clean up the pseries scanlog driver's use of procfs:

 (1) Don't need to save the proc_dir_entry pointer as we have the filename to
     remove with.

 (2) Save the scan log buffer pointer in a static variable (there is only one
     of it) and don't save it in the PDE (which doesn't have a destructor).
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
cc: Paul Mackerras <paulus@samba.org>
cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Clean up some of the problems with the rtas_flash driver:

 (1) It shouldn't fiddle with the internals of the procfs filesystem (altering
     pde->count).

 (2) If pid namespaces are in effect, then you can get multiple inodes
     connected to a single pde, thereby rendering the pde->count > 2 test
     useless.

 (3) The pde->count fudging doesn't work for forked, dup'd or cloned file
     descriptors, so add static mutexes and use them to wrap access to the
     driver through read, write and release methods.

 (4) The driver can only handle one device, so allocate most of the data
     previously attached to the pde->data as static variables instead (though
     allocate the validation data buffer with kmalloc).

 (5) We don't need to save the pde pointers as long as we have the filenames
     available for removal.

 (6) Don't try to multiplex what the update file read method does based on the
     filename.  Instead provide separate file ops and split the function.

Whilst we're at it, tabulate the procfile information and loop through it when
creating or destroying them rather than manually coding each one.

[Folded fixes from Vasant Hegde <hegdevasant@linux.vnet.ibm.com>]
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
cc: Paul Mackerras <paulus@samba.org>
cc: Anton Blanchard <anton@samba.org>
cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Supply accessor functions to set attributes in proc_dir_entry structs.

The following are supplied: proc_set_size() and proc_set_user().
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Acked-by: NMauro Carvalho Chehab <mchehab@redhat.com>
cc: linuxppc-dev@lists.ozlabs.org
cc: linux-media@vger.kernel.org
cc: netdev@vger.kernel.org
cc: linux-wireless@vger.kernel.org
cc: linux-pci@vger.kernel.org
cc: netfilter-devel@vger.kernel.org
cc: alsa-devel@alsa-project.org
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NRichard Kuo <rkuo@codeaurora.org>

Signed-off-by: NRichard Kuo <rkuo@codeaurora.org>

With physical offsets, pa<->va translations aren't just based
on PAGE_OFFSET anymore.
Signed-off-by: NRichard Kuo <rkuo@codeaurora.org>

Signed-off-by: NRichard Kuo <rkuo@codeaurora.org>

Signed-off-by: NRichard Kuo <rkuo@codeaurora.org>