md/raid10: Fix memory leak when raid10 reshape completes.

When a raid10 commences a resync/recovery/reshape it allocates
some buffer space.
When a resync/recovery completes the buffer space is freed.  But not
when the reshape completes.
This can result in a small memory leak.

There is a subtle side-effect of this bug.  When a RAID10 is reshaped
to a larger array (more devices), the reshape is immediately followed
by a "resync" of the new space.  This "resync" will use the buffer
space which was allocated for "reshape".  This can cause problems
including a "BUG" in the SCSI layer.  So this is suitable for -stable.

Cc: stable@vger.kernel.org (v3.5+)
Fixes: 3ea7daa5d7fde47cd41f4d56c2deb949114da9d6
Signed-off-by: NeilBrown <neilb@suse.de>
md/raid10: avoid memory leak on error path during reshape.

If raid10 reshape fails to find somewhere to read a block
from, it returns without freeing memory...

Signed-off-by: NeilBrown <neilb@suse.de>
md/raid10: always initialise ->state on newly allocated r10_bio

Most places which allocate an r10_bio zero the ->state, some don't.
As the r10_bio comes from a mempool, and the allocation function uses
kzalloc it is often zero anyway.  But sometimes it isn't and it is
best to be safe.

I only noticed this because of the bug fixed by an earlier patch
where the r10_bios allocated for a reshape were left around to
be used by a subsequent resync.  In that case the R10BIO_IsReshape
flag caused problems.

Signed-off-by: NeilBrown <neilb@suse.de>
ALSA: hda/hdmi - set depop_delay for haswell plus

Both Haswell and Broadwell need set depop_delay to 0. So apply this
setting to haswell plus.

Signed-off-by: Libin Yang <libin.yang@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display codec

Valleyview and Cherryview have the same behavior on display audio. So this patch
defines is_valleyview_plus() to include codecs for both Valleyview and its successor
Cherryview, and apply Valleyview fix-ups to Cherryview.

Signed-off-by: Libin Yang <libin.yang@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
MIPS: MSP71xx: remove unused plat_irq_dispatch() argument

Remove unused argument to make the plat_irq_dispatch() function
declaration similar to the realization of other platforms.

Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Cc: Linux MIPS <linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/7538/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: Add common plat_irq_dispatch declaration

Add common declaration to get rid of following sparse warning: "symbol
'plat_irq_dispatch' was not declared. Should it be static?"

Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Cc: Linux MIPS <linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/7539/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: Remove duplicated include from numa.c

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/7537/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: BCM47XX: Fix reboot problem on BCM4705/BCM4785

This adds some code based on code from the Broadcom GPL tar to fix the
reboot problems on BCM4705/BCM4785. I tried rebooting my device for ~10
times and have never seen a problem. This reverts the changes in the
previous commit and adds the real fix as suggested by Rafał.

Setting bit 22 in Reg 22, sel 4 puts the BIU (Bus Interface Unit) into
async mode.

The previous commit was 316cad5c1d4daee998cd1f83ccdb437f6f20d45c [MIPS:
BCM47XX: make reboot more relaiable]

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Cc: jogo@openwrt.org
Cc: zajec5@gmail.com
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7545/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: Alchemy: Fix db1200 PSC clock enablement

Enable PSC0 (I2C/SPI) clock and leave PSC1 (Audio) alone.  This patch
restores functionality to both Audio and I2C/SPI.

Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
Cc: Linux-MIPS <linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/7544/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: Malta: Improve system memory detection for '{e, }memsize' >= 2G

Using kstrtol to parse the "{e,}memsize" variables was wrong because this
parses signed long numbers. In case of '{e,}memsize' >= 2G, the top bit
is set, resulting to -ERANGE errors and possibly random system memory
boundaries. We fix this by replacing "kstrtol" with "kstrtoul".
We also improve the code to check the kstrtoul return value and
print a warning if an error was returned.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: <stable@vger.kernel.org> # v3.15+
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7543/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
MIPS: Remove race window in page fault handling

Multicore MIPSes without I/D hardware coherency suffered from a race
condition in the page fault handler. The page table entry was
published before any pending lazy D-cache flush was committed, hence
it allowed execution of stale page cache data by other VPEs in the
system.

To make the cache handling safe we need to perform flushing already in
the set_pte_at function. MIPSes without coherent I-caches can get a
small increase in flushes due to the unavailability of the execute
flag in set_pte_at.

[ralf@linux-mips.org: outlining set_pte_at() saves a good k in a test
build, so I moved its definition from pgtable.h to cache.c.]

Signed-off-by: Lars Persson <larper@axis.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7511/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
ARM: dts: imx6sx: fix the pad setting for uart CTS_B

The current pinfunc define all uart CTS_B IO port for DCE uart 'CTS_B'
IP port. Since uart IP port 'CTS_B' is output, and it don't need to
set 'SELECT_INPUT' bit.

Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@freescale.com>
kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)

The third parameter of kvm_iommu_put_pages is wrong,
It should be 'gfn - slot->base_gfn'.

By making gfn very large, malicious guest or userspace can cause kvm to
go to this error path, and subsequently to pass a huge value as size.
Alternatively if gfn is small, then pages would be pinned but never
unpinned, causing host memory leak and local DOS.

Passing a reasonable but large value could be the most dangerous case,
because it would unpin a page that should have stayed pinned, and thus
allow the device to DMA into arbitrary memory.  However, this cannot
happen because of the condition that can trigger the error:

- out of memory (where you can't allocate even a single page)
  should not be possible for the attacker to trigger

- when exceeding the iommu's address space, guest pages after gfn
  will also exceed the iommu's address space, and inside
  kvm_iommu_put_pages() the iommu_iova_to_phys() will fail.  The
  page thus would not be unpinned at all.

Reported-by: Jack Morgenstein <jackm@mellanox.com>
Cc: stable@vger.kernel.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
PC, KVM, CMA: Fix regression caused by wrong get_order() use

fc95ca7284bc54953165cba76c3228bd2cdb9591 claims that there is no
functional change but this is not true as it calls get_order() (which
takes bytes) where it should have called order_base_2() and the kernel
stops on VM_BUG_ON().

This replaces get_order() with order_base_2() (round-up version of ilog2).

Suggested-by: Paul Mackerras <paulus@samba.org>
Cc: Alexander Graf <agraf@suse.de>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: Avoid emulating instructions on #UD mistakenly

Commit d40a6898e5 mistakenly caused instructions which are not marked as
EmulateOnUD to be emulated upon #UD exception. The commit caused the check of
whether the instruction flags include EmulateOnUD to never be evaluated. As a
result instructions whose emulation is broken may be emulated.  This fix moves
the evaluation of EmulateOnUD so it would be evaluated.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
[Tweak operand order in &&, remove EmulateOnUD where it's now superfluous.
 - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: do not check CS.DPL against RPL during task switch

This reverts the check added by commit 5045b468037d (KVM: x86: check CS.DPL
against RPL during task switch, 2014-05-15).  Although the CS.DPL=CS.RPL
check is mentioned in table 7-1 of the SDM as causing a #TSS exception,
it is not mentioned in table 6-6 that lists "invalid TSS conditions"
which cause #TSS exceptions. In fact it causes some tests to fail, which
pass on bare-metal.

Keep the rest of the commit, since we will find new uses for it in 3.18.

Reported-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Revert "KVM: x86: Increase the number of fixed MTRR regs to 10"

This reverts commit 682367c494869008eb89ef733f196e99415ae862,
which causes 32-bit SMP Windows 7 guests to panic.

SeaBIOS has a limit on the number of MTRRs that it can handle,
and this patch exceeded the limit.  Better revert it.
Thanks to Nadav Amit for debugging the cause.

Cc: stable@nongnu.org
Reported-by: Wanpeng Li <wanpeng.li@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it

As a generic function, deassign_guest_irq() assumes it can be called
even if assign_guest_irq() is not be called successfully (which can be
triggered by ioctl from user mode, indirectly).

So for assign_guest_irq() failure process, need set 'dev->irq_source_id'
to -1 after free 'dev->irq_source_id', or deassign_guest_irq() may free
it again.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
ARM: dts: imx53-qsrb: Fix suspend/resume

The following error is seen after a suspend/resume cycle on a mx53qsb with a
MC34708 PMIC:

root@freescale /$ echo mem > /sys/power/state
[   32.630592] PM: Syncing filesystems ... done.
[   32.643924] Freezing user space processes ... (elapsed 0.001 seconds) done.
[   32.652384] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
[   32.679156] PM: suspend of devices complete after 13.113 msecs
[   32.685128] PM: suspend devices took 0.030 seconds
[   32.696109] PM: late suspend of devices complete after 6.133 msecs
[   33.313032] mc13xxx 0-0008: Failed to read IRQ status: -110
[   33.322009] PM: noirq suspend of devices complete after 619.667 msecs
[   33.328544] Disabling non-boot CPUs ...
[   33.335031] PM: noirq resume of devices complete after 2.352 msecs
[   33.842940] mc13xxx 0-0008: Failed to read IRQ status: -110
[   33.976095] [sched_delayed] sched: RT throttling activated
[   33.984804] PM: early resume of devices complete after 642.642 msecs
[   34.352954] mc13xxx 0-0008: Failed to read IRQ status: -110
[   34.862910] mc13xxx 0-0008: Failed to read IRQ status: -110
[   34.996595] PM: resume of devices complete after 1005.367 msecs
[   35.372925] mc13xxx 0-0008: Failed to read IRQ status: -110
[   35.882911] mc13xxx 0-0008: Failed to read IRQ status: -110
[   35.955707] PM: resume devices took 1.970 seconds
[   35.960445] Restarting tasks ... done.
[   35.993386] fec 63fec000.ethernet eth0: Link is Down
[   36.392980] mc13xxx 0-0008: Failed to read IRQ status: -110
[   36.902908] mc13xxx 0-0008: Failed to read IRQ status: -110
[   36.953036] ata1: SATA link down (SStatus 0 SControl 300)
[   37.412922] mc13xxx 0-0008: Failed to read IRQ status: -110
[   37.922906] mc13xxx 0-0008: Failed to read IRQ status: -110
[   37.993379] fec 63fec000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
[   38.432938] mc13xxx 0-0008: Failed to read IRQ status: -110
[   38.942920] mc13xxx 0-0008: Failed to read IRQ status: -110
[   39.452933] mc13xxx 0-0008: Failed to read IRQ status: -110

(flood of this error message continues forever)

Commit 5169df8be0a432ee ("ARM: dts: i.MX53: add support for MCIMX53-START-R")
missed to configure the IOMUX for the PMIC IRQ pin.

Configure the PMIC IRQ pin so that the suspend/resume sequence behaves cleanly
as expected.

Cc: <stable@vger.kernel.org> # 3.16
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@freescale.com>