android-sdk/kernel-video.git
6 years agoti: config: android: disable kdevtmpfs
Vishal Mahaveer [Tue, 14 Jul 2015 23:21:00 +0000 (18:21 -0500)]
ti: config: android: disable kdevtmpfs

Having CONFIG_DEVTMPFS enabled causes SELinux denials for mknod permissions.
Since we don't use this, disabling it.

Other option is to write a new rule for devtmpfs

Change-Id: I45ae0111bf0f7116549d3cf9214834b57cdd4d83
Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android
Praneeth Bajjuri [Thu, 23 Jul 2015 18:43:38 +0000 (13:43 -0500)]
Merge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android

* p-ti-linux-3.14.y-common:
  usb: dwc3: run/stop metastability workaround: i819
  ARM: dts: DRA7: Fix tlv320aic3106 i2c address

Change-Id: Ib9ba569f99736c11de728bd473ed4d52d82d7cfe
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android...
Praneeth Bajjuri [Thu, 23 Jul 2015 18:41:39 +0000 (13:41 -0500)]
Merge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio into p-ti-linux-3.14.y-common

* 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio:
  ARM: dts: DRA7: Fix tlv320aic3106 i2c address

Change-Id: I2ecde01de076b517146395574f066a14dbd5dbb9
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'p-android-3.14' into p-ti-linux-3.14.y-android
Praneeth Bajjuri [Tue, 21 Jul 2015 18:25:56 +0000 (13:25 -0500)]
Merge branch 'p-android-3.14' into p-ti-linux-3.14.y-android

* p-android-3.14:
  net/ipv4: android: don't destroy sockets on TCP_TIME_WAIT
  uid_cputime: fix cputime overflow
  initramfs: Add skip_initramfs command line option
  cpu_power: Avoids race condition when the task exits.
  of: add empty of_find_node_by_path() for !OF
  uid_cputime: Avoids double accounting of process stime, utime and cpu_power in task exit.
  Shrink ashmem directly through shmem_fallocate
  cpufreq: Iterate over all the possible cpus to create powerstats.
  sched: cpufreq: update power usage only if cpufreq_stat is enabled
  uid_cputime: Extends the cputime functionality to report power per uid
  sched: cpufreq: Adds a field cpu_power in the task_struct
  cpufreq_stats: Adds the fucntionality to load current values for each frequency for all the cores.
  New Build Breakage in branch: kernel-m-dev-tegra-flounder-3.10 @ 1960706
  net/unix: sk_socket can disappear when state is unlocked
  selinux: enable genfscon labeling for sysfs and pstore files
  ext4: don't save the error information if the block device is read-only

Conflicts:
drivers/cpufreq/cpufreq_stats.c

Change-Id: Ia55fa9903e1955b5f1839d0f17239147e460ea1b
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agonet/ipv4: android: don't destroy sockets on TCP_TIME_WAIT
Jorge Ramirez-Ortiz [Fri, 17 Jul 2015 15:29:39 +0000 (11:29 -0400)]
net/ipv4: android: don't destroy sockets on TCP_TIME_WAIT

Sockets in this state end up being released by the stack when the
connection is stablished again.

This commit fixes a spinlock lockup that can be reproduced as follows:

1. stablish a wifi connection.
2. stream/play a video with the web client.
3. switch off the router or close the connection while playing.

trace:

[   92.754225] BUG: spinlock lockup suspected on CPU#5, netd/1747
[   92.760095]  lock: 0xffffffc03364cfb0, .magic: 0bd10606, .owner:
[   92.768113] CPU: 5 PID: 1747 Comm: netd Tainted:
[   92.775168] Call trace:
[   92.777625] [<ffffffc000088d24>] dump_backtrace+0x0/0x124
[   92.783027] [<ffffffc000088e58>] show_stack+0x10/0x1c
[   92.788092] [<ffffffc000906208>] dump_stack+0x74/0xb8
[   92.793147] [<ffffffc000101e14>] spin_dump+0x68/0x90
[   92.798122] [<ffffffc000102044>] do_raw_spin_lock+0x178/0x1b0
[   92.803871] [<ffffffc00090ca48>] _raw_spin_lock+0x40/0x50
[   92.809283] [<ffffffc0007f271c>] tcp_nuke_addr+0x2cc/0x3b8
[   92.814779] [<ffffffc00081fea8>] devinet_ioctl+0x44c/0x7a0
[   92.820266] [<ffffffc0008222ec>] inet_ioctl+0x88/0xa8
[   92.825330] [<ffffffc00074d2b4>] sock_do_ioctl+0x30/0x70
[   92.830643] [<ffffffc00074db6c>] sock_ioctl+0x234/0x320
[   92.835880] [<ffffffc000215004>] do_vfs_ioctl+0x350/0x59c
[   92.841279] [<ffffffc0002152d0>] SyS_ioctl+0x80/0x98

Change-Id: Icf7e71ff238b5be3f26d597592ffdb0dff0819e6
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
[Picked and validated on TI platform]
Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
6 years agoMerge branch 'android-3.14' of https://android.googlesource.com/kernel/common into...
Praneeth Bajjuri [Tue, 21 Jul 2015 18:01:53 +0000 (13:01 -0500)]
Merge branch 'android-3.14' of https://android.googlesource.com/kernel/common into p-android-3.14

* 'android-3.14' of https://android.googlesource.com/kernel/common:
  uid_cputime: fix cputime overflow
  initramfs: Add skip_initramfs command line option
  cpu_power: Avoids race condition when the task exits.
  of: add empty of_find_node_by_path() for !OF
  uid_cputime: Avoids double accounting of process stime, utime and cpu_power in task exit.
  Shrink ashmem directly through shmem_fallocate
  cpufreq: Iterate over all the possible cpus to create powerstats.
  sched: cpufreq: update power usage only if cpufreq_stat is enabled
  uid_cputime: Extends the cputime functionality to report power per uid
  sched: cpufreq: Adds a field cpu_power in the task_struct
  cpufreq_stats: Adds the fucntionality to load current values for each frequency for all the cores.
  New Build Breakage in branch: kernel-m-dev-tegra-flounder-3.10 @ 1960706
  net/unix: sk_socket can disappear when state is unlocked
  selinux: enable genfscon labeling for sysfs and pstore files
  ext4: don't save the error information if the block device is read-only

Change-Id: Icdcc50352b5d4adeabced0a5541ed27aa776e425
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agousb: dwc3: run/stop metastability workaround: i819
Roger Quadros [Tue, 23 Jun 2015 13:58:36 +0000 (16:58 +0300)]
usb: dwc3: run/stop metastability workaround: i819

The existing workaround of forcing DEVSPD to SUPER_SPEED
for HIGH_SPEED ports is causing another side effect
which causes erratic interrupts and delayed gadget
enumeration of upto 2 seconds.

Work around the run/stop issue by detecting if
it happened using debug LTSSM state and issuing
soft reset to the controller when changing RUN_STOP
from 0 to 1.

We apply the workaround only if PRTCAP is DEVICE mode.

Use USB RESET event as exit condition for workaround.

Change-Id: I8b6f526f3a147b8907f184f84e6b1f754bf9a94d
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Ravi Babu <ravibabu@ti.com>
6 years agoARM: dts: DRA7: Fix tlv320aic3106 i2c address
Misael Lopez Cruz [Mon, 20 Jul 2015 22:51:45 +0000 (17:51 -0500)]
ARM: dts: DRA7: Fix tlv320aic3106 i2c address

i2c address of the tlv320aic3106 audio codec is 0x18 in
J6 EVM boards with 7" panel (Rev. E or older).  Newer
EVM boards have a 10" panel whose i2c address is also
0x18, so the codec address is change to 0x19 instead.

The lcd7 dtsi file includes the lcd10 one, which makes
the i2c address to be incorrectly overwritten to 0x19.
At this point, the less invasive solution is just
explicitly setting the codec's i2c address back to 0x18.

Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android
Praneeth Bajjuri [Fri, 17 Jul 2015 18:45:12 +0000 (13:45 -0500)]
Merge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android

* p-ti-linux-3.14.y-common: (34 commits)
  ASoC: davinci-mcasp: Add workaround for errata i868
  ASoC: davinci-mcasp: Get McASP IP revision number on DRA7xx
  Linux 3.14.48
  x86/iosf: Add Kconfig prompt for IOSF_MBI selection
  arm/arm64: KVM: Keep elrsr/aisr in sync with software model
  arm64: KVM: Do not use pgd_index to index stage-2 pgd
  arm64: KVM: Fix HCR setting for 32bit guests
  arm64: KVM: Fix TLB invalidation by IPA/VMID
  arm/arm64: KVM: Require in-kernel vgic for the arch timers
  vfs: Ignore unlocked mounts in fs_fully_visible
  vfs: Remove incorrect debugging WARN in prepend_path
  fs: Fix S_NOSEC handling
  KVM: x86: make vapics_in_nmi_mode atomic
  MIPS: Fix KVM guest fixmap address
  x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
  x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
  powerpc/perf: Fix book3s kernel to userspace backtraces
  arm: KVM: force execution of HCPTR access on VM exit
  intel_pstate: set BYT MSR with wrmsrl_on_cpu()
  iommu/amd: Handle large pages correctly in free_pagetable
  ...

Change-Id: Iafcf6cd86f00ed41225a8f5dca9e6239d013e060
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android...
Praneeth Bajjuri [Fri, 17 Jul 2015 18:39:49 +0000 (13:39 -0500)]
Merge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio into p-ti-linux-3.14.y-common

* 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio:
  ASoC: davinci-mcasp: Add workaround for errata i868
  ASoC: davinci-mcasp: Get McASP IP revision number on DRA7xx
  ASoC: davinci-mcasp: Remove AFIFO hw_rule

Change-Id: Idb39b56505ea7af7e9db0dc2ceb1edb534329076
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel...
Praneeth Bajjuri [Fri, 17 Jul 2015 18:39:14 +0000 (13:39 -0500)]
Merge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel into p-ti-linux-3.14.y-common

* 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel: (31 commits)
  Linux 3.14.48
  x86/iosf: Add Kconfig prompt for IOSF_MBI selection
  arm/arm64: KVM: Keep elrsr/aisr in sync with software model
  arm64: KVM: Do not use pgd_index to index stage-2 pgd
  arm64: KVM: Fix HCR setting for 32bit guests
  arm64: KVM: Fix TLB invalidation by IPA/VMID
  arm/arm64: KVM: Require in-kernel vgic for the arch timers
  vfs: Ignore unlocked mounts in fs_fully_visible
  vfs: Remove incorrect debugging WARN in prepend_path
  fs: Fix S_NOSEC handling
  KVM: x86: make vapics_in_nmi_mode atomic
  MIPS: Fix KVM guest fixmap address
  x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
  x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
  powerpc/perf: Fix book3s kernel to userspace backtraces
  arm: KVM: force execution of HCPTR access on VM exit
  intel_pstate: set BYT MSR with wrmsrl_on_cpu()
  iommu/amd: Handle large pages correctly in free_pagetable
  Revert "crypto: talitos - convert to use be16_add_cpu()"
  crypto: talitos - avoid memleak in talitos_alg_alloc()
  ...

Change-Id: I587964c658979e4991e48270ddeeec67be95cbf6
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agouid_cputime: fix cputime overflow
Jin Qian [Tue, 14 Jul 2015 01:16:55 +0000 (18:16 -0700)]
uid_cputime: fix cputime overflow

Converting cputime_t to usec caused overflow when the value is greater
than 1 hour. Use msec and convert to unsigned long long to support bigger
range.

Bug: 22461683

Change-Id: I853fe3e8e7dbf0d3e2cc5c6f9688a5a6e1f1fb3e
Signed-off-by: Jin Qian <jinqian@google.com>
6 years agoASoC: davinci-mcasp: Add workaround for errata i868
Misael Lopez Cruz [Tue, 14 Jul 2015 16:24:51 +0000 (11:24 -0500)]
ASoC: davinci-mcasp: Add workaround for errata i868

McASP FIFO events to eDMA or sDMA can be lost depending on the
timing between McASP side activity and DMA side activity, causing
overflow (capture) or underflow (playback).

The workaround consists of maximizing the time to avoid the
boundary condition in hardware.  So the RNUMEVT/WNUMEVT should be
set to the multiple of the active serializers that is close to 32.

This errata is applicable for McASP IP revision < 3.3, which may
be present in other platforms.  But since the revision definition
is not consistent across those platforms, the errata workaround
is only set for DRA7xx family whose revision information is
known.

Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoASoC: davinci-mcasp: Get McASP IP revision number on DRA7xx
Misael Lopez Cruz [Tue, 12 May 2015 21:38:16 +0000 (16:38 -0500)]
ASoC: davinci-mcasp: Get McASP IP revision number on DRA7xx

The McASP IP revision number can be useful to identify
applicable features, limitations and erratas in a given
device.

Unfortunately, the McASP PID register fields are not
consistent across platforms where McASP is present.
The McASP revision added here is only applicable for
DRA7xx family.

Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoMerge tag 'v3.14.48' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Texas Instruments Auto Merger [Mon, 13 Jul 2015 16:01:47 +0000 (11:01 -0500)]
Merge tag 'v3.14.48' of git./linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.48 stable release

* tag 'v3.14.48' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (31 commits)
  Linux 3.14.48
  x86/iosf: Add Kconfig prompt for IOSF_MBI selection
  arm/arm64: KVM: Keep elrsr/aisr in sync with software model
  arm64: KVM: Do not use pgd_index to index stage-2 pgd
  arm64: KVM: Fix HCR setting for 32bit guests
  arm64: KVM: Fix TLB invalidation by IPA/VMID
  arm/arm64: KVM: Require in-kernel vgic for the arch timers
  vfs: Ignore unlocked mounts in fs_fully_visible
  vfs: Remove incorrect debugging WARN in prepend_path
  fs: Fix S_NOSEC handling
  KVM: x86: make vapics_in_nmi_mode atomic
  MIPS: Fix KVM guest fixmap address
  x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
  x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
  powerpc/perf: Fix book3s kernel to userspace backtraces
  arm: KVM: force execution of HCPTR access on VM exit
  intel_pstate: set BYT MSR with wrmsrl_on_cpu()
  iommu/amd: Handle large pages correctly in free_pagetable
  Revert "crypto: talitos - convert to use be16_add_cpu()"
  crypto: talitos - avoid memleak in talitos_alg_alloc()
  ...

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
6 years agoLinux 3.14.48
Greg Kroah-Hartman [Fri, 10 Jul 2015 17:38:15 +0000 (10:38 -0700)]
Linux 3.14.48

6 years agox86/iosf: Add Kconfig prompt for IOSF_MBI selection
David E. Box [Wed, 27 Aug 2014 21:40:39 +0000 (14:40 -0700)]
x86/iosf: Add Kconfig prompt for IOSF_MBI selection

commit aa8e4f22ab7773352ba3895597189b8097f2c307 upstream.

Fixes an error in having the iosf build as 'default m'. On X86 SoC's the iosf
sideband is the only way to access information for some registers, as opposed to
through MSR's on other Intel architectures. While selecting IOSF_MBI is
preferred, it does mean carrying extra code on non-SoC architectures. This
exports the selection to the user, allowing those driver writers to compile out
iosf code if it's not being built.

Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Link: http://lkml.kernel.org/r/1409175640-32426-2-git-send-email-david.e.box@linux.intel.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: William Dauchy <william@gandi.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Keep elrsr/aisr in sync with software model
Christoffer Dall [Fri, 13 Mar 2015 17:02:56 +0000 (17:02 +0000)]
arm/arm64: KVM: Keep elrsr/aisr in sync with software model

commit ae705930fca6322600690df9dc1c7d0516145a93 upstream.

[Note the upstream one of this patch requires applying full GICv3 support
but it's out of the scope of stable kernel. So this patch has a huge
modification for stable kernel comparing to the upstream one.]

There is an interesting bug in the vgic code, which manifests itself
when the KVM run loop has a signal pending or needs a vmid generation
rollover after having disabled interrupts but before actually switching
to the guest.

In this case, we flush the vgic as usual, but we sync back the vgic
state and exit to userspace before entering the guest.  The consequence
is that we will be syncing the list registers back to the software model
using the GICH_ELRSR and GICH_EISR from the last execution of the guest,
potentially overwriting a list register containing an interrupt.

This showed up during migration testing where we would capture a state
where the VM has masked the arch timer but there were no interrupts,
resulting in a hung test.

Cc: Marc Zyngier <marc.zyngier@arm.com>
Reported-by: Alex Bennee <alex.bennee@linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: KVM: Do not use pgd_index to index stage-2 pgd
Marc Zyngier [Tue, 10 Mar 2015 19:07:00 +0000 (19:07 +0000)]
arm64: KVM: Do not use pgd_index to index stage-2 pgd

commit 04b8dc85bf4a64517e3cf20e409eeaa503b15cc1 upstream.

[Since we don't backport commit c647355 (KVM: arm: Add initial dirty page
locking support) for linux-3.14.y, there is no stage2_wp_range in
arch/arm/kvm/mmu.c. So ignore the change in stage2_wp_range introduced
by this patch.]

The kernel's pgd_index macro is designed to index a normal, page
sized array. KVM is a bit diffferent, as we can use concatenated
pages to have a bigger address space (for example 40bit IPA with
4kB pages gives us an 8kB PGD.

In the above case, the use of pgd_index will always return an index
inside the first 4kB, which makes a guest that has memory above
0x8000000000 rather unhappy, as it spins forever in a page fault,
whist the host happilly corrupts the lower pgd.

The obvious fix is to get our own kvm_pgd_index that does the right
thing(tm).

Tested on X-Gene with a hacked kvmtool that put memory at a stupidly
high address.

Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: KVM: Fix HCR setting for 32bit guests
Marc Zyngier [Sun, 11 Jan 2015 13:10:11 +0000 (14:10 +0100)]
arm64: KVM: Fix HCR setting for 32bit guests

commit 801f6772cecea6cfc7da61aa197716ab64db5f9e upstream.

Commit b856a59141b1 (arm/arm64: KVM: Reset the HCR on each vcpu
when resetting the vcpu) moved the init of the HCR register to
happen later in the init of a vcpu, but left out the fixup
done in kvm_reset_vcpu when preparing for a 32bit guest.

As a result, the 32bit guest is run as a 64bit guest, but the
rest of the kernel still manages it as a 32bit. Fun follows.

Moving the fixup to vcpu_reset_hcr solves the problem for good.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: KVM: Fix TLB invalidation by IPA/VMID
Marc Zyngier [Sun, 11 Jan 2015 13:10:10 +0000 (14:10 +0100)]
arm64: KVM: Fix TLB invalidation by IPA/VMID

commit 55e858b75808347378e5117c3c2339f46cc03575 upstream.

It took about two years for someone to notice that the IPA passed
to TLBI IPAS2E1IS must be shifted by 12 bits. Clearly our reviewing
is not as good as it should be...

Paper bag time for me.

Reported-by: Mario Smarduch <m.smarduch@samsung.com>
Tested-by: Mario Smarduch <m.smarduch@samsung.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Require in-kernel vgic for the arch timers
Christoffer Dall [Fri, 12 Dec 2014 20:19:23 +0000 (21:19 +0100)]
arm/arm64: KVM: Require in-kernel vgic for the arch timers

commit 05971120fca43e0357789a14b3386bb56eef2201 upstream.

[Note this patch is a bit different from the original one as the names of
vgic_initialized and kvm_vgic_init are different.]

It is curently possible to run a VM with architected timers support
without creating an in-kernel VGIC, which will result in interrupts from
the virtual timer going nowhere.

To address this issue, move the architected timers initialization to the
time when we run a VCPU for the first time, and then only initialize
(and enable) the architected timers if we have a properly created and
initialized in-kernel VGIC.

When injecting interrupts from the virtual timer to the vgic, the
current setup should ensure that this never calls an on-demand init of
the VGIC, which is the only call path that could return an error from
kvm_vgic_inject_irq(), so capture the return value and raise a warning
if there's an error there.

We also change the kvm_timer_init() function from returning an int to be
a void function, since the function always succeeds.

Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agovfs: Ignore unlocked mounts in fs_fully_visible
Eric W. Biederman [Wed, 7 Jan 2015 14:10:09 +0000 (08:10 -0600)]
vfs: Ignore unlocked mounts in fs_fully_visible

commit ceeb0e5d39fcdf4dca2c997bf225c7fc49200b37 upstream.

Limit the mounts fs_fully_visible considers to locked mounts.
Unlocked can always be unmounted so considering them adds hassle
but no security benefit.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agovfs: Remove incorrect debugging WARN in prepend_path
Eric W. Biederman [Sun, 24 May 2015 14:25:00 +0000 (09:25 -0500)]
vfs: Remove incorrect debugging WARN in prepend_path

commit 93e3bce6287e1fb3e60d3324ed08555b5bbafa89 upstream.

The warning message in prepend_path is unclear and outdated.  It was
added as a warning that the mechanism for generating names of pseudo
files had been removed from prepend_path and d_dname should be used
instead.  Unfortunately the warning reads like a general warning,
making it unclear what to do with it.

Remove the warning.  The transition it was added to warn about is long
over, and I added code several years ago which in rare cases causes
the warning to fire on legitimate code, and the warning is now firing
and scaring people for no good reason.

Reported-by: Ivan Delalande <colona@arista.com>
Reported-by: Omar Sandoval <osandov@osandov.com>
Fixes: f48cfddc6729e ("vfs: In d_path don't call d_dname on a mount point")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agofs: Fix S_NOSEC handling
Jan Kara [Thu, 21 May 2015 14:05:52 +0000 (16:05 +0200)]
fs: Fix S_NOSEC handling

commit 2426f3910069ed47c0cc58559a6d088af7920201 upstream.

file_remove_suid() could mistakenly set S_NOSEC inode bit when root was
modifying the file. As a result following writes to the file by ordinary
user would avoid clearing suid or sgid bits.

Fix the bug by checking actual mode bits before setting S_NOSEC.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: x86: make vapics_in_nmi_mode atomic
Radim Krčmář [Wed, 1 Jul 2015 13:31:49 +0000 (15:31 +0200)]
KVM: x86: make vapics_in_nmi_mode atomic

commit 42720138b06301cc8a7ee8a495a6d021c4b6a9bc upstream.

Writes were a bit racy, but hard to turn into a bug at the same time.
(Particularly because modern Linux doesn't use this feature anymore.)

Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
[Actually the next patch makes it much, much easier to trigger the race
 so I'm including this one for stable@ as well. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoMIPS: Fix KVM guest fixmap address
James Hogan [Mon, 27 Apr 2015 14:07:16 +0000 (15:07 +0100)]
MIPS: Fix KVM guest fixmap address

commit 8e748c8d09a9314eedb5c6367d9acfaacddcdc88 upstream.

KVM guest kernels for trap & emulate run in user mode, with a modified
set of kernel memory segments. However the fixmap address is still in
the normal KSeg3 region at 0xfffe0000 regardless, causing problems when
cache alias handling makes use of them when handling copy on write.

Therefore define FIXADDR_TOP as 0x7ffe0000 in the guest kernel mapped
region when CONFIG_KVM_GUEST is defined.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/9887/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agox86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
Bjorn Helgaas [Tue, 9 Jun 2015 23:54:07 +0000 (18:54 -0500)]
x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A

commit 1dace0116d0b05c967d94644fc4dfe96be2ecd3d upstream.

The Foxconn K8M890-8237A has two PCI host bridges, and we can't assign
resources correctly without the information from _CRS that tells us which
address ranges are claimed by which bridge.  In the bugs mentioned below,
we incorrectly assign a sound card address (this example is from 1033299):

  bus: 00 index 2 [mem 0x80000000-0xfcffffffff]
  ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7f])
  pci_root PNP0A08:00: host bridge window [mem 0x80000000-0xbfefffff] (ignored)
  pci_root PNP0A08:00: host bridge window [mem 0xc0000000-0xdfffffff] (ignored)
  pci_root PNP0A08:00: host bridge window [mem 0xf0000000-0xfebfffff] (ignored)
  ACPI: PCI Root Bridge [PCI1] (domain 0000 [bus 80-ff])
  pci_root PNP0A08:01: host bridge window [mem 0xbff00000-0xbfffffff] (ignored)
  pci 0000:80:01.0: [1106:3288] type 0 class 0x000403
  pci 0000:80:01.0: reg 10: [mem 0xbfffc000-0xbfffffff 64bit]
  pci 0000:80:01.0: address space collision: [mem 0xbfffc000-0xbfffffff 64bit] conflicts with PCI Bus #00 [mem 0x80000000-0xfcffffffff]
  pci 0000:80:01.0: BAR 0: assigned [mem 0xfd00000000-0xfd00003fff 64bit]
  BUG: unable to handle kernel paging request at ffffc90000378000
  IP: [<ffffffffa0345f63>] azx_create+0x37c/0x822 [snd_hda_intel]

We assigned 0xfd_0000_0000, but that is not in any of the host bridge
windows, and the sound card doesn't work.

Turn on pci=use_crs automatically for this system.

Link: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368
Link: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agox86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
Bjorn Helgaas [Tue, 9 Jun 2015 22:31:38 +0000 (17:31 -0500)]
x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing

commit 3d9fecf6bfb8b12bc2f9a4c7109895a2a2bb9436 upstream.

We enable _CRS on all systems from 2008 and later.  On older systems, we
ignore _CRS and assume the whole physical address space (excluding RAM and
other devices) is available for PCI devices, but on systems that support
physical address spaces larger than 4GB, it's doubtful that the area above
4GB is really available for PCI.

After d56dbf5bab8c ("PCI: Allocate 64-bit BARs above 4G when possible"), we
try to use that space above 4GB *first*, so we're more likely to put a
device there.

On Juan's Toshiba Satellite Pro U200, BIOS left the graphics, sound, 1394,
and card reader devices unassigned (but only after Windows had been
booted).  Only the sound device had a 64-bit BAR, so it was the only device
placed above 4GB, and hence the only device that didn't work.

Keep _CRS enabled even on pre-2008 systems if they support physical address
space larger than 4GB.

Fixes: d56dbf5bab8c ("PCI: Allocate 64-bit BARs above 4G when possible")
Reported-and-tested-by: Juan Dayer <jdayer@outlook.com>
Reported-and-tested-by: Alan Horsfield <alan@hazelgarth.co.uk>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99221
Link: https://bugzilla.opensuse.org/show_bug.cgi?id=907092
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agopowerpc/perf: Fix book3s kernel to userspace backtraces
Anton Blanchard [Tue, 26 May 2015 05:10:24 +0000 (15:10 +1000)]
powerpc/perf: Fix book3s kernel to userspace backtraces

commit 72e349f1124a114435e599479c9b8d14bfd1ebcd upstream.

When we take a PMU exception or a software event we call
perf_read_regs(). This overloads regs->result with a boolean that
describes if we should use the sampled instruction address register
(SIAR) or the regs.

If the exception is in kernel, we start with the kernel regs and
backtrace through the kernel stack. At this point we switch to the
userspace regs and backtrace the user stack with perf_callchain_user().

Unfortunately these regs have not got the perf_read_regs() treatment,
so regs->result could be anything. If it is non zero,
perf_instruction_pointer() decides to use the SIAR, and we get issues
like this:

0.11%  qemu-system-ppc  [kernel.kallsyms]        [k] _raw_spin_lock_irqsave
       |
       ---_raw_spin_lock_irqsave
          |
          |--52.35%-- 0
          |          |
          |          |--46.39%-- __hrtimer_start_range_ns
          |          |          kvmppc_run_core
          |          |          kvmppc_vcpu_run_hv
          |          |          kvmppc_vcpu_run
          |          |          kvm_arch_vcpu_ioctl_run
          |          |          kvm_vcpu_ioctl
          |          |          do_vfs_ioctl
          |          |          sys_ioctl
          |          |          system_call
          |          |          |
          |          |          |--67.08%-- _raw_spin_lock_irqsave <--- hi mum
          |          |          |          |
          |          |          |           --100.00%-- 0x7e714
          |          |          |                     0x7e714

Notice the bogus _raw_spin_irqsave when we transition from kernel
(system_call) to userspace (0x7e714). We inserted what was in the SIAR.

Add a check in regs_use_siar() to check that the regs in question
are from a PMU exception. With this fix the backtrace makes sense:

     0.47%  qemu-system-ppc  [kernel.vmlinux]         [k] _raw_spin_lock_irqsave
            |
            ---_raw_spin_lock_irqsave
               |
               |--53.83%-- 0
               |          |
               |          |--44.73%-- hrtimer_try_to_cancel
               |          |          kvmppc_start_thread
               |          |          kvmppc_run_core
               |          |          kvmppc_vcpu_run_hv
               |          |          kvmppc_vcpu_run
               |          |          kvm_arch_vcpu_ioctl_run
               |          |          kvm_vcpu_ioctl
               |          |          do_vfs_ioctl
               |          |          sys_ioctl
               |          |          system_call
               |          |          __ioctl
               |          |          0x7e714
               |          |          0x7e714

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm: KVM: force execution of HCPTR access on VM exit
Marc Zyngier [Mon, 16 Mar 2015 10:59:43 +0000 (10:59 +0000)]
arm: KVM: force execution of HCPTR access on VM exit

commit 85e84ba31039595995dae80b277378213602891b upstream.

On VM entry, we disable access to the VFP registers in order to
perform a lazy save/restore of these registers.

On VM exit, we restore access, test if we did enable them before,
and save/restore the guest/host registers if necessary. In this
sequence, the FPEXC register is always accessed, irrespective
of the trapping configuration.

If the guest didn't touch the VFP registers, then the HCPTR access
has now enabled such access, but we're missing a barrier to ensure
architectural execution of the new HCPTR configuration. If the HCPTR
access has been delayed/reordered, the subsequent access to FPEXC
will cause a trap, which we aren't prepared to handle at all.

The same condition exists when trapping to enable VFP for the guest.

The fix is to introduce a barrier after enabling VFP access. In the
vmexit case, it can be relaxed to only takes place if the guest hasn't
accessed its view of the VFP registers, making the access to FPEXC safe.

The set_hcptr macro is modified to deal with both vmenter/vmexit and
vmtrap operations, and now takes an optional label that is branched to
when the guest hasn't touched the VFP registers.

Reported-by: Vikram Sethi <vikrams@codeaurora.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agointel_pstate: set BYT MSR with wrmsrl_on_cpu()
Joe Konno [Tue, 12 May 2015 14:59:42 +0000 (07:59 -0700)]
intel_pstate: set BYT MSR with wrmsrl_on_cpu()

commit 0dd23f94251f49da99a6cbfb22418b2d757d77d6 upstream.

Commit 007bea098b86 (intel_pstate: Add setting voltage value for
baytrail P states.) introduced byt_set_pstate() with the assumption that
it would always be run by the CPU whose MSR is to be written by it.  It
turns out, however, that is not always the case in practice, so modify
byt_set_pstate() to enforce the MSR write done by it to always happen on
the right CPU.

Fixes: 007bea098b86 (intel_pstate: Add setting voltage value for baytrail P states.)
Signed-off-by: Joe Konno <joe.konno@intel.com>
Acked-by: Kristen Carlson Accardi <kristen@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoiommu/amd: Handle large pages correctly in free_pagetable
Joerg Roedel [Thu, 18 Jun 2015 08:48:34 +0000 (10:48 +0200)]
iommu/amd: Handle large pages correctly in free_pagetable

commit 0b3fff54bc01e8e6064d222a33e6fa7adabd94cd upstream.

Make sure that we are skipping over large PTEs while walking
the page-table tree.

Fixes: 5c34c403b723 ("iommu/amd: Fix memory leak in free_pagetable")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoRevert "crypto: talitos - convert to use be16_add_cpu()"
Horia Geant? [Mon, 11 May 2015 17:04:49 +0000 (20:04 +0300)]
Revert "crypto: talitos - convert to use be16_add_cpu()"

commit 69d9cd8c592f1abce820dbce7181bbbf6812cfbd upstream.

This reverts commit 7291a932c6e27d9768e374e9d648086636daf61c.

The conversion to be16_add_cpu() is incorrect in case cryptlen is
negative due to premature (i.e. before addition / subtraction)
implicit conversion of cryptlen (int -> u16) leading to sign loss.

Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agocrypto: talitos - avoid memleak in talitos_alg_alloc()
Horia Geant? [Mon, 11 May 2015 17:03:24 +0000 (20:03 +0300)]
crypto: talitos - avoid memleak in talitos_alg_alloc()

commit 5fa7dadc898567ce14d6d6d427e7bd8ce6eb5d39 upstream.

Fixes: 1d11911a8c57 ("crypto: talitos - fix warning: 'alg' may be used uninitialized in this function")
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agosctp: Fix race between OOTB responce and route removal
Alexander Sverdlin [Mon, 29 Jun 2015 08:41:03 +0000 (10:41 +0200)]
sctp: Fix race between OOTB responce and route removal

[ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ]

There is NULL pointer dereference possible during statistics update if the route
used for OOTB responce is removed at unfortunate time. If the route exists when
we receive OOTB packet and we finally jump into sctp_packet_transmit() to send
ABORT, but in the meantime route is removed under our feet, we take "no_route"
path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...).

But sctp_ootb_pkt_new() used to prepare responce packet doesn't call
sctp_transport_set_owner() and therefore there is no asoc associated with this
packet. Probably temporary asoc just for OOTB responces is overkill, so just
introduce a check like in all other places in sctp_packet_transmit(), where
"asoc" is dereferenced.

To reproduce this, one needs to
0. ensure that sctp module is loaded (otherwise ABORT is not generated)
1. remove default route on the machine
2. while true; do
     ip route del [interface-specific route]
     ip route add [interface-specific route]
   done
3. send enough OOTB packets (i.e. HB REQs) from another host to trigger ABORT
   responce

On x86_64 the crash looks like this:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
IP: [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: ...
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O    4.0.5-1-ARCH #1
Hardware name: ...
task: ffffffff818124c0 ti: ffffffff81800000 task.ti: ffffffff81800000
RIP: 0010:[<ffffffffa05ec9ac>]  [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
RSP: 0018:ffff880127c037b8  EFLAGS: 00010296
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000015ff66b480
RDX: 00000015ff66b400 RSI: ffff880127c17200 RDI: ffff880123403700
RBP: ffff880127c03888 R08: 0000000000017200 R09: ffffffff814625af
R10: ffffea00047e4680 R11: 00000000ffffff80 R12: ffff8800b0d38a28
R13: ffff8800b0d38a28 R14: ffff8800b3e88000 R15: ffffffffa05f24e0
FS:  0000000000000000(0000) GS:ffff880127c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000020 CR3: 00000000c855b000 CR4: 00000000000007f0
Stack:
 ffff880127c03910 ffff8800b0d38a28 ffffffff8189d240 ffff88011f91b400
 ffff880127c03828 ffffffffa05c94c5 0000000000000000 ffff8800baa1c520
 0000000000000000 0000000000000001 0000000000000000 0000000000000000
Call Trace:
 <IRQ>
 [<ffffffffa05c94c5>] ? sctp_sf_tabort_8_4_8.isra.20+0x85/0x140 [sctp]
 [<ffffffffa05d6b42>] ? sctp_transport_put+0x52/0x80 [sctp]
 [<ffffffffa05d0bfc>] sctp_do_sm+0xb8c/0x19a0 [sctp]
 [<ffffffff810b0e00>] ? trigger_load_balance+0x90/0x210
 [<ffffffff810e0329>] ? update_process_times+0x59/0x60
 [<ffffffff812c7a40>] ? timerqueue_add+0x60/0xb0
 [<ffffffff810e0549>] ? enqueue_hrtimer+0x29/0xa0
 [<ffffffff8101f599>] ? read_tsc+0x9/0x10
 [<ffffffff8116d4b5>] ? put_page+0x55/0x60
 [<ffffffff810ee1ad>] ? clockevents_program_event+0x6d/0x100
 [<ffffffff81462b68>] ? skb_free_head+0x58/0x80
 [<ffffffffa029a10b>] ? chksum_update+0x1b/0x27 [crc32c_generic]
 [<ffffffff81283f3e>] ? crypto_shash_update+0xce/0xf0
 [<ffffffffa05d3993>] sctp_endpoint_bh_rcv+0x113/0x280 [sctp]
 [<ffffffffa05dd4e6>] sctp_inq_push+0x46/0x60 [sctp]
 [<ffffffffa05ed7a0>] sctp_rcv+0x880/0x910 [sctp]
 [<ffffffffa05ecb50>] ? sctp_packet_transmit_chunk+0xb0/0xb0 [sctp]
 [<ffffffffa05ecb70>] ? sctp_csum_update+0x20/0x20 [sctp]
 [<ffffffff814b05a5>] ? ip_route_input_noref+0x235/0xd30
 [<ffffffff81051d6b>] ? ack_ioapic_level+0x7b/0x150
 [<ffffffff814b27be>] ip_local_deliver_finish+0xae/0x210
 [<ffffffff814b2e15>] ip_local_deliver+0x35/0x90
 [<ffffffff814b2a15>] ip_rcv_finish+0xf5/0x370
 [<ffffffff814b3128>] ip_rcv+0x2b8/0x3a0
 [<ffffffff81474193>] __netif_receive_skb_core+0x763/0xa50
 [<ffffffff81476c28>] __netif_receive_skb+0x18/0x60
 [<ffffffff81476cb0>] netif_receive_skb_internal+0x40/0xd0
 [<ffffffff814776c8>] napi_gro_receive+0xe8/0x120
 [<ffffffffa03946aa>] rtl8169_poll+0x2da/0x660 [r8169]
 [<ffffffff8147896a>] net_rx_action+0x21a/0x360
 [<ffffffff81078dc1>] __do_softirq+0xe1/0x2d0
 [<ffffffff8107912d>] irq_exit+0xad/0xb0
 [<ffffffff8157d158>] do_IRQ+0x58/0xf0
 [<ffffffff8157b06d>] common_interrupt+0x6d/0x6d
 <EOI>
 [<ffffffff810e1218>] ? hrtimer_start+0x18/0x20
 [<ffffffffa05d65f9>] ? sctp_transport_destroy_rcu+0x29/0x30 [sctp]
 [<ffffffff81020c50>] ? mwait_idle+0x60/0xa0
 [<ffffffff810216ef>] arch_cpu_idle+0xf/0x20
 [<ffffffff810b731c>] cpu_startup_entry+0x3ec/0x480
 [<ffffffff8156b365>] rest_init+0x85/0x90
 [<ffffffff818eb035>] start_kernel+0x48b/0x4ac
 [<ffffffff818ea120>] ? early_idt_handlers+0x120/0x120
 [<ffffffff818ea339>] x86_64_start_reservations+0x2a/0x2c
 [<ffffffff818ea49c>] x86_64_start_kernel+0x161/0x184
Code: 90 48 8b 80 b8 00 00 00 48 89 85 70 ff ff ff 48 83 bd 70 ff ff ff 00 0f 85 cd fa ff ff 48 89 df 31 db e8 18 63 e7 e0 48 8b 45 80 <48> 8b 40 20 48 8b 40 30 48 8b 80 68 01 00 00 65 48 ff 40 78 e9
RIP  [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
 RSP <ffff880127c037b8>
CR2: 0000000000000020
---[ end trace 5aec7fd2dc983574 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
drm_kms_helper: panic occurred, switching back to text console
---[ end Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonet: phy: fix phy link up when limiting speed via device tree
Mugunthan V N [Thu, 25 Jun 2015 16:51:02 +0000 (22:21 +0530)]
net: phy: fix phy link up when limiting speed via device tree

[ Upstream commit eb686231fce3770299760f24fdcf5ad041f44153 ]

When limiting phy link speed using "max-speed" to 100mbps or less on a
giga bit phy, phy never completes auto negotiation and phy state
machine is held in PHY_AN. Fixing this issue by comparing the giga
bit advertise though phydev->supported doesn't have it but phy has
BMSR_ESTATEN set. So that auto negotiation is restarted as old and
new advertise are different and link comes up fine.

Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotcp: Do not call tcp_fastopen_reset_cipher from interrupt context
Christoph Paasch [Thu, 18 Jun 2015 16:15:34 +0000 (09:15 -0700)]
tcp: Do not call tcp_fastopen_reset_cipher from interrupt context

[ Upstream commit dfea2aa654243f70dc53b8648d0bbdeec55a7df1 ]

tcp_fastopen_reset_cipher really cannot be called from interrupt
context. It allocates the tcp_fastopen_context with GFP_KERNEL and
calls crypto_alloc_cipher, which allocates all kind of stuff with
GFP_KERNEL.

Thus, we might sleep when the key-generation is triggered by an
incoming TFO cookie-request which would then happen in interrupt-
context, as shown by enabling CONFIG_DEBUG_ATOMIC_SLEEP:

[   36.001813] BUG: sleeping function called from invalid context at mm/slub.c:1266
[   36.003624] in_atomic(): 1, irqs_disabled(): 0, pid: 1016, name: packetdrill
[   36.004859] CPU: 1 PID: 1016 Comm: packetdrill Not tainted 4.1.0-rc7 #14
[   36.006085] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
[   36.008250]  00000000000004f2 ffff88007f8838a8 ffffffff8171d53a ffff880075a084a8
[   36.009630]  ffff880075a08000 ffff88007f8838c8 ffffffff810967d3 ffff88007f883928
[   36.011076]  0000000000000000 ffff88007f8838f8 ffffffff81096892 ffff88007f89be00
[   36.012494] Call Trace:
[   36.012953]  <IRQ>  [<ffffffff8171d53a>] dump_stack+0x4f/0x6d
[   36.014085]  [<ffffffff810967d3>] ___might_sleep+0x103/0x170
[   36.015117]  [<ffffffff81096892>] __might_sleep+0x52/0x90
[   36.016117]  [<ffffffff8118e887>] kmem_cache_alloc_trace+0x47/0x190
[   36.017266]  [<ffffffff81680d82>] ? tcp_fastopen_reset_cipher+0x42/0x130
[   36.018485]  [<ffffffff81680d82>] tcp_fastopen_reset_cipher+0x42/0x130
[   36.019679]  [<ffffffff81680f01>] tcp_fastopen_init_key_once+0x61/0x70
[   36.020884]  [<ffffffff81680f2c>] __tcp_fastopen_cookie_gen+0x1c/0x60
[   36.022058]  [<ffffffff816814ff>] tcp_try_fastopen+0x58f/0x730
[   36.023118]  [<ffffffff81671788>] tcp_conn_request+0x3e8/0x7b0
[   36.024185]  [<ffffffff810e3872>] ? __module_text_address+0x12/0x60
[   36.025327]  [<ffffffff8167b2e1>] tcp_v4_conn_request+0x51/0x60
[   36.026410]  [<ffffffff816727e0>] tcp_rcv_state_process+0x190/0xda0
[   36.027556]  [<ffffffff81661f97>] ? __inet_lookup_established+0x47/0x170
[   36.028784]  [<ffffffff8167c2ad>] tcp_v4_do_rcv+0x16d/0x3d0
[   36.029832]  [<ffffffff812e6806>] ? security_sock_rcv_skb+0x16/0x20
[   36.030936]  [<ffffffff8167cc8a>] tcp_v4_rcv+0x77a/0x7b0
[   36.031875]  [<ffffffff816af8c3>] ? iptable_filter_hook+0x33/0x70
[   36.032953]  [<ffffffff81657d22>] ip_local_deliver_finish+0x92/0x1f0
[   36.034065]  [<ffffffff81657f1a>] ip_local_deliver+0x9a/0xb0
[   36.035069]  [<ffffffff81657c90>] ? ip_rcv+0x3d0/0x3d0
[   36.035963]  [<ffffffff81657569>] ip_rcv_finish+0x119/0x330
[   36.036950]  [<ffffffff81657ba7>] ip_rcv+0x2e7/0x3d0
[   36.037847]  [<ffffffff81610652>] __netif_receive_skb_core+0x552/0x930
[   36.038994]  [<ffffffff81610a57>] __netif_receive_skb+0x27/0x70
[   36.040033]  [<ffffffff81610b72>] process_backlog+0xd2/0x1f0
[   36.041025]  [<ffffffff81611482>] net_rx_action+0x122/0x310
[   36.042007]  [<ffffffff81076743>] __do_softirq+0x103/0x2f0
[   36.042978]  [<ffffffff81723e3c>] do_softirq_own_stack+0x1c/0x30

This patch moves the call to tcp_fastopen_init_key_once to the places
where a listener socket creates its TFO-state, which always happens in
user-context (either from the setsockopt, or implicitly during the
listen()-call)

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Fixes: 222e83d2e0ae ("tcp: switch tcp_fastopen key generation to net_get_random_once")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoneigh: do not modify unlinked entries
Julian Anastasov [Tue, 16 Jun 2015 19:56:39 +0000 (22:56 +0300)]
neigh: do not modify unlinked entries

[ Upstream commit 2c51a97f76d20ebf1f50fef908b986cb051fdff9 ]

The lockless lookups can return entry that is unlinked.
Sometimes they get reference before last neigh_cleanup_and_release,
sometimes they do not need reference. Later, any
modification attempts may result in the following problems:

1. entry is not destroyed immediately because neigh_update
can start the timer for dead entry, eg. on change to NUD_REACHABLE
state. As result, entry lives for some time but is invisible
and out of control.

2. __neigh_event_send can run in parallel with neigh_destroy
while refcnt=0 but if timer is started and expired refcnt can
reach 0 for second time leading to second neigh_destroy and
possible crash.

Thanks to Eric Dumazet and Ying Xue for their work and analyze
on the __neigh_event_send change.

Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour")
Fixes: a263b3093641 ("ipv4: Make neigh lookups directly in output packet path.")
Fixes: 6fd6ce2056de ("ipv6: Do not depend on rt->n in ip6_finish_output2().")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agopacket: avoid out of bounds read in round robin fanout
Willem de Bruijn [Wed, 17 Jun 2015 19:59:34 +0000 (15:59 -0400)]
packet: avoid out of bounds read in round robin fanout

[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]

PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.

When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.

Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agopacket: read num_members once in packet_rcv_fanout()
Eric Dumazet [Tue, 16 Jun 2015 14:59:11 +0000 (07:59 -0700)]
packet: read num_members once in packet_rcv_fanout()

[ Upstream commit f98f4514d07871da7a113dd9e3e330743fd70ae4 ]

We need to tell compiler it must not read f->num_members multiple
times. Otherwise testing if num is not zero is flaky, and we could
attempt an invalid divide by 0 in fanout_demux_cpu()

Note bug was present in packet_rcv_fanout_hash() and
packet_rcv_fanout_lb() but final 3.1 had a simple location
after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.")

Fixes: dc99f600698dc ("packet: Add fanout support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agobridge: fix br_stp_set_bridge_priority race conditions
Nikolay Aleksandrov [Mon, 15 Jun 2015 17:28:51 +0000 (20:28 +0300)]
bridge: fix br_stp_set_bridge_priority race conditions

[ Upstream commit 2dab80a8b486f02222a69daca6859519e05781d9 ]

After the ->set() spinlocks were removed br_stp_set_bridge_priority
was left running without any protection when used via sysfs. It can
race with port add/del and could result in use-after-free cases and
corrupted lists. Tested by running port add/del in a loop with stp
enabled while setting priority in a loop, crashes are easily
reproducible.
The spinlocks around sysfs ->set() were removed in commit:
14f98f258f19 ("bridge: range check STP parameters")
There's also a race condition in the netlink priority support that is
fixed by this change, but it was introduced recently and the fixes tag
covers it, just in case it's needed the commit is:
af615762e972 ("bridge: add ageing_time, stp_state, priority over netlink")

Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Fixes: 14f98f258f19 ("bridge: range check STP parameters")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agosctp: fix ASCONF list handling
Marcelo Ricardo Leitner [Fri, 12 Jun 2015 13:16:41 +0000 (10:16 -0300)]
sctp: fix ASCONF list handling

[ Upstream commit 2d45a02d0166caf2627fe91897c6ffc3b19514c4 ]

->auto_asconf_splist is per namespace and mangled by functions like
sctp_setsockopt_auto_asconf() which doesn't guarantee any serialization.

Also, the call to inet_sk_copy_descendant() was backuping
->auto_asconf_list through the copy but was not honoring
->do_auto_asconf, which could lead to list corruption if it was
different between both sockets.

This commit thus fixes the list handling by using ->addr_wq_lock
spinlock to protect the list. A special handling is done upon socket
creation and destruction for that. Error handlig on sctp_init_sock()
will never return an error after having initialized asconf, so
sctp_destroy_sock() can be called without addrq_wq_lock. The lock now
will be take on sctp_close_sock(), before locking the socket, so we
don't do it in inverse order compared to sctp_addr_wq_timeout_handler().

Instead of taking the lock on sctp_sock_migrate() for copying and
restoring the list values, it's preferred to avoid rewritting it by
implementing sctp_copy_descendant().

Issue was found with a test application that kept flipping sysctl
default_auto_asconf on and off, but one could trigger it by issuing
simultaneous setsockopt() calls on multiple sockets or by
creating/destroying sockets fast enough. This is only triggerable
locally.

Fixes: 9f7d653b67ae ("sctp: Add Auto-ASCONF support (core).")
Reported-by: Ji Jianwen <jiji@redhat.com>
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonet: don't wait for order-3 page allocation
Shaohua Li [Thu, 11 Jun 2015 23:50:48 +0000 (16:50 -0700)]
net: don't wait for order-3 page allocation

[ Upstream commit fb05e7a89f500cfc06ae277bdc911b281928995d ]

We saw excessive direct memory compaction triggered by skb_page_frag_refill.
This causes performance issues and add latency. Commit 5640f7685831e0
introduces the order-3 allocation. According to the changelog, the order-3
allocation isn't a must-have but to improve performance. But direct memory
compaction has high overhead. The benefit of order-3 allocation can't
compensate the overhead of direct memory compaction.

This patch makes the order-3 page allocation atomic. If there is no memory
pressure and memory isn't fragmented, the alloction will still success, so we
don't sacrifice the order-3 benefit here. If the atomic allocation fails,
direct memory compaction will not be triggered, skb_page_frag_refill will
fallback to order-0 immediately, hence the direct memory compaction overhead is
avoided. In the allocation failure case, kswapd is waken up and doing
compaction, so chances are allocation could success next time.

alloc_skb_with_frags is the same.

The mellanox driver does similar thing, if this is accepted, we must fix
the driver too.

V3: fix the same issue in alloc_skb_with_frags as pointed out by Eric
V2: make the changelog clearer

Cc: Eric Dumazet <edumazet@google.com>
Cc: Chris Mason <clm@fb.com>
Cc: Debabrata Banerjee <dbavatar@gmail.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agobridge: fix multicast router rlist endless loop
Nikolay Aleksandrov [Tue, 9 Jun 2015 17:23:57 +0000 (10:23 -0700)]
bridge: fix multicast router rlist endless loop

[ Upstream commit 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 ]

Since the addition of sysfs multicast router support if one set
multicast_router to "2" more than once, then the port would be added to
the hlist every time and could end up linking to itself and thus causing an
endless loop for rlist walkers.
So to reproduce just do:
echo 2 > multicast_router; echo 2 > multicast_router;
in a bridge port and let some igmp traffic flow, for me it hangs up
in br_multicast_flood().
Fix this by adding a check in br_multicast_add_router() if the port is
already linked.
The reason this didn't happen before the addition of multicast_router
sysfs entries is because there's a !hlist_unhashed check that prevents
it.

Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agosparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context
Sowmini Varadhan [Tue, 21 Apr 2015 14:30:41 +0000 (10:30 -0400)]
sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context

Upstream commit 671d773297969bebb1732e1cdc1ec03aa53c6be2

Since it is possible for vnet_event_napi to end up doing
vnet_control_pkt_engine -> ... -> vnet_send_attr ->
vnet_port_alloc_tx_ring -> ldc_alloc_exp_dring -> kzalloc()
(i.e., in softirq context), kzalloc() should be called with
GFP_ATOMIC from ldc_alloc_exp_dring.

Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoti: config: android: add CTS related changes
Vishal Mahaveer [Wed, 8 Jul 2015 14:19:13 +0000 (09:19 -0500)]
ti: config: android: add CTS related changes

Config changes for fixing some of the Android CTS failures

Fix for test class:android.os.cts.SeccompTest method:testSeccomp
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y

Fix for test class:android.permission.cts.FileSystemPermissionTest method:testDevHwRandomLockedDown
CONFIG_HW_RANDOM=n

Fix for test class:android.security.cts.KernelSettingsTest method:testNoConfigGz
CONFIG_IKCONFIG_PROC=n

Change-Id: I56f3641806445a7c21328605f7bccb9c862de8c3
Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
6 years agoti: config: android: enable selinux permissive mode
Vishal Mahaveer [Mon, 29 Jun 2015 15:49:23 +0000 (10:49 -0500)]
ti: config: android: enable selinux permissive mode

Enable SELinux with permissive mode for Android kernel

Change-Id: I70a57a5dc5f40abc7abebfca58d7f49bc3d80876
Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android
Praneeth Bajjuri [Wed, 8 Jul 2015 19:28:54 +0000 (14:28 -0500)]
Merge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android

* p-ti-linux-3.14.y-common: (35 commits)
  Linux 3.14.47
  arm/arm64: KVM: Don't allow creating VCPUs after vgic_initialized
  arm/arm64: KVM: Introduce stage2_unmap_vm
  arm/arm64: KVM: Reset the HCR on each vcpu when resetting the vcpu
  arm/arm64: KVM: Correct KVM_ARM_VCPU_INIT power off option
  arm/arm64: KVM: Don't clear the VCPU_POWER_OFF flag
  arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
  arm64/kvm: Fix assembler compatibility of macros
  arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
  arm64: KVM: fix unmapping with 48-bit VAs
  arm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort
  arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE
  arm/arm64: KVM: fix potential NULL dereference in user_mem_abort()
  arm: kvm: fix CPU hotplug
  arm/arm64: KVM: Fix VTTBR_BADDR_MASK and pgd alloc
  arm/arm64: KVM: Fix set_clear_sgi_pend_reg offset
  KVM: ARM: vgic: plug irq injection race
  ARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()
  bus: mvebu: pass the coherency availability information at init time
  KVM: nSVM: Check for NRIPS support before updating control field
  ...

Change-Id: Icd5ce4be9884abdd69eaab17e3405546a22739cd
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel...
Praneeth Bajjuri [Wed, 8 Jul 2015 19:28:16 +0000 (14:28 -0500)]
Merge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel into p-ti-linux-3.14.y-common

* 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel: (35 commits)
  Linux 3.14.47
  arm/arm64: KVM: Don't allow creating VCPUs after vgic_initialized
  arm/arm64: KVM: Introduce stage2_unmap_vm
  arm/arm64: KVM: Reset the HCR on each vcpu when resetting the vcpu
  arm/arm64: KVM: Correct KVM_ARM_VCPU_INIT power off option
  arm/arm64: KVM: Don't clear the VCPU_POWER_OFF flag
  arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
  arm64/kvm: Fix assembler compatibility of macros
  arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
  arm64: KVM: fix unmapping with 48-bit VAs
  arm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort
  arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE
  arm/arm64: KVM: fix potential NULL dereference in user_mem_abort()
  arm: kvm: fix CPU hotplug
  arm/arm64: KVM: Fix VTTBR_BADDR_MASK and pgd alloc
  arm/arm64: KVM: Fix set_clear_sgi_pend_reg offset
  KVM: ARM: vgic: plug irq injection race
  ARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()
  bus: mvebu: pass the coherency availability information at init time
  KVM: nSVM: Check for NRIPS support before updating control field
  ...

Change-Id: I4f7d7ab97f3e29de2f1ff6f42e051cbd3ab43597
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoinitramfs: Add skip_initramfs command line option
Rom Lemarchand [Mon, 6 Jul 2015 23:50:33 +0000 (16:50 -0700)]
initramfs: Add skip_initramfs command line option

Add a skip_initramfs option to allow choosing whether to boot using
the initramfs or not at runtime.

Change-Id: If30428fa748c1d4d3d7b9d97c1f781de5e4558c3
Signed-off-by: Rom Lemarchand <romlem@google.com>
6 years agoti_config_fragments: android_config.sh: change merge order
Praneeth Bajjuri [Tue, 7 Jul 2015 20:28:04 +0000 (15:28 -0500)]
ti_config_fragments: android_config.sh: change merge order

android has specific command line arguments, hence android_omap.cfg
should override any other command line set in auto.cfg.

hence changing the merge script order to append android_omap.cfg in the end.

Change-Id: I1a0eff0dce6a7709610e5bbe538defcd4217bc0a
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android
Praneeth Bajjuri [Mon, 6 Jul 2015 22:57:49 +0000 (17:57 -0500)]
Merge branch 'p-ti-linux-3.14.y-common' into p-ti-linux-3.14.y-android

* p-ti-linux-3.14.y-common: (206 commits)
  ARM: dts: dra7xx-jamr3: Enable i2c4 required for radio
  Linux 3.14.46
  KVM: vgic: return int instead of bool when checking I/O ranges
  KVM: ARM/arm64: avoid returning negative error code as bool
  KVM: ARM/arm64: fix broken __percpu annotation
  KVM: ARM/arm64: fix non-const declaration of function returning const
  ARM64: KVM: store kvm_vcpu_fault_info est_el2 as word
  ARM: virt: fix wrong HSCTLR.EE bit setting
  arm64: KVM: export demux regids as KVM_REG_ARM64
  ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping
  ARM: KVM: Unmap IPA on memslot delete/move
  arm/arm64: KVM: Fix and refactor unmap_range
  lpfc: Add iotag memory barrier
  pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic
  ath3k: add support of 13d3:3474 AR3012 device
  ath3k: Add support of 0489:e076 AR3012 device
  drm/mgag200: Reject non-character-cell-aligned mode widths
  tracing: Have filter check for balanced ops
  crypto: caam - fix RNG buffer cache alignment
  Revert "ARM: OMAP: DRA7: change IPU1 clk domain to SWSUP for proper boot"
  ...

Conflicts:
drivers/media/platform/ti-vpe/vip.c

Change-Id: I033593fb5e2a12fa4df0e518af809ba99e6b8b7e
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common-next' into p-ti-linux-3.14.y-common
Praneeth Bajjuri [Mon, 6 Jul 2015 22:40:02 +0000 (17:40 -0500)]
Merge branch 'p-ti-linux-3.14.y-common-next' into p-ti-linux-3.14.y-common

* p-ti-linux-3.14.y-common-next: (187 commits)
  ARM: dts: dra7xx-jamr3: Enable i2c4 required for radio
  Linux 3.14.46
  KVM: vgic: return int instead of bool when checking I/O ranges
  KVM: ARM/arm64: avoid returning negative error code as bool
  KVM: ARM/arm64: fix broken __percpu annotation
  KVM: ARM/arm64: fix non-const declaration of function returning const
  ARM64: KVM: store kvm_vcpu_fault_info est_el2 as word
  ARM: virt: fix wrong HSCTLR.EE bit setting
  arm64: KVM: export demux regids as KVM_REG_ARM64
  ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping
  ARM: KVM: Unmap IPA on memslot delete/move
  arm/arm64: KVM: Fix and refactor unmap_range
  lpfc: Add iotag memory barrier
  pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic
  ath3k: add support of 13d3:3474 AR3012 device
  ath3k: Add support of 0489:e076 AR3012 device
  drm/mgag200: Reject non-character-cell-aligned mode widths
  tracing: Have filter check for balanced ops
  crypto: caam - fix RNG buffer cache alignment
  Linux 3.14.45
  ...

Conflicts:
drivers/iommu/omap-iommu.c
drivers/media/platform/ti-vpe/vip.c
drivers/mmc/host/omap_hsmmc.c
drivers/iommu/omap-iommu.h

Change-Id: I181ac4eb5fa293a6f0a6744c5ef1b86a87c0587a
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge tag 'v3.14.47' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Dan Murphy [Mon, 6 Jul 2015 16:02:03 +0000 (11:02 -0500)]
Merge tag 'v3.14.47' of git./linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.47 stable release

* tag 'v3.14.47' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (35 commits)
  Linux 3.14.47
  arm/arm64: KVM: Don't allow creating VCPUs after vgic_initialized
  arm/arm64: KVM: Introduce stage2_unmap_vm
  arm/arm64: KVM: Reset the HCR on each vcpu when resetting the vcpu
  arm/arm64: KVM: Correct KVM_ARM_VCPU_INIT power off option
  arm/arm64: KVM: Don't clear the VCPU_POWER_OFF flag
  arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
  arm64/kvm: Fix assembler compatibility of macros
  arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
  arm64: KVM: fix unmapping with 48-bit VAs
  arm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort
  arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE
  arm/arm64: KVM: fix potential NULL dereference in user_mem_abort()
  arm: kvm: fix CPU hotplug
  arm/arm64: KVM: Fix VTTBR_BADDR_MASK and pgd alloc
  arm/arm64: KVM: Fix set_clear_sgi_pend_reg offset
  KVM: ARM: vgic: plug irq injection race
  ARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()
  bus: mvebu: pass the coherency availability information at init time
  KVM: nSVM: Check for NRIPS support before updating control field
  ...

Signed-off-by: Dan Murphy <dmurphy@ti.com>
6 years agoLinux 3.14.47
Greg Kroah-Hartman [Sat, 4 Jul 2015 02:49:53 +0000 (19:49 -0700)]
Linux 3.14.47

6 years agoarm/arm64: KVM: Don't allow creating VCPUs after vgic_initialized
Christoffer Dall [Tue, 9 Dec 2014 13:33:45 +0000 (14:33 +0100)]
arm/arm64: KVM: Don't allow creating VCPUs after vgic_initialized

commit 716139df2517fbc3f2306dbe8eba0fa88dca0189 upstream.

When the vgic initializes its internal state it does so based on the
number of VCPUs available at the time.  If we allow KVM to create more
VCPUs after the VGIC has been initialized, we are likely to error out in
unfortunate ways later, perform buffer overflows etc.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Reviewed-by: Eric Auger <eric.auger@linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Introduce stage2_unmap_vm
Christoffer Dall [Thu, 27 Nov 2014 09:35:03 +0000 (10:35 +0100)]
arm/arm64: KVM: Introduce stage2_unmap_vm

commit 957db105c99792ae8ef61ffc9ae77d910f6471da upstream.

Introduce a new function to unmap user RAM regions in the stage2 page
tables.  This is needed on reboot (or when the guest turns off the MMU)
to ensure we fault in pages again and make the dcache, RAM, and icache
coherent.

Using unmap_stage2_range for the whole guest physical range does not
work, because that unmaps IO regions (such as the GIC) which will not be
recreated or in the best case faulted in on a page-by-page basis.

Call this function on secondary and subsequent calls to the
KVM_ARM_VCPU_INIT ioctl so that a reset VCPU will detect the guest
Stage-1 MMU is off when faulting in pages and make the caches coherent.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Reset the HCR on each vcpu when resetting the vcpu
Christoffer Dall [Thu, 16 Oct 2014 15:21:16 +0000 (17:21 +0200)]
arm/arm64: KVM: Reset the HCR on each vcpu when resetting the vcpu

commit b856a59141b1066d3c896a0d0231f84dabd040af upstream.

When userspace resets the vcpu using KVM_ARM_VCPU_INIT, we should also
reset the HCR, because we now modify the HCR dynamically to
enable/disable trapping of guest accesses to the VM registers.

This is crucial for reboot of VMs working since otherwise we will not be
doing the necessary cache maintenance operations when faulting in pages
with the guest MMU off.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Correct KVM_ARM_VCPU_INIT power off option
Christoffer Dall [Thu, 16 Oct 2014 14:14:43 +0000 (16:14 +0200)]
arm/arm64: KVM: Correct KVM_ARM_VCPU_INIT power off option

commit 3ad8b3de526a76fbe9466b366059e4958957b88f upstream.

The implementation of KVM_ARM_VCPU_INIT is currently not doing what
userspace expects, namely making sure that a vcpu which may have been
turned off using PSCI is returned to its initial state, which would be
powered on if userspace does not set the KVM_ARM_VCPU_POWER_OFF flag.

Implement the expected functionality and clarify the ABI.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Don't clear the VCPU_POWER_OFF flag
Christoffer Dall [Tue, 2 Dec 2014 14:27:51 +0000 (15:27 +0100)]
arm/arm64: KVM: Don't clear the VCPU_POWER_OFF flag

commit 03f1d4c17edb31b41b14ca3a749ae38d2dd6639d upstream.

If a VCPU was originally started with power off (typically to be brought
up by PSCI in SMP configurations), there is no need to clear the
POWER_OFF flag in the kernel, as this flag is only tested during the
init ioctl itself.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()
Ard Biesheuvel [Mon, 10 Nov 2014 08:33:55 +0000 (08:33 +0000)]
arm/arm64: kvm: drop inappropriate use of kvm_is_mmio_pfn()

commit 07a9748c78cfc39b54f06125a216b67b9c8f09ed upstream.

Instead of using kvm_is_mmio_pfn() to decide whether a host region
should be stage 2 mapped with device attributes, add a new static
function kvm_is_device_pfn() that disregards RAM pages with the
reserved bit set, as those should usually not be mapped as device
memory.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64/kvm: Fix assembler compatibility of macros
Geoff Levand [Fri, 31 Oct 2014 23:06:47 +0000 (23:06 +0000)]
arm64/kvm: Fix assembler compatibility of macros

commit 286fb1cc32b11c18da3573a8c8c37a4f9da16e30 upstream.

Some of the macros defined in kvm_arm.h are useful in assembly files, but are
not compatible with the assembler.  Change any C language integer constant
definitions using appended U, UL, or ULL to the UL() preprocessor macro.  Also,
add a preprocessor include of the asm/memory.h file which defines the UL()
macro.

Fixes build errors like these when using kvm_arm.h in assembly
source files:

  Error: unexpected characters following instruction at operand 3 -- `and x0,x1,#((1U<<25)-1)'

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()
Christoffer Dall [Thu, 6 Nov 2014 11:47:39 +0000 (11:47 +0000)]
arm/arm64: KVM: vgic: Fix error code in kvm_vgic_create()

commit 6b50f54064a02b77a7b990032b80234fee59bcd6 upstream.

If we detect another vCPU is running we just exit and return 0 as if we
succesfully created the VGIC, but the VGIC wouldn't actual be created.

This shouldn't break in-kernel behavior because the kernel will not
observe the failed the attempt to create the VGIC, but userspace could
be rightfully confused.

Cc: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: KVM: fix unmapping with 48-bit VAs
Mark Rutland [Tue, 28 Oct 2014 19:36:45 +0000 (19:36 +0000)]
arm64: KVM: fix unmapping with 48-bit VAs

commit 7cbb87d67e38cfc55680290a706fd7517f10050d upstream.

Currently if using a 48-bit VA, tearing down the hyp page tables (which
can happen in the absence of a GICH or GICV resource) results in the
rather nasty splat below, evidently becasue we access a table that
doesn't actually exist.

Commit 38f791a4e499792e (arm64: KVM: Implement 48 VA support for KVM EL2
and Stage-2) added a pgd_none check to __create_hyp_mappings to account
for the additional level of tables, but didn't add a corresponding check
to unmap_range, and this seems to be the source of the problem.

This patch adds the missing pgd_none check, ensuring we don't try to
access tables that don't exist.

Original splat below:

kvm [1]: Using HYP init bounce page @83fe94a000
kvm [1]: Cannot obtain GICH resource
Unable to handle kernel paging request at virtual address ffff7f7fff000000
pgd = ffff800000770000
[ffff7f7fff000000] *pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc2+ #89
task: ffff8003eb500000 ti: ffff8003eb45c000 task.ti: ffff8003eb45c000
PC is at unmap_range+0x120/0x580
LR is at free_hyp_pgds+0xac/0xe4
pc : [<ffff80000009b768>] lr : [<ffff80000009cad8>] pstate: 80000045
sp : ffff8003eb45fbf0
x29: ffff8003eb45fbf0 x28: ffff800000736000
x27: ffff800000735000 x26: ffff7f7fff000000
x25: 0000000040000000 x24: ffff8000006f5000
x23: 0000000000000000 x22: 0000007fffffffff
x21: 0000800000000000 x20: 0000008000000000
x19: 0000000000000000 x18: ffff800000648000
x17: ffff800000537228 x16: 0000000000000000
x15: 000000000000001f x14: 0000000000000000
x13: 0000000000000001 x12: 0000000000000020
x11: 0000000000000062 x10: 0000000000000006
x9 : 0000000000000000 x8 : 0000000000000063
x7 : 0000000000000018 x6 : 00000003ff000000
x5 : ffff800000744188 x4 : 0000000000000001
x3 : 0000000040000000 x2 : ffff800000000000
x1 : 0000007fffffffff x0 : 000000003fffffff

Process swapper/0 (pid: 1, stack limit = 0xffff8003eb45c058)
Stack: (0xffff8003eb45fbf0 to 0xffff8003eb460000)
fbe0:                                     eb45fcb0 ffff8003 0009cad8 ffff8000
fc00: 00000000 00000080 00736140 ffff8000 00736000 ffff8000 00000000 00007c80
fc20: 00000000 00000080 006f5000 ffff8000 00000000 00000080 00743000 ffff8000
fc40: 00735000 ffff8000 006d3030 ffff8000 006fe7b8 ffff8000 00000000 00000080
fc60: ffffffff 0000007f fdac1000 ffff8003 fd94b000 ffff8003 fda47000 ffff8003
fc80: 00502b40 ffff8000 ff000000 ffff7f7f fdec6000 00008003 fdac1630 ffff8003
fca0: eb45fcb0 ffff8003 ffffffff 0000007f eb45fd00 ffff8003 0009b378 ffff8000
fcc0: ffffffea 00000000 006fe000 ffff8000 00736728 ffff8000 00736120 ffff8000
fce0: 00000040 00000000 00743000 ffff8000 006fe7b8 ffff8000 0050cd48 00000000
fd00: eb45fd60 ffff8003 00096070 ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
fd20: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00000000 00000000
fd40: 00000ae0 00000000 006aa25c ffff8000 eb45fd60 ffff8003 0017ca44 00000002
fd60: eb45fdc0 ffff8003 0009a33c ffff8000 006f06e0 ffff8000 006f06e0 ffff8000
fd80: fd948b40 ffff8003 0009a320 ffff8000 00000000 00000000 00735000 ffff8000
fda0: 006d3090 ffff8000 006aa25c ffff8000 00735000 ffff8000 006d3030 ffff8000
fdc0: eb45fdd0 ffff8003 000814c0 ffff8000 eb45fe50 ffff8003 006aaac4 ffff8000
fde0: 006ddd90 ffff8000 00000006 00000000 006d3000 ffff8000 00000095 00000000
fe00: 006a1e90 ffff8000 00735000 ffff8000 006d3000 ffff8000 006aa25c ffff8000
fe20: 00735000 ffff8000 006d3030 ffff8000 eb45fe50 ffff8003 006fac68 ffff8000
fe40: 00000006 00000006 fe293ee6 ffff8003 eb45feb0 ffff8003 004f8ee8 ffff8000
fe60: 004f8ed4 ffff8000 00735000 ffff8000 00000000 00000000 00000000 00000000
fe80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
fea0: 00000000 00000000 00000000 00000000 00000000 00000000 000843d0 ffff8000
fec0: 004f8ed4 ffff8000 00000000 00000000 00000000 00000000 00000000 00000000
fee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ff00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ff20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ff40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ff60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ff80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ffa0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000005 00000000
ffe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Call trace:
[<ffff80000009b768>] unmap_range+0x120/0x580
[<ffff80000009cad4>] free_hyp_pgds+0xa8/0xe4
[<ffff80000009b374>] kvm_arch_init+0x268/0x44c
[<ffff80000009606c>] kvm_init+0x24/0x260
[<ffff80000009a338>] arm_init+0x18/0x24
[<ffff8000000814bc>] do_one_initcall+0x88/0x1a0
[<ffff8000006aaac0>] kernel_init_freeable+0x148/0x1e8
[<ffff8000004f8ee4>] kernel_init+0x10/0xd4
Code: 8b000263 92628479 d1000720 eb01001f (f9400340)
---[ end trace 3bc230562e926fa4 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Jungseok Lee <jungseoklee85@gmail.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort
Steve Capper [Tue, 14 Oct 2014 14:02:15 +0000 (15:02 +0100)]
arm: kvm: STRICT_MM_TYPECHECKS fix for user_mem_abort

commit 3d08c629244257473450a8ba17cb8184b91e68f8 upstream.

Commit:
b886576 ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping

introduced some code in user_mem_abort that failed to compile if
STRICT_MM_TYPECHECKS was enabled.

This patch fixes up the failing comparison.

Signed-off-by: Steve Capper <steve.capper@linaro.org>
Reviewed-by: Kim Phillips <kim.phillips@linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE
Christoffer Dall [Fri, 10 Oct 2014 10:14:29 +0000 (12:14 +0200)]
arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE

commit c3058d5da2222629bc2223c488a4512b59bb4baf upstream.

[Since we don't backport commit 8eef912 (arm/arm64: KVM: map MMIO regions
at creation time) for linux-3.14.y, the context of this patch is
different, while the change itself is same.]

When creating or moving a memslot, make sure the IPA space is within the
addressable range of the guest.  Otherwise, user space can create too
large a memslot and KVM would try to access potentially unallocated page
table entries when inserting entries in the Stage-2 page tables.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: fix potential NULL dereference in user_mem_abort()
Ard Biesheuvel [Wed, 17 Sep 2014 21:56:17 +0000 (14:56 -0700)]
arm/arm64: KVM: fix potential NULL dereference in user_mem_abort()

commit 37b544087ef3f65ca68465ba39291a07195dac26 upstream.

Handle the potential NULL return value of find_vma_intersection()
before dereferencing it.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm: kvm: fix CPU hotplug
Vladimir Murzin [Mon, 22 Sep 2014 14:52:48 +0000 (15:52 +0100)]
arm: kvm: fix CPU hotplug

commit 37a34ac1d4775aafbc73b9db53c7daebbbc67e6a upstream.

On some platforms with no power management capabilities, the hotplug
implementation is allowed to return from a smp_ops.cpu_die() call as a
function return. Upon a CPU onlining event, the KVM CPU notifier tries
to reinstall the hyp stub, which fails on platform where no reset took
place following a hotplug event, with the message:

CPU1: smp_ops.cpu_die() returned, trying to resuscitate
CPU1: Booted secondary processor
Kernel panic - not syncing: unexpected prefetch abort in Hyp mode at: 0x80409540
unexpected data abort in Hyp mode at: 0x80401fe8
unexpected HVC/SVC trap in Hyp mode at: 0x805c6170

since KVM code is trying to reinstall the stub on a system where it is
already configured.

To prevent this issue, this patch adds a check in the KVM hotplug
notifier that detects if the HYP stub really needs re-installing when a
CPU is onlined and skips the installation call if the stub is already in
place, which means that the CPU has not been reset.

Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Fix VTTBR_BADDR_MASK and pgd alloc
Joel Schopp [Wed, 9 Jul 2014 16:17:04 +0000 (11:17 -0500)]
arm/arm64: KVM: Fix VTTBR_BADDR_MASK and pgd alloc

commit dbff124e29fa24aff9705b354b5f4648cd96e0bb upstream.

The current aarch64 calculation for VTTBR_BADDR_MASK masks only 39 bits
and not all the bits in the PA range. This is clearly a bug that
manifests itself on systems that allocate memory in the higher address
space range.

 [ Modified from Joel's original patch to be based on PHYS_MASK_SHIFT
   instead of a hard-coded value and to move the alignment check of the
   allocation to mmu.c.  Also added a comment explaining why we hardcode
   the IPA range and changed the stage-2 pgd allocation to be based on
   the 40 bit IPA range instead of the maximum possible 48 bit PA range.
   - Christoffer ]

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Joel Schopp <joel.schopp@amd.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm/arm64: KVM: Fix set_clear_sgi_pend_reg offset
Christoffer Dall [Thu, 25 Sep 2014 16:41:07 +0000 (18:41 +0200)]
arm/arm64: KVM: Fix set_clear_sgi_pend_reg offset

commit 0fea6d7628ed6e25a9ee1b67edf7c859718d39e8 upstream.

The sgi values calculated in read_set_clear_sgi_pend_reg() and
write_set_clear_sgi_pend_reg() were horribly incorrectly multiplied by 4
with catastrophic results in that subfunctions ended up overwriting
memory not allocated for the expected purpose.

This showed up as bugs in kfree() and the kernel complaining a lot of
you turn on memory debugging.

This addresses: http://marc.info/?l=kvm&m=141164910007868&w=2

Reported-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: ARM: vgic: plug irq injection race
Marc Zyngier [Tue, 8 Jul 2014 11:09:00 +0000 (12:09 +0100)]
KVM: ARM: vgic: plug irq injection race

commit 71afaba4a2e98bb7bdeba5078370ab43d46e67a1 upstream.

[Since we don't backport commit 227844f (arm/arm64: KVM: Rename irq_state
to irq_pending) for linux-3.14.y, here we still use vgic_update_irq_state
instead of vgic_update_irq_pending.]

As it stands, nothing prevents userspace from injecting an interrupt
before the guest's GIC is actually initialized.

This goes unnoticed so far (as everything is pretty much statically
allocated), but ends up exploding in a spectacular way once we switch
to a more dynamic allocation (the GIC data structure isn't there yet).

The fix is to test for the "ready" flag in the VGIC distributor before
trying to inject the interrupt. Note that in order to avoid breaking
userspace, we have to ignore what is essentially an error.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()
Ard Biesheuvel [Tue, 9 Sep 2014 10:27:09 +0000 (11:27 +0100)]
ARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()

commit a7d079cea2dffb112e26da2566dd84c0ef1fce97 upstream.

[Since we don't backport commit 9804788 (arm/arm64: KVM: Support
KVM_CAP_READONLY_MEM), ingore the changes in kvm_handle_guest_abort
introduced by this patch.]

The ISS encoding for an exception from a Data Abort has a WnR
bit[6] that indicates whether the Data Abort was caused by a
read or a write instruction. While there are several fields
in the encoding that are only valid if the ISV bit[24] is set,
WnR is not one of them, so we can read it unconditionally.

Instead of fixing both implementations of kvm_is_write_fault()
in place, reimplement it just once using kvm_vcpu_dabt_iswrite(),
which already does the right thing with respect to the WnR bit.
Also fix up the callers to pass 'vcpu'

Acked-by: Laszlo Ersek <lersek@redhat.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agobus: mvebu: pass the coherency availability information at init time
Greg Ungerer [Mon, 14 Apr 2014 13:47:01 +0000 (15:47 +0200)]
bus: mvebu: pass the coherency availability information at init time

commit 5686a1e5aa436c49187a60052d5885fb1f541ce6 upstream.

Until now, the mvebu-mbus was guessing by itself whether hardware I/O
coherency was available or not by poking into the Device Tree to see
if the coherency fabric Device Tree node was present or not.

However, on some upcoming SoCs, the presence or absence of the
coherency fabric DT node isn't sufficient: in CONFIG_SMP, the
coherency can be enabled, but not in !CONFIG_SMP.

In order to clean this up, the mvebu_mbus_dt_init() function is
extended to get a boolean argument telling whether coherency is
enabled or not. Therefore, the logic to decide whether coherency is
available or not now belongs to the core SoC code instead of the
mvebu-mbus driver itself, which is much better.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1397483228-25625-4-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
[ Greg Ungerer: back ported to linux-3.14.y
  Back port necessary due to large code differences in affected files.
  This change in combination with commit e553554536 ("ARM: mvebu: disable
  I/O coherency on non-SMP situations on Armada 370/375/38x/XP") is
  critical to the hardware I/O coherency being set correctly by both the
  mbus driver and all peripheral hardware drivers. Without this change
  drivers will incorrectly enable I/O coherency window attributes and
  this causes rare unreliable system behavior including oops. ]

Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: nSVM: Check for NRIPS support before updating control field
Bandan Das [Thu, 11 Jun 2015 06:05:33 +0000 (02:05 -0400)]
KVM: nSVM: Check for NRIPS support before updating control field

commit f104765b4f81fd74d69e0eb161e89096deade2db upstream.

If hardware doesn't support DecodeAssist - a feature that provides
more information about the intercept in the VMCB, KVM decodes the
instruction and then updates the next_rip vmcb control field.
However, NRIP support itself depends on cpuid Fn8000_000A_EDX[NRIPS].
Since skip_emulated_instruction() doesn't verify nrip support
before accepting control.next_rip as valid, avoid writing this
field if support isn't present.

Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: clk-imx6q: refine sata's parent
Sebastien Szymanski [Wed, 20 May 2015 14:30:37 +0000 (16:30 +0200)]
ARM: clk-imx6q: refine sata's parent

commit da946aeaeadcd24ff0cda9984c6fb8ed2bfd462a upstream.

According to IMX6D/Q RM, table 18-3, sata clock's parent is ahb, not ipg.

Signed-off-by: Sebastien Szymanski <sebastien.szymanski@armadeus.com>
Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
[dirk.behme: Adjust moved file]
Signed-off-by: Dirk Behme <dirk.behme@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agosplice: Apply generic position and size checks to each write
Ben Hutchings [Thu, 29 Jan 2015 02:50:33 +0000 (02:50 +0000)]
splice: Apply generic position and size checks to each write

commit 894c6350eaad7e613ae267504014a456e00a3e2a from the 3.2-stable branch.

We need to check the position and size of file writes against various
limits, using generic_write_check().  This was not being done for
the splice write path.  It was fixed upstream by commit 8d0207652cbe
("->splice_write() via ->write_iter()") but we can't apply that.

CVE-2014-7822

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Vinson Lee <vlee@twopensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonet/mlx4_en: Don't attempt to TX offload the outer UDP checksum for VXLAN
Or Gerlitz [Thu, 30 Oct 2014 13:59:27 +0000 (15:59 +0200)]
net/mlx4_en: Don't attempt to TX offload the outer UDP checksum for VXLAN

commit a4f2dacbf2a5045e34b98a35d9a3857800f25a7b upstream.

For VXLAN/NVGRE encapsulation, the current HW doesn't support offloading
both the outer UDP TX checksum and the inner TCP/UDP TX checksum.

The driver doesn't advertize SKB_GSO_UDP_TUNNEL_CSUM, however we are wrongly
telling the HW to offload the outer UDP checksum for encapsulated packets,
fix that.

Fixes: 837052d0ccc5 ('net/mlx4_en: Add netdev support for TCP/IP
     offloads of vxlan tunneling')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoBtrfs: make xattr replace operations atomic
Filipe Manana [Sun, 9 Nov 2014 08:38:39 +0000 (08:38 +0000)]
Btrfs: make xattr replace operations atomic

commit 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 upstream.

Replacing a xattr consists of doing a lookup for its existing value, delete
the current value from the respective leaf, release the search path and then
finally insert the new value. This leaves a time window where readers (getxattr,
listxattrs) won't see any value for the xattr. Xattrs are used to store ACLs,
so this has security implications.

This change also fixes 2 other existing issues which were:

*) Deleting the old xattr value without verifying first if the new xattr will
   fit in the existing leaf item (in case multiple xattrs are packed in the
   same item due to name hash collision);

*) Returning -EEXIST when the flag XATTR_CREATE is given and the xattr doesn't
   exist but we have have an existing item that packs muliple xattrs with
   the same name hash as the input xattr. In this case we should return ENOSPC.

A test case for xfstests follows soon.

Thanks to Alexandre Oliva for reporting the non-atomicity of the xattr replace
implementation.

Reported-by: Alexandre Oliva <oliva@gnu.org>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agox86/microcode/intel: Guard against stack overflow in the loader
Quentin Casasnovas [Tue, 3 Feb 2015 12:00:22 +0000 (13:00 +0100)]
x86/microcode/intel: Guard against stack overflow in the loader

commit f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4 upstream.

mc_saved_tmp is a static array allocated on the stack, we need to make
sure mc_saved_count stays within its bounds, otherwise we're overflowing
the stack in _save_mc(). A specially crafted microcode header could lead
to a kernel crash or potentially kernel execution.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1422964824-22056-1-git-send-email-quentin.casasnovas@oracle.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agohpsa: add missing pci_set_master in kdump path
Tomas Henzl [Fri, 12 Sep 2014 12:44:15 +0000 (14:44 +0200)]
hpsa: add missing pci_set_master in kdump path

commit 859c75aba20264d87dd026bab0d0ca3bff385955 upstream.

Add a call to pci_set_master(...)  missing in the previous
patch "hpsa: refine the pci enable/disable handling".
Found thanks to Rob Elliot.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Reviewed-by: Robert Elliott <elliott@hp.com>
Tested-by: Robert Elliott <elliott@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonetfilter: nf_tables: allow to change chain policy without hook if it exists
Pablo Neira Ayuso [Tue, 17 Mar 2015 12:21:42 +0000 (13:21 +0100)]
netfilter: nf_tables: allow to change chain policy without hook if it exists

commit d6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99 upstream.

If there's an existing base chain, we have to allow to change the
default policy without indicating the hook information.

However, if the chain doesn't exists, we have to enforce the presence of
the hook attribute.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonetfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set
Pablo Neira Ayuso [Sat, 21 Mar 2015 18:25:05 +0000 (19:25 +0100)]
netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set

commit 749177ccc74f9c6d0f51bd78a15c652a2134aa11 upstream.

ip6tables extensions check for this flag to restrict match/target to a
given protocol. Without this flag set, SYNPROXY6 returns an error.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonetfilter: Zero the tuple in nfnl_cthelper_parse_tuple()
Ian Wilson [Thu, 12 Mar 2015 09:37:58 +0000 (09:37 +0000)]
netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()

commit 78146572b9cd20452da47951812f35b1ad4906be upstream.

nfnl_cthelper_parse_tuple() is called from nfnl_cthelper_new(),
nfnl_cthelper_get() and nfnl_cthelper_del().  In each case they pass
a pointer to an nf_conntrack_tuple data structure local variable:

    struct nf_conntrack_tuple tuple;
    ...
    ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);

The problem is that this local variable is not initialized, and
nfnl_cthelper_parse_tuple() only initializes two fields: src.l3num and
dst.protonum.  This leaves all other fields with undefined values
based on whatever is on the stack:

    tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
    tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);

The symptom observed was that when the rpc and tns helpers were added
then traffic to port 1536 was being sent to user-space.

Signed-off-by: Ian Wilson <iwilson@brocade.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agohpsa: refine the pci enable/disable handling
Tomas Henzl [Thu, 14 Aug 2014 14:12:39 +0000 (16:12 +0200)]
hpsa: refine the pci enable/disable handling

commit 132aa220b45d60e9b20def1e9d8be9422eed9616 upstream.

When a second(kdump) kernel starts and the hard reset method is used
the driver calls pci_disable_device without previously enabling it,
so the kernel shows a warning -
[   16.876248] WARNING: at drivers/pci/pci.c:1431 pci_disable_device+0x84/0x90()
[   16.882686] Device hpsa
disabling already-disabled device
...
This patch fixes it, in addition to this I tried to balance also some other pairs
of enable/disable device in the driver.
Unfortunately I wasn't able to verify the functionality for the case of a sw reset,
because of a lack of proper hw.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Reviewed-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agosb_edac: Fix erroneous bytes->gigabytes conversion
Jim Snow [Tue, 18 Nov 2014 13:51:09 +0000 (14:51 +0100)]
sb_edac: Fix erroneous bytes->gigabytes conversion

commit 8c009100295597f23978c224aec5751a365bc965 upstream.

Signed-off-by: Jim Snow <jim.snow@intel.com>
Signed-off-by: Lukasz Anaczkowski <lukasz.anaczkowski@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[ vlee: Backported to 3.14. Adjusted context. ]
Signed-off-by: Vinson Lee <vlee@twitter.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonetfilter: nfnetlink_cthelper: Remove 'const' and '&' to avoid warnings
Chen Gang [Wed, 24 Dec 2014 15:04:54 +0000 (23:04 +0800)]
netfilter: nfnetlink_cthelper: Remove 'const' and '&' to avoid warnings

commit b18c5d15e8714336365d9d51782d5b53afa0443c upstream.

The related code can be simplified, and also can avoid related warnings
(with allmodconfig under parisc):

    CC [M]  net/netfilter/nfnetlink_cthelper.o
  net/netfilter/nfnetlink_cthelper.c: In function ‘nfnl_cthelper_from_nlattr’:
  net/netfilter/nfnetlink_cthelper.c:97:9: warning: passing argument 1 o ‘memcpy’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-array-qualifiers]
    memcpy(&help->data, nla_data(attr), help->helper->data_len);
           ^
  In file included from include/linux/string.h:17:0,
                   from include/uapi/linux/uuid.h:25,
                   from include/linux/uuid.h:23,
                   from include/linux/mod_devicetable.h:12,
                   from ./arch/parisc/include/asm/hardware.h:4,
                   from ./arch/parisc/include/asm/processor.h:15,
                   from ./arch/parisc/include/asm/spinlock.h:6,
                   from ./arch/parisc/include/asm/atomic.h:21,
                   from include/linux/atomic.h:4,
                   from ./arch/parisc/include/asm/bitops.h:12,
                   from include/linux/bitops.h:36,
                   from include/linux/kernel.h:10,
                   from include/linux/list.h:8,
                   from include/linux/module.h:9,
                   from net/netfilter/nfnetlink_cthelper.c:11:
  ./arch/parisc/include/asm/string.h:8:8: note: expected ‘void *’ but argument is of type ‘const char (*)[]’
   void * memcpy(void * dest,const void *src,size_t count);
          ^

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoconfig: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected
Konrad Rzeszutek Wilk [Fri, 17 Apr 2015 19:04:48 +0000 (15:04 -0400)]
config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected

commit a6dfa128ce5c414ab46b1d690f7a1b8decb8526d upstream.

A huge amount of NIC drivers use the DMA API, however if
compiled under 32-bit an very important part of the DMA API can
be ommitted leading to the drivers not working at all
(especially if used with 'swiotlb=force iommu=soft').

As Prashant Sreedharan explains it: "the driver [tg3] uses
DEFINE_DMA_UNMAP_ADDR(), dma_unmap_addr_set() to keep a copy of
the dma "mapping" and dma_unmap_addr() to get the "mapping"
value. On most of the platforms this is a no-op, but ... with
"iommu=soft and swiotlb=force" this house keeping is required,
... otherwise we pass 0 while calling pci_unmap_/pci_dma_sync_
instead of the DMA address."

As such enable this even when using 32-bit kernels.

Reported-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Prashant Sreedharan <prashant@broadcom.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Chan <mchan@broadcom.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: boris.ostrovsky@oracle.com
Cc: cascardo@linux.vnet.ibm.com
Cc: david.vrabel@citrix.com
Cc: sanjeevb@broadcom.com
Cc: siva.kallam@broadcom.com
Cc: vyasevich@gmail.com
Cc: xen-devel@lists.xensource.com
Link: http://lkml.kernel.org/r/20150417190448.GA9462@l.oracle.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agokprobes/x86: Return correct length in __copy_instruction()
Eugene Shatokhin [Tue, 17 Mar 2015 10:09:18 +0000 (19:09 +0900)]
kprobes/x86: Return correct length in __copy_instruction()

commit c80e5c0c23ce2282476fdc64c4b5e3d3a40723fd upstream.

On x86-64, __copy_instruction() always returns 0 (error) if the
instruction uses %rip-relative addressing. This is because
kernel_insn_init() is called the second time for 'insn' instance
in such cases and sets all its fields to 0.

Because of this, trying to place a kprobe on such instruction
will fail, register_kprobe() will return -EINVAL.

This patch fixes the problem.

Signed-off-by: Eugene Shatokhin <eugene.shatokhin@rosalab.ru>
Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Link: http://lkml.kernel.org/r/20150317100918.28349.94654.stgit@localhost.localdomain
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: dma-mapping: always clear allocated buffers
Marek Szyprowski [Thu, 23 Apr 2015 11:46:16 +0000 (12:46 +0100)]
arm64: dma-mapping: always clear allocated buffers

commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 upstream.

Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha,
ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.
It turned out that some drivers rely on this 'feature'. Allocated buffer
might be also exposed to userspace with dma_mmap() call, so clearing it
is desired from security point of view to avoid exposing random memory
to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64
architecture with other implementations by unconditionally zeroing
allocated buffer.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
[will: ported to 3.14.y]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: dts: dra7xx-jamr3: Enable i2c4 required for radio
Stephen Molfetta [Wed, 1 Jul 2015 21:04:04 +0000 (16:04 -0500)]
ARM: dts: dra7xx-jamr3: Enable i2c4 required for radio

The radio tuner on the JAMR3 daughter is connected to the i2c4
bus.  The i2c4 node needs to be explicitly enabled so that the
corresponding i2c adapter is registered and the radio userspace
software can control the tuner.

Change-Id: Ibde1a574113cfb21509d5776708e545654d0873a
Signed-off-by: Stephen Molfetta <sjmolfetta@ti.com>
Signed-off-by: Venkateswara Rao Mandela <venkat.mandela@ti.com>
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel...
Praneeth Bajjuri [Wed, 1 Jul 2015 19:00:43 +0000 (14:00 -0500)]
Merge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel into p-ti-linux-3.14.y-common-next

* 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel: (125 commits)
  Linux 3.14.46
  KVM: vgic: return int instead of bool when checking I/O ranges
  KVM: ARM/arm64: avoid returning negative error code as bool
  KVM: ARM/arm64: fix broken __percpu annotation
  KVM: ARM/arm64: fix non-const declaration of function returning const
  ARM64: KVM: store kvm_vcpu_fault_info est_el2 as word
  ARM: virt: fix wrong HSCTLR.EE bit setting
  arm64: KVM: export demux regids as KVM_REG_ARM64
  ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping
  ARM: KVM: Unmap IPA on memslot delete/move
  arm/arm64: KVM: Fix and refactor unmap_range
  lpfc: Add iotag memory barrier
  pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic
  ath3k: add support of 13d3:3474 AR3012 device
  ath3k: Add support of 0489:e076 AR3012 device
  drm/mgag200: Reject non-character-cell-aligned mode widths
  tracing: Have filter check for balanced ops
  crypto: caam - fix RNG buffer cache alignment
  Linux 3.14.45
  btrfs: cleanup orphans while looking up default subvolume
  ...

Change-Id: Ia19b003af76404a9342b4345c5b6902005d26177
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agocpu_power: Avoids race condition when the task exits.
Ruchi Kandoi [Sat, 27 Jun 2015 02:02:08 +0000 (19:02 -0700)]
cpu_power: Avoids race condition when the task exits.

When the task is terminated, the cpu_power for that particular task is
added to the terminated tasks. cpu_power is set to ULLONG_MAX at this
point to avoid double accounting of the power. It is possible that before the
task releases all the resources, cpu reschedules the task or a timer
interrupt is fired. At this point we will try to add the additional time
to the process, which will cause the accounting to be skewed. This
avoids the case where we change the cpu_power when it is already set to
ULLONG_MAX.

Bug: 22064385
Change-Id: I405733725d535b0a864088516bf52fa3638ee6aa
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
6 years agoMerge tag 'v3.14.46' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Texas Instruments Auto Merger [Mon, 29 Jun 2015 20:16:22 +0000 (15:16 -0500)]
Merge tag 'v3.14.46' of git./linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.46 stable release

* tag 'v3.14.46' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable:
  Linux 3.14.46
  KVM: vgic: return int instead of bool when checking I/O ranges
  KVM: ARM/arm64: avoid returning negative error code as bool
  KVM: ARM/arm64: fix broken __percpu annotation
  KVM: ARM/arm64: fix non-const declaration of function returning const
  ARM64: KVM: store kvm_vcpu_fault_info est_el2 as word
  ARM: virt: fix wrong HSCTLR.EE bit setting
  arm64: KVM: export demux regids as KVM_REG_ARM64
  ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping
  ARM: KVM: Unmap IPA on memslot delete/move
  arm/arm64: KVM: Fix and refactor unmap_range
  lpfc: Add iotag memory barrier
  pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic
  ath3k: add support of 13d3:3474 AR3012 device
  ath3k: Add support of 0489:e076 AR3012 device
  drm/mgag200: Reject non-character-cell-aligned mode widths
  tracing: Have filter check for balanced ops
  crypto: caam - fix RNG buffer cache alignment

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
6 years agoLinux 3.14.46
Greg Kroah-Hartman [Mon, 29 Jun 2015 19:25:50 +0000 (12:25 -0700)]
Linux 3.14.46

6 years agoKVM: vgic: return int instead of bool when checking I/O ranges
Will Deacon [Tue, 26 Aug 2014 14:13:24 +0000 (15:13 +0100)]
KVM: vgic: return int instead of bool when checking I/O ranges

commit 1fa451bcc67fa921a04c5fac8dbcde7844d54512 upstream.

vgic_ioaddr_overlap claims to return a bool, but in reality it returns
an int. Shut sparse up by fixing the type signature.

Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: ARM/arm64: avoid returning negative error code as bool
Will Deacon [Tue, 26 Aug 2014 14:13:22 +0000 (15:13 +0100)]
KVM: ARM/arm64: avoid returning negative error code as bool

commit 18d457661fb9fa69352822ab98d39331c3d0e571 upstream.

is_valid_cache returns true if the specified cache is valid.
Unfortunately, if the parameter passed it out of range, we return
-ENOENT, which ends up as true leading to potential hilarity.

This patch returns false on the failure path instead.

Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: ARM/arm64: fix broken __percpu annotation
Will Deacon [Tue, 26 Aug 2014 14:13:21 +0000 (15:13 +0100)]
KVM: ARM/arm64: fix broken __percpu annotation

commit 4000be423cb01a8d09de878bb8184511c49d4238 upstream.

Running sparse results in a bunch of noisy address space mismatches
thanks to the broken __percpu annotation on kvm_get_running_vcpus.

This function returns a pcpu pointer to a pointer, not a pointer to a
pcpu pointer. This patch fixes the annotation, which kills the warnings
from sparse.

Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: ARM/arm64: fix non-const declaration of function returning const
Will Deacon [Tue, 26 Aug 2014 14:13:20 +0000 (15:13 +0100)]
KVM: ARM/arm64: fix non-const declaration of function returning const

commit 6951e48bff0b55d2a8e825a953fc1f8e3a34bf1c upstream.

Sparse kicks up about a type mismatch for kvm_target_cpu:

arch/arm64/kvm/guest.c:271:25: error: symbol 'kvm_target_cpu' redeclared with different type (originally declared at ./arch/arm64/include/asm/kvm_host.h:45) - different modifiers

so fix this by adding the missing const attribute to the function
declaration.

Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM64: KVM: store kvm_vcpu_fault_info est_el2 as word
Victor Kamensky [Thu, 12 Jun 2014 16:30:09 +0000 (09:30 -0700)]
ARM64: KVM: store kvm_vcpu_fault_info est_el2 as word

commit ba083d20d8cfa9e999043cd89c4ebc964ccf8927 upstream.

esr_el2 field of struct kvm_vcpu_fault_info has u32 type.
It should be stored as word. Current code works in LE case
because existing puts least significant word of x1 into
esr_el2, and it puts most significant work of x1 into next
field, which accidentally is OK because it is updated again
by next instruction. But existing code breaks in BE case.

Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>