1. 13 10月, 2013 7 次提交
  2. 12 10月, 2013 1 次提交
    • V
      ARC: Ignore ptrace SETREGSET request for synthetic register "stop_pc" · 5b242828
      Vineet Gupta 提交于
      ARCompact TRAP_S insn used for breakpoints, commits before exception is
      taken (updating architectural PC). So ptregs->ret contains next-PC and
      not the breakpoint PC itself. This is different from other restartable
      exceptions such as TLB Miss where ptregs->ret has exact faulting PC.
      gdb needs to know exact-PC hence ARC ptrace GETREGSET provides for
      @stop_pc which returns ptregs->ret vs. EFA depending on the
      situation.
      
      However, writing stop_pc (SETREGSET request), which updates ptregs->ret
      doesn't makes sense stop_pc doesn't always correspond to that reg as
      described above.
      
      This was not an issue so far since user_regs->ret / user_regs->stop_pc
      had same value and both writing to ptregs->ret was OK, needless, but NOT
      broken, hence not observed.
      
      With gdb "jump", they diverge, and user_regs->ret updating ptregs is
      overwritten immediately with stop_pc, which this patch fixes.
      Reported-by: NAnton Kolesov <akolesov@synopsys.com>
      Signed-off-by: NVineet Gupta <vgupta@synopsys.com>
      5b242828
  3. 11 10月, 2013 1 次提交
  4. 10 10月, 2013 3 次提交
    • B
      kvm: ppc: booke: check range page invalidation progress on page setup · 40fde70d
      Bharat Bhushan 提交于
      When the MM code is invalidating a range of pages, it calls the KVM
      kvm_mmu_notifier_invalidate_range_start() notifier function, which calls
      kvm_unmap_hva_range(), which arranges to flush all the TLBs for guest pages.
      However, the Linux PTEs for the range being flushed are still valid at
      that point.  We are not supposed to establish any new references to pages
      in the range until the ...range_end() notifier gets called.
      The PPC-specific KVM code doesn't get any explicit notification of that;
      instead, we are supposed to use mmu_notifier_retry() to test whether we
      are or have been inside a range flush notifier pair while we have been
      referencing a page.
      
      This patch calls the mmu_notifier_retry() while mapping the guest
      page to ensure we are not referencing a page when in range invalidation.
      
      This call is inside a region locked with kvm->mmu_lock, which is the
      same lock that is called by the KVM MMU notifier functions, thus
      ensuring that no new notification can proceed while we are in the
      locked region.
      Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
      Acked-by: NAlexander Graf <agraf@suse.de>
      [Backported to 3.12 - Paolo]
      Reviewed-by: NBharat Bhushan <bharat.bhushan@freescale.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      40fde70d
    • P
      KVM: PPC: Book3S HV: Fix typo in saving DSCR · cfc86025
      Paul Mackerras 提交于
      This fixes a typo in the code that saves the guest DSCR (Data Stream
      Control Register) into the kvm_vcpu_arch struct on guest exit.  The
      effect of the typo was that the DSCR value was saved in the wrong place,
      so changes to the DSCR by the guest didn't persist across guest exit
      and entry, and some host kernel memory got corrupted.
      
      Cc: stable@vger.kernel.org [v3.1+]
      Signed-off-by: NPaul Mackerras <paulus@samba.org>
      Acked-by: NAlexander Graf <agraf@suse.de>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      cfc86025
    • G
      KVM: nVMX: fix shadow on EPT · d0d538b9
      Gleb Natapov 提交于
      72f85795 broke shadow on EPT. This patch reverts it and fixes PAE
      on nEPT (which reverted commit fixed) in other way.
      
      Shadow on EPT is now broken because while L1 builds shadow page table
      for L2 (which is PAE while L2 is in real mode) it never loads L2's
      GUEST_PDPTR[0-3].  They do not need to be loaded because without nested
      virtualization HW does this during guest entry if EPT is disabled,
      but in our case L0 emulates L2's vmentry while EPT is enables, so we
      cannot rely on vmcs12->guest_pdptr[0-3] to contain up-to-date values
      and need to re-read PDPTEs from L2 memory. This is what kvm_set_cr3()
      is doing, but by clearing cache bits during L2 vmentry we drop values
      that kvm_set_cr3() read from memory.
      
      So why the same code does not work for PAE on nEPT? kvm_set_cr3()
      reads pdptes into vcpu->arch.walk_mmu->pdptrs[]. walk_mmu points to
      vcpu->arch.nested_mmu while nested guest is running, but ept_load_pdptrs()
      uses vcpu->arch.mmu which contain incorrect values. Fix that by using
      walk_mmu in ept_(load|save)_pdptrs.
      Signed-off-by: NGleb Natapov <gleb@redhat.com>
      Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
      Tested-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      d0d538b9
  5. 08 10月, 2013 1 次提交
  6. 07 10月, 2013 1 次提交
    • J
      MIPS: stack protector: Fix per-task canary switch · 8b3c569a
      James Hogan 提交于
      Commit 1400eb65 (MIPS: r4k,octeon,r2300: stack protector: change canary
      per task) was merged in v3.11 and introduced assembly in the MIPS resume
      functions to update the value of the current canary in
      __stack_chk_guard. However it used PTR_L resulting in a load of the
      canary value, instead of PTR_LA to construct its address. The value is
      intended to be random but is then treated as an address in the
      subsequent LONG_S (store).
      
      This was observed to cause a fault and panic:
      
      CPU 0 Unable to handle kernel paging request at virtual address 139fea20, epc == 8000cc0c, ra == 8034f2a4
      Oops[#1]:
      ...
      $24   : 139fea20 1e1f7cb6
      ...
      Call Trace:
      [<8000cc0c>] resume+0xac/0x118
      [<8034f2a4>] __schedule+0x5f8/0x78c
      [<8034f4e0>] schedule_preempt_disabled+0x20/0x2c
      [<80348eec>] rest_init+0x74/0x84
      [<804dc990>] start_kernel+0x43c/0x454
      Code: 3c18804b  8f184030  8cb901f8 <af190000> 00c0e021  8cb002f0 8cb102f4  8cb202f8  8cb302fc
      
      This can also be forced by modifying
      arch/mips/include/asm/stackprotector.h so that the default
      __stack_chk_guard value is more likely to be a bad (or unaligned)
      pointer.
      
      Fix it to use PTR_LA instead, to load the address of the canary value,
      which the LONG_S can then use to write into it.
      
      Reported-by: bobjones (via #mipslinux on IRC)
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Gregory Fong <gregory.0xf0@gmail.com>
      Cc: linux-mips@linux-mips.org
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/6026/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      8b3c569a
  7. 06 10月, 2013 1 次提交
  8. 05 10月, 2013 2 次提交
  9. 04 10月, 2013 1 次提交
  10. 03 10月, 2013 17 次提交
  11. 02 10月, 2013 2 次提交
    • Y
      MIPS: Fix forgotten preempt_enable() when CPU has inclusive pcaches · 5596b0b2
      Yoichi Yuasa 提交于
      [    1.904000] BUG: scheduling while atomic: swapper/1/0x00000002
      [    1.908000] Modules linked in:
      [    1.916000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0-rc2-lemote-los.git-5318619-dirty #1
      [    1.920000] Stack : 0000000031aac000 ffffffff810d0000 0000000000000052 ffffffff802730a4
                0000000000000000 0000000000000001 ffffffff810cdf90 ffffffff810d0000
                ffffffff8068b968 ffffffff806f5537 ffffffff810cdf90 980000009f0782e8
                0000000000000001 ffffffff80720000 ffffffff806b0000 980000009f078000
                980000009f290000 ffffffff805f312c 980000009f05b5d8 ffffffff80233518
                980000009f05b5e8 ffffffff80274b7c 980000009f078000 ffffffff8068b968
                0000000000000000 0000000000000000 0000000000000000 0000000000000000
                0000000000000000 980000009f05b520 0000000000000000 ffffffff805f2f6c
                0000000000000000 ffffffff80700000 ffffffff80700000 ffffffff806fc758
                ffffffff80700000 ffffffff8020be98 ffffffff806fceb0 ffffffff805f2f6c
                ...
      [    2.028000] Call Trace:
      [    2.032000] [<ffffffff8020be98>] show_stack+0x80/0x98
      [    2.036000] [<ffffffff805f2f6c>] __schedule_bug+0x44/0x6c
      [    2.040000] [<ffffffff805fac58>] __schedule+0x518/0x5b0
      [    2.044000] [<ffffffff805f8a58>] schedule_timeout+0x128/0x1f0
      [    2.048000] [<ffffffff80240314>] msleep+0x3c/0x60
      [    2.052000] [<ffffffff80495400>] do_probe+0x238/0x3a8
      [    2.056000] [<ffffffff804958b0>] ide_probe_port+0x340/0x7e8
      [    2.060000] [<ffffffff80496028>] ide_host_register+0x2d0/0x7a8
      [    2.064000] [<ffffffff8049c65c>] ide_pci_init_two+0x4e4/0x790
      [    2.068000] [<ffffffff8049f9b8>] amd74xx_probe+0x148/0x2c8
      [    2.072000] [<ffffffff803f571c>] pci_device_probe+0xc4/0x130
      [    2.076000] [<ffffffff80478f60>] driver_probe_device+0x98/0x270
      [    2.080000] [<ffffffff80479298>] __driver_attach+0xe0/0xe8
      [    2.084000] [<ffffffff80476ab0>] bus_for_each_dev+0x78/0xe0
      [    2.088000] [<ffffffff80478468>] bus_add_driver+0x230/0x310
      [    2.092000] [<ffffffff80479b44>] driver_register+0x84/0x158
      [    2.096000] [<ffffffff80200504>] do_one_initcall+0x104/0x160
      Signed-off-by: NYoichi Yuasa <yuasa@linux-mips.org>
      Reported-by: NAaro Koskinen <aaro.koskinen@iki.fi>
      Tested-by: NAaro Koskinen <aaro.koskinen@iki.fi>
      Cc: linux-mips@linux-mips.org
      Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
      Patchwork: https://patchwork.linux-mips.org/patch/5941/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      5596b0b2
    • T
      x86/simplefb: Fix overflow causing bogus fall-back · e33a29a5
      Tom Gundersen 提交于
      On my MacBook Air lfb_size is 4M, which makes the bitshit
      overflow (to 256GB - larger than 32 bits), meaning we fall
      back to efifb unnecessarily.
      
      Cast to u64 to avoid the overflow.
      Signed-off-by: NTom Gundersen <teg@jklm.no>
      Reviewed-by: NDavid Herrmann <dh.herrmann@gmail.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Stephen Warren <swarren@nvidia.com>
      Cc: Stephen Warren <swarren@wwwdotorg.org>
      Link: http://lkml.kernel.org/r/1380644320-1026-1-git-send-email-teg@jklm.noSigned-off-by: NIngo Molnar <mingo@kernel.org>
      e33a29a5
  12. 01 10月, 2013 3 次提交