summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* can: gs_usb: fix memory leak in gs_cmd_reset()Marc Kleine-Budde2017-09-151-0/+2
| | | | | | | | | | | commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream. This patch adds the missing kfree() in gs_cmd_reset() to free the memory that is not used anymore after usb_control_msg(). Cc: Maximilian Schneider <max@schneidersoft.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* target: Fix kref->refcount underflow in transport_cmd_finish_abortNicholas Bellinger2017-09-153-12/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 73d4e580ccc5c3e05cea002f18111f66c9c07034 upstream. This patch fixes a se_cmd->cmd_kref underflow during CMD_T_ABORTED when a fabric driver drops it's second reference from below the target_core_tmr.c based callers of transport_cmd_finish_abort(). Recently with the conversion of kref to refcount_t, this bug was manifesting itself as: [705519.601034] refcount_t: underflow; use-after-free. [705519.604034] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 20116.512 msecs [705539.719111] ------------[ cut here ]------------ [705539.719117] WARNING: CPU: 3 PID: 26510 at lib/refcount.c:184 refcount_sub_and_test+0x33/0x51 Since the original kref atomic_t based kref_put() didn't check for underflow and only invoked the final callback when zero was reached, this bug did not manifest in practice since all se_cmd memory is using preallocated tags. To address this, go ahead and propigate the existing return from transport_put_cmd() up via transport_cmd_finish_abort(), and change transport_cmd_finish_abort() + core_tmr_handle_tas_abort() callers to only do their local target_put_sess_cmd() if necessary. Reported-by: Bart Van Assche <bart.vanassche@sandisk.com> Tested-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Mike Christie <mchristi@redhat.com> Cc: Hannes Reinecke <hare@suse.de> Cc: Christoph Hellwig <hch@lst.de> Cc: Himanshu Madhani <himanshu.madhani@qlogic.com> Cc: Sagi Grimberg <sagig@mellanox.com> Tested-by: Gary Guo <ghg@datera.io> Tested-by: Chu Yuan Lin <cyl@datera.io> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* KEYS: fix dereferencing NULL payload with nonzero lengthEric Biggers2017-09-151-2/+2
| | | | | | | | | | | | | | | | | | | | commit 5649645d725c73df4302428ee4e02c869248b4c5 upstream. sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a NULL payload with nonzero length to be passed to the key type's ->preparse(), ->instantiate(), and/or ->update() methods. Various key types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did not handle this case, allowing an unprivileged user to trivially cause a NULL pointer dereference (kernel oops) if one of these key types was present. Fix it by doing the copy_from_user() when 'plen' is nonzero rather than when '_payload' is non-NULL, causing the syscall to fail with EFAULT as expected when an invalid buffer is specified. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* srcu: Allow use of Classic SRCU from both process and interrupt contextPaolo Bonzini2017-09-152-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1123a6041654e8f889014659593bad4168e542c2 upstream. Linu Cherian reported a WARN in cleanup_srcu_struct() when shutting down a guest running iperf on a VFIO assigned device. This happens because irqfd_wakeup() calls srcu_read_lock(&kvm->irq_srcu) in interrupt context, while a worker thread does the same inside kvm_set_irq(). If the interrupt happens while the worker thread is executing __srcu_read_lock(), updates to the Classic SRCU ->lock_count[] field or the Tree SRCU ->srcu_lock_count[] field can be lost. The docs say you are not supposed to call srcu_read_lock() and srcu_read_unlock() from irq context, but KVM interrupt injection happens from (host) interrupt context and it would be nice if SRCU supported the use case. KVM is using SRCU here not really for the "sleepable" part, but rather due to its IPI-free fast detection of grace periods. It is therefore not desirable to switch back to RCU, which would effectively revert commit 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING", 2014-01-16). However, the docs are overly conservative. You can have an SRCU instance only has users in irq context, and you can mix process and irq context as long as process context users disable interrupts. In addition, __srcu_read_unlock() actually uses this_cpu_dec() on both Tree SRCU and Classic SRCU. For those two implementations, only srcu_read_lock() is unsafe. When Classic SRCU's __srcu_read_unlock() was changed to use this_cpu_dec(), in commit 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()", 2012-11-29), __srcu_read_lock() did two increments. Therefore it kept __this_cpu_inc(), with preempt_disable/enable in the caller. Tree SRCU however only does one increment, so on most architectures it is more efficient for __srcu_read_lock() to use this_cpu_inc(), and any performance differences appear to be down in the noise. Fixes: 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING") Reported-by: Linu Cherian <linuc.decode@gmail.com> Suggested-by: Linu Cherian <linuc.decode@gmail.com> Cc: kvm@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> [bwh: Backported to 3.16: __srcu_read_lock() still updates two different counters. So follow what _this_cpu_generic_to_op() does and use raw_local_irq_{save,restore}() and raw_cpu_ptr().] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* rcu: Move preemption disabling out of __srcu_read_lock()Paul E. McKenney2017-09-152-3/+4
| | | | | | | | | | | | | | | | | | | commit 49f5903b473c5f63f3b57856d1bd4593db0a2eef upstream. Currently, __srcu_read_lock() cannot be invoked from restricted environments because it contains calls to preempt_disable() and preempt_enable(), both of which can invoke lockdep, which is a bad idea in some restricted execution modes. This commit therefore moves the preempt_disable() and preempt_enable() from __srcu_read_lock() to srcu_read_lock(). It also inserts the preempt_disable() and preempt_enable() around the call to __srcu_read_lock() in do_exit(). Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org> [bwh: Backported to 3.16: - Drop changes in do_exit() - Adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* net: emac: fix reset timeout with AR8035 phyChristian Lamparter2017-09-151-4/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 19d90ece81da802207a9b91ce95a29fbdc40626e upstream. This patch fixes a problem where the AR8035 PHY can't be detected on an Cisco Meraki MR24, if the ethernet cable is not connected on boot. Russell Senior provided steps to reproduce the issue: |Disconnect ethernet cable, apply power, wait until device has booted, |plug in ethernet, check for interfaces, no eth0 is listed. | |This appears to be a problem during probing of the AR8035 Phy chip. |When ethernet has no link, the phy detection fails, and eth0 is not |created. Plugging ethernet later has no effect, because there is no |interface as far as the kernel is concerned. The relevant part of |the boot log looks like this: |this is the failing case: | |[ 0.876611] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode |[ 0.882532] /plb/opb/ethernet@ef600c00: reset timeout |[ 0.888546] /plb/opb/ethernet@ef600c00: can't find PHY! |and the succeeding case: | |[ 0.876672] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode |[ 0.883952] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:.. |[ 0.890822] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01) Based on the comment and the commit message of commit 23fbb5a87c56 ("emac: Fix EMAC soft reset on 460EX/GT"). This is because the AR8035 PHY doesn't provide the TX Clock, if the ethernet cable is not attached. This causes the reset to timeout and the PHY detection code in emac_init_phy() is unable to detect the AR8035 PHY. As a result, the emac driver bails out early and the user left with no ethernet. In order to stay compatible with existing configurations, the driver tries the current reset approach at first. Only if the first attempt timed out, it does perform one more retry with the clock temporarily switched to the internal source for just the duration of the reset. LEDE-Bug: #687 <https://bugs.lede-project.org/index.php?do=details&task_id=687> Cc: Chris Blake <chrisrblake93@gmail.com> Reported-by: Russell Senior <russell@personaltelco.net> Fixes: 23fbb5a87c56e98 ("emac: Fix EMAC soft reset on 460EX/GT") Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* MIPS: kprobes: flush_insn_slot should flush only if probe initialisedMarcin Nowakowski2017-09-151-1/+2
| | | | | | | | | | | | | | | | commit 698b851073ddf5a894910d63ca04605e0473414e upstream. When ftrace is used with kprobes, it is possible for a kprobe to contain an invalid location (ie. only initialised to 0 and not to a specific location in the code). Trying to perform a cache flush on such location leads to a crash r4k_flush_icache_range(). Fixes: c1bf207d6ee1 ("MIPS: kprobe: Add support.") Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16296/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulationWanpeng Li2017-09-151-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a3641631d14571242eec0d30c9faa786cbf52d44 upstream. If "i" is the last element in the vcpu->arch.cpuid_entries[] array, it potentially can be exploited the vulnerability. this will out-of-bounds read and write. Luckily, the effect is small: /* when no next entry is found, the current entry[i] is reselected */ for (j = i + 1; ; j = (j + 1) % nent) { struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j]; if (ej->function == e->function) { It reads ej->maxphyaddr, which is user controlled. However... ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; After cpuid_entries there is int maxphyaddr; struct x86_emulate_ctxt emulate_ctxt; /* 16-byte aligned */ So we have: - cpuid_entries at offset 1B50 (6992) - maxphyaddr at offset 27D0 (6992 + 3200 = 10192) - padding at 27D4...27DF - emulate_ctxt at 27E0 And it writes in the padding. Pfew, writing the ops field of emulate_ctxt would have been much worse. This patch fixes it by modding the index to avoid the out-of-bounds access. Worst case, i == j and ej->function == e->function, the loop can bail out. Reported-by: Moguofang <moguofang@huawei.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Guofang Mo <moguofang@huawei.com> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf script python: Remove dups in documentation examplesSeongJae Park2017-09-151-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | commit 14fc42fa1b3e7ea5160c84d0e686a3a0c1ffe619 upstream. Few shell command examples in perf-script-python.txt has few nitpicks include: - tools/perf/scripts/python directory listing command is unnecessarily repeated. - few examples contain additional information in command prompt unnecessarily and inconsistently. This commit fixes them to enhance readability of the document. Signed-off-by: SeongJae Park <sj38.park@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Tom Zanussi <tzanussi@gmail.com> Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-4-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf script python: Updated trace_unhandled() signatureSeongJae Park2017-09-151-6/+3
| | | | | | | | | | | | | | | | | commit 1bf8d5a4a5da19b1f6e7958fe67db4118fa7a1c1 upstream. Default function signature of trace_unhandled() got changed to include a field dict, but its documentation, perf-script-python.txt has not been updated. Fix it. Signed-off-by: SeongJae Park <sj38.park@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Pierre Tardy <tardyp@gmail.com> Fixes: c02514850d67 ("perf scripts python: Give field dict to unhandled callback") Link: http://lkml.kernel.org/r/20170530111827.21732-6-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf script python: Fix wrong code snippets in documentationSeongJae Park2017-09-151-2/+2
| | | | | | | | | | | | | | | | | commit 26ddb8722df865aa67fbe459107d2f3f8e5c6829 upstream. This commit fixes wrong code snippets for trace_begin() and trace_end() function example definition. Signed-off-by: SeongJae Park <sj38.park@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Tom Zanussi <tzanussi@gmail.com> Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-5-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf script: Fix documentation errorsSeongJae Park2017-09-152-3/+3
| | | | | | | | | | | | | | | | | | | | commit 34d4453dac257be53c21abf2f713c992fb692b5c upstream. This commit fixes two errors in documents for perf-script-python and perf-script-perl as below: - /sys/kernel/debug/tracing events -> /sys/kernel/debug/tracing/events/ - trace_handled -> trace_unhandled Signed-off-by: SeongJae Park <sj38.park@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Tom Zanussi <tzanussi@gmail.com> Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-3-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf script: Fix outdated comment for perf-trace-pythonSeongJae Park2017-09-151-1/+1
| | | | | | | | | | | | | | | | | commit c76132dc5182776b98e946d674cb41c421661ea9 upstream. Script generated by the '--gen-script' option contains an outdated comment. It mentions a 'perf-trace-python' document while it has been renamed to 'perf-script-python'. Fix it. Signed-off-by: SeongJae Park <sj38.park@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: 133dc4c39c57 ("perf: Rename 'perf trace' to 'perf script'") Link: http://lkml.kernel.org/r/20170530111827.21732-2-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* perf probe: Fix examples section of documentationSeongJae Park2017-09-151-2/+6
| | | | | | | | | | | | | | | | | | commit d89269a89ebb6a74512f3f40e89cd12017f60a75 upstream. An example in perf-probe documentation for pattern of function name based probe addition is not providing example command for that case. This commit fixes the example to give appropriate example command. Signed-off-by: SeongJae Park <sj38.park@gmail.com> Acked-by: Masami Hiramatsu <mhiramat@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Taeung Song <treeze.taeung@gmail.com> Fixes: ee391de876ae ("perf probe: Update perf probe document") Link: http://lkml.kernel.org/r/20170507103642.30560-1-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabledUlrik De Bie2017-09-151-0/+16
| | | | | | | | | | | | | | | | | commit 47eb0c8b4d9eb6368941c6a9bb443f00847a46d7 upstream. The Lifebook E546 and E557 touchpad were also not functioning and worked after running: echo "1" > /sys/devices/platform/i8042/serio2/crc_enabled Add them to the list of machines that need this workaround. Signed-off-by: Ulrik De Bie <ulrik.debie-os@e2big.org> Reviewed-by: Arjan Opmeer <arjan@opmeer.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()Dan Carpenter2017-09-151-0/+2
| | | | | | | | | | | commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream. If vmalloc() fails then we need to a bit of cleanup before returning. Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Sinclair Yeh <syeh@vmware.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* net: ethoc: enable NAPI before poll may be scheduledMax Filippov2017-09-151-1/+2
| | | | | | | | | | | | | | | | | | | commit d220b942a4b6a0640aee78841608f4aa5e8e185e upstream. ethoc_reset enables device interrupts, ethoc_interrupt may schedule a NAPI poll before NAPI is enabled in the ethoc_open, which results in device being unable to send or receive anything until it's closed and reopened. In case the device is flooded with ingress packets it may be unable to recover at all. Move napi_enable above ethoc_reset in the ethoc_open to fix that. Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.") Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Tobias Klauser <tklauser@distanz.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* arm: KVM: Allow unaligned accesses at HYPMarc Zyngier2017-09-151-3/+2
| | | | | | | | | | | | | | commit 33b5c38852b29736f3b472dd095c9a18ec22746f upstream. We currently have the HSCTLR.A bit set, trapping unaligned accesses at HYP, but we're not really prepared to deal with it. Since the rest of the kernel is pretty happy about that, let's follow its example and set HSCTLR.A to zero. Modern CPUs don't really care. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Christoffer Dall <cdall@linaro.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* arm64: KVM: Allow unaligned accesses at EL2Marc Zyngier2017-09-151-2/+3
| | | | | | | | | | | | | | | | | | | commit 78fd6dcf11468a5a131b8365580d0c613bcc02cb upstream. We currently have the SCTLR_EL2.A bit set, trapping unaligned accesses at EL2, but we're not really prepared to deal with it. So far, this has been unnoticed, until GCC 7 started emitting those (in particular 64bit writes on a 32bit boundary). Since the rest of the kernel is pretty happy about that, let's follow its example and set SCTLR_EL2.A to zero. Modern CPUs don't really care. Reported-by: Alexander Graf <agraf@suse.de> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Christoffer Dall <cdall@linaro.org> [bwh: Backported to 3.16: s/ELx/EL2/] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* arm64: KVM: Preserve RES1 bits in SCTLR_EL2Marc Zyngier2017-09-152-4/+11
| | | | | | | | | | | | | | | | | | commit d68c1f7fd1b7148dab5fe658321d511998969f2d upstream. __do_hyp_init has the rather bad habit of ignoring RES1 bits and writing them back as zero. On a v8.0-8.2 CPU, this doesn't do anything bad, but may end-up being pretty nasty on future revisions of the architecture. Let's preserve those bits so that we don't have to fix this later on. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Christoffer Dall <cdall@linaro.org> [bwh: Backported to 3.16: - s/ELx/EL2/ - Adjust filename, context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* KVM: nVMX: Fix exception injectionWanpeng Li2017-09-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d4912215d1031e4fb3d1038d2e1857218dba0d0a upstream. WARNING: CPU: 3 PID: 2840 at arch/x86/kvm/vmx.c:10966 nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel] CPU: 3 PID: 2840 Comm: qemu-system-x86 Tainted: G OE 4.12.0-rc3+ #23 RIP: 0010:nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel] Call Trace: ? kvm_check_async_pf_completion+0xef/0x120 [kvm] ? rcu_read_lock_sched_held+0x79/0x80 vmx_queue_exception+0x104/0x160 [kvm_intel] ? vmx_queue_exception+0x104/0x160 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x1171/0x1ce0 [kvm] ? kvm_arch_vcpu_load+0x47/0x240 [kvm] ? kvm_arch_vcpu_load+0x62/0x240 [kvm] kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? __fget+0xf3/0x210 do_vfs_ioctl+0xa4/0x700 ? __fget+0x114/0x210 SyS_ioctl+0x79/0x90 do_syscall_64+0x81/0x220 entry_SYSCALL64_slow_path+0x25/0x25 This is triggered occasionally by running both win7 and win2016 in L2, in addition, EPT is disabled on both L1 and L2. It can't be reproduced easily. Commit 0b6ac343fc (KVM: nVMX: Correct handling of exception injection) mentioned that "KVM wants to inject page-faults which it got to the guest. This function assumes it is called with the exit reason in vmcs02 being a #PF exception". Commit e011c663 (KVM: nVMX: Check all exceptions for intercept during delivery to L2) allows to check all exceptions for intercept during delivery to L2. However, there is no guarantee the exit reason is exception currently, when there is an external interrupt occurred on host, maybe a time interrupt for host which should not be injected to guest, and somewhere queues an exception, then the function nested_vmx_check_exception() will be called and the vmexit emulation codes will try to emulate the "Acknowledge interrupt on exit" behavior, the warning is triggered. Reusing the exit reason from the L2->L0 vmexit is wrong in this case, the reason must always be EXCEPTION_NMI when injecting an exception into L1 as a nested vmexit. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> Fixes: e011c663b9c7 ("KVM: nVMX: Check all exceptions for intercept during delivery to L2") Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: Add quirk for Dell PIXART OEM mouseSebastian Parschauer2017-09-152-0/+4
| | | | | | | | | | | commit 3db28271f0feae129262d30e41384a7c4c767987 upstream. This mouse is also known under other IDs. It needs the quirk ALWAYS_POLL or will disconnect in runlevel 1 or 3. Signed-off-by: Sebastian Parschauer <sparschauer@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switchVasilis Liaskovitis2017-09-152-0/+2
| | | | | | | | | | | | | | commit d529a4ad91efcf68b65440c6555895fd7ad5a08e upstream. Like other switches, the Aten CS-1758 KVM switch needs a quirk to avoid spewing errors: [12599018.071059] usb 5-2: input irq status -75 received [12599018.079053] usb 5-2: input irq status -75 received Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGBOscar Campos2017-09-152-0/+6
| | | | | | | | | | | | | | | | | commit deaba636997557fce46ca7bcb509bff5ea1b0558 upstream. Add quirks for several corsair gaming devices to avoid long delays on report initialization Supported devices: - Corsair K65RGB Rapidfire Gaming Keyboard - Corsair K70RGB Rapidfire Gaming Keyboard - Corsair Scimitar Pro RGB Gaming Mouse Signed-off-by: Oscar Campos <oscar.campos@member.fsf.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLLColin Ian King2017-09-152-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ed9ab4287f96e66340e0390e2c583f2f9110cba0 upstream. Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI virtual keyboard and mouse from not responding and timing out when it is attached to a ppc64el Power 8 system and when we have some rapid open/closes on the mouse device. usb 1-3: new high-speed USB device number 2 using xhci_hcd usb 1-3: New USB device found, idVendor=046b, idProduct=ff01 usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-3: Product: Virtual Hub usb 1-3: Manufacturer: American Megatrends Inc. usb 1-3: SerialNumber: serial usb 1-3.3: new high-speed USB device number 3 using xhci_hcd usb 1-3.3: New USB device found, idVendor=046b, idProduct=ff31 usb 1-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-3.3: Product: Virtual HardDisk Device usb 1-3.3: Manufacturer: American Megatrends Inc. usb 1-3.4: new low-speed USB device number 4 using xhci_hcd usb 1-3.4: New USB device found, idVendor=046b, idProduct=ff10 usb 1-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 1-3.4: Product: Virtual Keyboard and Mouse usb 1-3.4: Manufacturer: American Megatrends Inc. With the quirk I have not been able to trigger the issue with half an hour of saturation soak testing. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar.Marcel Hasler2017-09-152-0/+2
| | | | | | | | | | | | | commit 8aa2cc7e747881d1fd52db28261b201d4e3e5565 upstream. The DolphinBar by Mayflash (identified as Dragonrise) needs HID_QUIRK_MULTI_INPUT to split it up into four input devices. Without this quirk the adapter is falsely recognized as a tablet. See also bug 115841 (https://bugzilla.kernel.org/show_bug.cgi?id=115841). Signed-off-by: Marcel Hasler <mahasler@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFDAlex Wood2017-09-152-0/+4
| | | | | | | | | | | commit f83f90cf7ba68deb09406ea9da80852a64c4db29 upstream. The Futaba TOSD-5711BB VFD crashes when the initial HID report is requested, register the display in hid-ids and tell hid-quirks to not do the init. Signed-off-by: Alex Wood <thetewood@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: microsoft: Add Surface 4 type cover pro 4 not JP versionsDaniel Keller2017-09-154-0/+12
| | | | | | | | | | | | | | commit 2ae3986b84e9d325bc92a1efbcf0c6b0f5016b35 upstream. Adding support for not JP versions of the Microsoft Surface 4 Type Cover Pro [jkosina@suse.cz: The identical patch has been sent by Jeff Farthing, so I am including his signoff as well] Signed-off-by: Jeff Farthing <jeff@jfarthing.com> Signed-off-by: Daniel Keller <daniel.keller@gcd.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Add quirks for Mayflash/Dragonrise GameCube and PS3 adaptersMarcel Hasler2017-09-152-2/+6
| | | | | | | | | | | | | | commit b2554000f5b5d2a3a368d09c6debf7da64901fcf upstream. All known gamepad adapters by Mayflash (identified as Dragonrise) need HID_QUIRK_MULTI_INPUT to split them up into four input devices. Without this quirk those adapters are falsely recognized as tablets. Fixes bug 115841 (https://bugzilla.kernel.org/show_bug.cgi?id=115841). Signed-off-by: Marcel Hasler <mahasler@gmail.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: add quirk for Akai MIDImix.Steinar H. Gunderson2017-09-152-0/+4
| | | | | | | | | | | | | | | | | | commit 4973ca9a01e2354b159acedec1b9b8eb8de02ab7 upstream. The Akai MIDImix (09e8:0031) is a MIDI fader controller that speaks regular MIDI and works well with Linux. However, initialization gets delayed due to reports timeout: [3643645.631124] hid-generic 0003:09E8:0031.0020: timeout initializing reports [3643645.632416] hid-generic 0003:09E8:0031.0020: hiddev0: USB HID v1.11 Device [AKAI MIDI Mix] on usb-0000:00:14.0-2/input0 Adding "usbhid.quirks=0x09e8:0x0031:0x20000000" on the kernel command line makes the issues go away. Signed-off-by: Steinar H. Gunderson <sgunderson@bigfoot.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: support for keyboard - Corsair STRAFEMarian Krivoš2017-09-152-0/+2
| | | | | | | | | | | | | commit 3da30bfc0b0a572a4f977a586edf34cf3dd503c3 upstream. Add quirk for Corsair STRAFE keyboard, similarly to what we've been doing for other CORSAIR devices already, in order to avoid long delays during boot. [jkosina@suse.cz: reword changelog a little bit] Signed-off-by: Marian Krivos <marian.krivos@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: microsoft: Add Surface 4 type cover pro 4 (JP)Yuta Kobayashi2017-09-154-0/+6
| | | | | | | | | | commit b490a8537df60d449199e162417da74ee9262515 upstream. Adding support for the Microsoft Surface 4 Type Cover Pro (JP). Signed-off-by: Yuta Kobayashi <alu.ula@outlook.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, ↵Trent Lloyd2017-09-152-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | K70RGB, K65RGB) commit 282bf1fe6dca4b768d6bedc14aea1b82c36241c1 upstream. These devices feature multiple interfaces/endpoints: a legacy BIOS/boot interface (endpoint 0x81), as well as 2 corsair-specific keyboard interfaces (endpoint 0x82, 0x83 IN/0x03 OUT) and an RGB LED control interface (endpoint 0x84 IN/0x04 OUT) Because the extra 3 interfaces are not of subclass USB_INTERFACE_SUBCLASS_BOOT, HID_QUIRK_NOGET is not automatically set on them and a 10s timeout per-endpoint (30s per device) occurs initialising reports on boot. We configure HID_QUIRK_NO_INIT_REPORTS for these devices. Additionally the left-side G1-G18 macro keys on the K95RGB generate output on the un-opened 0x82/0x83 endpoints which causes the keyboard to stop responding waiting for this event to be collected. We enable HID_QUIRK_ALWAYS_POLL to prevent this situation from occurring. Signed-off-by: Trent Lloyd <trent@lloyd.id.au> Tested-by: SUGNIAUX Wilfried <wsu@ppharm2k20.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirkNazar Mokrynskyi2017-09-152-0/+2
| | | | | | | | | | | | commit 567a44ecb44eb2584ddb93e962cfb133ce77e0bb upstream. Needed for v2 of the device firmware, otherwise kernel will stuck for few seconds and throw "usb_submit_urb(ctrl) failed: -1" early on system boot. Signed-off-by: Nazar Mokrynskyi <nazar@mokrynskyi.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2Daniel Bristot de Oliveira2017-09-152-0/+2
| | | | | | | | | | | | | | | | | | | | commit c14022bfd2eb2d2ece74a405dfbdb02a829c07bc upstream. The device which identifies itself as a "USB Keykoard" (no typo) with VID:PID 1a2c:0027 does not seem to be handling the reports initialization very well. This results in a "usb_submit_urb(ctrl) failed: -1" message from the kernel when connected, and a delay before its initialization. It can also cause the hang the system. This patch adds the quirk for this device, which causes the delay to disappear. It is named as "USB Keykoard2" because the "USB Keykoard" already exists. Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: quirks: Add no_init_reports for AKAI midi controllerStafford Horne2017-09-152-0/+4
| | | | | | | | | | | | | | commit a382c30c662a31dd8f51cc4b6dad82d39205d50c upstream. The midi controller times-out while initializing reports, this causes boot to take an extra 10 seconds. The device descriptor advertises that it has an internal HID device but seems to not actually do anything useful. Signed-off-by: Stafford Horne <shorne@gmail.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: add HID_QUIRK_NOGET to Quanta 3003 tooBenjamin Tissoires2017-09-152-0/+2
| | | | | | | | | | | | | | | | commit 962b7a0e77015802f0ceefe6f0e3cad3f10fd4f8 upstream. dmesg shows a lot of: [ 1374.890348] hid-multitouch 0003:0408:3003.0007: usb_submit_urb(ctrl) failed: -1 [ 1384.916388] hid-multitouch 0003:0408:3003.0007: usb_submit_urb(ctrl) failed: -1 [ 1384.916432] hid-multitouch 0003:0408:3003.0007: timeout initializing reports Add the quirk and make the touchscreen happy. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Tested-by: Jim lovell <jimlovell777@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* USB: quirks: Apply ALWAYS_POLL to all ELAN devicesAdrien Vergé2017-09-152-11/+3
| | | | | | | | | | | | | | | commit 33bd2dd03dd0bfa1130d11062a9e5f40d0cf1d3f upstream. All ELAN hid devices seem to require the ALWAYS_POLL quirk. Let's use this quirk for all devices from this vendor, rather than maintaining a list of all its known product IDs. Tested-by: Adrien Vergé <adrienverge@gmail.com> Signed-off-by: Adrien Vergé <adrienverge@gmail.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: add Logitech G710+ keyboard quirk NOGETJimmy Berry2017-09-152-0/+2
| | | | | | | | | | | commit 0d51571d51ea8eb72b903b2a4f3f43a38e7bc718 upstream. Without quirk keyboard repeats '6' until volume control is used since it indicates the key is pressed without ever releasing. Signed-off-by: Jimmy Berry <jimmy@boombatower.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Fix for the WiiU adapter from MayflashOliver Schmitt2017-09-152-0/+2
| | | | | | | | | | | | | | | | | | | | | commit b6ad9a26e7c6fae74062baa9b8a7f583a803e092 upstream. The WiiU adapter from Mayflash (see http://www.mayflash.com/Products/NINTENDOWiiU/W009.html) is not working correctly. The "XInput" mode works fine, the controller is recognized as a xbox controller. But it is only possible to connect one controller with this method. In "DInput" mode the device is recognized as some kind of mouse input but no joystick is created. This commit will change this behavior with HID_QUIRK_MULTI_INPUT to split the device into 4 input devices so that it will also create joysticks in /dev/input/js*. Signed-off-by: Oliver Schmitt <voltumna@gmx.net> Reviewed-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: Add new Microsoft Type Cover 3 product IDDonavan Lance2017-09-154-0/+6
| | | | | | | | | | commit c6956eb70e2549a3c2fa6ee525e02776d293caf4 upstream. Adds support for Microsoft Type Cover 3 with 0x07e2 product ID. Signed-off-by: Donavan Lance <shvr@fedoraproject.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: quirks: add QUIRK_NOGET for an other TPV touchscreenBenjamin Tissoires2017-09-152-2/+4
| | | | | | | | | | | | | commit c9b57724b38d4c1555ee49418be3d76801e3327c upstream. Looks like 0x8882 needs the same quirk than 0x8883. Given that both devices claim they are "TPV OpticalTouchScreen" rename the 0x8883 to add its PID in the #define. Reported-by: Blaine Lee <blaine.j.lee@medtronic.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: microsoft: Add Surface 3 type coverStephen Just2017-09-154-8/+14
| | | | | | | | | | | | | | | | commit 0439de75d32c249bd9f5824ffd5e40c4c2109d77 upstream. Adding support for the Microsoft Surface 3 (non-pro) Type Cover. The existing definitions and quirks are actually for the Surface Pro 3 type covers. I've renamed the old constants to reflect that they belong to the Surface Pro 3, and added a new constant and matching code for the Surface 3. Signed-off-by: Stephen Just <stephenjust@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: microsoft: Add quirk for MS Surface Type/Touch coverReyad Attiyat2017-09-151-0/+3
| | | | | | | | | | | commit c5b2b809cee8db018ac68566fe2114c175d79b5b upstream. The newer firmware on MS Surface 2 tablets causes the type and touch cover keyboards to timeout when waiting for reports. The quirk HID_QUIRK_NO_INIT_REPORTS allows them to function normally. Signed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: microsoft: Add Surface Power CoverRaimund Roth2017-09-154-1/+7
| | | | | | | | | | | commit 18eec2cd7e9746cd672ada102987534ae16f0f44 upstream. Adding support for the Microsoft Surface Pro Power Cover. Signed-off-by: Raimund Roth <raimundmroth@gmail.gom> Signed-off-by: Jiri Kosina <jkosina@suse.cz> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: sjoy: support Super Joy Box 4Sean Young2017-09-153-1/+4
| | | | | | | | | | | commit 6e5e9a06a206010eabd19b523fd0833c51afc0b0 upstream. This device supports force feedback and has two ports. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: Add a quirk for raphnet multi-gamepad adaptersRaphael Assenat2017-09-152-0/+10
| | | | | | | | | | | | | | | | commit d6ea2f88ac3659b799d8079a4fbda4f8faf6ff90 upstream. The raphnet.net 4nes4snes and 2nes2snes multi-joystick adapters use a single HID report descriptor with one report ID per controller. This has the effect that the inputs of otherwise independent game controllers get packed in one large joystick device. With this patch each controller gets its own /dev/input/jsX device, which is more natural and less confusing than having all inputs going to the same place. Signed-off-by: Raphael Assenat <raph@raphnet.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: yet another mouse with ALWAYS_POLLOliver Neukum2017-09-152-2/+4
| | | | | | | | | | | commit 43faadfe96d3f049f4ae2c4090d2e57b9aafb995 upstream. The device exists with two device IDs instead of one as previously believed. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: usbhid: more mice with ALWAYS_POLLOliver Neukum2017-09-152-0/+8
| | | | | | | | | | | commit 003e817a9ecf6cfded59630858bbf04056d71e9a upstream. During a stress test these mice kept dropping and reappearing in runlevel 1 as opposed to 5. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* HID: uclogic: Set quirks from inside the driverBenjamin Tissoires2017-09-152-4/+27
| | | | | | | | | | | | | | | | | | | | | | | commit 70b69cfb88467988116c4863056495fa3615271a upstream. Based on a patch from: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> Most of the tablets handled by hid-uclogic already use MULTI_INPUT. For the ones which are not quirked in usbhid/hidquirks, they have a custom report descriptor which contains only one report per HID interface. For those tablets HID_QUIRK_MULTI_INPUT is transparent. According to https://github.com/DIGImend/tablets, the only problematic tablet currently handled by hid-uclogic is the TWHA60 v3. This tablet presents different report descriptors from the ones currently quirked. This is not a problem per se, given that this tablet is not supported currently in this version (it needs the same command as a Huion to start forwarding events). Reviewed-by: Nikolai Kondrashov <spbnick@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-03 21:08:45 +0000