ti-linux-kernel/ti-linux-kernel-next.git
2 years agoMerge branch 'ti-linux-4.14.y-for-next' of git://git.ti.com/linux-phy/kishons-ti... ti-linux-4.14.y-next ti-linux-4.14.y-next-20181101 ti-linux-4.14.y-next-20181123
LCPD Auto Merger [Thu, 1 Nov 2018 07:48:52 +0000 (02:48 -0500)]
Merge branch 'ti-linux-4.14.y-for-next' of git://git.ti.com/linux-phy/kishons-ti-linux-kernel into ti-linux-4.14.y-next

TI-Feature: kishon_next
TI-Tree: git://git.ti.com/linux-phy/kishons-ti-linux-kernel.git
TI-Branch: ti-linux-4.14.y-for-next

* 'ti-linux-4.14.y-for-next' of git://git.ti.com/linux-phy/kishons-ti-linux-kernel:
  phy: ti: Add depends on COMMON_CLK for PHY_AM654

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'rpmsg-ti-linux-4.14.y-next' of git://git.ti.com/rpmsg/rpmsg into ti...
LCPD Auto Merger [Thu, 1 Nov 2018 07:48:41 +0000 (02:48 -0500)]
Merge branch 'rpmsg-ti-linux-4.14.y-next' of git://git.ti.com/rpmsg/rpmsg into ti-linux-4.14.y-next

TI-Feature: suman_next
TI-Tree: git://git.ti.com/rpmsg/rpmsg.git
TI-Branch: rpmsg-ti-linux-4.14.y-next

* 'rpmsg-ti-linux-4.14.y-next' of git://git.ti.com/rpmsg/rpmsg:
  remoteproc/pruss: update pruss_get() to retrieve a PRUSS id
  remoteproc/pruss: store the pruss instance id
  remoteproc: expose rproc_set_firmware() to remoteproc clients
  arm64: dts: ti: k3-am6: Reserve some MCU SRAM for MCU R5F0

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'sekhar_next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti...
LCPD Auto Merger [Thu, 1 Nov 2018 07:48:39 +0000 (02:48 -0500)]
Merge branch 'sekhar_next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel into ti-linux-4.14.y-next

TI-Feature: sekhar_next
TI-Tree: git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel.git
TI-Branch: sekhar_next

* 'sekhar_next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel:
  arm64: dts: ti: k3-am654-base-board: add mcu cpsw phy reset

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'linux-4.14.y' of http://git.kernel.org/pub/scm/linux/kernel/git/stable...
LCPD Auto Merger [Thu, 1 Nov 2018 07:48:37 +0000 (02:48 -0500)]
Merge branch 'linux-4.14.y' of git./linux/kernel/git/stable/linux-stable-rc into ti-linux-4.14.y-next

TI-Feature: linux-stable-4.14-rc
TI-Tree: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
TI-Branch: linux-4.14.y

* 'linux-4.14.y' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc: (664 commits)
  Linux 4.14.78
  IB/hfi1: Fix destroy_qp hang after a link down
  i2c: rcar: handle RXDMA HW behaviour on Gen3
  drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.
  mm: disallow mappings that conflict for devm_memremap_pages()
  staging: ccree: check DMA pool buf !NULL before free
  drm/i915: Nuke the LVDS lid notifier
  HID: quirks: fix support for Apple Magic Keyboards
  ARC: build: Don't set CROSS_COMPILE in arch's Makefile
  ARC: build: Get rid of toolchain check
  mremap: properly flush TLB before releasing the page
  Revert "vfs: fix freeze protection in mnt_want_write_file() for overlayfs"
  powerpc/lib/feature-fixups: use raw_patch_instruction()
  iommu/amd: Return devid as alias for ACPI HID devices
  powerpc/tm: Avoid possible userspace r1 corruption on reclaim
  powerpc/tm: Fix userspace r13 corruption
  clocksource/drivers/fttmr010: Fix set_next_event handler
  net/mlx4: Use cpumask_available for eq->affinity_mask
  scsi: sd: don't crash the host on invalid commands
  scsi: ipr: System hung while dlpar adding primary ipr adapter back
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti...
LCPD Auto Merger [Tue, 30 Oct 2018 23:26:09 +0000 (18:26 -0500)]
Merge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti-linux-4.14.y

TI-Feature: rpmsg
TI-Tree: git://git.ti.com/rpmsg/rpmsg.git
TI-Branch: rpmsg-ti-linux-4.14.y-intg

* 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg:
  remoteproc/k3-r5: cleanup k3_r5_cluster_rproc_exit() for split-mode
  remoteproc/k3-r5: cleanup failure paths in k3_r5_cluster_rproc_init()
  remoteproc: use a local copy for the name field
  remoteproc/k3-r5: fix missing put_device() in cluster OF init code

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoremoteproc/pruss: update pruss_get() to retrieve a PRUSS id
Suman Anna [Wed, 27 Jun 2018 20:18:28 +0000 (15:18 -0500)]
remoteproc/pruss: update pruss_get() to retrieve a PRUSS id

Update the pruss_get() function to take in an additional integer
pointer argument in which the PRUSS instance id is filled in and
provided back to the callers. This allows the drivers to add some
instance-specific logic/customization in their code, as the PRUSS
handle is not useful to build this logic.

The already existing usage within both the regular PRU Ethernet
and the ICSSG PRU Ethernet drivers have also been updated accordingly,
and this will cater to its need for supporting switching between
different Ethernet protocols dynamically per instance.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/pruss: store the pruss instance id
Suman Anna [Fri, 15 Jun 2018 21:45:39 +0000 (16:45 -0500)]
remoteproc/pruss: store the pruss instance id

Add logic to the PRUSS platform driver to store the instance id
of a PRUSS instance. This is being added to enable support for
the PRU Ethernet driver to be able to switch between different
Ethernet protocols dynamically per instance.

The values for instance ids are not always zero-indexed on all
SoCs, they were chosen to match the numbering used in the TRMs.
The instance ids are computed assigned using the PRUSS memory
region base address lookup table. The base address matching
logic is not robust for long-term for newer SoCs, but is okay
for currently supported SoCs as all the addresses are unique.
This is done this way to retain the current usage of minimal
static data and to avoid having to introduce the instance
specific static data just for the instance id data.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc: expose rproc_set_firmware() to remoteproc clients
Suman Anna [Wed, 18 Apr 2018 18:13:24 +0000 (13:13 -0500)]
remoteproc: expose rproc_set_firmware() to remoteproc clients

The rproc_set_firmware() API added in commit ("remoteproc: add a
rproc_set_firmware() API") allows the remoteproc platform drivers
to be able to configure a custom firmware name overriding the default
firmware name used during the remoteproc registration time. This
function was limited to only the remoteproc platform drivers. Expose
this function to drivers outside of the remoteproc folder as well
so that remoteproc client drivers can also use it to customize the
firmware name. The TI PRU Ethernet driver will be an example of
such usage as it requires to use different firmwares for different
supported protocols.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoarm64: dts: ti: k3-am6: Reserve some MCU SRAM for MCU R5F0
Suman Anna [Fri, 30 Jun 2017 21:52:38 +0000 (16:52 -0500)]
arm64: dts: ti: k3-am6: Reserve some MCU SRAM for MCU R5F0

Add a child SRAM node to reserve a portion of the MCU domain
on-chip SRAM memory for use by the MCU R5F Core0. A preliminary
size of 256 KB (half of the current SRAM) is reserved to begin
with and can be adjusted as per need.

This memory is also added to the R5F0 remoteproc node using
the sram property.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/k3-r5: cleanup k3_r5_cluster_rproc_exit() for split-mode
Suman Anna [Fri, 26 Oct 2018 23:57:42 +0000 (18:57 -0500)]
remoteproc/k3-r5: cleanup k3_r5_cluster_rproc_exit() for split-mode

The function k3_r5_cluster_rproc_exit() performs complimentary operations
to those performed in the k3_r5_cluster_rproc_init() function and is
responsible for unregistering and freeing the remoteprocs. This function
currently unregisters the remoteprocs in the same order as done in the
init function. Reorder this unregistration so that Core1 is unregistered
before Core0 in Split-mode, the behavior in LockStep mode is unchanged
since this mode has only one remoteproc registered.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/k3-r5: cleanup failure paths in k3_r5_cluster_rproc_init()
Suman Anna [Mon, 29 Oct 2018 21:48:47 +0000 (16:48 -0500)]
remoteproc/k3-r5: cleanup failure paths in k3_r5_cluster_rproc_init()

The k3_r5_cluster_rproc_init() function is not performing all the
required cleanup for failure paths if the MCU R5F cluster is configured
for Split-mode. Clean up the function so that all prior successful
operation on any of Core0 and/or Core1 are addressed upon any failure
on any core in both LockStep and Split modes. The changes also fixes
a minor cleanup bug introduced in commit 2419f21396b9 ("remoteproc/k3-r5:
fix the R5 boot state machine for multiple combinations").

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc: use a local copy for the name field
Suman Anna [Tue, 30 Oct 2018 18:06:34 +0000 (13:06 -0500)]
remoteproc: use a local copy for the name field

The current name field used in the remoteproc structure is simply
a pointer to a name field supplied during the rproc_alloc() call.
The pointer passed in by remoteproc drivers during registration is
typically a dev_name pointer, but it is possible that the pointer
will no longer remain valid if the devices themselves were created
at runtime like in the case of of_platform_populate(), and were
deleted upon any failures within the respective remoteproc driver
probe function.

So, allocate and maintain a local copy for this name field to
keep it agnostic of the logic used in the remoteproc drivers.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/k3-r5: fix missing put_device() in cluster OF init code
Suman Anna [Mon, 29 Oct 2018 23:36:00 +0000 (18:36 -0500)]
remoteproc/k3-r5: fix missing put_device() in cluster OF init code

The of_find_device_by_node() function returns a platform device for the
passed in device node and takes a reference to the embedded struct device
on success. This needs to be dropped to balance the reference count once
the platform device usage is done with. This is currently missing on each
of the R5F core nodes in the k3_r5_cluster_of_init() function and results
in a memory leak. Fix this properly.

Fixes: 8cdfa3a5d4b8 ("remoteproc/k3-r5: add a remoteproc driver for MCU (dual-R5F) subsystem")
Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoMerge branch 'platform-ti-linux-4.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
LCPD Auto Merger [Tue, 30 Oct 2018 11:09:51 +0000 (06:09 -0500)]
Merge branch 'platform-ti-linux-4.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-4.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-4.14.y

* 'platform-ti-linux-4.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  crypto: omap-sham: split up data to multiple sg elements with huge data
  firmware: ti_sci: allow frequency change for disabled clocks by default

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agocrypto: omap-sham: split up data to multiple sg elements with huge data
Tero Kristo [Fri, 26 Oct 2018 15:08:02 +0000 (18:08 +0300)]
crypto: omap-sham: split up data to multiple sg elements with huge data

When using huge data amount, allocating free pages fails as the kernel
isn't able to process get_free_page requests larger than MAX_ORDER.
Also, the DMA subsystem has an inherent limitation that data size
larger than some 2MB can't be handled properly. In these cases,
split up the data instead to smaller requests so that the kernel
can allocate the data, and also so that the DMA driver can handle
the separate SG elements.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Tested-by: Bin Liu <b-liu@ti.com>
2 years agofirmware: ti_sci: allow frequency change for disabled clocks by default
Tero Kristo [Mon, 1 Oct 2018 12:43:33 +0000 (15:43 +0300)]
firmware: ti_sci: allow frequency change for disabled clocks by default

If a clock is disabled, its frequency should be allowed to change as
it is no longer in use. Add a flag towards this to the firmware clock
API handler routines.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Tested-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agoMerge branch 'connectivity-ti-linux-4.14.y' of git://git.ti.com/connectivity-integrat...
LCPD Auto Merger [Thu, 25 Oct 2018 20:59:38 +0000 (15:59 -0500)]
Merge branch 'connectivity-ti-linux-4.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-4.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-4.14.y

* 'connectivity-ti-linux-4.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  net: ethernet: ti: am65-cpsw-nuss: use round robin mode for cppi tx queues

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti...
LCPD Auto Merger [Thu, 25 Oct 2018 18:29:37 +0000 (13:29 -0500)]
Merge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti-linux-4.14.y

TI-Feature: rpmsg
TI-Tree: git://git.ti.com/rpmsg/rpmsg.git
TI-Branch: rpmsg-ti-linux-4.14.y-intg

* 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg:
  remoteproc/k3-r5: fix the R5 boot state machine for multiple combinations
  remoteproc: add prepare and unprepare ops
  remoteproc/k3-r5: fix use after free with reserved memory regions

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoremoteproc/k3-r5: fix the R5 boot state machine for multiple combinations
Suman Anna [Wed, 24 Oct 2018 22:15:03 +0000 (17:15 -0500)]
remoteproc/k3-r5: fix the R5 boot state machine for multiple combinations

The R5F processors on TI K3 SoCs require a specific sequence for booting
and shutting down the processors. This sequence is also dependent on the
mode (LockStep or Split) the R5F cluster is configured for. The R5F cores
have a Memory Protection Unit (MPU) that has a default configuration that
does not allow the cores to run out of DDR out of reset. This is resolved
by using the TCMs for boot-strapping code that applies the appropriate
executable permissions on desired DDR memory. The loading into the TCMs
requires that the resets be released first with the cores in halted state.
The Power Sleep Controller (PSC) module on K3 SoCs requires that the cores
be in WFI/WFE states with no active bus transactions before the cores can
be put back into reset.

The existing code uses an asymmetric logic for asserting and deasserting
the resets to satisfy the above conditions. The resets are released before
the rproc is registered (during probe), with the cores unhalted in .start()
ops. The cores are halted, resets asserted and released again in .stop()
ops to allow the remoteprocs to be started and stopped repeatedly using
the sysfs 'state' file. The resets are also asserted during remove, and
the deassertion logic in .stop() is done conditionally only if it not
invoked through the remove path. This covers the repeated insmod/rmmod
or sysfs stop/start sequences. This however causes a rproc boot hang
with sysfs stop, rmmod followed by an insmod, since the cores are not
in WFE/WFI during rmmod.

Fix the above issue and the asymmetrical usage properly leveraging the
newly introduce .prepare() and .unprepare() ops in the remoteproc core.
The .prepare() ops is invoked before any loading, and the .unprepare()
ops is invoked after the remoteproc resource cleanup. The R5F core resets
are deasserted in .prepare() and asserted in .unprepare() eliminating the
need for the previous complex logic.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc: add prepare and unprepare ops
Loic Pallardy [Thu, 1 Mar 2018 16:23:55 +0000 (17:23 +0100)]
remoteproc: add prepare and unprepare ops

On some SoC architecture, it is needed to enable HW like
clock, bus, regulator, memory region... before loading
co-processor firmware.

This patch introduces prepare and unprepare ops to execute
platform specific function before firmware loading and after
stop execution.

Signed-off-by: Loic Pallardy <loic.pallardy@st.com>
[s-anna@ti.com: cherry-pick linux-remoteproc patchwork id '10251897']
Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/k3-r5: fix use after free with reserved memory regions
Suman Anna [Wed, 24 Oct 2018 21:05:28 +0000 (16:05 -0500)]
remoteproc/k3-r5: fix use after free with reserved memory regions

The commit 6a28d115b972 ("remoteproc/k3-r5: add support for fixed reserved
memory regions") has replaced the of_reserved_mem_device_init/release()
functions with newer k3_r5_reserved_mem_init/exit() functions that include
the previous functionality. These new functions however have references
to the remoteproc structures, and the k3_r5_reserved_mem_exit() function
is currently invoked after the corresponding remoteproc is freed. This
can cause potential kernel crashes by accessing freed memory. Fix this
properly.

Fixes: 6a28d115b972 ("remoteproc/k3-r5: add support for fixed reserved memory regions")
Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Thu, 25 Oct 2018 12:29:51 +0000 (07:29 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  drm/tidss: Fix copy-paste error in fb uv-plane address calculations

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agodrm/tidss: Fix copy-paste error in fb uv-plane address calculations
Jyri Sarha [Thu, 25 Oct 2018 11:52:05 +0000 (14:52 +0300)]
drm/tidss: Fix copy-paste error in fb uv-plane address calculations

The offset calculation of frame buffers uv-plane were wrongly using
the the first planes cpp and pitches values. This patch fixes the
problem.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Wed, 24 Oct 2018 12:53:34 +0000 (07:53 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  drm/tidss: The CRTC state needs to be written to HW also in enable()

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agodrm/tidss: The CRTC state needs to be written to HW also in enable()
Jyri Sarha [Wed, 24 Oct 2018 08:43:34 +0000 (11:43 +0300)]
drm/tidss: The CRTC state needs to be written to HW also in enable()

The CRTC properties were written to HW only in tidss_crtc_atomic_flush(),
which is skipped if the CRTC is not yet enabled. Because of this we need
to set the video port state also in tidss_crtc_atomic_enable().

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Wed, 24 Oct 2018 08:27:08 +0000 (03:27 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  drm/omap: omap_wb_m2m: add cropping parameter support
  drm/omap: omap_wb_m2m: g/s_selection ioctl always fails
  drm/omap: omap_wb: remove unneeded vb2_dma_addr_plus_data_offset()

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'for18.05.00' of git.ti.com:~bparrot/ti-linux-kernel/bp-ti-linux into...
Jyri Sarha [Wed, 24 Oct 2018 07:25:50 +0000 (10:25 +0300)]
Merge branch 'for18.05.00' of git.ti.com:~bparrot/ti-linux-kernel/bp-ti-linux into audio-display-ti-linux-4.14.y

OMAP-WB fixes 2018.05

* 'for18.05.00' of git.ti.com:~bparrot/ti-linux-kernel/bp-ti-linux:
  drm/omap: omap_wb_m2m: add cropping parameter support
  drm/omap: omap_wb_m2m: g/s_selection ioctl always fails
  drm/omap: omap_wb: remove unneeded vb2_dma_addr_plus_data_offset()

2 years agodrm/omap: omap_wb_m2m: add cropping parameter support
Benoit Parrot [Fri, 19 Oct 2018 19:55:07 +0000 (14:55 -0500)]
drm/omap: omap_wb_m2m: add cropping parameter support

Implement support for cropping functionality.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
2 years agodrm/omap: omap_wb_m2m: g/s_selection ioctl always fails
Benoit Parrot [Wed, 17 Oct 2018 21:24:36 +0000 (16:24 -0500)]
drm/omap: omap_wb_m2m: g/s_selection ioctl always fails

When checking the v4l2_selection.type parameter the driver was checking
against either V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE or
V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE values but the proper values to check
against would be either V4L2_BUF_TYPE_VIDEO_OUTPUT or
V4L2_BUF_TYPE_VIDEO_CAPTURE.

This was causing the g/s_selection ioctls to always return -EINVAL.

In addition a copy/paste mistake was having the driver validate both
V4L2_SEL_TGT_COMPOSE and V4L2_SEL_TGT_CROP operation against
V4L2_BUF_TYPE_VIDEO_OUTPUT. But for the proper validation
V4L2_SEL_TGT_COMPOSE operations are valid on
V4L2_BUF_TYPE_VIDEO_CAPTURE type while V4L2_SEL_TGT_CROP operations are
valid on V4L2_BUF_TYPE_VIDEO_OUTPUT type.

This was causing s_selection ioctl to also return -EINVAL.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
2 years agodrm/omap: omap_wb: remove unneeded vb2_dma_addr_plus_data_offset()
Benoit Parrot [Fri, 19 Oct 2018 14:59:47 +0000 (09:59 -0500)]
drm/omap: omap_wb: remove unneeded vb2_dma_addr_plus_data_offset()

vb2_dma_addr_plus_data_offset() was originally created for the VPE
driver as a hack to handle NV12 frames and make them look like 2 plane
buffer by mis-using the .data_offset to point to the beginning of the UV
part of the image for the second plane. However .data_offset was meant
to be used by userspace using frame buffer which would contain an info
header where the actual video data starts. Sometime after kernel v3.14
the V4L2 framework started to check that the .data_offset could not be
larger than the .bytesused, meaning .data_offset could not indicate an
offset outside of the current buffer. The V4L2 framework nows issue WARN
if data_offset is anything but zero.

Since .data_offset is forced to zero by the framework then this change
does not change the code behavior.

Both VPE and OMAP WB-M2M driver were updated to properly deal NV12
format but the above helper function was not removed from the OMAP WB
M2M driver when we removed it from VPE. We are now correcting that
mistake.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
2 years agoLinux 4.14.78
Greg Kroah-Hartman [Sat, 20 Oct 2018 07:48:54 +0000 (09:48 +0200)]
Linux 4.14.78

2 years agoIB/hfi1: Fix destroy_qp hang after a link down
Michael J. Ruhl [Thu, 20 Sep 2018 19:59:14 +0000 (12:59 -0700)]
IB/hfi1: Fix destroy_qp hang after a link down

commit b4a4957d3d1c328b733fce783b7264996f866ad2 upstream.

rvt_destroy_qp() cannot complete until all in process packets have
been released from the underlying hardware.  If a link down event
occurs, an application can hang with a kernel stack similar to:

cat /proc/<app PID>/stack
 quiesce_qp+0x178/0x250 [hfi1]
 rvt_reset_qp+0x23d/0x400 [rdmavt]
 rvt_destroy_qp+0x69/0x210 [rdmavt]
 ib_destroy_qp+0xba/0x1c0 [ib_core]
 nvme_rdma_destroy_queue_ib+0x46/0x80 [nvme_rdma]
 nvme_rdma_free_queue+0x3c/0xd0 [nvme_rdma]
 nvme_rdma_destroy_io_queues+0x88/0xd0 [nvme_rdma]
 nvme_rdma_error_recovery_work+0x52/0xf0 [nvme_rdma]
 process_one_work+0x17a/0x440
 worker_thread+0x126/0x3c0
 kthread+0xcf/0xe0
 ret_from_fork+0x58/0x90
 0xffffffffffffffff

quiesce_qp() waits until all outstanding packets have been freed.
This wait should be momentary.  During a link down event, the cleanup
handling does not ensure that all packets caught by the link down are
flushed properly.

This is caused by the fact that the freeze path and the link down
event is handled the same.  This is not correct.  The freeze path
waits until the HFI is unfrozen and then restarts PIO.  A link down
is not a freeze event.  The link down path cannot restart the PIO
until link is restored.  If the PIO path is restarted before the link
comes up, the application (QP) using the PIO path will hang (until
link is restored).

Fix by separating the linkdown path from the freeze path and use the
link down path for link down events.

Close a race condition sc_disable() by acquiring both the progress
and release locks.

Close a race condition in sc_stop() by moving the setting of the flag
bits under the alloc lock.

Cc: <stable@vger.kernel.org> # 4.9.x+
Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoi2c: rcar: handle RXDMA HW behaviour on Gen3
Wolfram Sang [Thu, 28 Jun 2018 20:45:38 +0000 (22:45 +0200)]
i2c: rcar: handle RXDMA HW behaviour on Gen3

commit 2b16fd63059ab9a46d473620749672dc342e1d21 upstream.

On Gen3, we can only do RXDMA once per transfer reliably. For that, we
must reset the device, then we can have RXDMA once. This patch
implements this. When there is no reset controller or the reset fails,
RXDMA will be blocked completely. Otherwise, it will be disabled after
the first RXDMA transfer. Based on a commit from the BSP by Hiromitsu
Yamasaki, yet completely refactored to handle multiple read messages
within one transfer.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agodrm/i915/glk: Add Quirk for GLK NUC HDMI port issues.
Clint Taylor [Tue, 10 Jul 2018 20:02:05 +0000 (13:02 -0700)]
drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.

commit 0ca9488193e61ec5f31a631d8147f74525629e8a upstream.

On GLK NUC platforms the HDMI retiming buffer needs additional disabled
time to correctly sync to a faster incoming signal.

When measured on a scope the highspeed lines of the HDMI clock turn off
 for ~400uS during a normal resolution change. The HDMI retimer on the
 GLK NUC appears to require at least a full frame of quiet time before a
new faster clock can be correctly sync'd. Wait 100ms due to msleep
inaccuracies while waiting for a completed frame. Add a quirk to the
driver for GLK boards that use ITE66317 HDMI retimers.

V2: Add more devices to the quirk list
V3: Delay increased to 100ms, check to confirm crtc type is HDMI.
V4: crtc type check extended to include _DDI and whitespace fixes
v5: Fix white spaces, remove the macro for delay. Revert the crtc type
    check introduced in v4.

Cc: Imre Deak <imre.deak@intel.com>
Cc: <stable@vger.kernel.org> # v4.14+
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105887
Signed-off-by: Clint Taylor <clinton.a.taylor@intel.com>
Tested-by: Daniel Scheller <d.scheller.oss@gmail.com>
Signed-off-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180710200205.1478-1-radhakrishna.sripada@intel.com
(cherry picked from commit 90c3e2198777aaa355b6994a31a79c636c8d4306)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agomm: disallow mappings that conflict for devm_memremap_pages()
Dave Jiang [Thu, 26 Jul 2018 23:37:15 +0000 (16:37 -0700)]
mm: disallow mappings that conflict for devm_memremap_pages()

commit 15d36fecd0bdc7510b70a0e5ec6671140b3fce0c upstream.

When pmem namespaces created are smaller than section size, this can
cause an issue during removal and gpf was observed:

  general protection fault: 0000 1 SMP PTI
  CPU: 36 PID: 3941 Comm: ndctl Tainted: G W 4.14.28-1.el7uek.x86_64 #2
  task: ffff88acda150000 task.stack: ffffc900233a4000
  RIP: 0010:__put_page+0x56/0x79
  Call Trace:
    devm_memremap_pages_release+0x155/0x23a
    release_nodes+0x21e/0x260
    devres_release_all+0x3c/0x48
    device_release_driver_internal+0x15c/0x207
    device_release_driver+0x12/0x14
    unbind_store+0xba/0xd8
    drv_attr_store+0x27/0x31
    sysfs_kf_write+0x3f/0x46
    kernfs_fop_write+0x10f/0x18b
    __vfs_write+0x3a/0x16d
    vfs_write+0xb2/0x1a1
    SyS_write+0x55/0xb9
    do_syscall_64+0x79/0x1ae
    entry_SYSCALL_64_after_hwframe+0x3d/0x0

Add code to check whether we have a mapping already in the same section
and prevent additional mappings from being created if that is the case.

Link: http://lkml.kernel.org/r/152909478401.50143.312364396244072931.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Robert Elliott <elliott@hpe.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agostaging: ccree: check DMA pool buf !NULL before free
Gilad Ben-Yossef [Sun, 7 Jan 2018 12:14:24 +0000 (12:14 +0000)]
staging: ccree: check DMA pool buf !NULL before free

commit 2f7caf6b02145bd9cd9d0b56204f51a5fefe7790 upstream.

If we ran out of DMA pool buffers, we get into the unmap
code path with a NULL before. Deal with this by checking
the virtual mapping is not NULL.

Cc: stable@vger.kernel.org
Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agodrm/i915: Nuke the LVDS lid notifier
Ville Syrjälä [Tue, 17 Jul 2018 17:42:14 +0000 (20:42 +0300)]
drm/i915: Nuke the LVDS lid notifier

commit 05c72e77ccda89ff624108b1b59a0fc43843f343 upstream.

We broke the LVDS notifier resume thing in (presumably) commit
e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.") as
we no longer duplicate the current state in the LVDS notifier and
thus we never resume it properly either.

Instead of trying to fix it again let's just kill off the lid
notifier entirely. None of the machines tested thus far have
apparently needed it. Originally the lid notifier was added to
work around cases where the VBIOS was clobbering some of the
hardware state behind the driver's back, mostly on Thinkpads.
We now have a few report of Thinkpads working just fine without
the notifier. So maybe it was misdiagnosed originally, or
something else has changed (ACPI video stuff perhaps?).

If we do end up finding a machine where the VBIOS is still causing
problems I would suggest that we first try setting various bits in
the VBIOS scratch registers. There are several to choose from that
may instruct the VBIOS to steer clear.

With the notifier gone we'll also stop looking at the panel status
in ->detect().

v2: Nuke enum modeset_restore (Rodrigo)

Cc: stable@vger.kernel.org
Cc: Wolfgang Draxinger <wdraxinger.maillist@draxit.de>
Cc: Vito Caputo <vcaputo@pengaru.com>
Cc: kitsunyan <kitsunyan@airmail.cc>
Cc: Joonas Saarinen <jza@saunalahti.fi>
Tested-by: Vito Caputo <vcaputo@pengaru.com> # Thinkapd X61s
Tested-by: kitsunyan <kitsunyan@airmail.cc> # ThinkPad X200
Tested-by: Joonas Saarinen <jza@saunalahti.fi> # Fujitsu Siemens U9210
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105902
References: https://lists.freedesktop.org/archives/intel-gfx/2018-June/169315.html
References: https://bugs.freedesktop.org/show_bug.cgi?id=21230
Fixes: e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180717174216.22252-1-ville.syrjala@linux.intel.com
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoHID: quirks: fix support for Apple Magic Keyboards
Natanael Copa [Thu, 18 Oct 2018 15:04:17 +0000 (17:04 +0200)]
HID: quirks: fix support for Apple Magic Keyboards

Commit b6cc0ba2cbf4 (HID: add support for Apple Magic Keyboards)
backported support for the Magic Keyboard over Bluetooth, but did not
add the BT_VENDOR_ID_APPLE to hid_have_special_driver[] so the hid-apple
driver is never loaded and Fn key does not work at all.

Adding BT_VENDOR_ID_APPLE to hid_have_special_driver[] is not needed
after commit e04a0442d33b (HID: core: remove the absolute need of
hid_have_special_driver[]), so 4.16 kernels and newer does not need it.

Fixes: b6cc0ba2cbf4 (HID: add support for Apple Magic Keyboards)
Bugzilla-id: https://bugzilla.kernel.org/show_bug.cgi?id=99881
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoARC: build: Don't set CROSS_COMPILE in arch's Makefile
Alexey Brodkin [Sun, 16 Sep 2018 20:47:57 +0000 (23:47 +0300)]
ARC: build: Don't set CROSS_COMPILE in arch's Makefile

commit 40660f1fcee8d524a60b5101538e42b1f39f106d upstream.

There's not much sense in doing that because if user or
his build-system didn't set CROSS_COMPILE we still may
very well make incorrect guess.

But as it turned out setting CROSS_COMPILE is not as harmless
as one may think: with recent changes that implemented automatic
discovery of __host__ gcc features unconditional setup of
CROSS_COMPILE leads to failures on execution of "make xxx_defconfig"
with absent cross-compiler, for more info see [1].

Set CROSS_COMPILE as well gets in the way if we want only to build
.dtb's (again with absent cross-compiler which is not really needed
for building .dtb's), see [2].

Note, we had to change LIBGCC assignment type from ":=" to "="
so that is is resolved on its usage, otherwise if it is resolved
at declaration time with missing CROSS_COMPILE we're getting this
error message from host GCC:

| gcc: error: unrecognized command line option -mmedium-calls
| gcc: error: unrecognized command line option -mno-sdata

[1] http://lists.infradead.org/pipermail/linux-snps-arc/2018-September/004308.html
[2] http://lists.infradead.org/pipermail/linux-snps-arc/2018-September/004320.html

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoARC: build: Get rid of toolchain check
Alexey Brodkin [Thu, 13 Sep 2018 20:24:28 +0000 (23:24 +0300)]
ARC: build: Get rid of toolchain check

commit 615f64458ad890ef94abc879a66d8b27236e733a upstream.

This check is very naive: we simply test if GCC invoked without
"-mcpu=XXX" has ARC700 define set. In that case we think that GCC
was built with "--with-cpu=arc700" and has libgcc built for ARC700.

Otherwise if ARC700 is not defined we think that everythng was built
for ARCv2.

But in reality our life is much more interesting.

1. Regardless of GCC configuration (i.e. what we pass in "--with-cpu"
   it may generate code for any ARC core).

2. libgcc might be built with explicitly specified "--mcpu=YYY"

That's exactly what happens in case of multilibbed toolchains:
 - GCC is configured with default settings
 - All the libs built for many different CPU flavors

I.e. that check gets in the way of usage of multilibbed
toolchains. And even non-multilibbed toolchains are affected.
OpenEmbedded also builds GCC without "--with-cpu" because
each and every target component later is compiled with explicitly
set "-mcpu=ZZZ".

Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agomremap: properly flush TLB before releasing the page
Linus Torvalds [Fri, 12 Oct 2018 22:22:59 +0000 (15:22 -0700)]
mremap: properly flush TLB before releasing the page

commit eb66ae030829605d61fbef1909ce310e29f78821 upstream.

Jann Horn points out that our TLB flushing was subtly wrong for the
mremap() case.  What makes mremap() special is that we don't follow the
usual "add page to list of pages to be freed, then flush tlb, and then
free pages".  No, mremap() obviously just _moves_ the page from one page
table location to another.

That matters, because mremap() thus doesn't directly control the
lifetime of the moved page with a freelist: instead, the lifetime of the
page is controlled by the page table locking, that serializes access to
the entry.

As a result, we need to flush the TLB not just before releasing the lock
for the source location (to avoid any concurrent accesses to the entry),
but also before we release the destination page table lock (to avoid the
TLB being flushed after somebody else has already done something to that
page).

This also makes the whole "need_flush" logic unnecessary, since we now
always end up flushing the TLB for every valid entry.

Reported-and-tested-by: Jann Horn <jannh@google.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Tested-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoRevert "vfs: fix freeze protection in mnt_want_write_file() for overlayfs"
Greg Kroah-Hartman [Thu, 18 Oct 2018 12:22:54 +0000 (14:22 +0200)]
Revert "vfs: fix freeze protection in mnt_want_write_file() for overlayfs"

This reverts commit 4f4374a9bd25b333971e6f2656b642d29e2efe7b which was
commit a6795a585929d94ca3e931bc8518f8deb8bbe627 upstream.

Turns out this causes problems and was to fix a patch only in the 4.19
and newer tree.

Reported-by: Amir Goldstein <amir73il@gmail.com>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agopowerpc/lib/feature-fixups: use raw_patch_instruction()
Christophe Leroy [Fri, 24 Nov 2017 07:31:09 +0000 (08:31 +0100)]
powerpc/lib/feature-fixups: use raw_patch_instruction()

commit 8183d99f4a22c2abbc543847a588df3666ef0c0c upstream.

feature fixups need to use patch_instruction() early in the boot,
even before the code is relocated to its final address, requiring
patch_instruction() to use PTRRELOC() in order to address data.

But feature fixups applies on code before it is set to read only,
even for modules. Therefore, feature fixups can use
raw_patch_instruction() instead.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reported-by: David Gounaris <david.gounaris@infinera.com>
Tested-by: David Gounaris <david.gounaris@infinera.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoiommu/amd: Return devid as alias for ACPI HID devices
Arindam Nath [Tue, 18 Sep 2018 10:10:58 +0000 (15:40 +0530)]
iommu/amd: Return devid as alias for ACPI HID devices

[ Upstream commit 5ebb1bc2d63d90dd204169e21fd7a0b4bb8c776e ]

ACPI HID devices do not actually have an alias for
them in the IVRS. But dev_data->alias is still used
for indexing into the IOMMU device table for devices
being handled by the IOMMU. So for ACPI HID devices,
we simply return the corresponding devid as an alias,
as parsed from IVRS table.

Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Fixes: 2bf9a0a12749 ('iommu/amd: Add iommu support for ACPI HID devices')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agopowerpc/tm: Avoid possible userspace r1 corruption on reclaim
Michael Neuling [Tue, 25 Sep 2018 09:36:47 +0000 (19:36 +1000)]
powerpc/tm: Avoid possible userspace r1 corruption on reclaim

[ Upstream commit 96dc89d526ef77604376f06220e3d2931a0bfd58 ]

Current we store the userspace r1 to PACATMSCRATCH before finally
saving it to the thread struct.

In theory an exception could be taken here (like a machine check or
SLB miss) that could write PACATMSCRATCH and hence corrupt the
userspace r1. The SLB fault currently doesn't touch PACATMSCRATCH, but
others do.

We've never actually seen this happen but it's theoretically
possible. Either way, the code is fragile as it is.

This patch saves r1 to the kernel stack (which can't fault) before we
turn MSR[RI] back on. PACATMSCRATCH is still used but only with
MSR[RI] off. We then copy r1 from the kernel stack to the thread
struct once we have MSR[RI] back on.

Suggested-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agopowerpc/tm: Fix userspace r13 corruption
Michael Neuling [Mon, 24 Sep 2018 07:27:04 +0000 (17:27 +1000)]
powerpc/tm: Fix userspace r13 corruption

[ Upstream commit cf13435b730a502e814c63c84d93db131e563f5f ]

When we treclaim we store the userspace checkpointed r13 to a scratch
SPR and then later save the scratch SPR to the user thread struct.

Unfortunately, this doesn't work as accessing the user thread struct
can take an SLB fault and the SLB fault handler will write the same
scratch SPRG that now contains the userspace r13.

To fix this, we store r13 to the kernel stack (which can't fault)
before we access the user thread struct.

Found by running P8 guest + powervm + disable_1tb_segments + TM. Seen
as a random userspace segfault with r13 looking like a kernel address.

Signed-off-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoclocksource/drivers/fttmr010: Fix set_next_event handler
Tao Ren [Wed, 19 Sep 2018 22:13:31 +0000 (15:13 -0700)]
clocksource/drivers/fttmr010: Fix set_next_event handler

[ Upstream commit 4451d3f59f2a6f95e5d205c2d04ea072955d080d ]

Currently, the aspeed MATCH1 register is updated to <current_count -
cycles> in set_next_event handler, with the assumption that COUNT
register value is preserved when the timer is disabled and it continues
decrementing after the timer is enabled. But the assumption is wrong:
RELOAD register is loaded into COUNT register when the aspeed timer is
enabled, which means the next event may be delayed because timer
interrupt won't be generated until <0xFFFFFFFF - current_count +
cycles>.

The problem can be fixed by updating RELOAD register to <cycles>, and
COUNT register will be re-loaded when the timer is enabled and interrupt
is generated when COUNT register overflows.

The test result on Facebook Backpack-CMM BMC hardware (AST2500) shows
the issue is fixed: without the patch, usleep(100) suspends the process
for several milliseconds (and sometimes even over 40 milliseconds);
after applying the fix, usleep(100) takes averagely 240 microseconds to
return under the same workload level.

Signed-off-by: Tao Ren <taoren@fb.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Lei YU <mine260309@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agonet/mlx4: Use cpumask_available for eq->affinity_mask
Nathan Chancellor [Fri, 21 Sep 2018 09:44:12 +0000 (02:44 -0700)]
net/mlx4: Use cpumask_available for eq->affinity_mask

[ Upstream commit 8ac1ee6f4d62e781e3b3fd8b9c42b70371427669 ]

Clang warns that the address of a pointer will always evaluated as true
in a boolean context:

drivers/net/ethernet/mellanox/mlx4/eq.c:243:11: warning: address of
array 'eq->affinity_mask' will always evaluate to 'true'
[-Wpointer-bool-conversion]
        if (!eq->affinity_mask || cpumask_empty(eq->affinity_mask))
            ~~~~~^~~~~~~~~~~~~
1 warning generated.

Use cpumask_available, introduced in commit f7e30f01a9e2 ("cpumask: Add
helper cpumask_available()"), which does the proper checking and avoids
this warning.

Link: https://github.com/ClangBuiltLinux/linux/issues/86
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoscsi: sd: don't crash the host on invalid commands
Johannes Thumshirn [Fri, 21 Sep 2018 07:01:01 +0000 (09:01 +0200)]
scsi: sd: don't crash the host on invalid commands

[ Upstream commit f1f1fadacaf08b7cf11714c0c29f8fa4d4ef68a9 ]

When sd_init_command() get's a command with a unknown req_op() it crashes the
system via BUG().

This makes debugging the actual reason for the broken request cmd_flags pretty
hard as the system is down before it's able to write out debugging data on the
serial console or the trace buffer.

Change the BUG() to a WARN_ON() and return BLKPREP_KILL to fail gracefully and
return an I/O error to the producer of the request.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Christoph Hellwig <hch@lst.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoscsi: ipr: System hung while dlpar adding primary ipr adapter back
Wen Xiong [Fri, 21 Sep 2018 00:32:12 +0000 (19:32 -0500)]
scsi: ipr: System hung while dlpar adding primary ipr adapter back

[ Upstream commit 318ddb34b2052f838aa243d07173e2badf3e630e ]

While dlpar adding primary ipr adapter back, driver goes through adapter
initialization then schedule ipr_worker_thread to start te disk scan by
dropping the host lock, calling scsi_add_device.  Then get the adapter reset
request again, so driver does scsi_block_requests, this will cause the
scsi_add_device get hung until we unblock. But we can't run ipr_worker_thread
to do the unblock because its stuck in scsi_add_device.

This patch fixes the issue.

[mkp: typo and whitespace fixes]

Signed-off-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Acked-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agodrm: mali-dp: Call drm_crtc_vblank_reset on device init
Alexandru Gheorghe [Mon, 16 Jul 2018 10:07:07 +0000 (11:07 +0100)]
drm: mali-dp: Call drm_crtc_vblank_reset on device init

[ Upstream commit 69be1984ded00a11b1ed0888c6d8e4f35370372f ]

Currently, if userspace calls drm_wait_vblank before the crtc is
activated the crtc vblank_enable hook is called, which in case of
malidp driver triggers some warninngs. This happens because on
device init we don't inform the drm core about the vblank state
by calling drm_crtc_vblank_on/off/reset which together with
drm_vblank_get have some magic that prevents calling drm_vblank_enable
when crtc is off.

Signed-off-by: Alexandru Gheorghe <alexandru-cosmin.gheorghe@arm.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoPCI: dwc: Fix scheduling while atomic issues
Jisheng Zhang [Thu, 20 Sep 2018 21:32:52 +0000 (16:32 -0500)]
PCI: dwc: Fix scheduling while atomic issues

[ Upstream commit 9024143e700f89d74b8cdaf316a3499d74fc56fe ]

When programming the inbound/outbound ATUs, we call usleep_range() after
each checking PCIE_ATU_ENABLE bit. Unfortunately, the ATU programming
can be executed in atomic context:

inbound ATU programming could be called through
pci_epc_write_header()
  =>dw_pcie_ep_write_header()
    =>dw_pcie_prog_inbound_atu()

outbound ATU programming could be called through
pci_bus_read_config_dword()
  =>dw_pcie_rd_conf()
    =>dw_pcie_prog_outbound_atu()

Fix this issue by calling mdelay() instead.

Fixes: f8aed6ec624f ("PCI: dwc: designware: Add EP mode support")
Fixes: d8bbeb39fbf3 ("PCI: designware: Wait for iATU enable")
Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
[lorenzo.pieralisi@arm.com: commit log update]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoravb: do not write 1 to reserved bits
Kazuya Mizuguchi [Tue, 18 Sep 2018 10:22:26 +0000 (12:22 +0200)]
ravb: do not write 1 to reserved bits

[ Upstream commit 2fe397a3959de8a472f165e6d152f64cb77fa2cc ]

EtherAVB hardware requires 0 to be written to status register bits in
order to clear them, however, care must be taken not to:

1. Clear other bits, by writing zero to them
2. Write one to reserved bits

This patch corrects the ravb driver with respect to the second point above.
This is done by defining reserved bit masks for the affected registers and,
after auditing the code, ensure all sites that may write a one to a
reserved bit use are suitably masked.

Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agonet: emac: fix fixed-link setup for the RTL8363SB switch
Christian Lamparter [Mon, 17 Sep 2018 15:22:40 +0000 (17:22 +0200)]
net: emac: fix fixed-link setup for the RTL8363SB switch

[ Upstream commit 08e39982ef64f800fd1f9b9b92968d14d5fafa82 ]

On the Netgear WNDAP620, the emac ethernet isn't receiving nor
xmitting any frames from/to the RTL8363SB (identifies itself
as a RTL8367RB).

This is caused by the emac hardware not knowing the forced link
parameters for speed, duplex, pause, etc.

This begs the question, how this was working on the original
driver code, when it was necessary to set the phy_address and
phy_map to 0xffffffff. But I guess without access to the old
PPC405/440/460 hardware, it's not possible to know.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoInput: atakbd - fix Atari CapsLock behaviour
Michael Schmitz [Mon, 17 Sep 2018 22:27:49 +0000 (15:27 -0700)]
Input: atakbd - fix Atari CapsLock behaviour

[ Upstream commit 52d2c7bf7c90217fbe875d2d76f310979c48eb83 ]

The CapsLock key on Atari keyboards is not a toggle, it does send the
normal make and break scancodes.

Drop the CapsLock toggle handling code, which did cause the CapsLock
key to merely act as a Shift key.

Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoInput: atakbd - fix Atari keymap
Andreas Schwab [Mon, 17 Sep 2018 19:43:34 +0000 (12:43 -0700)]
Input: atakbd - fix Atari keymap

[ Upstream commit 9e62df51be993035c577371ffee5477697a56aad ]

Fix errors in Atari keymap (mostly in keypad, help and undo keys).

Patch provided on debian-68k ML by Andreas Schwab <schwab@linux-m68k.org>,
keymap array size and unhandled scancode limit adjusted to 0x73 by me.

Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agointel_th: pci: Add Ice Lake PCH support
Alexander Shishkin [Tue, 18 Sep 2018 13:10:49 +0000 (16:10 +0300)]
intel_th: pci: Add Ice Lake PCH support

[ Upstream commit 59d08d00d43c644ee2011d7ff1807bdd69f31fe0 ]

This adds Intel(R) Trace Hub PCI ID for Ice Lake PCH.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoscsi: ibmvscsis: Ensure partition name is properly NUL terminated
Laura Abbott [Tue, 11 Sep 2018 19:22:26 +0000 (12:22 -0700)]
scsi: ibmvscsis: Ensure partition name is properly NUL terminated

[ Upstream commit adad633af7b970bfa5dd1b624a4afc83cac9b235 ]

While reviewing another part of the code, Kees noticed that the strncpy of the
partition name might not always be NUL terminated. Switch to using strscpy
which does this safely.

Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoscsi: ibmvscsis: Fix a stringop-overflow warning
Laura Abbott [Tue, 11 Sep 2018 19:22:25 +0000 (12:22 -0700)]
scsi: ibmvscsis: Fix a stringop-overflow warning

[ Upstream commit d792d4c4fc866ae224b0b0ca2aabd87d23b4d6cc ]

There's currently a warning about string overflow with strncat:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_probe':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:3479:2: error: 'strncat' specified
bound 64 equals destination size [-Werror=stringop-overflow=]
  strncat(vscsi->eye, vdev->name, MAX_EYE);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Switch to a single snprintf instead of a strcpy + strcat to handle this
cleanly.

Signed-off-by: Laura Abbott <labbott@redhat.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoclocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs
Keerthy [Wed, 8 Aug 2018 13:14:59 +0000 (18:44 +0530)]
clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs

[ Upstream commit 3b7d96a0dbb6b630878597a1838fc39f808b761b ]

The 32k clocksource is NONSTOP for non-am43 SoCs. Hence
add the flag for all the other SoCs.

Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Keerthy <j-keerthy@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: fix hardif_neigh refcount on queue_work() failure
Marek Lindner [Thu, 6 Sep 2018 21:45:55 +0000 (05:45 +0800)]
batman-adv: fix hardif_neigh refcount on queue_work() failure

[ Upstream commit 4c4af6900844ab04c9434c972021d7b48610e06a ]

The hardif_neigh refcounter is to be decreased by the queued work and
currently is never decreased if the queue_work() call fails.
Fix by checking the queue_work() return value and decrease refcount
if necessary.

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: fix backbone_gw refcount on queue_work() failure
Marek Lindner [Thu, 6 Sep 2018 21:45:54 +0000 (05:45 +0800)]
batman-adv: fix backbone_gw refcount on queue_work() failure

[ Upstream commit 5af96b9c59c72fb2af2d19c5cc2f3cdcee391dff ]

The backbone_gw refcounter is to be decreased by the queued work and
currently is never decreased if the queue_work() call fails.
Fix by checking the queue_work() return value and decrease refcount
if necessary.

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Prevent duplicated tvlv handler
Sven Eckelmann [Sun, 12 Aug 2018 19:04:45 +0000 (21:04 +0200)]
batman-adv: Prevent duplicated tvlv handler

[ Upstream commit ae3cdc97dc10c7a3b31f297dab429bfb774c9ccb ]

The function batadv_tvlv_handler_register is responsible for adding new
tvlv_handler to the handler_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.

But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.

The check and the manipulation of the list must therefore be in the same
locked code section.

Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Prevent duplicated global TT entry
Sven Eckelmann [Sun, 12 Aug 2018 19:04:44 +0000 (21:04 +0200)]
batman-adv: Prevent duplicated global TT entry

[ Upstream commit e7136e48ffdfb9f37b0820f619380485eb407361 ]

The function batadv_tt_global_orig_entry_add is responsible for adding new
tt_orig_list_entry to the orig_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.

But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.

The check and the manipulation of the list must therefore be in the same
locked code section.

Fixes: d657e621a0f5 ("batman-adv: add reference counting for type batadv_tt_orig_list_entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Prevent duplicated softif_vlan entry
Sven Eckelmann [Sun, 12 Aug 2018 19:04:43 +0000 (21:04 +0200)]
batman-adv: Prevent duplicated softif_vlan entry

[ Upstream commit 94cb82f594ed86be303398d6dfc7640a6f1d45d4 ]

The function batadv_softif_vlan_get is responsible for adding new
softif_vlan to the softif_vlan_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.

But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.

The check and the manipulation of the list must therefore be in the same
locked code section.

Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Prevent duplicated nc_node entry
Sven Eckelmann [Sun, 12 Aug 2018 19:04:42 +0000 (21:04 +0200)]
batman-adv: Prevent duplicated nc_node entry

[ Upstream commit fa122fec8640eb7186ce5a41b83a4c1744ceef8f ]

The function batadv_nc_get_nc_node is responsible for adding new nc_nodes
to the in_coding_list and out_coding_list. It first checks whether the
entry already is in the list or not. If it is, then the creation of a new
entry is aborted.

But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.

The check and the manipulation of the list must therefore be in the same
locked code section.

Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Prevent duplicated gateway_node entry
Sven Eckelmann [Sun, 12 Aug 2018 19:04:41 +0000 (21:04 +0200)]
batman-adv: Prevent duplicated gateway_node entry

[ Upstream commit dff9bc42ab0b2d38c5e90ddd79b238fed5b4c7ad ]

The function batadv_gw_node_add is responsible for adding new gw_node to
the gateway_list. It is expecting that the caller already checked that
there is not already an entry with the same key or not.

But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.

The check and the manipulation of the list must therefore be in the same
locked code section.

Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Fix segfault when writing to sysfs elp_interval
Sven Eckelmann [Fri, 31 Aug 2018 14:56:29 +0000 (16:56 +0200)]
batman-adv: Fix segfault when writing to sysfs elp_interval

[ Upstream commit a25bab9d723a08bd0bdafb1529faf9094c690b70 ]

The per hardif sysfs file "batman_adv/elp_interval" is using the generic
functions to store/show uint values. The helper __batadv_store_uint_attr
requires the softif net_device as parameter to print the resulting change
as info text when the users writes to this file. It uses the helper
function batadv_info to add it at the same time to the kernel ring buffer
and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG is enabled).

The function batadv_info requires as first parameter the batman-adv softif
net_device. This parameter is then used to find the private buffer which
contains the debug log for this batman-adv interface. But
batadv_store_throughput_override used as first argument the slave
net_device. This slave device doesn't have the batadv_priv private data
which is access by batadv_info.

Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
to a segfault or to memory corruption.

Fixes: 0744ff8fa8fa ("batman-adv: Add hard_iface specific sysfs wrapper macros for UINT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Fix segfault when writing to throughput_override
Sven Eckelmann [Fri, 31 Aug 2018 14:46:47 +0000 (16:46 +0200)]
batman-adv: Fix segfault when writing to throughput_override

[ Upstream commit b9fd14c20871e6189f635e49b32d7789e430b3c8 ]

The per hardif sysfs file "batman_adv/throughput_override" prints the
resulting change as info text when the users writes to this file. It uses
the helper function batadv_info to add it at the same time to the kernel
ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG
is enabled).

The function batadv_info requires as first parameter the batman-adv softif
net_device. This parameter is then used to find the private buffer which
contains the debug log for this batman-adv interface. But
batadv_store_throughput_override used as first argument the slave
net_device. This slave device doesn't have the batadv_priv private data
which is access by batadv_info.

Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
to a segfault or to memory corruption.

Fixes: 0b5ecc6811bd ("batman-adv: add throughput override attribute to hard_ifaces")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agobatman-adv: Avoid probe ELP information leak
Sven Eckelmann [Fri, 31 Aug 2018 13:08:44 +0000 (15:08 +0200)]
batman-adv: Avoid probe ELP information leak

[ Upstream commit 88d0895d0ea9d4431507d576c963f2ff9918144d ]

The probe ELPs for WiFi interfaces are expanded to contain at least
BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
number of bytes which the template ELP packet requires.

These extra padding bytes were not initialized and thus could contain data
which were previously stored at the same location. It is therefore required
to set it to some predefined or random values to avoid leaking private
information from the system transmitting these kind of packets.

Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agomedia: af9035: prevent buffer overflow on write
Jozef Balga [Tue, 21 Aug 2018 09:01:04 +0000 (05:01 -0400)]
media: af9035: prevent buffer overflow on write

[ Upstream commit 312f73b648626a0526a3aceebb0a3192aaba05ce ]

When less than 3 bytes are written to the device, memcpy is called with
negative array size which leads to buffer overflow and kernel panic. This
patch adds a condition and returns -EOPNOTSUPP instead.
Fixes bugzilla issue 64871

[mchehab+samsung@kernel.org: fix a merge conflict and changed the
 condition to match the patch's comment, e. g. len == 3 could
 also be valid]
Signed-off-by: Jozef Balga <jozef.balga@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoMerge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti...
LCPD Auto Merger [Fri, 19 Oct 2018 21:26:34 +0000 (16:26 -0500)]
Merge branch 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti-linux-4.14.y

TI-Feature: rpmsg
TI-Tree: git://git.ti.com/rpmsg/rpmsg.git
TI-Branch: rpmsg-ti-linux-4.14.y-intg

* 'rpmsg-ti-linux-4.14.y-intg' of git://git.ti.com/rpmsg/rpmsg:
  arm64: dts: ti: k3-am654-base-board: split the R5F memory regions
  remoteproc/k3-r5: add support for fixed reserved memory regions
  dt-bindings: remoteproc: k3-r5f: Update bindings for multiple memory regions
  of: reserved_mem: Accessor for acquiring reserved_mem

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoarm64: dts: ti: k3-am654-base-board: split the R5F memory regions
Suman Anna [Wed, 10 Oct 2018 01:45:21 +0000 (20:45 -0500)]
arm64: dts: ti: k3-am654-base-board: split the R5F memory regions

The commit 44dc2a65ba1d ("arm64: dts: ti: k3-am654-evm: Add DDR carveout
memory nodes for R5Fs") adds two carveout reserved memory nodes for each
of the MCU R5F remote processor devices. Split each of these regions into
two different regions for the all the TI K3 AM65x boards to support R5F
firmwares without any RSC_CARVEOUT entries in their resource tables. The
first region will be used as the DMA pool for the rproc devices, and the
second region will furnish the static carveout regions for the firmware
memory.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoremoteproc/k3-r5: add support for fixed reserved memory regions
Suman Anna [Tue, 9 Oct 2018 20:57:02 +0000 (15:57 -0500)]
remoteproc/k3-r5: add support for fixed reserved memory regions

The R5F remote processors do not have an MMU, and so require fixed
memory carveout regions matching the firmware image addresses. The
R5F remoteproc driver currently relies on a single memory region
provided to the device and uses it to dynamically allocate memory
for both the vrings/vring buffers as well as for the firmware image
segments. The latter is done through matching RSC_CARVEOUT entries.
This is not a scalable solution though as there is no way to ensure
the allocated memories will match the exact firmware image addresses.

Enhance the current R5F remoteproc driver to remove this limitation.
Support for this is added by mandating multiple memory regions to be
attached to the remoteproc device. The first memory region will be
used to serve as the DMA pool for all dynamic allocations like the
vrings and vring buffers. The remaining memory regions are mapped
into the kernel at device probe time, and are used to provide address
translations for firmware image segments without the need for any
RSC_CARVEOUT entries. Any firmware image using memory outside of
the supplied reserved memory carveout regions will be errored out.

NOTE:
The R5F remoteproc driver currently does not support the Region
Address Translator allowing the R5F cores to use a 32-bit processor
address for leveraging a physical address > 32-bit address. All
the reserved memory regions are therefore expected to be using
memory regions within the first 2 GB.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agodt-bindings: remoteproc: k3-r5f: Update bindings for multiple memory regions
Suman Anna [Wed, 10 Oct 2018 20:13:12 +0000 (15:13 -0500)]
dt-bindings: remoteproc: k3-r5f: Update bindings for multiple memory regions

The R5F remote processors do not have an MMU, and so require fixed memory
carveout regions matching the firmware image addresses. Update the bindings
to require more than one memory region, with the first memory region used
for DMA allocations at runtime. The remaining memory regions are reserved
and are used for the loading and running of the R5F remote processors.

The AM65x example has also been updated accordingly.

Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoof: reserved_mem: Accessor for acquiring reserved_mem
Bjorn Andersson [Wed, 11 Oct 2017 05:08:54 +0000 (22:08 -0700)]
of: reserved_mem: Accessor for acquiring reserved_mem

In some cases drivers referencing a reserved-memory region might want to
remap the entire region, but when defining the reserved-memory by "size"
the client driver has no means to know the associated base address of
the reserved memory region.

This patch adds an accessor for such drivers to acquire a handle to
their associated reserved-memory for this purpose.

A complicating factor for the implementation is that the reserved_mem
objects are created from the flattened DeviceTree, as such we can't
use the device_node address for comparison. Fortunately the name of the
node will be used as "name" of the reserved_mem and will be used when
building the full_name, so we can compare the "name" with the basename
of the full_name to find the match.

Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
[s-anna@ti.com: cherry-pick commit 'eb297bc716ec' from v4.15]
Signed-off-by: Suman Anna <s-anna@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Fri, 19 Oct 2018 13:27:31 +0000 (08:27 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  drm/tidss: dispc7: Remove unneeded semicolon at the end of switch-block

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agodrm/tidss: dispc7: Remove unneeded semicolon at the end of switch-block
Jyri Sarha [Fri, 19 Oct 2018 10:15:35 +0000 (13:15 +0300)]
drm/tidss: dispc7: Remove unneeded semicolon at the end of switch-block

Remove unneeded semicolon at the end of the newly added switch-case-block.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Thu, 18 Oct 2018 21:26:54 +0000 (16:26 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  drm/tidss: dispc7: Remove double spaces from scaling code
  drm/tidss: dispc7: Simplify assignment of VP POL FREQ bits in vp_enable()
  drm/tidss: Add TI custom "background" color property and functionality
  drm/tidss: Add TI custom transparency key properties and functionality
  drm/tidss: dispc7: Add conversion modes to argb8888_to_argb12121212()
  drm/tidss: Add skeleton code for custom crtc properties
  drm/tidss: Add missing dispc_ops->vp_setup() call to crtc_atomic_flush()
  drm/tidss: dispc7: Statically assign OLDI and DPI bus types to vp
  drm/tidss: Add missing static to dispc[67]_plane_feat() functions
  drm/tidss: dispc7: Drop entry print in dispc7_init() to dbg level
  drm/tidss: dispc7: Cleanup OVR handling

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch '2018.05LTS-tidss' into audio-display-ti-linux-4.14.y
Jyri Sarha [Thu, 18 Oct 2018 20:47:18 +0000 (23:47 +0300)]
Merge branch '2018.05LTS-tidss' into audio-display-ti-linux-4.14.y

drm/tidss changes for 2018.05

* 2018.05LTS-tidss:
  drm/tidss: dispc7: Remove double spaces from scaling code
  drm/tidss: dispc7: Simplify assignment of VP POL FREQ bits in vp_enable()
  drm/tidss: Add TI custom "background" color property and functionality
  drm/tidss: Add TI custom transparency key properties and functionality
  drm/tidss: dispc7: Add conversion modes to argb8888_to_argb12121212()
  drm/tidss: Add skeleton code for custom crtc properties
  drm/tidss: Add missing dispc_ops->vp_setup() call to crtc_atomic_flush()
  drm/tidss: dispc7: Statically assign OLDI and DPI bus types to vp
  drm/tidss: Add missing static to dispc[67]_plane_feat() functions
  drm/tidss: dispc7: Drop entry print in dispc7_init() to dbg level
  drm/tidss: dispc7: Cleanup OVR handling

2 years agodrm/tidss: dispc7: Remove double spaces from scaling code
Jyri Sarha [Fri, 12 Oct 2018 07:29:53 +0000 (10:29 +0300)]
drm/tidss: dispc7: Remove double spaces from scaling code

Remove double spaces from scaling code debug print command lines.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: dispc7: Simplify assignment of VP POL FREQ bits in vp_enable()
Jyri Sarha [Tue, 9 Oct 2018 21:12:19 +0000 (00:12 +0300)]
drm/tidss: dispc7: Simplify assignment of VP POL FREQ bits in vp_enable()

Replace if statements that assign DISPC_VP_POL_FREQ bits according to
struct drm_display_mode flags with more compact logical expressions.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: Add TI custom "background" color property and functionality
Jyri Sarha [Thu, 4 Oct 2018 10:21:57 +0000 (13:21 +0300)]
drm/tidss: Add TI custom "background" color property and functionality

Add TI custom "background" color property and functionality for both
DSS6 and DSS7. The property should work the same way as the same
property in omapdrm.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: Add TI custom transparency key properties and functionality
Jyri Sarha [Thu, 11 Oct 2018 11:46:36 +0000 (14:46 +0300)]
drm/tidss: Add TI custom transparency key properties and functionality

Add TI custom transparency key properties and functionality for
DSS7. The properties should work the same way as the same
properties in omapdrm.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: dispc7: Add conversion modes to argb8888_to_argb12121212()
Jyri Sarha [Tue, 16 Oct 2018 16:25:18 +0000 (19:25 +0300)]
drm/tidss: dispc7: Add conversion modes to argb8888_to_argb12121212()

Add selection for min, max, and replicate conversion modes for 8-bit
to 12-bit color format conversion. With the mode the caller can select
how the four least significant bits are generated.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: Add skeleton code for custom crtc properties
Jyri Sarha [Wed, 3 Oct 2018 13:32:44 +0000 (16:32 +0300)]
drm/tidss: Add skeleton code for custom crtc properties

This patch does not add any working functionality, just callbacks
needed for custom properties.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: Add missing dispc_ops->vp_setup() call to crtc_atomic_flush()
Jyri Sarha [Thu, 11 Oct 2018 09:08:31 +0000 (12:08 +0300)]
drm/tidss: Add missing dispc_ops->vp_setup() call to crtc_atomic_flush()

The tidss->dispc_ops->vp_setup() should always be called in
tidss_crtc_atomic_flush(), even if the current implementation works
well without it. This patch adds the call.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/tidss: dispc7: Statically assign OLDI and DPI bus types to vp
Jyri Sarha [Wed, 19 Sep 2018 16:57:49 +0000 (19:57 +0300)]
drm/tidss: dispc7: Statically assign OLDI and DPI bus types to vp

This patch assigns statically OLDI and DPI bus types to video ports in
struct dispc7_features. Actually this was done already before, but
there was still some residual code allowing dynamic VP bus type
configuration. This patch removes all traces of the dynamic VP bus
type code.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agoMerge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel...
LCPD Auto Merger [Thu, 18 Oct 2018 13:27:36 +0000 (08:27 -0500)]
Merge branch 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree into ti-linux-4.14.y

TI-Feature: audio-display
TI-Tree: git@git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-4.14.y

* 'audio-display-ti-linux-4.14.y' of git.ti.com:~jyrisarha/ti-linux-kernel/jyrisarhas-audio-video-linux-feature-tree:
  arm64: dts: Add k3-am654-evm-tc358876.dtso
  arm64: dts: am654-base-board: add mcu_i2c0 pinmux
  ti_config_fragments: audio_display: add TC358767
  drm/omap: fix missing scaler pixel fmt limitations
  drm/omap: DMM: Fix interrupt request/free sequence during probe/remove
  drm/omap: fbdev: avoid double initializer entry
  drm/omap: fbdev: use 'screen_buffer' field
  drm/omap: acx565akm:  use __be32 when reading status

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
2 years agoMerge branch 'ti/4.14-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into...
Jyri Sarha [Thu, 18 Oct 2018 09:34:38 +0000 (12:34 +0300)]
Merge branch 'ti/4.14-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux into audio-display-ti-linux-4.14.y

2018.05 dss patches

* 'ti/4.14-pull' of https://bitbucket.itg.ti.com/scm/~a0400822/linux:
  arm64: dts: Add k3-am654-evm-tc358876.dtso
  arm64: dts: am654-base-board: add mcu_i2c0 pinmux
  ti_config_fragments: audio_display: add TC358767
  drm/omap: fix missing scaler pixel fmt limitations
  drm/omap: fbdev: avoid double initializer entry
  drm/omap: fbdev: use 'screen_buffer' field
  drm/omap: acx565akm:  use __be32 when reading status

2 years agoMerge branch 'peter/ti-linux-4.14.y/topic/display' of https://github.com/omap-audio...
Jyri Sarha [Thu, 18 Oct 2018 09:33:20 +0000 (12:33 +0300)]
Merge branch 'peter/ti-linux-4.14.y/topic/display' of https://github.com/omap-audio/linux-audio into audio-display-ti-linux-4.14.y

2018.05 - Fix DMM crash on module removal

* 'peter/ti-linux-4.14.y/topic/display' of https://github.com/omap-audio/linux-audio:
  drm/omap: DMM: Fix interrupt request/free sequence during probe/remove

2 years agoarm64: dts: Add k3-am654-evm-tc358876.dtso
Tomi Valkeinen [Fri, 5 Oct 2018 10:26:16 +0000 (13:26 +0300)]
arm64: dts: Add k3-am654-evm-tc358876.dtso

Add support for Toshiba TC358876 based expansion board for AM6 EVM. The
expansion board has a DisplayPort 1.1 output with 2 lanes.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agoarm64: dts: am654-base-board: add mcu_i2c0 pinmux
Tomi Valkeinen [Fri, 5 Oct 2018 10:25:38 +0000 (13:25 +0300)]
arm64: dts: am654-base-board: add mcu_i2c0 pinmux

Add mcu_i2c0 pinmux.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Acked-by: Sekhar Nori <nsekhar@ti.com>
2 years agoti_config_fragments: audio_display: add TC358767
Tomi Valkeinen [Thu, 11 Oct 2018 11:07:30 +0000 (14:07 +0300)]
ti_config_fragments: audio_display: add TC358767

Enable TC358767 DisplayPort bridge.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/omap: fix missing scaler pixel fmt limitations
Tomi Valkeinen [Tue, 16 Oct 2018 10:22:09 +0000 (13:22 +0300)]
drm/omap: fix missing scaler pixel fmt limitations

OMAP2 and OMAP3/AM4 have limitations with the scaler:
- OMAP2 can only scale XRGB8888
- OMAP3/AM4 can only scale XRGB8888, RGB565, YUYV and UYVY

The driver doesn't check these limitations, which leads to sync-lost
floods.

This patch adds a check for the pixel formats when scaling.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2 years agodrm/omap: DMM: Fix interrupt request/free sequence during probe/remove
Peter Ujfalusi [Fri, 21 Sep 2018 13:06:00 +0000 (16:06 +0300)]
drm/omap: DMM: Fix interrupt request/free sequence during probe/remove

The interrupts should be enabled after the driver initialization to avoid
early interrupts while the driver is not yet ready to handle them.

On removal the interrupts must be disabled before other resources are
released, freed up.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
2 years agoLinux 4.14.77
Greg Kroah-Hartman [Thu, 18 Oct 2018 07:16:28 +0000 (09:16 +0200)]
Linux 4.14.77

2 years agoperf tools: Fix snprint warnings for gcc 8
Jiri Olsa [Mon, 19 Mar 2018 08:29:01 +0000 (09:29 +0100)]
perf tools: Fix snprint warnings for gcc 8

commit 77f18153c080855e1c3fb520ca31a4e61530121d upstream.

With gcc 8 we get new set of snprintf() warnings that breaks the
compilation, one example:

  tests/mem.c: In function ‘check’:
  tests/mem.c:19:48: error: ‘%s’ directive output may be truncated writing \
        up to 99 bytes into a region of size 89 [-Werror=format-truncation=]
    snprintf(failure, sizeof failure, "unexpected %s", out);

The gcc docs says:

 To avoid the warning either use a bigger buffer or handle the
 function's return value which indicates whether or not its output
 has been truncated.

Given that all these warnings are harmless, because the code either
properly fails due to uncomplete file path or we don't care for
truncated output at all, I'm changing all those snprintf() calls to
scnprintf(), which actually 'checks' for the snprint return value so the
gcc stays silent.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Link: http://lkml.kernel.org/r/20180319082902.4518-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Ignat Korchagin <ignat@cloudflare.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoARM: spectre-v1: mitigate user accesses
Russell King [Mon, 15 Oct 2018 15:32:18 +0000 (11:32 -0400)]
ARM: spectre-v1: mitigate user accesses

Commit a3c0f84765bb429ba0fd23de1c57b5e1591c9389 upstream.

Spectre variant 1 attacks are about this sequence of pseudo-code:

index = load(user-manipulated pointer);
access(base + index * stride);

In order for the cache side-channel to work, the access() must me made
to memory which userspace can detect whether cache lines have been
loaded.  On 32-bit ARM, this must be either user accessible memory, or
a kernel mapping of that same user accessible memory.

The problem occurs when the load() speculatively loads privileged data,
and the subsequent access() is made to user accessible memory.

Any load() which makes use of a user-maniplated pointer is a potential
problem if the data it has loaded is used in a subsequent access.  This
also applies for the access() if the data loaded by that access is used
by a subsequent access.

Harden the get_user() accessors against Spectre attacks by forcing out
of bounds addresses to a NULL pointer.  This prevents get_user() being
used as the load() step above.  As a side effect, put_user() will also
be affected even though it isn't implicated.

Also harden copy_from_user() by redoing the bounds check within the
arm_copy_from_user() code, and NULLing the pointer if out of bounds.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2 years agoARM: spectre-v1: use get_user() for __get_user()
Russell King [Mon, 15 Oct 2018 15:32:17 +0000 (11:32 -0400)]
ARM: spectre-v1: use get_user() for __get_user()

Commit b1cd0a14806321721aae45f5446ed83a3647c914 upstream.

Fixing __get_user() for spectre variant 1 is not sane: we would have to
add address space bounds checking in order to validate that the location
should be accessed, and then zero the address if found to be invalid.

Since __get_user() is supposed to avoid the bounds check, and this is
exactly what get_user() does, there's no point having two different
implementations that are doing the same thing.  So, when the Spectre
workarounds are required, make __get_user() an alias of get_user().

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>