rpmsg/rpmsg.git
16 months agoMerge branch 'rpmsg-ti-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti... rpmsg-ti-linux-4.19.y-intg
Suman Anna [Tue, 24 Dec 2019 19:34:56 +0000 (13:34 -0600)]
Merge branch 'rpmsg-ti-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti-linux-4.19.y-intg

Signed-off-by: Suman Anna <s-anna@ti.com>
16 months agoMerge branch 'rpmsg-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti-linux... rpmsg-ti-linux-4.19.y
Suman Anna [Tue, 24 Dec 2019 19:21:59 +0000 (13:21 -0600)]
Merge branch 'rpmsg-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti-linux-4.19.y

Pull in the updated rpmsg base feature branch that includes a minor fix
in the rpmsg-rpc driver for issues reported by the static code checker
tool Klocwork.

* 'rpmsg-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg:
  rpmsg: rpc: fix static checker errors

Signed-off-by: Suman Anna <s-anna@ti.com>
16 months agoMerge branch 'topic/4.19/am65x' of git://git.ti.com/rpmsg/remoteproc into rpmsg-ti...
Suman Anna [Tue, 24 Dec 2019 19:18:52 +0000 (13:18 -0600)]
Merge branch 'topic/4.19/am65x' of git://git.ti.com/rpmsg/remoteproc into rpmsg-ti-linux-4.19.y

Pull in the dedicated AM65x remoteproc topic branch that includes a fix
for probe failures in remoteproc mode on devices where the R5FSS is
only capable of Split-mode.

* 'topic/4.19/am65x' of git://git.ti.com/rpmsg/remoteproc:
  remoteproc/k3-r5: fix probe failure on Split-mode _only_ devices

Signed-off-by: Suman Anna <s-anna@ti.com>
16 months agoremoteproc/k3-r5: fix probe failure on Split-mode _only_ devices
Suman Anna [Fri, 20 Dec 2019 21:48:58 +0000 (15:48 -0600)]
remoteproc/k3-r5: fix probe failure on Split-mode _only_ devices

The R5F subsystem/cluster on K3 SoCs can support both LockStep and
Split-modes (superset) or just Split-mode depending on an eFUSE
capability register. The k3_r5_rproc_configure() function is used to
configure the R5F remote processors in remoteproc mode, and performs
this by requesting the System Firmware as per the requested DT properties.
This function initializes identical settings for both cores in LockStep
mode by first programming it for Split-mode and then reverting back
to LockStep mode after the settings initialization. The Split-mode
setting is done on Core0 always irrespective of the mode.

The LockStep configuration bit is Read-only though on Split-mode _only_
devices and as such the System Firmware does not allow the LockStep
mode bit to be configured on such devices. The current logic in
k3_r5_rproc_configure() fails on Split-mode devices because of this
unconditional programming of the LockStep mode bit.

Fix this by limiting the LockStep mode bit clear configuration only on
devices supporting both LockStep/Split-modes.

Reported-by: Andreas Dannenberg <dannenberg@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
16 months agoMerged TI feature audio-display into ti-linux-4.19.y
LCPD Auto Merger [Fri, 20 Dec 2019 14:36:43 +0000 (08:36 -0600)]
Merged TI feature audio-display into ti-linux-4.19.y

TI-Feature: audio-display
TI-Branch: audio_display-ti-linux-4.19.y

* 'audio_display-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/audio-display:
  drm/tidss: remove underflow handling
  drm/tidss: increase preload to avoid underflows
  arm64: dts: ti: k3-am65-main: fix DSS irq trigger type

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
16 months agoMerge branch 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into...
Jyri Sarha [Fri, 20 Dec 2019 13:48:06 +0000 (15:48 +0200)]
Merge branch 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into audio_display-ti-linux-4.19.y

[GIT PULL] underflow fixes for .06

* 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux:
  drm/tidss: remove underflow handling
  drm/tidss: increase preload to avoid underflows
  arm64: dts: ti: k3-am65-main: fix DSS irq trigger type

16 months agodrm/tidss: remove underflow handling
Tomi Valkeinen [Fri, 20 Dec 2019 09:24:47 +0000 (11:24 +0200)]
drm/tidss: remove underflow handling

It was found out that we may have lots of underflows even in a normal,
working, setup.

This may happen during the DSS preload period, where DSS fills all its
fifos and buffers at maximum speed. Underflow indicates that the DMA
cannot keep up with the DSS's internal pixel processing, but as the
pixels are not consumed yet by anything, there's no harm in these
underflows. It effectively just indicates that DSS's internal processing
is being limited by the DMA.

If an underflow happens during the active period of the display, it
causes a sync-lost interrupt as the videoport cannot get the pixels it
needs. This sync-lost is often caused by an underflow, though.

So, underflow alone is not an indication of a problem, but sync lost
always is.

This patch removes underflow handling from the driver to get rid of the
underflow error print floods. In the future we may want to improve this
so that via a debug option some kind of underflow statistics could be
collected.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
16 months agodrm/tidss: increase preload to avoid underflows
Tomi Valkeinen [Thu, 19 Dec 2019 07:57:17 +0000 (09:57 +0200)]
drm/tidss: increase preload to avoid underflows

AM6 EVM shows underflows with some downscaling use cases. One way to
decrease the possibility of underflows is to adjust the preload value.
The driver currently sets it to a rather low value.

This patch makes the HW use the fifo high-threshold value as the preload
value, which should minimize the possibility of underflows from preload
perspective.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
16 months agorpmsg: rpc: fix static checker errors rpmsg-linux-4.19.y
Suman Anna [Wed, 18 Dec 2019 22:30:15 +0000 (16:30 -0600)]
rpmsg: rpc: fix static checker errors

Fix couple of minor issues reported by the Klocwork static checker
analysis tool:
 - Perform a sanity check on the function index against the available
   number of functions supported by the rppc device to avoid out-of-bound
   array access in rppc_write().
 - Remove a stale local variable redefinition to avoid returning an
   uninitialized return value in certain paths in rppc_probe().

Fixes: 1b5a3b2ef344 ("rpmsg: rpc: introduce a new rpmsg_rpc driver")
Signed-off-by: Suman Anna <s-anna@ti.com>
16 months agoarm64: dts: ti: k3-am65-main: fix DSS irq trigger type
Tomi Valkeinen [Wed, 11 Dec 2019 07:13:00 +0000 (09:13 +0200)]
arm64: dts: ti: k3-am65-main: fix DSS irq trigger type

DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING. For some reason this
results in double the amount of expected interrupts, e.g. for normal
page flipping test the number of interrupts per second is 2 * fps. It is
as if the IRQ would trigger on both edges.

In any case, it's better to use IRQ_TYPE_LEVEL_HIGH, like the other
devices do, which seems to fix this problem.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
16 months agoMerged TI feature platform_base into ti-linux-4.19.y
LCPD Auto Merger [Mon, 16 Dec 2019 20:56:10 +0000 (14:56 -0600)]
Merged TI feature platform_base into ti-linux-4.19.y

TI-Feature: platform_base
TI-Branch: platform-ti-linux-4.19.y

* 'platform-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/platform:
  ARM: dts: AM57xx: beagleboneai: add dts file
  dt-bindings: Add vendor prefix for BeagleBoard.org

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
16 months agoARM: dts: AM57xx: beagleboneai: add dts file
Jason Kridner [Mon, 16 Dec 2019 14:56:57 +0000 (08:56 -0600)]
ARM: dts: AM57xx: beagleboneai: add dts file

BeagleBoard.org BeagleBone AI is an open source hardware single
board computer based on the Texas Instruments AM5729 SoC featuring
dual-core 1.5GHz Arm Cortex-A15 processor, dual-core C66 digital
signal processor (DSP), quad-core embedded vision engine (EVE),
Arm Cortex-M4 processors, dual programmable realtime unit
industrial control subsystems and more. The board features 1GB
DDR3L, USB3.0 Type-C, USB HS Type-A, microHDMI, 16GB eMMC flash,
1G Ethernet, 802.11ac 2/5GHz, Bluetooth, and BeagleBone expansion
headers.

For more information, refer to:
https://beaglebone.ai

This patch introduces the BeagleBone AI device tree.

Note that this patch has been submitted to the upstream linux
kernel here: https://patchwork.kernel.org/patch/11254903/

However, there are additional features necessary to utilize
TIDL, such as dsp firmware loading that are not yet
features of the mainline kernel, making this patch necessary.

Note that the device use the "ti,tpd12s016" component which is
software compatible with "ti,tpd12s015". Thus we only use the
latter driver.

Signed-off-by: Jason Kridner <jdk@ti.com>
Signed-off-by: Caleb Robey <c-robey@ti.com>
Cc: Robert Nelson <robertcnelson@gmail.com>
[t-kristo@ti.com: added the dtb as a build target under makefile, fixed
 subject, and dropped broken opp_slow definition]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
[d-gerlach@ti.com: fix copyright date in am5729-beagleboneai.dts]
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
16 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Fri, 13 Dec 2019 10:16:51 +0000 (04:16 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity:
  arm64: dts: ti: k3-am65-mcu: Update Device IDs for OSPIs
  pwm: pru: adjust the pwm period low boundary

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoarm64: dts: ti: k3-am65-mcu: Update Device IDs for OSPIs
Vignesh Raghavendra [Wed, 11 Dec 2019 13:12:12 +0000 (18:42 +0530)]
arm64: dts: ti: k3-am65-mcu: Update Device IDs for OSPIs

Device IDs for OSPIs have changed in latest SYSFW release, update the
same.

Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agodt-bindings: Add vendor prefix for BeagleBoard.org
Jason Kridner [Wed, 11 Dec 2019 22:09:34 +0000 (16:09 -0600)]
dt-bindings: Add vendor prefix for BeagleBoard.org

Add vendor prefix for BeagleBoard.org Foundation

Signed-off-by: Jason Kridner <jdk@ti.com>
17 months agopwm: pru: adjust the pwm period low boundary
Bin Liu [Tue, 10 Dec 2019 14:44:49 +0000 (08:44 -0600)]
pwm: pru: adjust the pwm period low boundary

The 10us of pwm period low boundary it too tight, which could cause pwm
output polarity flipped. Adjust it to 40us.

Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoMerged TI feature audio-display into ti-linux-4.19.y
LCPD Auto Merger [Wed, 11 Dec 2019 12:01:58 +0000 (06:01 -0600)]
Merged TI feature audio-display into ti-linux-4.19.y

TI-Feature: audio-display
TI-Branch: audio_display-ti-linux-4.19.y

* 'audio_display-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/audio-display:
  drm/tidss: fix corrupted plane pixel formats

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agodrm/tidss: fix corrupted plane pixel formats
Tomi Valkeinen [Tue, 10 Dec 2019 08:05:04 +0000 (10:05 +0200)]
drm/tidss: fix corrupted plane pixel formats

fourcc array is filled with the fourccs that are available, but
ARRAY_SIZE(fourccs) is used to tell the number of fourccs. This can lead
to uninitialized values at the end of fourcc to be considered as pixel
formats.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
17 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Wed, 11 Dec 2019 08:34:25 +0000 (02:34 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity:
  Revert "mmc: sdhci: Fix incorrect switch to HS mode"
  net: ethernet: ti: cpsw: fix extra rx interrupt
  mmc: sdhci: Update the tuning failed messages to pr_debug level

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoRevert "mmc: sdhci: Fix incorrect switch to HS mode"
Faiz Abbas [Fri, 29 Nov 2019 12:16:43 +0000 (17:46 +0530)]
Revert "mmc: sdhci: Fix incorrect switch to HS mode"

This reverts commit 8ba99d50cb61fdb26e66a13d581086f05a83175a.

This commit aims to treat SD High speed and SDR25 as the same while
setting UHS Timings in HOST_CONTROL2 which leads to failures with some
SD cards in AM65x. Revert this commit.

The issue this commit was trying to fix can be implemented in a platform
specific callback instead of common sdhci code.

Cc: <stable@vger.kernel.org>
Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: cpsw: fix extra rx interrupt
Grygorii Strashko [Wed, 4 Dec 2019 17:01:27 +0000 (19:01 +0200)]
net: ethernet: ti: cpsw: fix extra rx interrupt

Now RX interrupt will be triggered twice every time, because in
cpsw_rx_interrupt() is asked first and then disabled. So there will be
pending interrupt always when RX interrupt is enabled again in NAPI
handler.

Fix it by first disabling IRQ and then do ask.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agommc: sdhci: Update the tuning failed messages to pr_debug level
Faiz Abbas [Tue, 10 Dec 2019 13:34:43 +0000 (19:04 +0530)]
mmc: sdhci: Update the tuning failed messages to pr_debug level

commit 63fe5e7356b8bfe0b80a57cb615533febb8312ba upstream.

Tuning support in DDR50 speed mode was added in SD Specifications Part1
Physical Layer Specification v3.01. Its not possible to distinguish
between v3.00 and v3.01 from the SCR and that is why since
commit 4324f6de6d2e ("mmc: core: enable CMD19 tuning for DDR50 mode")
tuning failures are ignored in DDR50 speed mode.

Cards compatible with v3.00 don't respond to CMD19 in DDR50 and this
error gets printed during enumeration and also if retune is triggered at
any time during operation. Update the printk level to pr_debug so that
these errors don't lead to false error reports.

Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoMerged TI feature platform_base into ti-linux-4.19.y
LCPD Auto Merger [Mon, 9 Dec 2019 10:36:23 +0000 (04:36 -0600)]
Merged TI feature platform_base into ti-linux-4.19.y

TI-Feature: platform_base
TI-Branch: platform-ti-linux-4.19.y

* 'platform-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/platform:
  watchdog: rti: fix max hearbeat duration

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agowatchdog: rti: fix max hearbeat duration
Tero Kristo [Tue, 3 Dec 2019 14:29:46 +0000 (16:29 +0200)]
watchdog: rti: fix max hearbeat duration

In reality, this can be around 1000 seconds, so fix the definition.
Also, add a multiplier to the max_hw_hearbeat_ms so that the value is
correct.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
17 months agoMerge tag 'v4.19.82' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Dan Murphy [Mon, 2 Dec 2019 18:04:23 +0000 (12:04 -0600)]
Merge tag 'v4.19.82' of git./linux/kernel/git/stable/linux-stable into ti-linux-4.19.y

This is the 4.19.82 stable release

* tag 'v4.19.82' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (327 commits)
  Linux 4.19.82
  Revert "ALSA: hda: Flush interrupts on disabling"
  powerpc/powernv: Fix CPU idle to be called with IRQs disabled
  ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface
  ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel
  ALSA: usb-audio: DSD auto-detection for Playback Designs
  ALSA: timer: Fix mutex deadlock at releasing card
  ALSA: timer: Simplify error path in snd_timer_open()
  sch_netem: fix rcu splat in netem_enqueue()
  net: usb: sr9800: fix uninitialized local variable
  bonding: fix potential NULL deref in bond_update_slave_arr
  NFC: pn533: fix use-after-free and memleaks
  rxrpc: Fix trace-after-put looking at the put peer record
  rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record
  rxrpc: Fix call ref leak
  llc: fix sk_buff leak in llc_conn_service()
  llc: fix sk_buff leak in llc_sap_state_process()
  batman-adv: Avoid free/alloc race when handling OGM buffer
  NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()
  drm/amdgpu/powerplay/vega10: allow undervolting in p7
  ...

Signed-off-by: Dan Murphy <dmurphy@ti.com>
# Conflicts:
# drivers/usb/dwc3/gadget.c

17 months agoMerged TI feature audio-display into ti-linux-4.19.y
LCPD Auto Merger [Fri, 29 Nov 2019 21:36:17 +0000 (15:36 -0600)]
Merged TI feature audio-display into ti-linux-4.19.y

TI-Feature: audio-display
TI-Branch: audio_display-ti-linux-4.19.y

* 'audio_display-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/audio-display:
  arm64: dts: ti: k3-j721e-proc-board-tps65917.dts: Switch to custom audio support

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoMerge branch 'peter/ti-linux-4.19.y/topic/audio' of https://github.com/omap-audio...
Jyri Sarha [Thu, 28 Nov 2019 15:02:46 +0000 (17:02 +0200)]
Merge branch 'peter/ti-linux-4.19.y/topic/audio' of https://github.com/omap-audio/linux-audio into audio_display-ti-linux-4.19.y

[GIT PULL] 2019.06 - j721e alpha cpb: use the custom audio driver

* 'peter/ti-linux-4.19.y/topic/audio' of https://github.com/omap-audio/linux-audio:
  arm64: dts: ti: k3-j721e-proc-board-tps65917.dts: Switch to custom audio support

17 months agoarm64: dts: ti: k3-j721e-proc-board-tps65917.dts: Switch to custom audio support
Peter Ujfalusi [Thu, 28 Nov 2019 12:54:27 +0000 (14:54 +0200)]
arm64: dts: ti: k3-j721e-proc-board-tps65917.dts: Switch to custom audio support

Due to the audio setup in hardware with the generic sound card the features
we can support is limited.

With the custom audio driver it is possible to support both 48KHz and
44.1Khz sampling rate families by switching between PLL4/15 as needed.

We can also support both 16 and 24 bit audio in this case as with a custom
driver we can change the slot_width on the bus.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
17 months agoMerged TI feature audio-display into ti-linux-4.19.y
LCPD Auto Merger [Wed, 27 Nov 2019 20:35:52 +0000 (14:35 -0600)]
Merged TI feature audio-display into ti-linux-4.19.y

TI-Feature: audio-display
TI-Branch: audio_display-ti-linux-4.19.y

* 'audio_display-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/audio-display:
  drm/tidss: fix race issue with GO bit handling
  drm/tidss: use spin_lock irqsave with event_lock
  drm/tidss: add WARN if we overwrite tcrtc->event
  drm/tidss: bail out from atomic_flush if there's no event
  drm/tidss: WARN if GO bit is set when dispc7_vp_go is called
  HACK: drm/bridge: cdns-mhdp: quickfix output enable

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoMerge branch 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into...
Jyri Sarha [Wed, 27 Nov 2019 15:43:51 +0000 (17:43 +0200)]
Merge branch 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into audio_display-ti-linux-4.19.y

[GIT PULL] tidss/dp for .06

* 'ti/4.19-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux:
  drm/tidss: fix race issue with GO bit handling
  drm/tidss: use spin_lock irqsave with event_lock
  drm/tidss: add WARN if we overwrite tcrtc->event
  drm/tidss: bail out from atomic_flush if there's no event
  drm/tidss: WARN if GO bit is set when dispc7_vp_go is called
  HACK: drm/bridge: cdns-mhdp: quickfix output enable

17 months agodrm/tidss: fix race issue with GO bit handling
Tomi Valkeinen [Mon, 18 Nov 2019 09:15:28 +0000 (11:15 +0200)]
drm/tidss: fix race issue with GO bit handling

A race issue has been seen which result in hitting the
WARN_ON(go-bit-is-set) in tidss_crtc_atomic_flush():

WARNING: CPU: 0 PID: 153 at drivers/gpu/drm/tidss/tidss_crtc.c:123 tidss_crtc_atomic_flush+0x100/0x138

It's not easy to reproduce, and I have only seen it with multiple
displays. The race is between tidss_atomic_commit_tail and
tidss_crtc_finish_page_flip.

The sequence is roughly as follows:

- Thread A is doing a new commit, and calls tidss_atomic_commit_tail.
- At the same time thread B is handling vblank, and calls
  tidss_crtc_finish_page_flip.
- Thread B checks if GO bit is high, and it's not, so it proceeds.
- Thread A configures dispc, and sets GO bit and sets tcrtc->event.
- Thread B sees tcrtc->event, and does drm_crtc_send_vblank_event
- Thread A calls drm_atomic_helper_wait_for_flip_done() which checks the
  completion that was just marked as complete by drm_crtc_send_vblank_event
- Thread A thinks the new settings are in use, and GO bit is low and
  returns.
- A new commit is made and tidss_crtc_atomic_flush is called. But GO bit
  is still high, as drm_atomic_helper_wait_for_flip_done didn't actually
  wait for it to complete.

Fix this by moving the check of the GO bit in
tidss_crtc_finish_page_flip to inside the event_lock. This way the GO
bit and tcrtc->event will be handled atomically (which is already done
that way in tidss_crtc_atomic_flush).

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
17 months agodrm/tidss: use spin_lock irqsave with event_lock
Tomi Valkeinen [Mon, 18 Nov 2019 09:17:20 +0000 (11:17 +0200)]
drm/tidss: use spin_lock irqsave with event_lock

For some reason we are using spin_lock_irq & spin_unlock_irq with
event_lock in tidss_crtc.c. Documentation says about spin_lock_irq:
"[use it] if you are absolutely sure nothing else might have already
disabled interrupts on your processor".

I'm not absolutely sure about that for the current or future code. I
think it's safer to just use the spin_lock_irqsave. The minimal
performance improvements with spin_lock_irq should be so small that
they're not noticeable.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
17 months agodrm/tidss: add WARN if we overwrite tcrtc->event
Tomi Valkeinen [Mon, 18 Nov 2019 09:16:27 +0000 (11:16 +0200)]
drm/tidss: add WARN if we overwrite tcrtc->event

we move crtc->state->event to tcrtc->event in tidss_crtc_atomic_flush,
and vblank handler will consume tcrtc->event and set it back to NULL.
When tidss_crtc_atomic_flush is called, tcrtc->event should always be
NULL, so add a WARN_ON to catch race conditions.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
17 months agodrm/tidss: bail out from atomic_flush if there's no event
Tomi Valkeinen [Mon, 18 Nov 2019 09:14:15 +0000 (11:14 +0200)]
drm/tidss: bail out from atomic_flush if there's no event

We expect crtc->state->event to be set when tidss_crtc_atomic_flush is
called, and we have a WARN_ON() to check it. However, if
crtc->state->event is NULL, we'll still continue, and later again check
if crtc->state->event is set.

Clean this up by returning from the function if the WARN_ON() is hit. As
this ensures crtc->state->event is not NULL, we can drop the latter
check.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
17 months agodrm/tidss: WARN if GO bit is set when dispc7_vp_go is called
Tomi Valkeinen [Mon, 18 Nov 2019 09:02:23 +0000 (11:02 +0200)]
drm/tidss: WARN if GO bit is set when dispc7_vp_go is called

To catch race issues, add a WARN_ON() to dispc7_vp_go() so that if GO
bit is already set, we will notice it.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
17 months agoHACK: drm/bridge: cdns-mhdp: quickfix output enable
Tomi Valkeinen [Wed, 13 Nov 2019 10:40:33 +0000 (12:40 +0200)]
HACK: drm/bridge: cdns-mhdp: quickfix output enable

I noticed that a sleep (or print) at the wrong place in the Linux driver
breaks my DP-HDMI adapter and also another DP dongle. When that happens,
link training is ok, but there's no picture, and reading 0x200 via DPCD
gives mostly zeroes.

In mhdp_link_training(), after link training has succeeded, we do:

/* Reset PHY config */
reg32 = CDNS_PHY_COMMON_CONFIG | CDNS_PHY_TRAINING_TYPE(1);
if (!(mhdp->host.lanes_cnt & CDNS_SCRAMBLER))
    reg32 |= CDNS_PHY_SCRAMBLER_BYPASS;
cdns_mhdp_reg_write(mhdp, CDNS_DPTX_PHY_CONFIG, reg32);

If I have msleep(100) after that code, the issue happens. A sleep before
that code block causes no problems. If I move the above code to
cdns_mhdp_enable(), after the call to cdns_mhdp_sst_enable(), I see no
problem.

And it looks like the other critical code part is in
cdns_mhdp_configure_video() where we enable the framer via
CDNS_DP_FRAMER_GLOBAL_CONFIG.CDNS_DP_FRAMER_EN. So a small sleep between
the "reset PHY config" code and setting FRAMER_EN causes the issue.

The issue is seen very often in jailhouse environment (perhaps due to
single-CPU?). This hack patch moves the "reset phy config" code, as a
quick fix for issue.

The root cause and proper fix are unknown.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
17 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Tue, 26 Nov 2019 17:03:36 +0000 (11:03 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity:
  net: ethernet: ti: prueth: support allmulti
  ethernet: ti: am65-cpts: shorten critical sections for ptp clock lock
  ethernet: ti: am65-cpts: replace ptp clock mutex on spinlock
  ethernet: ti: am65-cpts: fix ptp clock synchronization entropy
  ethernet: ti: am65-cpts: make fifo event read to be safe
  ethernet: ti: am65-cpts: limit max_adj according to TRM
  ethernet: ti: am65-cpts: fix long ptp stabilization time (in 5 times)
  ethernet: ti: am65-cpts: fix incorrect mask in pps adjust
  net: ethernet: ti: icssg-prueth: fix TX descriptor not available case
  net: ethernet: ti: icssg-prueth: optimize napi rx during netif down
  net: ethernet: ti: icssg-prueth: add missed stats counters prueth_dma_rx_push() fail
  net: ti: icssg_prueth: implement shutdown command
  dmaengine: ti: clear pkt_info2 pkt type before setting
  net: ethernet: ti: icssg-prueth: remove redundant disable FT1
  net: ethernet: ti: icssg-prueth: Simplify promiscuous mode
  net: ti: icssg-prueth: Add allmulti support
  net: ti: icssg-prueth: Fix non promiscuous mode

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoMerged TI feature platform_base into ti-linux-4.19.y
LCPD Auto Merger [Tue, 26 Nov 2019 14:38:26 +0000 (08:38 -0600)]
Merged TI feature platform_base into ti-linux-4.19.y

TI-Feature: platform_base
TI-Branch: platform-ti-linux-4.19.y

* 'platform-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/platform:
  soc: ti: ti-pat: Fix leak of sg_table memory on detach
  perf stat: Fix shadow stats for clock events
  perf stat: Use perf_evsel__is_clocki() for clock events

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agonet: ethernet: ti: prueth: support allmulti
Roger Quadros [Mon, 18 Nov 2019 13:07:28 +0000 (15:07 +0200)]
net: ethernet: ti: prueth: support allmulti

Firmware supports multicast filters. We use that
to support allmulti mode.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: shorten critical sections for ptp clock lock
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:09 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: shorten critical sections for ptp clock lock

No need to hide not related calculation under clock lock, so correct it.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: replace ptp clock mutex on spinlock
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:08 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: replace ptp clock mutex on spinlock

After ptp_gettime optimization that removed wait_completion there is
no need to use one more entropy source primitive - mutex. It allows
to save ~90 ns on latency and remove potential unnecessarily context
swap.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: fix ptp clock synchronization entropy
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:07 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: fix ptp clock synchronization entropy

The primitives like completion, threaded irq, mutexes, add more
entropy on routine delay. So, they should be avoided in time
sensitive ptp callbacks. One of such ptp functions is ptp_gettime()
and ptp_adjtime(), that should have the latency as low as it's
possible, or at least to be stable enough in time.

The ptp_gettime is using cpts_gettime() that is based on completion
got from threaded irq, so that it can sleep on completion waiting on
interrupt. It adds not small deviation visually on ~+-700ns and
additionally stable latency on ~24us.

This patch allows to read PUSH event directly, as it's added to the
fifo immediately and no need to have time unstable elements between.
To avoid concurrent fifo read with cpts interrupt (that also can have
place, but not intentionally), the interrupt is temporarily disabled,
and the events are read as from interrupt.

After short investigation, this patch decreases phc2sys
synchronization delay in 7.5 times, RMS and deviation after
clocks sync stabilized in tens times.

Test command:
phc2sys -s CLOCK_REALTIME -c eth0 -m -O 0

Whole logs used in statistic below:

before the fix:
https://pastebin.com/mXbZ7DjV

after the fix:
https://pastebin.com/zBBLAfsM

Before fix:
phc2sys[122.647]: sys offset    -19374 s2 freq  -19304 delay  19545
phc2sys[123.647]: sys offset      -400 s2 freq   -6142 delay  19671
phc2sys[124.648]: sys offset      5799 s2 freq     -63 delay  19495
phc2sys[125.648]: sys offset      5856 s2 freq   +1733 delay  19580
phc2sys[126.649]: sys offset      4100 s2 freq   +1734 delay  19525
phc2sys[127.649]: sys offset      2499 s2 freq   +1363 delay  19455
phc2sys[128.650]: sys offset       992 s2 freq    +606 delay  19630
phc2sys[129.650]: sys offset       365 s2 freq    +277 delay  19769
phc2sys[130.650]: sys offset       198 s2 freq    +219 delay  19520
phc2sys[131.651]: sys offset        50 s2 freq    +130 delay  19325
phc2sys[132.651]: sys offset      -278 s2 freq    -183 delay  19660
phc2sys[133.652]: sys offset       -23 s2 freq     -11 delay  19605
phc2sys[134.652]: sys offset        47 s2 freq     +52 delay  19415
phc2sys[135.653]: sys offset        22 s2 freq     +41 delay  19380
phc2sys[136.653]: sys offset      -128 s2 freq    -102 delay  19645
phc2sys[137.653]: sys offset       -41 s2 freq     -54 delay  19585
phc2sys[138.654]: sys offset        45 s2 freq     +20 delay  19520
phc2sys[139.654]: sys offset       154 s2 freq    +143 delay  19300
phc2sys[140.655]: sys offset      -137 s2 freq    -102 delay  19515
phc2sys[141.655]: sys offset        55 s2 freq     +49 delay  19445
phc2sys[142.656]: sys offset        11 s2 freq     +21 delay  19325
phc2sys[143.656]: sys offset       -53 s2 freq     -39 delay  19510
phc2sys[144.657]: sys offset       -52 s2 freq     -54 delay  19565
phc2sys[145.657]: sys offset        57 s2 freq     +39 delay  19495
phc2sys[146.657]: sys offset       -46 s2 freq     -47 delay  19560
phc2sys[147.658]: sys offset       110 s2 freq     +95 delay  19430
phc2sys[148.658]: sys offset       -68 s2 freq     -50 delay  19625
phc2sys[149.659]: sys offset       -81 s2 freq     -83 delay  19480
phc2sys[150.659]: sys offset        42 s2 freq     +16 delay  19610
phc2sys[151.660]: sys offset        81 s2 freq     +67 delay  19550

After fix:
phc2sys[137.984]: sys offset     -3665 s2 freq   -3665 delay   4445
phc2sys[138.984]: sys offset        14 s2 freq   -1086 delay   4440
phc2sys[139.985]: sys offset      1100 s2 freq      +5 delay   4460
phc2sys[140.985]: sys offset      1103 s2 freq    +338 delay   4425
phc2sys[141.985]: sys offset       758 s2 freq    +324 delay   4460
phc2sys[142.985]: sys offset       424 s2 freq    +217 delay   4450
phc2sys[143.986]: sys offset       206 s2 freq    +126 delay   4430
phc2sys[144.986]: sys offset        99 s2 freq     +81 delay   4420
phc2sys[145.986]: sys offset        15 s2 freq     +27 delay   4435
phc2sys[146.987]: sys offset       -14 s2 freq      +2 delay   4440
phc2sys[147.987]: sys offset       -12 s2 freq      +0 delay   4440
phc2sys[148.987]: sys offset       -22 s2 freq     -14 delay   4450
phc2sys[149.987]: sys offset       -16 s2 freq     -14 delay   4455
phc2sys[150.988]: sys offset        10 s2 freq      +7 delay   4440
phc2sys[151.988]: sys offset       -15 s2 freq     -15 delay   4435
phc2sys[152.988]: sys offset        13 s2 freq      +9 delay   4440
phc2sys[153.989]: sys offset         1 s2 freq      +0 delay   4445
phc2sys[154.989]: sys offset        20 s2 freq     +20 delay   4435
phc2sys[155.989]: sys offset        -7 s2 freq      -1 delay   4440
phc2sys[156.989]: sys offset       -14 s2 freq     -10 delay   4425
phc2sys[157.990]: sys offset         1 s2 freq      +0 delay   4435
phc2sys[158.990]: sys offset       -10 s2 freq     -10 delay   4445
phc2sys[159.990]: sys offset        13 s2 freq     +10 delay   4420
phc2sys[160.991]: sys offset        -7 s2 freq      -6 delay   4440
phc2sys[161.991]: sys offset       -14 s2 freq     -15 delay   4455
phc2sys[162.991]: sys offset        21 s2 freq     +15 delay   4435
phc2sys[163.991]: sys offset        10 s2 freq     +11 delay   4435
phc2sys[164.992]: sys offset       -16 s2 freq     -12 delay   4425
phc2sys[165.992]: sys offset         1 s2 freq      -0 delay   4425
phc2sys[166.992]: sys offset         9 s2 freq      +8 delay   4440
phc2sys[167.993]: sys offset        -1 s2 freq      +1 delay   4440

A little statistic:

BEFORE CLOCK OFFSET STABILIZATION (first 74 iterations, no 1,2):
===================================
no_fixes_am65_log
-----------------
num of sync: 72
max positive deviation: 5856ns (3)
min negative deviation: -19374ns (0)
max mod deviation: 19374ns
min mod deviation: 7ns
mean +-RMS: 611.8472 +- 2623.0614 ns

with_fixes_am65_log
-------------------
num of sync: 72
max positive deviation: 1103ns (3)
min negative deviation: -3665ns (0)
max mod deviation: 3665ns
min mod deviation: 1ns
mean +-RMS: 111.3611 +- 493.9493 ns

AFTER CLOCK OFFSET STABILIZATION (above 74 iterations, no 1,2):
===================================
no_fixes_am65_log
-----------------
num of sync: 126
max positive deviation: 306ns (33)
min negative deviation: -270ns (20)
max mod deviation: 306ns
min mod deviation: 1ns
mean +-RMS: 70.3650 +- 115.7331 ns

with_fixes_am65_log
------------------
num of sync: 110
max positive deviation: 25ns (56)
min negative deviation: -25ns (37)
max mod deviation: 25ns
min mod deviation: 0ns
mean +-RMS: 7.7909 +- 12.5382 ns

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: make fifo event read to be safe
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:06 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: make fifo event read to be safe

The fifo event read function was created to be called from interrupt
context only and some code inside is not safe if the same function can
be called in parallel. In order this function to be called not only
from interrupt, lets move unsafe peaces under lock.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: limit max_adj according to TRM
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:05 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: limit max_adj according to TRM

According to TRM, the minimum allowed ppm is 0x400. So set it
accordingly. It's about 195312 for 200MHz clock.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: fix long ptp stabilization time (in 5 times)
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:04 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: fix long ptp stabilization time (in 5 times)

The ppb in freq_adj cb it's normalized ppb for 1GHz clock, that is
with 1 ns step. Or another word it's ppb but with assumption the
base frequency is 1 GHz. That is 1 ppb for 1GHz it's 5 ppb for 200MHz.
So, knowing this, recalculate hw_ppm value, that is no more then part
of adding 1 cycle per given period. Also, rename hw_ppm in desc as
it's period for adjustment - adj_period, that is number of cycles when
adjustment happens, but not ppm  or hw_pmm in meaning of cb.

That fixes very long stabilization time for phc2sys adjustment loop
and thus responsiveness of the system. It's decreases number of
iterations to stabilize the clock in ~5 times based on results got
from the phc2sys log.

command to verify:
phc2sys -s CLOCK_REALTIME -c eth0 -m -O 0

Only short snippet of first 32 iterations:

Before fix:
phc2sys[72.255]: sys offset    -19473 s2 freq  -19478 delay  19395
phc2sys[73.255]: sys offset    -19499 s2 freq  -25346 delay  19435
phc2sys[74.256]: sys offset    -14344 s2 freq  -26041 delay  19270
phc2sys[75.256]: sys offset     -9316 s2 freq  -25316 delay  19586
phc2sys[76.257]: sys offset     -4271 s2 freq  -23066 delay  19595
phc2sys[77.257]: sys offset       464 s2 freq  -19612 delay  19305
phc2sys[78.258]: sys offset      4312 s2 freq  -15625 delay  19560
phc2sys[79.258]: sys offset      7478 s2 freq  -11165 delay  19440
phc2sys[80.259]: sys offset      9562 s2 freq   -6838 delay  19750
phc2sys[81.259]: sys offset     11121 s2 freq   -2410 delay  19430
phc2sys[82.260]: sys offset     11540 s2 freq   +1345 delay  19675
phc2sys[83.260]: sys offset      9555 s2 freq   +2822 delay  23065
phc2sys[84.261]: sys offset      8891 s2 freq   +5025 delay  23265
phc2sys[85.261]: sys offset      8016 s2 freq   +6817 delay  23095
phc2sys[86.262]: sys offset      6697 s2 freq   +7903 delay  22865
phc2sys[87.262]: sys offset      4924 s2 freq   +8139 delay  23200
phc2sys[88.263]: sys offset      3373 s2 freq   +8065 delay  23145
phc2sys[89.263]: sys offset      1579 s2 freq   +7283 delay  23485
phc2sys[90.264]: sys offset      2184 s2 freq   +8362 delay  19300
phc2sys[91.264]: sys offset     -1249 s2 freq   +5584 delay  22910
phc2sys[92.265]: sys offset     -2457 s2 freq   +4001 delay  23040
phc2sys[93.265]: sys offset     -1571 s2 freq   +4150 delay  19535
phc2sys[94.266]: sys offset     -2268 s2 freq   +2982 delay  19490
phc2sys[95.266]: sys offset     -3015 s2 freq   +1554 delay  19710
phc2sys[96.267]: sys offset     -3249 s2 freq    +416 delay  19575
phc2sys[97.267]: sys offset     -3338 s2 freq    -648 delay  19555
phc2sys[98.268]: sys offset     -3171 s2 freq   -1482 delay  19360
phc2sys[99.268]: sys offset     -2819 s2 freq   -2081 delay  19435
phc2sys[100.269]: sys offset     -2477 s2 freq   -2585 delay  19575
phc2sys[101.269]: sys offset     -2072 s2 freq   -2923 delay  19730

After fix:

phc2sys[122.647]: sys offset    -19374 s2 freq  -19304 delay  19545
phc2sys[123.647]: sys offset      -400 s2 freq   -6142 delay  19671
phc2sys[124.648]: sys offset      5799 s2 freq     -63 delay  19495
phc2sys[125.648]: sys offset      5856 s2 freq   +1733 delay  19580
phc2sys[126.649]: sys offset      4100 s2 freq   +1734 delay  19525
phc2sys[127.649]: sys offset      2499 s2 freq   +1363 delay  19455
phc2sys[128.650]: sys offset       992 s2 freq    +606 delay  19630
phc2sys[129.650]: sys offset       365 s2 freq    +277 delay  19769
phc2sys[130.650]: sys offset       198 s2 freq    +219 delay  19520
phc2sys[131.651]: sys offset        50 s2 freq    +130 delay  19325
phc2sys[132.651]: sys offset      -278 s2 freq    -183 delay  19660
phc2sys[133.652]: sys offset       -23 s2 freq     -11 delay  19605
phc2sys[134.652]: sys offset        47 s2 freq     +52 delay  19415
phc2sys[135.653]: sys offset        22 s2 freq     +41 delay  19380
phc2sys[136.653]: sys offset      -128 s2 freq    -102 delay  19645
phc2sys[137.653]: sys offset       -41 s2 freq     -54 delay  19585
phc2sys[138.654]: sys offset        45 s2 freq     +20 delay  19520
phc2sys[139.654]: sys offset       154 s2 freq    +143 delay  19300
phc2sys[140.655]: sys offset      -137 s2 freq    -102 delay  19515
phc2sys[141.655]: sys offset        55 s2 freq     +49 delay  19445
phc2sys[142.656]: sys offset        11 s2 freq     +21 delay  19325
phc2sys[143.656]: sys offset       -53 s2 freq     -39 delay  19510
phc2sys[144.657]: sys offset       -52 s2 freq     -54 delay  19565
phc2sys[145.657]: sys offset        57 s2 freq     +39 delay  19495
phc2sys[146.657]: sys offset       -46 s2 freq     -47 delay  19560
phc2sys[147.658]: sys offset       110 s2 freq     +95 delay  19430
phc2sys[148.658]: sys offset       -68 s2 freq     -50 delay  19625
phc2sys[149.659]: sys offset       -81 s2 freq     -83 delay  19480
phc2sys[150.659]: sys offset        42 s2 freq     +16 delay  19610
phc2sys[151.660]: sys offset        81 s2 freq     +67 delay  19550

Whole logs used in statistic below:

before the fix:
https://pastebin.com/ZaT9pJCG

after the fix:
https://pastebin.com/mXbZ7DjV

A little statistic to verify if it's stable enough:

STABILIZATION PHASE:
===================
./calc_sync_stat_before_stab --offset 3_no_fixes_am65_log
num of sync: 72
max positive deviation: 11540ns (10)
min negative deviation: -19499ns (1)
max mod deviation: 19499ns
min mod deviation: 19ns
mean +-RMS: 2810.0694 +- 5858.0760 ns

/calc_sync_stat_before_stab --offset 3_with_fixes_am65_log
num of sync: 72
max positive deviation: 5856ns (3)
min negative deviation: -19374ns (0)
max mod deviation: 19374ns
min mod deviation: 7ns
mean +-RMS: 611.8472 +- 2623.0614 ns

STABLE PHASE:
===================
./calc_sync_stat_after_stab --offset 3_no_fixes_am65_log
num of sync: 151
max positive deviation: 1663ns (60)
min negative deviation: -1921ns (27)
max mod deviation: 1921ns
min mod deviation: 1ns
mean +-RMS: 235.1920 +- 440.5865 ns

./calc_sync_stat_after_stab --offset 3_with_fixes_am65_log
num of sync: 126
max positive deviation: 306ns (33)
min negative deviation: -270ns (20)
max mod deviation: 306ns
min mod deviation: 1ns
mean +-RMS: 70.3650 +- 115.7331 ns

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoethernet: ti: am65-cpts: fix incorrect mask in pps adjust
Ivan Khoronzhuk [Mon, 18 Nov 2019 18:19:03 +0000 (20:19 +0200)]
ethernet: ti: am65-cpts: fix incorrect mask in pps adjust

According to TRM, the mask for hi pps has to be 3FF, that is 0-9 bits
of hi pps register. The circumstances when it can happen look unreal
as first 32 bits has to be enough for everything, but who knows how
it can be used in future, so correct it.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: icssg-prueth: fix TX descriptor not available case
Roger Quadros [Fri, 22 Nov 2019 09:51:28 +0000 (11:51 +0200)]
net: ethernet: ti: icssg-prueth: fix TX descriptor not available case

When no TX descriptors are available, we need to return NETDEV_TX_BUSY.
Use netdev_dbg() instead of dev_err() since this is not
really an error case.

Reported-by: Murali Karicheri <m-karicheri2@ti.com>
Acked-by : Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: icssg-prueth: optimize napi rx during netif down
Grygorii Strashko [Fri, 22 Nov 2019 09:51:27 +0000 (11:51 +0200)]
net: ethernet: ti: icssg-prueth: optimize napi rx during netif down

The RX NAPI handler emac_rx_packet() will return errors now in
case there are still packets to process while interface is going down or
not ready which will cause break of the RX NAPI polling function and NAPI
resceduling. In other words, leftover packets will be processed one by one.

In such cases (interface is going down or not ready) it's valid to still
have unprocessed packets in RX queues and such packets expected just to be
dropped by RX NAPI handler emac_rx_packet().

Hence, update emac_rx_packet() to not return errors for packets
received while interface is going down or not ready, so they will be
processed in batch by NAPI polling function.

Acked-by : Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: icssg-prueth: add missed stats counters prueth_dma_rx_push() fail
Grygorii Strashko [Fri, 22 Nov 2019 09:51:26 +0000 (11:51 +0200)]
net: ethernet: ti: icssg-prueth: add missed stats counters prueth_dma_rx_push() fail

Add missed update of stats counters on prueth_dma_rx_push() failure.

Acked-by : Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ti: icssg_prueth: implement shutdown command
Roger Quadros [Fri, 22 Nov 2019 09:51:25 +0000 (11:51 +0200)]
net: ti: icssg_prueth: implement shutdown command

Implementing the shutdown command ensures that firmware
does a cleanup we cleanly complete all pending
DMA transfers.

Without this we see TX teardown timeouts at ndo_stop.

Acked-by : Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agodmaengine: ti: clear pkt_info2 pkt type before setting
Roger Quadros [Fri, 22 Nov 2019 09:51:24 +0000 (11:51 +0200)]
dmaengine: ti: clear pkt_info2 pkt type before setting

Make sure to clear the old pkt_info2 bits, before setting
new bits.

Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: icssg-prueth: remove redundant disable FT1
Roger Quadros [Mon, 18 Nov 2019 11:53:49 +0000 (13:53 +0200)]
net: ethernet: ti: icssg-prueth: remove redundant disable FT1

We're already disbling FT1 in icssg_class_disable() so don't
do it again.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ethernet: ti: icssg-prueth: Simplify promiscuous mode
Roger Quadros [Mon, 18 Nov 2019 11:53:48 +0000 (13:53 +0200)]
net: ethernet: ti: icssg-prueth: Simplify promiscuous mode

We can bypass all filters by just setting the RX_CLASS_GATES_RAW_MASK
in the classifiers thus putting us in promiscuous mode.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ti: icssg-prueth: Add allmulti support
Roger Quadros [Mon, 18 Nov 2019 11:53:47 +0000 (13:53 +0200)]
net: ti: icssg-prueth: Add allmulti support

We can easily support allmulti by using RX_CLASS_FT_MC
flag in the classifier.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agonet: ti: icssg-prueth: Fix non promiscuous mode
Roger Quadros [Mon, 18 Nov 2019 11:53:46 +0000 (13:53 +0200)]
net: ti: icssg-prueth: Fix non promiscuous mode

Setting RX_CLASS_GATES_RAW_MASK will bypass filters and will
act as promiscuous mode.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agosoc: ti: ti-pat: Fix leak of sg_table memory on detach
Andrew F. Davis [Fri, 15 Nov 2019 20:12:08 +0000 (15:12 -0500)]
soc: ti: ti-pat: Fix leak of sg_table memory on detach

When detaching and in the case of error when attaching we free the
allocated sg_table memory but not the allocated contents of the table.
Fix this here

Fixes: 1f105f47637b ("soc: ti: Add Support for the TI Page-based Address Translator (PAT)")
Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Andrew F. Davis <afd@ti.com>
17 months agoperf stat: Fix shadow stats for clock events
Ravi Bangoria [Fri, 15 Nov 2019 17:13:18 +0000 (11:13 -0600)]
perf stat: Fix shadow stats for clock events

commit 57ddf09173c1e7d0511ead8924675c7198e56545 upstream.

Commit 0aa802a79469 ("perf stat: Get rid of extra clock display
function") introduced scale and unit for clock events. Thus,
perf_stat__update_shadow_stats() now saves scaled values of clock events
in msecs, instead of original nsecs. But while calculating values of
shadow stats we still consider clock event values in nsecs. This results
in a wrong shadow stat values. Ex,

  # ./perf stat -e task-clock,cycles ls
    <SNIP>
              2.60 msec task-clock:u    #    0.877 CPUs utilized
         2,430,564      cycles:u        # 1215282.000 GHz

Fix this by saving original nsec values for clock events in
perf_stat__update_shadow_stats(). After patch:

  # ./perf stat -e task-clock,cycles ls
    <SNIP>
              3.14 msec task-clock:u    #    0.839 CPUs utilized
         3,094,528      cycles:u        #    0.985 GHz

Suggested-by: Jiri Olsa <jolsa@redhat.com>
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
Cc: yuzhoujian@didichuxing.com
Fixes: 0aa802a79469 ("perf stat: Get rid of extra clock display function")
Link: http://lkml.kernel.org/r/20181116042843.24067-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Tested-by: Andreas Dannenberg <dannenberg@ti.com>
17 months agoperf stat: Use perf_evsel__is_clocki() for clock events
Ravi Bangoria [Fri, 15 Nov 2019 17:13:17 +0000 (11:13 -0600)]
perf stat: Use perf_evsel__is_clocki() for clock events

commit eb08d006054e7e374592068919e32579988602d4 upstream.

We already have function to check if a given event is either
SW_CPU_CLOCK or SW_TASK_CLOCK. Utilize it.

Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anton Blanchard <anton@samba.org>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
Cc: yuzhoujian@didichuxing.com
Link: http://lkml.kernel.org/r/20181115095533.16930-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Tested-by: Andreas Dannenberg <dannenberg@ti.com>
17 months agoMerged TI feature rpmsg into ti-linux-4.19.y
LCPD Auto Merger [Wed, 20 Nov 2019 21:29:41 +0000 (15:29 -0600)]
Merged TI feature rpmsg into ti-linux-4.19.y

TI-Feature: rpmsg
TI-Branch: rpmsg-ti-linux-4.19.y-intg

* 'rpmsg-ti-linux-4.19.y-intg' of git://git.ti.com/rpmsg/rpmsg:
  TEMP: ARM: dts: dra7-ipu-common: Limit IPU early boot to only IPU1

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoMerge branch 'rpmsg-ti-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti...
Suman Anna [Wed, 20 Nov 2019 20:59:19 +0000 (14:59 -0600)]
Merge branch 'rpmsg-ti-linux-4.19.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti-linux-4.19.y-intg

Signed-off-by: Suman Anna <s-anna@ti.com>
17 months agoMerge branch 'topic/4.19/dra7-late-attach' of git://git.ti.com/rpmsg/remoteproc into...
Suman Anna [Wed, 20 Nov 2019 20:18:22 +0000 (14:18 -0600)]
Merge branch 'topic/4.19/dra7-late-attach' of git://git.ti.com/rpmsg/remoteproc into rpmsg-ti-linux-4.19.y

Pull in the dedicated remoteproc dra7-late-attach topic branch that limits
the "late-attach" mode to only IPU1. This change is done as the default IPU2
firmware file for MultiMedia use-cases is incompatible with the 'no-map'
carveouts needed by the late-attach functionality.

* 'topic/4.19/dra7-late-attach' of ssh://bitbucket.itg.ti.com/rpmsg/remoteproc:
  TEMP: ARM: dts: dra7-ipu-common: Limit IPU early boot to only IPU1

Signed-off-by: Suman Anna <s-anna@ti.com>
17 months agoTEMP: ARM: dts: dra7-ipu-common: Limit IPU early boot to only IPU1
Suman Anna [Wed, 20 Nov 2019 16:54:22 +0000 (10:54 -0600)]
TEMP: ARM: dts: dra7-ipu-common: Limit IPU early boot to only IPU1

The dra7-ipu-common-early-boot.dtsi file has the necessary changes to
configure both the IPU1 and IPU2 remote processors for 'late attach' mode.
Remove the changes for IPU2 for the moment to limit the 'late attach' mode
for IPU1 only. This is being done due to the limitations with some of the
current IPU2 firmware files.

Signed-off-by: Suman Anna <s-anna@ti.com>
17 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Wed, 20 Nov 2019 15:39:27 +0000 (09:39 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity:
  arm64: dts: set icssg1 iepclk to 200MHz in prupwm overlay

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoarm64: dts: set icssg1 iepclk to 200MHz in prupwm overlay
Bin Liu [Tue, 19 Nov 2019 15:17:57 +0000 (09:17 -0600)]
arm64: dts: set icssg1 iepclk to 200MHz in prupwm overlay

The PRU PWM driver requires the IEP clock to be at 200MHz, set it for
ICSSG1 in dt overlay.

Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoMerged TI feature audio-display into ti-linux-4.19.y
LCPD Auto Merger [Tue, 19 Nov 2019 18:18:49 +0000 (12:18 -0600)]
Merged TI feature audio-display into ti-linux-4.19.y

TI-Feature: audio-display
TI-Branch: audio_display-ti-linux-4.19.y

* 'audio_display-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/audio-display:
  drm/tidss: dispc7: Fix premultiplied alpha configuration

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Tue, 19 Nov 2019 17:07:42 +0000 (11:07 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity:
  usb: gadget: ncm: set max_speed to super-speed
  mfd: ti_am335x_tscadc: Fix static checker warning
  ti_config_fragments/connectivity.cfg: Enable PRU PWM driver as a module
  reset: Fix memory leak in reset_control_array_put()
  phy: cadence: Sierra: Use correct dev pointer in cdns_sierra_phy_remove()
  clk: Fix memory leak in clk_unregister()

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
17 months agousb: gadget: ncm: set max_speed to super-speed
Roger Quadros [Wed, 13 Nov 2019 09:35:15 +0000 (11:35 +0200)]
usb: gadget: ncm: set max_speed to super-speed

NCM interface does support super-speed so let's not
limit g_ncm's maximum speed to high-speed.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agomfd: ti_am335x_tscadc: Fix static checker warning
Vignesh Raghavendra [Wed, 13 Nov 2019 13:24:05 +0000 (18:54 +0530)]
mfd: ti_am335x_tscadc: Fix static checker warning

commit de98a43eb76b8442c02a2fe31c2a50d72cf6ded3 upstream.

It is possible that platform_get_resource() might return NULL and
therefore code needs to check for this condition before
de-referencing the pointer.

Therefore move the de-referencing of 'res' pointer after
devm_ioremap_resource() which would have checked the validity of the
pointer.

Reported-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
17 months agoti_config_fragments/connectivity.cfg: Enable PRU PWM driver as a module
Vignesh Raghavendra [Wed, 13 Nov 2019 05:33:12 +0000 (11:03 +0530)]
ti_config_fragments/connectivity.cfg: Enable PRU PWM driver as a module

Enable PRU PWM as a module.

Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
18 months agoreset: Fix memory leak in reset_control_array_put()
Kishon Vijay Abraham I [Tue, 5 Nov 2019 09:57:09 +0000 (15:27 +0530)]
reset: Fix memory leak in reset_control_array_put()

Memory allocated for 'struct reset_control_array' in
of_reset_control_array_get() is never freed in
reset_control_array_put() resulting in kmemleak showing
the following backtrace.

  backtrace:
    [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
    [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
    [<000000004cc02754>] 0xffff800008c669e4
    [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
    [<00000000d3a0b0bc>] really_probe+0x108/0x348
    [<000000005aa458ac>] driver_probe_device+0x58/0x100
    [<000000008853626c>] device_driver_attach+0x6c/0x90
    [<0000000085308d19>] __driver_attach+0x84/0xc8
    [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
    [<00000000dd7f015b>] driver_attach+0x20/0x28
    [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
    [<0000000061473b66>] driver_register+0x60/0x110
    [<00000000c5bec167>] __platform_driver_register+0x40/0x48
    [<000000007c764b4f>] 0xffff800008c6c020
    [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
    [<0000000093d4b50d>] do_init_module+0x54/0x1d0

Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
18 months agophy: cadence: Sierra: Use correct dev pointer in cdns_sierra_phy_remove()
Kishon Vijay Abraham I [Tue, 5 Nov 2019 09:57:08 +0000 (15:27 +0530)]
phy: cadence: Sierra: Use correct dev pointer in cdns_sierra_phy_remove()

commit 44d30d622821d3b ("phy: cadence: Add driver for Sierra PHY"),
incorrectly used parent device pointer to get driver data. Fix it here.

Fixes: 44d30d622821d3b ("phy: cadence: Add driver for Sierra PHY")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
18 months agoclk: Fix memory leak in clk_unregister()
Kishon Vijay Abraham I [Tue, 5 Nov 2019 09:57:07 +0000 (15:27 +0530)]
clk: Fix memory leak in clk_unregister()

Memory allocated in alloc_clk() for 'struct clk' and
'const char *con_id' while invoking clk_register() is never freed
in clk_unregister(), resulting in kmemleak showing the following
backtrace.

  backtrace:
    [<00000000546f5dd0>] kmem_cache_alloc+0x18c/0x270
    [<0000000073a32862>] alloc_clk+0x30/0x70
    [<0000000082942480>] __clk_register+0xc8/0x760
    [<000000005c859fca>] devm_clk_register+0x54/0xb0
    [<00000000868834a8>] 0xffff800008c60950
    [<00000000d5a80534>] platform_drv_probe+0x50/0xa0
    [<000000001b3889fc>] really_probe+0x108/0x348
    [<00000000953fa60a>] driver_probe_device+0x58/0x100
    [<0000000008acc17c>] device_driver_attach+0x6c/0x90
    [<0000000022813df3>] __driver_attach+0x84/0xc8
    [<00000000448d5443>] bus_for_each_dev+0x74/0xc8
    [<00000000294aa93f>] driver_attach+0x20/0x28
    [<00000000e5e52626>] bus_add_driver+0x148/0x1f0
    [<000000001de21efc>] driver_register+0x60/0x110
    [<00000000af07c068>] __platform_driver_register+0x40/0x48
    [<0000000060fa80ee>] 0xffff800008c66020

Fix it here.

Fixes: fcb0ee6a3d331fb ("clk: Implement clk_unregister")
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
18 months agoMerged TI feature connectivity into ti-linux-4.19.y
LCPD Auto Merger [Wed, 6 Nov 2019 15:53:17 +0000 (09:53 -0600)]
Merged TI feature connectivity into ti-linux-4.19.y

TI-Feature: connectivity
TI-Branch: connectivity-ti-linux-4.19.y

* 'connectivity-ti-linux-4.19.y' of ssh://bitbucket.itg.ti.com/lcpdpublicdom/connectivity: (21 commits)
  ethernet: ti: am65-cpts: drop timeouted packets only after match
  ethernet: ti: am65-cpts: fix tx ptp timestamp lost
  usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
  usb: gadget: legacy: multi: set max speed to super-speed
  net: ti: prueth: drop unsupported modes from the PHY
  net: ti: icssg_prueth: drop unsupported modes from the PHY
  net: phy: fix auto-negotiated flow control
  usb: cdns3: gadget: Don't manage pullups
  usb: cdns3: gadget: Fix g_audio use case when connected to Super-Speed host
  usb: cdns3: gadget: reset EP_CLAIMED flag while unloading
  usb: cdns3: include host-export,h for cdns3_host_init
  usb: cdns3: Error out if USB_DR_MODE_UNKNOWN in cdns3_core_init_role()
  usb: cdns3: Fix dequeue implementation.
  usb: cdns3: Fix sheduling with locks held.
  usb: cdns3: Fix use after free in probe error handling
  usb: cdns3: Remove redundant dev_err call in cdns3_probe()
  usb: cdns3: fix spelling mistake: "cnfiguration" -> "configuration"
  usb: cdns3: fix missing assignment of ret before error check on ret
  usb: cdns3: remove redundant assignment to ret on error exit path
  usb: cdns3: remove set but not used variable 'priv_dev'
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
18 months agodrm/tidss: dispc7: Fix premultiplied alpha configuration
Jyri Sarha [Wed, 6 Nov 2019 08:32:28 +0000 (10:32 +0200)]
drm/tidss: dispc7: Fix premultiplied alpha configuration

The premultiplied alpha setting is configured in DISPC_VID_ATTRIBUTES
register. The bit #22 of the register is wrong and a reserved
bit. Correctly set bit #28 instead.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
18 months agoLinux 4.19.82
Greg Kroah-Hartman [Wed, 6 Nov 2019 12:06:31 +0000 (13:06 +0100)]
Linux 4.19.82

18 months agoRevert "ALSA: hda: Flush interrupts on disabling"
Takashi Iwai [Mon, 28 Oct 2019 08:10:56 +0000 (09:10 +0100)]
Revert "ALSA: hda: Flush interrupts on disabling"

[ Upstream commit 1a7f60b9df614bb36d14dc0c0bc898a31b2b506f ]

This reverts commit caa8422d01e983782548648e125fd617cadcec3f.

It turned out that this commit caused a regression at shutdown /
reboot, as the synchronize_irq() calls seems blocking the whole
shutdown.  Also another part of the change about shuffling the call
order looks suspicious; the azx_stop_chip() call disables the CORB /
RIRB while the others may still need the CORB/RIRB update.

Since the original commit itself was a cargo-fix, let's revert the
whole patch.

Fixes: caa8422d01e9 ("ALSA: hda: Flush interrupts on disabling")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205333
BugLinK: https://bugs.freedesktop.org/show_bug.cgi?id=111174
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://lore.kernel.org/r/20191028081056.22010-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agopowerpc/powernv: Fix CPU idle to be called with IRQs disabled
Nicholas Piggin [Tue, 22 Oct 2019 11:58:14 +0000 (21:58 +1000)]
powerpc/powernv: Fix CPU idle to be called with IRQs disabled

[ Upstream commit 7d6475051fb3d9339c5c760ed9883bc0a9048b21 ]

Commit e78a7614f3876 ("idle: Prevent late-arriving interrupts from
disrupting offline") changes arch_cpu_idle_dead to be called with
interrupts disabled, which triggers the WARN in pnv_smp_cpu_kill_self.

Fix this by fixing up irq_happened after hard disabling, rather than
requiring there are no pending interrupts, similarly to what was done
done until commit 2525db04d1cc5 ("powerpc/powernv: Simplify lazy IRQ
handling in CPU offline").

Fixes: e78a7614f3876 ("idle: Prevent late-arriving interrupts from disrupting offline")
Reported-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[mpe: Add unexpected_mask rather than checking for known bad values,
      change the WARN_ON() to a WARN_ON_ONCE()]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20191022115814.22456-1-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agoALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface
Justin Song [Thu, 24 Oct 2019 10:27:14 +0000 (12:27 +0200)]
ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface

[ Upstream commit e2995b95a914bbc6b5352be27d5d5f33ec802d2c ]

This patch adds native DSD support for Gustard U16/X26 USB Interface.
Tested using VID and fp->dsd_raw method.

Signed-off-by: Justin Song <flyingecar@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/CA+9XP1ipsFn+r3bCBKRinQv-JrJ+EHOGBdZWZoMwxFv0R8Y1MQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agoALSA: usb-audio: Update DSD support quirks for Oppo and Rotel
Jussi Laako [Tue, 27 Aug 2019 21:08:47 +0000 (00:08 +0300)]
ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel

[ Upstream commit 0067e154b11e236d62a7a8205f321b097c21a35b ]

Oppo has issued firmware updates that change alt setting used for DSD
support. However, these devices seem to support auto-detection, so
support is moved from explicit whitelisting to auto-detection.

Also Rotel devices have USB interfaces that support DSD with
auto-detection.

Signed-off-by: Jussi Laako <jussi@sonarnerd.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agoALSA: usb-audio: DSD auto-detection for Playback Designs
Jussi Laako [Tue, 27 Aug 2019 21:08:46 +0000 (00:08 +0300)]
ALSA: usb-audio: DSD auto-detection for Playback Designs

[ Upstream commit eb7505d52a2f8b0cfc3fd7146d8cb2dab5a73f0d ]

Add DSD support auto-detection for newer Playback Designs devices. Older
device generations have a different USB interface implementation.

Keep the auto-detection VID whitelist sorted.

Signed-off-by: Jussi Laako <jussi@sonarnerd.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agoALSA: timer: Fix mutex deadlock at releasing card
Takashi Iwai [Wed, 30 Oct 2019 21:42:57 +0000 (22:42 +0100)]
ALSA: timer: Fix mutex deadlock at releasing card

[ Upstream commit a39331867335d4a94b6165e306265c9e24aca073 ]

When a card is disconnected while in use, the system waits until all
opened files are closed then releases the card.  This is done via
put_device() of the card device in each device release code.

The recently reported mutex deadlock bug happens in this code path;
snd_timer_close() for the timer device deals with the global
register_mutex and it calls put_device() there.  When this timer
device is the last one, the card gets freed and it eventually calls
snd_timer_free(), which has again the protection with the global
register_mutex -- boom.

Basically put_device() call itself is race-free, so a relative simple
workaround is to move this put_device() call out of the mutex.  For
achieving that, in this patch, snd_timer_close_locked() got a new
argument to store the card device pointer in return, and each caller
invokes put_device() with the returned object after the mutex unlock.

Reported-and-tested-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agoALSA: timer: Simplify error path in snd_timer_open()
Takashi Iwai [Thu, 28 Mar 2019 16:11:10 +0000 (17:11 +0100)]
ALSA: timer: Simplify error path in snd_timer_open()

[ Upstream commit 41672c0c24a62699d20aab53b98d843b16483053 ]

Just a minor refactoring to use the standard goto for error paths in
snd_timer_open() instead of open code.  The first mutex_lock() is
moved to the beginning of the function to make the code clearer.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 months agosch_netem: fix rcu splat in netem_enqueue()
Eric Dumazet [Tue, 24 Sep 2019 20:11:26 +0000 (13:11 -0700)]
sch_netem: fix rcu splat in netem_enqueue()

commit 159d2c7d8106177bd9a986fd005a311fe0d11285 upstream.

qdisc_root() use from netem_enqueue() triggers a lockdep warning.

__dev_queue_xmit() uses rcu_read_lock_bh() which is
not equivalent to rcu_read_lock() + local_bh_disable_bh as far
as lockdep is concerned.

WARNING: suspicious RCU usage
5.3.0-rc7+ #0 Not tainted
-----------------------------
include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syz-executor427/8855:
 #0: 00000000b5525c01 (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline]
 #0: 00000000b5525c01 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570 net/ipv4/ip_output.c:214
 #1: 00000000b5525c01 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x3650 net/core/dev.c:3804
 #2: 00000000364bae92 (&(&sch->q.lock)->rlock){+.-.}, at: spin_lock include/linux/spinlock.h:338 [inline]
 #2: 00000000364bae92 (&(&sch->q.lock)->rlock){+.-.}, at: __dev_xmit_skb net/core/dev.c:3502 [inline]
 #2: 00000000364bae92 (&(&sch->q.lock)->rlock){+.-.}, at: __dev_queue_xmit+0x14b8/0x3650 net/core/dev.c:3838

stack backtrace:
CPU: 0 PID: 8855 Comm: syz-executor427 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5357
 qdisc_root include/net/sch_generic.h:492 [inline]
 netem_enqueue+0x1cfb/0x2d80 net/sched/sch_netem.c:479
 __dev_xmit_skb net/core/dev.c:3527 [inline]
 __dev_queue_xmit+0x15d2/0x3650 net/core/dev.c:3838
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3902
 neigh_hh_output include/net/neighbour.h:500 [inline]
 neigh_output include/net/neighbour.h:509 [inline]
 ip_finish_output2+0x1726/0x2570 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x5fc/0xb90 net/ipv4/ip_output.c:290
 ip_finish_output+0x38/0x1f0 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_mc_output+0x292/0xf40 net/ipv4/ip_output.c:417
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0xbb/0x190 net/ipv4/ip_output.c:125
 ip_send_skb+0x42/0xf0 net/ipv4/ip_output.c:1555
 udp_send_skb.isra.0+0x6b2/0x1160 net/ipv4/udp.c:887
 udp_sendmsg+0x1e96/0x2820 net/ipv4/udp.c:1174
 inet_sendmsg+0x9e/0xe0 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:657
 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311
 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2439
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agonet: usb: sr9800: fix uninitialized local variable
Valentin Vidic [Tue, 15 Oct 2019 20:20:20 +0000 (22:20 +0200)]
net: usb: sr9800: fix uninitialized local variable

commit 77b6d09f4ae66d42cd63b121af67780ae3d1a5e9 upstream.

Make sure res does not contain random value if the call to
sr_read_cmd fails for some reason.

Reported-by: syzbot+f1842130bbcfb335bac1@syzkaller.appspotmail.com
Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agobonding: fix potential NULL deref in bond_update_slave_arr
Eric Dumazet [Mon, 7 Oct 2019 22:43:01 +0000 (15:43 -0700)]
bonding: fix potential NULL deref in bond_update_slave_arr

commit a7137534b597b7c303203e6bc3ed87e87a273bb8 upstream.

syzbot got a NULL dereference in bond_update_slave_arr() [1],
happening after a failure to allocate bond->slave_arr

A workqueue (bond_slave_arr_handler) is supposed to retry
the allocation later, but if the slave is removed before
the workqueue had a chance to complete, bond->slave_arr
can still be NULL.

[1]

Failed to build slave-array.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bond_update_slave_arr.cold+0xc6/0x198 drivers/net/bonding/bond_main.c:4039
RSP: 0018:ffff88018fe33678 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000290b000
RDX: 0000000000000000 RSI: ffffffff82b63037 RDI: ffff88019745ea20
RBP: ffff88018fe33760 R08: ffff880170754280 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88019745ea00 R14: 0000000000000000 R15: ffff88018fe338b0
FS:  00007febd837d700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004540a0 CR3: 00000001c242e005 CR4: 00000000001626f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 [<ffffffff82b5b45e>] __bond_release_one+0x43e/0x500 drivers/net/bonding/bond_main.c:1923
 [<ffffffff82b5b966>] bond_release drivers/net/bonding/bond_main.c:2039 [inline]
 [<ffffffff82b5b966>] bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3562
 [<ffffffff83ae25f4>] dev_ifsioc+0x6f4/0x940 net/core/dev_ioctl.c:328
 [<ffffffff83ae2e58>] dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:495
 [<ffffffff83995ffd>] sock_do_ioctl+0x1bd/0x300 net/socket.c:1088
 [<ffffffff83996a80>] sock_ioctl+0x300/0x5d0 net/socket.c:1196
 [<ffffffff81b124db>] vfs_ioctl fs/ioctl.c:47 [inline]
 [<ffffffff81b124db>] file_ioctl fs/ioctl.c:501 [inline]
 [<ffffffff81b124db>] do_vfs_ioctl+0xacb/0x1300 fs/ioctl.c:688
 [<ffffffff81b12dc6>] SYSC_ioctl fs/ioctl.c:705 [inline]
 [<ffffffff81b12dc6>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:696
 [<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305
 [<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: ee6377147409 ("bonding: Simplify the xmit function for modes that use xmit_hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agoNFC: pn533: fix use-after-free and memleaks
Johan Hovold [Mon, 7 Oct 2019 16:40:59 +0000 (18:40 +0200)]
NFC: pn533: fix use-after-free and memleaks

commit 6af3aa57a0984e061f61308fe181a9a12359fecc upstream.

The driver would fail to deregister and its class device and free
related resources on late probe errors.

Reported-by: syzbot+cb035c75c03dbe34b796@syzkaller.appspotmail.com
Fixes: 32ecc75ded72 ("NFC: pn533: change order operations in dev registation")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agorxrpc: Fix trace-after-put looking at the put peer record
David Howells [Mon, 7 Oct 2019 09:58:29 +0000 (10:58 +0100)]
rxrpc: Fix trace-after-put looking at the put peer record

commit 55f6c98e3674ce16038a1949c3f9ca5a9a99f289 upstream.

rxrpc_put_peer() calls trace_rxrpc_peer() after it has done the decrement
of the refcount - which looks at the debug_id in the peer record.  But
unless the refcount was reduced to zero, we no longer have the right to
look in the record and, indeed, it may be deleted by some other thread.

Fix this by getting the debug_id out before decrementing the refcount and
then passing that into the tracepoint.

This can cause the following symptoms:

    BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411
    [inline]
    BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0
    net/rxrpc/peer_object.c:435
    Read of size 8 at addr ffff888097ec0058 by task syz-executor823/24216

Fixes: 1159d4b496f5 ("rxrpc: Add a tracepoint to track rxrpc_peer refcounting")
Reported-by: syzbot+b9be979c55f2bea8ed30@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agorxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record
David Howells [Mon, 7 Oct 2019 09:58:29 +0000 (10:58 +0100)]
rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record

commit 9ebeddef58c41bd700419cdcece24cf64ce32276 upstream.

The rxrpc_peer record needs to hold a reference on the rxrpc_local record
it points as the peer is used as a base to access information in the
rxrpc_local record.

This can cause problems in __rxrpc_put_peer(), where we need the network
namespace pointer, and in rxrpc_send_keepalive(), where we need to access
the UDP socket, leading to symptoms like:

    BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411
    [inline]
    BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0
    net/rxrpc/peer_object.c:435
    Read of size 8 at addr ffff888097ec0058 by task syz-executor823/24216

Fix this by taking a ref on the local record for the peer record.

Fixes: ace45bec6d77 ("rxrpc: Fix firewall route keepalive")
Fixes: 2baec2c3f854 ("rxrpc: Support network namespacing")
Reported-by: syzbot+b9be979c55f2bea8ed30@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agorxrpc: Fix call ref leak
David Howells [Mon, 7 Oct 2019 09:58:28 +0000 (10:58 +0100)]
rxrpc: Fix call ref leak

commit c48fc11b69e95007109206311b0187a3090591f3 upstream.

When sendmsg() finds a call to continue on with, if the call is in an
inappropriate state, it doesn't release the ref it just got on that call
before returning an error.

This causes the following symptom to show up with kasan:

BUG: KASAN: use-after-free in rxrpc_send_keepalive+0x8a2/0x940
net/rxrpc/output.c:635
Read of size 8 at addr ffff888064219698 by task kworker/0:3/11077

where line 635 is:

whdr.epoch = htonl(peer->local->rxnet->epoch);

The local endpoint (which cannot be pinned by the call) has been released,
but not the peer (which is pinned by the call).

Fix this by releasing the call in the error path.

Fixes: 37411cad633f ("rxrpc: Fix potential NULL-pointer exception")
Reported-by: syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agollc: fix sk_buff leak in llc_conn_service()
Eric Biggers [Sun, 6 Oct 2019 21:24:25 +0000 (14:24 -0700)]
llc: fix sk_buff leak in llc_conn_service()

commit b74555de21acd791f12c4a1aeaf653dd7ac21133 upstream.

syzbot reported:

    BUG: memory leak
    unreferenced object 0xffff88811eb3de00 (size 224):
       comm "syz-executor559", pid 7315, jiffies 4294943019 (age 10.300s)
       hex dump (first 32 bytes):
         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
         00 a0 38 24 81 88 ff ff 00 c0 f2 15 81 88 ff ff  ..8$............
       backtrace:
         [<000000008d1c66a1>] kmemleak_alloc_recursive  include/linux/kmemleak.h:55 [inline]
         [<000000008d1c66a1>] slab_post_alloc_hook mm/slab.h:439 [inline]
         [<000000008d1c66a1>] slab_alloc_node mm/slab.c:3269 [inline]
         [<000000008d1c66a1>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
         [<00000000447d9496>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
         [<000000000cdbf82f>] alloc_skb include/linux/skbuff.h:1058 [inline]
         [<000000000cdbf82f>] llc_alloc_frame+0x66/0x110 net/llc/llc_sap.c:54
         [<000000002418b52e>] llc_conn_ac_send_sabme_cmd_p_set_x+0x2f/0x140  net/llc/llc_c_ac.c:777
         [<000000001372ae17>] llc_exec_conn_trans_actions net/llc/llc_conn.c:475  [inline]
         [<000000001372ae17>] llc_conn_service net/llc/llc_conn.c:400 [inline]
         [<000000001372ae17>] llc_conn_state_process+0x1ac/0x640  net/llc/llc_conn.c:75
         [<00000000f27e53c1>] llc_establish_connection+0x110/0x170  net/llc/llc_if.c:109
         [<00000000291b2ca0>] llc_ui_connect+0x10e/0x370 net/llc/af_llc.c:477
         [<000000000f9c740b>] __sys_connect+0x11d/0x170 net/socket.c:1840
         [...]

The bug is that most callers of llc_conn_send_pdu() assume it consumes a
reference to the skb, when actually due to commit b85ab56c3f81 ("llc:
properly handle dev_queue_xmit() return value") it doesn't.

Revert most of that commit, and instead make the few places that need
llc_conn_send_pdu() to *not* consume a reference call skb_get() before.

Fixes: b85ab56c3f81 ("llc: properly handle dev_queue_xmit() return value")
Reported-by: syzbot+6b825a6494a04cc0e3f7@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agollc: fix sk_buff leak in llc_sap_state_process()
Eric Biggers [Sun, 6 Oct 2019 21:24:24 +0000 (14:24 -0700)]
llc: fix sk_buff leak in llc_sap_state_process()

commit c6ee11c39fcc1fb55130748990a8f199e76263b4 upstream.

syzbot reported:

    BUG: memory leak
    unreferenced object 0xffff888116270800 (size 224):
       comm "syz-executor641", pid 7047, jiffies 4294947360 (age 13.860s)
       hex dump (first 32 bytes):
         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
         00 20 e1 2a 81 88 ff ff 00 40 3d 2a 81 88 ff ff  . .*.....@=*....
       backtrace:
         [<000000004d41b4cc>] kmemleak_alloc_recursive  include/linux/kmemleak.h:55 [inline]
         [<000000004d41b4cc>] slab_post_alloc_hook mm/slab.h:439 [inline]
         [<000000004d41b4cc>] slab_alloc_node mm/slab.c:3269 [inline]
         [<000000004d41b4cc>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
         [<00000000506a5965>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
         [<000000001ba5a161>] alloc_skb include/linux/skbuff.h:1058 [inline]
         [<000000001ba5a161>] alloc_skb_with_frags+0x5f/0x250  net/core/skbuff.c:5327
         [<0000000047d9c78b>] sock_alloc_send_pskb+0x269/0x2a0  net/core/sock.c:2225
         [<000000003828fe54>] sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2242
         [<00000000e34d94f9>] llc_ui_sendmsg+0x10a/0x540 net/llc/af_llc.c:933
         [<00000000de2de3fb>] sock_sendmsg_nosec net/socket.c:652 [inline]
         [<00000000de2de3fb>] sock_sendmsg+0x54/0x70 net/socket.c:671
         [<000000008fe16e7a>] __sys_sendto+0x148/0x1f0 net/socket.c:1964
 [...]

The bug is that llc_sap_state_process() always takes an extra reference
to the skb, but sometimes neither llc_sap_next_state() nor
llc_sap_state_process() itself drops this reference.

Fix it by changing llc_sap_next_state() to never consume a reference to
the skb, rather than sometimes do so and sometimes not.  Then remove the
extra skb_get() and kfree_skb() from llc_sap_state_process().

Reported-by: syzbot+6bf095f9becf5efef645@syzkaller.appspotmail.com
Reported-by: syzbot+31c16aa4202dace3812e@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agobatman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann [Thu, 3 Oct 2019 15:02:01 +0000 (17:02 +0200)]
batman-adv: Avoid free/alloc race when handling OGM buffer

commit 40e220b4218bb3d278e5e8cc04ccdfd1c7ff8307 upstream.

Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM
packet buffer which is initialized using data from netdevice notifier and
other rtnetlink related hooks. It is sent regularly via various slave
interfaces of the batadv virtual interface and in this process also
modified (realloced) to integrate additional state information via TVLV
containers.

It must be avoided that the worker item is executed without a common lock
with the netdevice notifier/rtnetlink helpers. Otherwise it can either
happen that half modified/freed data is sent out or functions modifying the
OGM buffer try to access already freed memory regions.

Reported-by: syzbot+0cc629f19ccb8534935b@syzkaller.appspotmail.com
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agoNFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()
Trond Myklebust [Thu, 31 Oct 2019 22:40:33 +0000 (18:40 -0400)]
NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()

commit 79cc55422ce99be5964bde208ba8557174720893 upstream.

A typo in nfs4_refresh_delegation_stateid() means we're leaking an
RCU lock, and always returning a value of 'false'. As the function
description states, we were always supposed to return 'true' if a
matching delegation was found.

Fixes: 12f275cdd163 ("NFSv4: Retry CLOSE and DELEGRETURN on NFS4ERR_OLD_STATEID.")
Cc: stable@vger.kernel.org # v4.15+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agodrm/amdgpu/powerplay/vega10: allow undervolting in p7
Pelle van Gils [Thu, 24 Oct 2019 14:04:31 +0000 (16:04 +0200)]
drm/amdgpu/powerplay/vega10: allow undervolting in p7

commit e6f4e274c1e52d1f0bfe293fb44ddf59de6c0374 upstream.

The vega10_odn_update_soc_table() function does not allow the SCLK
dependent voltage to be set for power-state 7 to a value below the default
in pptable. Change the for-loop condition to allow undervolting in the
highest state.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=205277
Signed-off-by: Pelle van Gils <pelle@vangils.xyz>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agodmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle
Tony Lindgren [Wed, 23 Oct 2019 15:31:38 +0000 (08:31 -0700)]
dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle

commit bacdcb6675e170bb2e8d3824da220e10274f42a7 upstream.

Yegor Yefremov <yegorslists@googlemail.com> reported that musb and ftdi
uart can fail for the first open of the uart unless connected using
a hub.

This is because the first dma call done by musb_ep_program() must wait
if cppi41 is PM runtime suspended. Otherwise musb_ep_program() continues
with other non-dma packets before the DMA transfer is started causing at
least ftdi uarts to fail to receive data.

Let's fix the issue by waking up cppi41 with PM runtime calls added to
cppi41_dma_prep_slave_sg() and return NULL if still idled. This way we
have musb_ep_program() continue with PIO until cppi41 is awake.

Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support")
Reported-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: stable@vger.kernel.org # v4.9+
Link: https://lore.kernel.org/r/20191023153138.23442-1-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agodmaengine: qcom: bam_dma: Fix resource leak
Jeffrey Hugo [Thu, 17 Oct 2019 15:26:06 +0000 (08:26 -0700)]
dmaengine: qcom: bam_dma: Fix resource leak

commit 7667819385457b4aeb5fac94f67f52ab52cc10d5 upstream.

bam_dma_terminate_all() will leak resources if any of the transactions are
committed to the hardware (present in the desc fifo), and not complete.
Since bam_dma_terminate_all() does not cause the hardware to be updated,
the hardware will still operate on any previously committed transactions.
This can cause memory corruption if the memory for the transaction has been
reassigned, and will cause a sync issue between the BAM and its client(s).

Fix this by properly updating the hardware in bam_dma_terminate_all().

Fixes: e7c0fe2a5c84 ("dmaengine: add Qualcomm BAM dma driver")
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20191017152606.34120-1-jeffrey.l.hugo@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agortlwifi: Fix potential overflow on P2P code
Laura Abbott [Fri, 18 Oct 2019 11:43:21 +0000 (07:43 -0400)]
rtlwifi: Fix potential overflow on P2P code

commit 8c55dedb795be8ec0cf488f98c03a1c2176f7fb1 upstream.

Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bound noa_num against P2P_MAX_NOA_NUM.

Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agoarm64: Ensure VM_WRITE|VM_SHARED ptes are clean by default
Catalin Marinas [Tue, 29 Oct 2019 15:30:51 +0000 (15:30 +0000)]
arm64: Ensure VM_WRITE|VM_SHARED ptes are clean by default

commit aa57157be69fb599bd4c38a4b75c5aad74a60ec0 upstream.

Shared and writable mappings (__S.1.) should be clean (!dirty) initially
and made dirty on a subsequent write either through the hardware DBM
(dirty bit management) mechanism or through a write page fault. A clean
pte for the arm64 kernel is one that has PTE_RDONLY set and PTE_DIRTY
clear.

The PAGE_SHARED{,_EXEC} attributes have PTE_WRITE set (PTE_DBM) and
PTE_DIRTY clear. Prior to commit 73e86cb03cf2 ("arm64: Move PTE_RDONLY
bit handling out of set_pte_at()"), it was the responsibility of
set_pte_at() to set the PTE_RDONLY bit and mark the pte clean if the
software PTE_DIRTY bit was not set. However, the above commit removed
the pte_sw_dirty() check and the subsequent setting of PTE_RDONLY in
set_pte_at() while leaving the PAGE_SHARED{,_EXEC} definitions
unchanged. The result is that shared+writable mappings are now dirty by
default

Fix the above by explicitly setting PTE_RDONLY in PAGE_SHARED{,_EXEC}.
In addition, remove the superfluous PTE_DIRTY bit from the kernel PROT_*
attributes.

Fixes: 73e86cb03cf2 ("arm64: Move PTE_RDONLY bit handling out of set_pte_at()")
Cc: <stable@vger.kernel.org> # 4.14.x-
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agos390/idle: fix cpu idle time calculation
Heiko Carstens [Mon, 28 Oct 2019 10:03:27 +0000 (11:03 +0100)]
s390/idle: fix cpu idle time calculation

commit 3d7efa4edd07be5c5c3ffa95ba63e97e070e1f3f upstream.

The idle time reported in /proc/stat sometimes incorrectly contains
huge values on s390. This is caused by a bug in arch_cpu_idle_time().

The kernel tries to figure out when a different cpu entered idle by
accessing its per-cpu data structure. There is an ordering problem: if
the remote cpu has an idle_enter value which is not zero, and an
idle_exit value which is zero, it is assumed it is idle since
"now". The "now" timestamp however is taken before the idle_enter
value is read.

Which in turn means that "now" can be smaller than idle_enter of the
remote cpu. Unconditionally subtracting idle_enter from "now" can thus
lead to a negative value (aka large unsigned value).

Fix this by moving the get_tod_clock() invocation out of the
loop. While at it also make the code a bit more readable.

A similar bug also exists for show_idle_time(). Fix this is as well.

Cc: <stable@vger.kernel.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 months agos390/cmm: fix information leak in cmm_timeout_handler()
Yihui ZENG [Fri, 25 Oct 2019 09:31:48 +0000 (12:31 +0300)]
s390/cmm: fix information leak in cmm_timeout_handler()

commit b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f upstream.

The problem is that we were putting the NUL terminator too far:

buf[sizeof(buf) - 1] = '\0';

If the user input isn't NUL terminated and they haven't initialized the
whole buffer then it leads to an info leak.  The NUL terminator should
be:

buf[len - 1] = '\0';

Signed-off-by: Yihui Zeng <yzeng56@asu.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[heiko.carstens@de.ibm.com: keep semantics of how *lenp and *ppos are handled]
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>