ti-linux-kernel/ti-linux-kernel-next.git
4 years agoMerge branch 'v4.4/topic/optee' of http://git.linaro.org/kernel/linux-linaro-stable... ti-lsk-linux-4.4.y-next ti-lsk-linux-4.4.y-next-20160801
Dan Murphy [Mon, 1 Aug 2016 19:31:02 +0000 (14:31 -0500)]
Merge branch 'v4.4/topic/optee' of git.linaro.org/kernel/linux-linaro-stable into ti-lsk-linux-4.4.y-next

TI-Feature: linaro_optee_topic
TI-Tree: http://git.linaro.org/kernel/linux-linaro-stable.git
TI-Branch: v4.4/topic/optee

* 'v4.4/topic/optee' of http://git.linaro.org/kernel/linux-linaro-stable:
  [v10 delta] tee: add OP-TEE driver
  [v10 delta] tee: generic TEE subsystem
  Documentation: tee subsystem and op-tee driver
  tee: add OP-TEE driver
  tee: generic TEE subsystem
  dt/bindings: add bindings for optee
  ARM: 8480/2: arm64: add implementation for arm-smccc
  ARM: 8479/2: add implementation for arm-smccc
  ARM: 8478/2: arm/arm64: add arm-smccc

Signed-off-by: Dan Murphy <dmurphy@ti.com>
# Conflicts:
# drivers/firmware/Kconfig

4 years agoMerge branch 'ti-linux-4.4.y-next' of git.ti.com:ti-linux-kernel/ti-linux-kernel...
Dan Murphy [Mon, 1 Aug 2016 19:30:12 +0000 (14:30 -0500)]
Merge branch 'ti-linux-4.4.y-next' of git.ti.com:ti-linux-kernel/ti-linux-kernel-next into ti-lsk-linux-4.4.y-next

TI-Feature: ti_linux_base_lsk
TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel-next.git
TI-Branch: ti-linux-4.4.y-next

* 'ti-linux-4.4.y-next' of git.ti.com:ti-linux-kernel/ti-linux-kernel-next: (53 commits)
  mmc: host: omap_hsmmc: Fix ADMAE_EN to point to the correct bit field
  mmc: host: omap_hsmmc: set 'valid' bit for the last descriptor
  mmc: host: omap_hsmmc: unmap sg list for non block adma transfers
  ARM: OMAP2+: omap_device: fix crash on omap_device removal
  drivers: net: cpsw: use of_platform_depopulate()
  drivers: net: cpsw: fix wrong regs access in cpsw_remove
  net: ethernet: ti: cpdma: fix lockup in cpdma_ctlr_destroy()
  [debug] cpsw module
  [hack] disable kmemleak
  Documentation: DT: net: cpsw: remove no_bd_ram property
  drivers: net: cpsw: add support for descs_pool_size dt property
  Documentation: DT: net: cpsw: allow to specify buffer descriptors pool size
  drivers: net: cpsw: use devm_ioremap
  drivers: net: cpsw: minimize number of parameter in cpdma_desc_pool_create/destroy()
  net: ethernet: ti: cpdma: fix desc re-queuing
  HACK: net: ethernet: ti: cpdma: am437x: allow descs to be plased in ddr
  iio: adc: ti_am335x_adc: Increase timeout value waiting for ADC sample.
  iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access
  ARM: dts: dra72-evm-common: Add aliases for audio cards
  ARM: dts: dra7-evm: Add aliases for audio cards
  ...

Signed-off-by: Dan Murphy <dmurphy@ti.com>
4 years agoMerge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into... ti2016.03-rc1
LCPD Auto Merger [Mon, 1 Aug 2016 11:07:37 +0000 (06:07 -0500)]
Merge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into ti-lsk-linux-4.4.y

TI-Feature: ti_linux_base_lsk
TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y

* 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel:
  ARM: dts: am57xx-idk-common: Enable support for QSPI

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'connectivity-ti-linux-4.4.y' of git://git.ti.com/connectivity-integrati... ti2016.03-rc1-int
LCPD Auto Merger [Mon, 1 Aug 2016 10:18:20 +0000 (05:18 -0500)]
Merge branch 'connectivity-ti-linux-4.4.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-4.4.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-4.4.y

* 'connectivity-ti-linux-4.4.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: am57xx-idk-common: Enable support for QSPI

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'peter/ti-linux-4.4.y/for-next' of https://github.com/omap-audio/linux... ti-linux-4.4.y-next-20160801
LCPD Auto Merger [Mon, 1 Aug 2016 07:54:24 +0000 (02:54 -0500)]
Merge branch 'peter/ti-linux-4.4.y/for-next' of https://github.com/omap-audio/linux-audio into ti-linux-4.4.y-next

TI-Feature: ujfalusi_next
TI-Tree: https://github.com/omap-audio/linux-audio.git
TI-Branch: peter/ti-linux-4.4.y/for-next

* 'peter/ti-linux-4.4.y/for-next' of https://github.com/omap-audio/linux-audio:
  ARM: dts: dra72-evm-common: Add aliases for audio cards
  ARM: dts: dra7-evm: Add aliases for audio cards
  ARM: dts: am57xx-beagle-x15-common: Add aliases for audio cards

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'ti-linux-4.4.y-for-next' of git://git.ti.com/~gragst/ti-linux-kernel...
LCPD Auto Merger [Mon, 1 Aug 2016 07:54:14 +0000 (02:54 -0500)]
Merge branch 'ti-linux-4.4.y-for-next' of git://git.ti.com/~gragst/ti-linux-kernel/gragsts-ti-linux-kernel into ti-linux-4.4.y-next

TI-Feature: gragsts_next
TI-Tree: git://git.ti.com/~gragst/ti-linux-kernel/gragsts-ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y-for-next

* 'ti-linux-4.4.y-for-next' of git://git.ti.com/~gragst/ti-linux-kernel/gragsts-ti-linux-kernel:
  ARM: OMAP2+: omap_device: fix crash on omap_device removal
  drivers: net: cpsw: use of_platform_depopulate()
  drivers: net: cpsw: fix wrong regs access in cpsw_remove
  net: ethernet: ti: cpdma: fix lockup in cpdma_ctlr_destroy()
  [debug] cpsw module
  [hack] disable kmemleak
  Documentation: DT: net: cpsw: remove no_bd_ram property
  drivers: net: cpsw: add support for descs_pool_size dt property
  Documentation: DT: net: cpsw: allow to specify buffer descriptors pool size
  drivers: net: cpsw: use devm_ioremap
  drivers: net: cpsw: minimize number of parameter in cpdma_desc_pool_create/destroy()
  net: ethernet: ti: cpdma: fix desc re-queuing
  HACK: net: ethernet: ti: cpdma: am437x: allow descs to be plased in ddr
  bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
  bus: omap_l3_noc: do not disable l3 irqs in suspend
  ARM: dts: am57xx-evm-common: remove duplicate i2c5 entry
  i2c/omap: drop the lock hard irq context
  usb: gadget: udc-core: remove manual dma configuration
  clk: ti: dra7: fix kernel boot with arg 'clocksource=gp_timer'

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'mugunthan-next' of git://git.ti.com/~mugunthanvnm/ti-linux-kernel/linux...
LCPD Auto Merger [Mon, 1 Aug 2016 07:54:07 +0000 (02:54 -0500)]
Merge branch 'mugunthan-next' of git://git.ti.com/~mugunthanvnm/ti-linux-kernel/linux into ti-linux-4.4.y-next

TI-Feature: mugunthan_next
TI-Tree: git://git.ti.com/~mugunthanvnm/ti-linux-kernel/linux.git
TI-Branch: mugunthan-next

* 'mugunthan-next' of git://git.ti.com/~mugunthanvnm/ti-linux-kernel/linux: (23 commits)
  iommu/omap: fix a build warning in OMAP IOMMU header file
  remoteproc/omap: fix build warnings for !CONFIG_PM_SLEEP
  ARM: omap: timers: reduce rating of gp_timer clocksource
  clocksource: kconfig: allow to select arm global timer manually
  clocksource/drivers/arm_global_timer: Fix suspend resume
  ti_config_fragments: Add android config options to the defconfig_map
  ti_config_frags: defconfig_builder: Exit if fragments do not exist
  ti_config_fragments: Add SDK release defconfig options
  ti_config_fragments: Fix defconfig_map for dra7 builds
  dts: dra7: mcasp updtaes from upstream
  hwmod: dra7: mcasp updates from upstream
  dmaengine: omap-dma: Do not suppress interrupts for memcpy
  media: omap3isp: Use dma_request_chan() to requesting DMA channel
  ASoC: davinci-mcasp: dai format runtime reconfiguration
  ASoC: davinci-mcasp: Add workaround for errata i868 (dra7xx family)
  ASoC: davinci-mcasp: HACK interface to handle dra7-evm's i2c2/HDMI mux
  ASoC: simple-card: Support for selecting system clocks by ID
  ASoC: simple-card: Add system-clock-direction DT parameter to dai nodes
  ASoC: davinci-mcasp: Improve the sysclk selection
  ASoC: davinci-mcasp: Use defines for clkdiv IDs via DT binding header
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'for-next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux...
LCPD Auto Merger [Mon, 1 Aug 2016 07:53:57 +0000 (02:53 -0500)]
Merge branch 'for-next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel into ti-linux-4.4.y-next

TI-Feature: sekhar_next
TI-Tree: git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel.git
TI-Branch: for-next

* 'for-next' of git://git.ti.com/~nsekhar/ti-linux-kernel/nsekhar-ti-linux-kernel:
  usb: phy: phy-am335x: bypass first VBUS sensing for host-only mode
  usb: phy: correct the am335x phy header filename
  usb: of: add an api to get dr_mode by the phy node

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'for-next' of git://git.ti.com/linux-phy/kishons-ti-linux-kernel into...
LCPD Auto Merger [Mon, 1 Aug 2016 07:53:51 +0000 (02:53 -0500)]
Merge branch 'for-next' of git://git.ti.com/linux-phy/kishons-ti-linux-kernel into ti-linux-4.4.y-next

TI-Feature: kishon_next
TI-Tree: git://git.ti.com/linux-phy/kishons-ti-linux-kernel.git
TI-Branch: for-next

* 'for-next' of git://git.ti.com/linux-phy/kishons-ti-linux-kernel:
  mmc: host: omap_hsmmc: Fix ADMAE_EN to point to the correct bit field
  mmc: host: omap_hsmmc: set 'valid' bit for the last descriptor
  mmc: host: omap_hsmmc: unmap sg list for non block adma transfers

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'ti-linux-4.4.y-for-next' of git://git.ti.com/~vigneshr/ti-linux-kernel...
LCPD Auto Merger [Mon, 1 Aug 2016 07:53:50 +0000 (02:53 -0500)]
Merge branch 'ti-linux-4.4.y-for-next' of git://git.ti.com/~vigneshr/ti-linux-kernel/vigneshr-ti-linux-kernel into ti-linux-4.4.y-next

TI-Feature: vignesh_next
TI-Tree: git://git.ti.com/~vigneshr/ti-linux-kernel/vigneshr-ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y-for-next

* 'ti-linux-4.4.y-for-next' of git://git.ti.com/~vigneshr/ti-linux-kernel/vigneshr-ti-linux-kernel:
  iio: adc: ti_am335x_adc: Increase timeout value waiting for ADC sample.
  iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'linux-linaro-lsk-v4.4' of http://git.linaro.org/kernel/linux-linaro...
LCPD Auto Merger [Fri, 29 Jul 2016 21:06:16 +0000 (16:06 -0500)]
Merge branch 'linux-linaro-lsk-v4.4' of git.linaro.org/kernel/linux-linaro-stable into ti-lsk-linux-4.4.y

TI-Feature: linaro-stable-4-4
TI-Tree: http://git.linaro.org/kernel/linux-linaro-stable.git
TI-Branch: linux-linaro-lsk-v4.4

* 'linux-linaro-lsk-v4.4' of http://git.linaro.org/kernel/linux-linaro-stable:
  arm64: kaslr: increase randomization granularity
  arm64: relocatable: deal with physically misaligned kernel images
  arm64: don't map TEXT_OFFSET bytes below the kernel if we can avoid it
  arm64: kernel: replace early 64-bit literal loads with move-immediates
  arm64: introduce mov_q macro to move a constant into a 64-bit register
  arm64: kernel: perform relocation processing from ID map
  arm64: kernel: use literal for relocated address of __secondary_switched
  arm64: kernel: don't export local symbols from head.S
  arm64: simplify kernel segment mapping granularity
  arm64: cover the .head.text section in the .text segment mapping
  arm64: move early boot code to the .init segment
  arm64: use 'segment' rather than 'chunk' to describe mapped kernel regions
  arm64: mm: Mark .rodata as RO

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge tag 'v4.4.16' into linux-linaro-lsk-v4.4 lsk-v4.4-16.07
Mark Brown [Fri, 29 Jul 2016 20:38:36 +0000 (21:38 +0100)]
Merge tag 'v4.4.16' into linux-linaro-lsk-v4.4

This is the 4.4.16 stable release

# gpg: Signature made Wed 27 Jul 2016 17:48:38 BST using RSA key ID 6092693E
# gpg: requesting key 6092693E from hkp server the.earth.li
# gpg: key 6092693E: public key "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>" imported
# gpg: public key of ultimately trusted key B4B0BED6 not found
# gpg: 2 marginal(s) needed, 1 complete(s) needed, PGP trust model
# gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
# gpg: Total number processed: 1
# gpg:               imported: 1  (RSA: 1)
# gpg: Good signature from "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E

4 years agoMerge remote-tracking branch 'lsk/v4.4/topic/mm-kaslr' into linux-linaro-lsk-v4.4
Mark Brown [Fri, 29 Jul 2016 20:33:51 +0000 (21:33 +0100)]
Merge remote-tracking branch 'lsk/v4.4/topic/mm-kaslr' into linux-linaro-lsk-v4.4

4 years agoarm64: kaslr: increase randomization granularity
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:48 +0000 (17:09 +0200)]
arm64: kaslr: increase randomization granularity

Currently, our KASLR implementation randomizes the placement of the core
kernel at 2 MB granularity. This is based on the arm64 kernel boot
protocol, which mandates that the kernel is loaded TEXT_OFFSET bytes above
a 2 MB aligned base address. This requirement is a result of the fact that
the block size used by the early mapping code may be 2 MB at the most (for
a 4 KB granule kernel)

But we can do better than that: since a KASLR kernel needs to be relocated
in any case, we can tolerate a physical misalignment as long as the virtual
misalignment relative to this 2 MB block size is equal in size, and code to
deal with this is already in place.

Since we align the kernel segments to 64 KB, let's randomize the physical
offset at 64 KB granularity as well (unless CONFIG_DEBUG_ALIGN_RODATA is
enabled). This way, the page table and TLB footprint is not affected.

The higher granularity allows for 5 bits of additional entropy to be used.

Reviewed-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 6f26b3671184c36d07eb5d61ba9a6d0aeb583c5d)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: relocatable: deal with physically misaligned kernel images
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:47 +0000 (17:09 +0200)]
arm64: relocatable: deal with physically misaligned kernel images

When booting a relocatable kernel image, there is no practical reason
to refuse an image whose load address is not exactly TEXT_OFFSET bytes
above a 2 MB aligned base address, as long as the physical and virtual
misalignment with respect to the swapper block size are equal, and are
both aligned to THREAD_SIZE.

Since the virtual misalignment is under our control when we first enter
the kernel proper, we can simply choose its value to be equal to the
physical misalignment.

So treat the misalignment of the physical load address as the initial
KASLR offset, and fix up the remaining code to deal with that.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 08cdac619c81b3fa8cd73aeed2330ffe0a0b73ca)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: don't map TEXT_OFFSET bytes below the kernel if we can avoid it
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:46 +0000 (17:09 +0200)]
arm64: don't map TEXT_OFFSET bytes below the kernel if we can avoid it

For historical reasons, the kernel Image must be loaded into physical
memory at a 512 KB offset above a 2 MB aligned base address. The region
between the base address and the start of the kernel Image has no
significance to the kernel itself, but it is currently mapped explicitly
into the early kernel VMA range for all translation granules.

In some cases (i.e., 4 KB granule), this is unavoidable, due to the 2 MB
granularity of the early kernel mappings. However, in other cases, e.g.,
when running with larger page sizes, or in the future, with more granular
KASLR, there is no reason to map it explicitly like we do currently.

So update the logic so that the region is mapped only if that happens as
a side effect of rounding the start address of the kernel to swapper block
size, and leave it unmapped otherwise.

Since the symbol kernel_img_size now simply resolves to the memory
footprint of the kernel Image, we can drop its definition from image.h
and opencode its calculation.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 18b9c0d641938242d8bcdba3c14a8f2beec2a97e)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: kernel: replace early 64-bit literal loads with move-immediates
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:45 +0000 (17:09 +0200)]
arm64: kernel: replace early 64-bit literal loads with move-immediates

When building a relocatable kernel, we currently rely on the fact that
early 64-bit literal loads need to be deferred to after the relocation
has been performed only if they involve symbol references, and not if
they involve assemble time constants. While this is not an unreasonable
assumption to make, it is better to switch to movk/movz sequences, since
these are guaranteed to be resolved at link time, simply because there are
no dynamic relocation types to describe them.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit b03cc885328e3c0de61843737d42eb0a0f112aab)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: introduce mov_q macro to move a constant into a 64-bit register
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:44 +0000 (17:09 +0200)]
arm64: introduce mov_q macro to move a constant into a 64-bit register

Implement a macro mov_q that can be used to move an immediate constant
into a 64-bit register, using between 2 and 4 movz/movk instructions
(depending on the operand)

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 30b5ba5cf333cc650e474eaf2cc1ae91bc7cf89f)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: kernel: perform relocation processing from ID map
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:43 +0000 (17:09 +0200)]
arm64: kernel: perform relocation processing from ID map

Refactor the relocation processing so that the code executes from the
ID map while accessing the relocation tables via the virtual mapping.
This way, we can use literals containing virtual addresses as before,
instead of having to use convoluted absolute expressions.

For symmetry with the secondary code path, the relocation code and the
subsequent jump to the virtual entry point are implemented in a function
called __primary_switch(), and __mmap_switched() is renamed to
__primary_switched(). Also, the call sequence in stext() is aligned with
the one in secondary_startup(), by replacing the awkward 'adr_l lr' and
'b cpu_setup' sequence with a simple branch and link.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 0cd3defe0af4153ffc5fe39bcfa4abfc301984e9)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: kernel: use literal for relocated address of __secondary_switched
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:42 +0000 (17:09 +0200)]
arm64: kernel: use literal for relocated address of __secondary_switched

We can simply use a relocated 64-bit literal to store the address of
__secondary_switched(), and the relocation code will ensure that it
holds the correct value at secondary entry time, as long as we make sure
that the literal is not dereferenced until after we have enabled the MMU.

So jump via a small __secondary_switch() function covered by the ID map
that performs the literal load and branch-to-register.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit e5ebeec879b726c755af0c1c15f3699b53268cd5)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: kernel: don't export local symbols from head.S
Ard Biesheuvel [Mon, 18 Apr 2016 15:09:41 +0000 (17:09 +0200)]
arm64: kernel: don't export local symbols from head.S

This unexports some symbols from head.S that are only used locally.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 190c056fc32a528979807cb5d5a0d68285933073)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: simplify kernel segment mapping granularity
Ard Biesheuvel [Wed, 30 Mar 2016 15:43:09 +0000 (17:43 +0200)]
arm64: simplify kernel segment mapping granularity

The mapping of the kernel consist of four segments, each of which is mapped
with different permission attributes and/or lifetimes. To optimize the TLB
and translation table footprint, we define various opaque constants in the
linker script that resolve to different aligment values depending on the
page size and whether CONFIG_DEBUG_ALIGN_RODATA is set.

Considering that
- a 4 KB granule kernel benefits from a 64 KB segment alignment (due to
  the fact that it allows the use of the contiguous bit),
- the minimum alignment of the .data segment is THREAD_SIZE already, not
  PAGE_SIZE (i.e., we already have padding between _data and the start of
  the .data payload in many cases),
- 2 MB is a suitable alignment value on all granule sizes, either for
  mapping directly (level 2 on 4 KB), or via the contiguous bit (level 3 on
  16 KB and 64 KB),
- anything beyond 2 MB exceeds the minimum alignment mandated by the boot
  protocol, and can only be mapped efficiently if the physical alignment
  happens to be the same,

we can simplify this by standardizing on 64 KB (or 2 MB) explicitly, i.e.,
regardless of granule size, all segments are aligned either to 64 KB, or to
2 MB if CONFIG_DEBUG_ALIGN_RODATA=y. This also means we can drop the Kconfig
dependency of CONFIG_DEBUG_ALIGN_RODATA on CONFIG_ARM64_4K_PAGES.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 97740051dd31d200a0efaa84544fe5e4713aac40)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: cover the .head.text section in the .text segment mapping
Ard Biesheuvel [Wed, 30 Mar 2016 15:43:08 +0000 (17:43 +0200)]
arm64: cover the .head.text section in the .text segment mapping

Keeping .head.text out of the .text mapping buys us very little: its actual
payload is only 4 KB, most of which is padding, but the page alignment may
add up to 2 MB (in case of CONFIG_DEBUG_ALIGN_RODATA=y) of additional
padding to the uncompressed kernel Image.

Also, on 4 KB granule kernels, the 4 KB misalignment of .text forces us to
map the adjacent 56 KB of code without the PTE_CONT attribute, and since
this region contains things like the vector table and the GIC interrupt
handling entry point, this region is likely to benefit from the reduced TLB
pressure that results from PTE_CONT mappings.

So remove the alignment between the .head.text and .text sections, and use
the [_text, _etext) rather than the [_stext, _etext) interval for mapping
the .text segment.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 7eb90f2ff7e3ee814ff12f3cd909b965cdd4a869)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: move early boot code to the .init segment
Ard Biesheuvel [Wed, 30 Mar 2016 15:43:07 +0000 (17:43 +0200)]
arm64: move early boot code to the .init segment

Apart from the arm64/linux and EFI header data structures, there is nothing
in the .head.text section that must reside at the beginning of the Image.
So let's move it to the .init section where it belongs.

Note that this involves some minor tweaking of the EFI header, primarily
because the address of 'stext' no longer coincides with the start of the
.text section. It also requires a couple of relocated symbol references
to be slightly rewritten or their definition moved to the linker script.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 546c8c44f092b2f23291fe499c221efc8cabbb67)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: use 'segment' rather than 'chunk' to describe mapped kernel regions
Ard Biesheuvel [Wed, 30 Mar 2016 15:43:06 +0000 (17:43 +0200)]
arm64: use 'segment' rather than 'chunk' to describe mapped kernel regions

Replace the poorly defined term chunk with segment, which is a term that is
already used by the ELF spec to describe contiguous mappings with the same
permission attributes of statically allocated ranges of an executable.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 2c09ec06bc39fc85a2b3856524348c301def27af)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoarm64: mm: Mark .rodata as RO
Jeremy Linton [Fri, 19 Feb 2016 17:50:32 +0000 (11:50 -0600)]
arm64: mm: Mark .rodata as RO

Currently the .rodata section is actually still executable when DEBUG_RODATA
is enabled. This changes that so the .rodata is actually read only, no execute.
It also adds the .rodata section to the mem_init banner.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
[catalin.marinas@arm.com: added vm_struct vmlinux_rodata in map_kernel()]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 2f39b5f91eb4bccd786d194e70db1dccad784755)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
4 years agoMerge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into...
LCPD Auto Merger [Fri, 29 Jul 2016 14:56:42 +0000 (09:56 -0500)]
Merge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into ti-lsk-linux-4.4.y

TI-Feature: ti_linux_base_lsk
TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y

* 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel:
  ARM: dts: AM4372: Add PRUSS0 node
  remoteproc/pruss: add support for PRUSS0 on AM437x SoCs
  remoteproc/pruss: adapt AM437x PRUSS1 node to use PRUSS wrapper driver
  remoteproc/pruss: add a syscfg IP wrapper driver for AM437x SoCs
  remoteproc/pruss: introduce has_no_syscfg private data field

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'rpmsg-ti-linux-4.4.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti...
LCPD Auto Merger [Fri, 29 Jul 2016 14:31:31 +0000 (09:31 -0500)]
Merge branch 'rpmsg-ti-linux-4.4.y-intg' of git://git.ti.com/rpmsg/rpmsg into ti-linux-4.4.y

TI-Feature: rpmsg
TI-Tree: git://git.ti.com/rpmsg/rpmsg.git
TI-Branch: rpmsg-ti-linux-4.4.y-intg

* 'rpmsg-ti-linux-4.4.y-intg' of git://git.ti.com/rpmsg/rpmsg:
  ARM: dts: AM4372: Add PRUSS0 node
  remoteproc/pruss: add support for PRUSS0 on AM437x SoCs
  remoteproc/pruss: adapt AM437x PRUSS1 node to use PRUSS wrapper driver
  remoteproc/pruss: add a syscfg IP wrapper driver for AM437x SoCs
  remoteproc/pruss: introduce has_no_syscfg private data field

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoARM: dts: am57xx-idk-common: Enable support for QSPI
Vignesh R [Mon, 25 Jul 2016 08:04:12 +0000 (13:34 +0530)]
ARM: dts: am57xx-idk-common: Enable support for QSPI

AM571x and AM572x IDK have a spansion s25fl256s QSPI flash on the EVM
connected to TI QSPI IP over CS0. Hence, add QSPI and flash slave
DT nodes.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
4 years agommc: host: omap_hsmmc: Fix ADMAE_EN to point to the correct bit field
Kishon Vijay Abraham I [Fri, 29 Jul 2016 12:37:27 +0000 (18:07 +0530)]
mmc: host: omap_hsmmc: Fix ADMAE_EN to point to the correct bit field

commit f89bdb32ed44e ("mmc: host: omap_hsmmc: Enable ADMA2")
added support for ADMA2 in omap_hsmmc driver. But ADMAE_EN was
populated with an incorrect value resulting in none of the ADMA
error interrupts to be raised.
Fix it here by populating ADMAE_EN with the correct value.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
4 years agommc: host: omap_hsmmc: set 'valid' bit for the last descriptor
Kishon Vijay Abraham I [Fri, 29 Jul 2016 12:27:39 +0000 (17:57 +0530)]
mmc: host: omap_hsmmc: set 'valid' bit for the last descriptor

commit f89bdb32ed44e ("mmc: host: omap_hsmmc: Enable ADMA2")
while preparing the adma descriptor table for every mmc data
request did not set the 'valid' bit for the last descriptor or
end of descriptor. 'valid' bit should be set irrespective of
whether the descriptor contains valid address.
Fix it here by setting 'valid' bit in the last descriptor.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
4 years agommc: host: omap_hsmmc: unmap sg list for non block adma transfers
Kishon Vijay Abraham I [Fri, 29 Jul 2016 11:11:32 +0000 (16:41 +0530)]
mmc: host: omap_hsmmc: unmap sg list for non block adma transfers

dma_unmap_sg is not invoked for commands which has a data response
(like CMD51) if adma is not used. This results in MMC core not seeing
a valid data response for commands like CMD51 causing enumeration
failure. Fix it here by invoking dma_unmap_sg after transfer
complete interrupt is received.
For block data transfer commands dma_unmap_sg is invoked in post_req
callback (for both adma and s-dma). In the case of s-dma, for commands
like CMD51, dma_unmap_sg is invoked in dma_callback.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
4 years agoMerge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into...
LCPD Auto Merger [Fri, 29 Jul 2016 10:19:52 +0000 (05:19 -0500)]
Merge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into ti-lsk-linux-4.4.y

TI-Feature: ti_linux_base_lsk
TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y

* 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel:
  crypto: omap-aes: make queue length configurable
  crypto: omap-aes: make fallback size configurable
  crypto: omap-sham: make queue length configurable
  crypto: omap-sham: make fallback size configurable
  ARM: dts: k2e: add dts node for k2e hw_rng driver
  ARM: dts: k2l: add dts node for k2l hw_rng driver
  ARM: dts: k2hk: add dts node for k2hk hw_rng driver
  hw_random: keystone2: add hw_random driver
  Documentation: dt: rng: add bindings doc for Keystone SA HWRNG driver
  ti_config_fragments: keystone: fix reboot related config options
  ARM: dts: DRA7: Enable Timers 13 through 16

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoARM: OMAP2+: omap_device: fix crash on omap_device removal
Grygorii Strashko [Thu, 28 Jul 2016 10:48:35 +0000 (13:48 +0300)]
ARM: OMAP2+: omap_device: fix crash on omap_device removal

Below call chain causes system crash when OMAP device is
removed by calling of_platform_depopulate()/device_del():

device_del()
- blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
       BUS_NOTIFY_DEL_DEVICE, dev);
  - _omap_device_notifier_call()
    - omap_device_delete()
      - od->pdev->archdata.od = NULL;
kfree(od->hwmods);
kfree(od);
  - bus_remove_device()
    - device_release_driver()
      - __device_release_driver()
- pm_runtime_get_sync()
   - _od_runtime_resume()
     - omap_hwmod_enable() <- OOPS od's delted already

Backtrace:
Unable to handle kernel NULL pointer dereference at virtual address 0000000d
pgd = eb100000
[0000000d] *pgd=ad6e1831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
CPU: 1 PID: 1273 Comm: modprobe Not tainted 4.4.15-rt19-00115-ge4d3cd3-dirty #68
Hardware name: Generic DRA74X (Flattened Device Tree)
task: eb1ee800 ti: ec962000 task.ti: ec962000
PC is at omap_device_enable+0x10/0x90
LR is at _od_runtime_resume+0x10/0x24
[...]
[<c00299dc>] (omap_device_enable) from [<c0029a6c>] (_od_runtime_resume+0x10/0x24)
[<c0029a6c>] (_od_runtime_resume) from [<c04ad404>] (__rpm_callback+0x20/0x34)
[<c04ad404>] (__rpm_callback) from [<c04ad438>] (rpm_callback+0x20/0x80)
[<c04ad438>] (rpm_callback) from [<c04aee28>] (rpm_resume+0x48c/0x964)
[<c04aee28>] (rpm_resume) from [<c04af360>] (__pm_runtime_resume+0x60/0x88)
[<c04af360>] (__pm_runtime_resume) from [<c04a4974>] (__device_release_driver+0x30/0x100)
[<c04a4974>] (__device_release_driver) from [<c04a4a60>] (device_release_driver+0x1c/0x28)
[<c04a4a60>] (device_release_driver) from [<c04a38c0>] (bus_remove_device+0xec/0x144)
[<c04a38c0>] (bus_remove_device) from [<c04a0764>] (device_del+0x10c/0x210)
[<c04a0764>] (device_del) from [<c04a67b0>] (platform_device_del+0x18/0x84)
[<c04a67b0>] (platform_device_del) from [<c04a6828>] (platform_device_unregister+0xc/0x20)
[<c04a6828>] (platform_device_unregister) from [<c05adcfc>] (of_platform_device_destroy+0x8c/0x90)
[<c05adcfc>] (of_platform_device_destroy) from [<c04a02f0>] (device_for_each_child+0x4c/0x78)
[<c04a02f0>] (device_for_each_child) from [<c05adc5c>] (of_platform_depopulate+0x30/0x44)
[<c05adc5c>] (of_platform_depopulate) from [<bf123920>] (cpsw_remove+0x68/0xf4 [ti_cpsw])
[<bf123920>] (cpsw_remove [ti_cpsw]) from [<c04a68d8>] (platform_drv_remove+0x24/0x3c)
[<c04a68d8>] (platform_drv_remove) from [<c04a49c8>] (__device_release_driver+0x84/0x100)
[<c04a49c8>] (__device_release_driver) from [<c04a4b20>] (driver_detach+0xac/0xb0)
[<c04a4b20>] (driver_detach) from [<c04a3be8>] (bus_remove_driver+0x60/0xd4)
[<c04a3be8>] (bus_remove_driver) from [<c00d9870>] (SyS_delete_module+0x184/0x20c)
[<c00d9870>] (SyS_delete_module) from [<c0010540>] (ret_fast_syscall+0x0/0x1c)
Code: e3500000 e92d4070 1590630c 01a06000 (e5d6300d)

Hence, fix it by using BUS_NOTIFY_REMOVED_DEVICE event for OMAP device
deletion which is sent when DD has finished processing of device
deletion.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agodrivers: net: cpsw: use of_platform_depopulate()
Grygorii Strashko [Fri, 22 Jul 2016 13:26:08 +0000 (16:26 +0300)]
drivers: net: cpsw: use of_platform_depopulate()

Use of_platform_depopulate() in cpsw_remove() instead of
of_device_unregister(), because CSPW child devices will not be
recreated otherwise on next insmod. of_platform_depopulate() is
correct way now as it will ensure that all steps done in
of_platform_populate() are reverted, including cleaning up of
OF_POPULATED flag.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agodrivers: net: cpsw: fix wrong regs access in cpsw_remove
Grygorii Strashko [Fri, 22 Jul 2016 13:03:52 +0000 (16:03 +0300)]
drivers: net: cpsw: fix wrong regs access in cpsw_remove

The L3 error will be generated and system will crash during unloading
of CPSW driver if CPSW is used as module and ethX devices are down.
This happens because CPSW can be power off by PM runtime now when ethX
devices are down.

Hence, ensure that CPSW powered up by PM runtime before performing any
deinitialization actions which require CPSW registers access. In case
of PM runtime error just leave cpsw_remove() as we can't do anything
anymore.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agonet: ethernet: ti: cpdma: fix lockup in cpdma_ctlr_destroy()
Grygorii Strashko [Fri, 22 Jul 2016 11:51:36 +0000 (14:51 +0300)]
net: ethernet: ti: cpdma: fix lockup in cpdma_ctlr_destroy()

Fix deadlock in cpdma_ctlr_destroy() which is triggered now on
cpsw module removal:
 cpsw_remove()
 - cpdma_ctlr_destroy()
   - spin_lock_irqsave(&ctlr->lock, flags)
   - cpdma_ctlr_stop()
     - spin_lock_irqsave(&ctlr->lock, flags);
   - cpdma_chan_destroy()
     - spin_lock_irqsave(&ctlr->lock, flags);

The issue has not been observed before because CPDMA channels have
been destroyed manually by CPSW until commit d941ebe88a41 ("net:
ethernet: ti: cpsw: use destroy ctlr to destroy channels") was merged.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years ago[debug] cpsw module
Grygorii Strashko [Thu, 21 Jul 2016 12:17:55 +0000 (15:17 +0300)]
[debug] cpsw module

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years ago[hack] disable kmemleak
Grygorii Strashko [Thu, 21 Jul 2016 12:17:22 +0000 (15:17 +0300)]
[hack] disable kmemleak

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agoDocumentation: DT: net: cpsw: remove no_bd_ram property
Grygorii Strashko [Fri, 24 Jun 2016 14:43:31 +0000 (17:43 +0300)]
Documentation: DT: net: cpsw: remove no_bd_ram property

Even if no_bd_ram property is described in TI CPSW bindings the
support for it has never been introduced in CPSW driver, so there are
no real users of it. Hence, remove no_bd_ram property.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agodrivers: net: cpsw: add support for descs_pool_size dt property
Grygorii Strashko [Fri, 24 Jun 2016 14:08:47 +0000 (17:08 +0300)]
drivers: net: cpsw: add support for descs_pool_size dt property

The CPSW CPDMA can process buffer descriptors placed as in internal
CPPI RAM as in DDR. This patch adds support in CPSW and CPDMA for
descs_pool_size DT property, which defines total number of CPDMA CPPI
descriptors to be used for both ingress/egress packets processing:
 - memory size required for CPDMA descriptor pool is calculated basing
on number of descriptors specified by user in descs_pool_size and
CPDMA descriptor size;
 - allocate CPDMA descriptor pool in DDR if pool memory size >
internal CPPI RAM or use internal CPPI RAM otherwise;
 - if descs_pool_size not specified in DT - the default value 256 will
be used which will allow to place CPDMA descriptors pool into the
internal CPPI RAM (current default behaviour);
 - CPDMA will ignore descs_pool_size if descs_pool_size = 0 for
backward comaptiobility with davinci_emac.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agoDocumentation: DT: net: cpsw: allow to specify buffer descriptors pool size
Grygorii Strashko [Fri, 24 Jun 2016 14:00:23 +0000 (17:00 +0300)]
Documentation: DT: net: cpsw: allow to specify buffer descriptors pool size

Add optional property "descs_pool_size" to specify buffer descriptor's
pool size. The "descs_pool_size" should define total number of CPDMA
CPPI descriptors to be used for both ingress/egress packets
processing. If not specified - the default value 256 will be used
which will allow to place descriptor's pool into the internal CPPI
RAM.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agodrivers: net: cpsw: use devm_ioremap
Grygorii Strashko [Fri, 24 Jun 2016 12:47:46 +0000 (15:47 +0300)]
drivers: net: cpsw: use devm_ioremap

Use devm_ioremap() and simplify the code.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agodrivers: net: cpsw: minimize number of parameter in cpdma_desc_pool_create/destroy()
Grygorii Strashko [Fri, 24 Jun 2016 12:40:38 +0000 (15:40 +0300)]
drivers: net: cpsw: minimize number of parameter in cpdma_desc_pool_create/destroy()

Update cpdma_desc_pool_create/destroy() to accept only one parameter
struct cpdma_ctlr*, as this structure contains all required
information for pool creation/destruction.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agonet: ethernet: ti: cpdma: fix desc re-queuing
Grygorii Strashko [Fri, 24 Jun 2016 10:35:35 +0000 (13:35 +0300)]
net: ethernet: ti: cpdma: fix desc re-queuing

The currently processing cpdma descriptor with EOQ flag set may
contain two values in Next Descriptor Pointer field:
- valid pointer: means CPDMA missed addition of new desc in queue;
- null: no more descriptors in queue.
In the later case, it's not required to write to HDP register, but now
CPDMA does it.

Hence, add additional check for Next Descriptor Pointer != null in
cpdma_chan_process() function before writing in HDP register.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agoHACK: net: ethernet: ti: cpdma: am437x: allow descs to be plased in ddr
Grygorii Strashko [Fri, 24 Jun 2016 10:01:43 +0000 (13:01 +0300)]
HACK: net: ethernet: ti: cpdma: am437x: allow descs to be plased in ddr

HACK as I can't properly explain what's really going on between MPU,
CPSW and EMIF(DDR) on interconnect.

 It's observed that cpsw/cpdma are not working properly when CPPI
descriptors are placed in DDR instead of internal CPPI RAM on am437x
SoC:
- rx/tx silently stops processing packets;
- or - after boot it's working for sometime, but stuck once Network
load is increased (ping is working, but iperf is not).

Seems, somehow, the write to HDP register processed faster by
interconnect than writing of descriptor memory bufer in DDR :( So, to
fix this i come up with two changes:

1) all accesses to the channel register HDP/CP/RXFREE registers should
be done using sync IO accessors which seems pretty reasonable, because
all previous memory writes writes have to be completed before starting
channel (write to HDP) or completing desc processing.

2) for some reasons the only change 1 doesn't work and additional
reading of desc's field is required right after the new descriptor was
filled with data. (I've also tried to replace read with wmb(),
dma_wmb() - doesn't work).

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
4 years agoMerge branch 'platform-ti-linux-4.4.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
LCPD Auto Merger [Fri, 29 Jul 2016 08:51:40 +0000 (03:51 -0500)]
Merge branch 'platform-ti-linux-4.4.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-4.4.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-4.4.y

* 'platform-ti-linux-4.4.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  crypto: omap-aes: make queue length configurable
  crypto: omap-aes: make fallback size configurable
  crypto: omap-sham: make queue length configurable
  crypto: omap-sham: make fallback size configurable
  ARM: dts: k2e: add dts node for k2e hw_rng driver
  ARM: dts: k2l: add dts node for k2l hw_rng driver
  ARM: dts: k2hk: add dts node for k2hk hw_rng driver
  hw_random: keystone2: add hw_random driver
  Documentation: dt: rng: add bindings doc for Keystone SA HWRNG driver
  ti_config_fragments: keystone: fix reboot related config options
  ARM: dts: DRA7: Enable Timers 13 through 16

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge branch 'platform-ti-linux-4.4.y-golden' into platform-ti-linux-4.4.y-next
Tero Kristo [Fri, 29 Jul 2016 08:28:10 +0000 (11:28 +0300)]
Merge branch 'platform-ti-linux-4.4.y-golden' into platform-ti-linux-4.4.y-next

Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agocrypto: omap-aes: make queue length configurable
Tero Kristo [Tue, 26 Jul 2016 12:14:56 +0000 (15:14 +0300)]
crypto: omap-aes: make queue length configurable

Crypto driver queue size can now be configured from userspace. This
allows optimizing the queue usage based on use case. Default queue
size is still 10 entries.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agocrypto: omap-aes: make fallback size configurable
Tero Kristo [Tue, 26 Jul 2016 12:14:55 +0000 (15:14 +0300)]
crypto: omap-aes: make fallback size configurable

Crypto driver fallback size can now be configured from userspace. This
allows optimizing the DMA usage based on use case. Detault fallback
size of 200 is still used.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agocrypto: omap-sham: make queue length configurable
Tero Kristo [Tue, 26 Jul 2016 12:14:54 +0000 (15:14 +0300)]
crypto: omap-sham: make queue length configurable

Crypto driver queue size can now be configured from userspace. This
allows optimizing the queue usage based on use case. Default queue
size is still 10 entries.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agocrypto: omap-sham: make fallback size configurable
Tero Kristo [Tue, 26 Jul 2016 12:14:53 +0000 (15:14 +0300)]
crypto: omap-sham: make fallback size configurable

Crypto driver fallback size can now be configured from userspace. This
allows optimizing the DMA usage based on use case. Default fallback
size of 240 is still used.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agoARM: dts: k2e: add dts node for k2e hw_rng driver
Vitaly Andrianov [Wed, 27 Jul 2016 17:20:16 +0000 (13:20 -0400)]
ARM: dts: k2e: add dts node for k2e hw_rng driver

This patch adds dts node for k2e hw_random generator driver

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
[t-kristo@ti.com: added missing addresses from node identifiers]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agoARM: dts: k2l: add dts node for k2l hw_rng driver
Vitaly Andrianov [Wed, 27 Jul 2016 17:20:15 +0000 (13:20 -0400)]
ARM: dts: k2l: add dts node for k2l hw_rng driver

This patch adds dts node for k2l hw_random generator driver

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
[t-kristo@ti.com: added missing addresses from node identifiers]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agoARM: dts: k2hk: add dts node for k2hk hw_rng driver
Vitaly Andrianov [Wed, 27 Jul 2016 17:20:14 +0000 (13:20 -0400)]
ARM: dts: k2hk: add dts node for k2hk hw_rng driver

This patch adds dts node for k2hk hw_random generator driver

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
[t-kristo@ti.com: added missing addresses from node identifiers]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agohw_random: keystone2: add hw_random driver
Vitaly Andrianov [Wed, 27 Jul 2016 17:20:13 +0000 (13:20 -0400)]
hw_random: keystone2: add hw_random driver

Keystone Security Accelerator module has a hardware random generator
sub-module. This commit adds the driver for this sub-module.

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
[t-kristo@ti.com: dropped one unnecessary dev_err message]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
4 years agoDocumentation: dt: rng: add bindings doc for Keystone SA HWRNG driver
Vitaly Andrianov [Wed, 27 Jul 2016 17:20:12 +0000 (13:20 -0400)]
Documentation: dt: rng: add bindings doc for Keystone SA HWRNG driver

The Keystone SA module has a hardware random generator module.
This commit adds binding doc for the KS2 SA HWRNG driver.

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>
4 years agoti_config_fragments: keystone: fix reboot related config options
Murali Karicheri [Thu, 28 Jul 2016 17:13:30 +0000 (13:13 -0400)]
ti_config_fragments: keystone: fix reboot related config options

Recent work to use multi_v7_defconfig for Keystone caused reset controller
for keystone disabled in release builds. The reset controller on keystone
requires CONFIG_POWER_SUPPLY to be enabled as well. As this option is
needed on other platforms such as DRA71 to support GPIO reset driver, this
patch enables it in baseport.cfg. Also Enable CONFIG_POWER_RESET_KEYSTONE
in keystone.cfg to support reset driver. Since K2G uses a different reset
controller that doesn't depend on CONFIG_POWER_SUPPLY, disable the same in
k2g_only.cfg

Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
Tested-by: WingMan Kwok <w-kwok2@ti.com>
4 years agoARM: dts: DRA7: Enable Timers 13 through 16
Suman Anna [Wed, 27 Jul 2016 23:21:53 +0000 (18:21 -0500)]
ARM: dts: DRA7: Enable Timers 13 through 16

commit 722326c49e0dc2f5c0d4ccd7b69174a63a903e7c upstream.

The Timers 13 through 16 have been added previously in
disabled state. These timers are common timers that are
present on all DRA7 family of SoCs, so enable these
devices by default like the rest of the DMTimers.

Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
4 years agoMerge branch 'rpmsg-ti-linux-4.4.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti...
Suman Anna [Thu, 28 Jul 2016 21:40:28 +0000 (16:40 -0500)]
Merge branch 'rpmsg-ti-linux-4.4.y' of git://git.ti.com/rpmsg/rpmsg into rpmsg-ti-linux-4.4.y-intg

Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoMerge branch 'rproc-linux-4.4.y' of git://git.ti.com/rpmsg/remoteproc into rpmsg...
Suman Anna [Thu, 28 Jul 2016 21:23:49 +0000 (16:23 -0500)]
Merge branch 'rproc-linux-4.4.y' of git://git.ti.com/rpmsg/remoteproc into rpmsg-ti-linux-4.4.y

Pull in the updated remoteproc feature branch that adds the support
for the smaller PRUSS0 subsystem present on the AM437x SoCs. The
support is enabled through the introduction of a new PRUSS SYSCFG
IP wrapper driver module (am437x_pruss_wrapper.ko) for dealing with
the PRUSS IP integration intricacies on AM437x SoCs.

* 'rproc-linux-4.4.y' of git://git.ti.com/rpmsg/remoteproc:
  ARM: dts: AM4372: Add PRUSS0 node
  remoteproc/pruss: add support for PRUSS0 on AM437x SoCs
  remoteproc/pruss: adapt AM437x PRUSS1 node to use PRUSS wrapper driver
  remoteproc/pruss: add a syscfg IP wrapper driver for AM437x SoCs
  remoteproc/pruss: introduce has_no_syscfg private data field

Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoARM: dts: AM4372: Add PRUSS0 node
Suman Anna [Wed, 27 Jul 2016 15:28:36 +0000 (10:28 -0500)]
ARM: dts: AM4372: Add PRUSS0 node

The AM437x SoC has a second smaller PRU-ICSS subsystem (PRUSS0)
in addition to the primary PRUSS1 instance. The PRUSS0 has less
DRAM per PRU, and no Shared DRAM among other minor differences.

This PRUSS0 instance has a weird SoC integration. It shares the
same L3 OCP interconnect interface with PRUSS1, and also shares
its reset line and clocks. Any external accesses from PRUSS0
requires the PRUSS1's PRUSS_SYSCFG register to be programmed
properly. That said, it is its own IP instance (a cut-down version),
and so it has been added as an independent node (sibling node to
PRUSS1 node) and a child node of the AM437x PRUSS wrapper node.
This allows the PRUSS0 instance to be enabled/disabled
independently of the PRUSS1 instance.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoremoteproc/pruss: add support for PRUSS0 on AM437x SoCs
Suman Anna [Tue, 26 Jul 2016 21:01:05 +0000 (16:01 -0500)]
remoteproc/pruss: add support for PRUSS0 on AM437x SoCs

The AM437x SoC has a second smaller PRU-ICSS subsystem (PRUSS0)
in addition to the primary PRUSS1 instance. The PRUSS0 is another
instantiation of the IP, but is not identical to PRUSS1. It is
essentially a cut-down version of the IP, with less DRAM per PRU,
no Shared DRAM etc. It also does not have direct access to L3 bus
regions, there is a single interface to L3 for both PRUSS0 and
PRUSS1, and it would have to go through the PRUSS1's interface.
The PRUSS_SYSCFG register is reserved on PRUSS0, so any external
access requires the programming the corresponding PRUSS_SYSCFG
register in PRUSS1. It does have its own dedicated I/O lines
though. The is managed by the common AM437x PRUSS wrapper module
so that PRUSS1 and PRUSS0 can be independently supported.

The PRUSS remoteproc drivers have been enhanced to support this
smaller PRUSS0 instance using instance-specific data. There is
no PRU Ethernet support for this instance. The reset and the
L3 external access are managed by the common AM437x PRUSS wrapper
module so that PRUSS1 and PRUSS0 can be independently supported.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoremoteproc/pruss: adapt AM437x PRUSS1 node to use PRUSS wrapper driver
Suman Anna [Wed, 27 Jul 2016 20:16:50 +0000 (15:16 -0500)]
remoteproc/pruss: adapt AM437x PRUSS1 node to use PRUSS wrapper driver

The AM437x PRUSS1 node is currently added directly as a child node
under the OCP node. This node is now moved under a newly created
PRUSS wrapper node with the ti,hwmods property moved to the parent
wrapper node. Only the CFG module space is mapped into the PRUSS
wrapper node to save kernel vmalloc space.

The pdata-quirks that adds the reset pdata ops to the PRUSS1 device
are also moved to the PRUSS wrapper device, and the PRUSS platform
driver is updated with new state variables that skips the management
of resets and PRUSS_CFG.SYSCFG programming, as these are handled by
the AM437x PRUSS syscfg wrapper driver.

Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoremoteproc/pruss: add a syscfg IP wrapper driver for AM437x SoCs
Suman Anna [Tue, 26 Jul 2016 22:08:33 +0000 (17:08 -0500)]
remoteproc/pruss: add a syscfg IP wrapper driver for AM437x SoCs

The AM437x SoC has two PRU-ICSS instances - PRUSS1 and PRUSS0.
The PRUSS1 instance is very similar to that of the lone PRUSS
instance on AM335x SoC. The PRUSS0 is a cut-down version of the
IP, it has less DRAM per PRU, and no Shared DRAM, a few more I/O
lines among other minor differences.

This PRUSS0 shares a single L3 OCP interconnect interface with
PRUSS1, and also shares its reset line and clocks. Any PRUSS0
functionality requires the same reset line to be deasserted and
requires the PRUSS1's PRUSS_SYSCFG register to be programmed
properly if requiring any L3 access.

This patch introduces a PRUSS syscfg IP wrapper driver that
manages the common resets, clocks and the L3 external access
specifically for AM437x SoCs. This driver is also responsible
for creating the child PRUSS devices. The code looks similar
to some of the existing code in the PRUSS driver, but this
design allows the PRUSS1 and PRUSS0 instances to be managed
independently like on AM57xx or Keystone K2G SoCs.

This is a preparatory patch, and the next patch adapts the
existing AM437x PRUSS1 node and update the PRUSS platform driver
to use this architecture.

Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoremoteproc/pruss: introduce has_no_syscfg private data field
Suman Anna [Tue, 26 Jul 2016 19:49:41 +0000 (14:49 -0500)]
remoteproc/pruss: introduce has_no_syscfg private data field

The PRUSS_SYSCFG register is applicable only on SoCs using the
OCP interconnect methodology (so not applicable on Keystone K2G
SoCs). However, this register is also not applicable to PRUSS0
instance on AM437x SoCs even though the interconnect follows OCP.
So, make this a private data field that can be set in the instance
specific private data. The functionality around the skip_syscfg
state variable in the pruss structure is also replaced with this
field.

Signed-off-by: Suman Anna <s-anna@ti.com>
4 years agoMerge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into...
LCPD Auto Merger [Wed, 27 Jul 2016 18:10:38 +0000 (13:10 -0500)]
Merge branch 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into ti-lsk-linux-4.4.y

TI-Feature: ti_linux_base_lsk
TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel.git
TI-Branch: ti-linux-4.4.y

* 'ti-linux-4.4.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel: (147 commits)
  Linux 4.4.16
  ovl: verify upper dentry before unlink and rename
  drm/i915: Revert DisplayPort fast link training feature
  tmpfs: fix regression hang in fallocate undo
  tmpfs: don't undo fallocate past its last page
  crypto: qat - make qat_asym_algs.o depend on asn1 headers
  xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
  File names with trailing period or space need special case conversion
  cifs: dynamic allocation of ntlmssp blob
  Fix reconnect to not defer smb3 session reconnect long after socket reconnect
  53c700: fix BUG on untagged commands
  s390: fix test_fp_ctl inline assembly contraints
  scsi: fix race between simultaneous decrements of ->host_failed
  ovl: verify upper dentry in ovl_remove_and_whiteout()
  ovl: Copy up underlying inode's ->i_mode to overlay inode
  ARM: mvebu: fix HW I/O coherency related deadlocks
  ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
  ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
  ALSA: hda: add AMD Stoney PCI ID with proper driver caps
  ALSA: hda - fix use-after-free after module unload
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoMerge tag 'v4.4.16' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
LCPD Auto Merger [Wed, 27 Jul 2016 17:10:35 +0000 (12:10 -0500)]
Merge tag 'v4.4.16' of git./linux/kernel/git/stable/linux-stable into ti-linux-4.4.y

This is the 4.4.16 stable release

* tag 'v4.4.16' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (147 commits)
  Linux 4.4.16
  ovl: verify upper dentry before unlink and rename
  drm/i915: Revert DisplayPort fast link training feature
  tmpfs: fix regression hang in fallocate undo
  tmpfs: don't undo fallocate past its last page
  crypto: qat - make qat_asym_algs.o depend on asn1 headers
  xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
  File names with trailing period or space need special case conversion
  cifs: dynamic allocation of ntlmssp blob
  Fix reconnect to not defer smb3 session reconnect long after socket reconnect
  53c700: fix BUG on untagged commands
  s390: fix test_fp_ctl inline assembly contraints
  scsi: fix race between simultaneous decrements of ->host_failed
  ovl: verify upper dentry in ovl_remove_and_whiteout()
  ovl: Copy up underlying inode's ->i_mode to overlay inode
  ARM: mvebu: fix HW I/O coherency related deadlocks
  ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
  ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
  ALSA: hda: add AMD Stoney PCI ID with proper driver caps
  ALSA: hda - fix use-after-free after module unload
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
4 years agoLinux 4.4.16 v4.4.16
Greg Kroah-Hartman [Wed, 27 Jul 2016 16:48:30 +0000 (09:48 -0700)]
Linux 4.4.16

4 years agoovl: verify upper dentry before unlink and rename
Miklos Szeredi [Mon, 21 Mar 2016 16:31:44 +0000 (17:31 +0100)]
ovl: verify upper dentry before unlink and rename

commit 11f3710417d026ea2f4fcf362d866342c5274185 upstream.

Unlink and rename in overlayfs checked the upper dentry for staleness by
verifying upper->d_parent against upperdir.  However the dentry can go
stale also by being unhashed, for example.

Expand the verification to actually look up the name again (under parent
lock) and check if it matches the upper dentry.  This matches what the VFS
does before passing the dentry to filesytem's unlink/rename methods, which
excludes any inconsistency caused by overlayfs.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agodrm/i915: Revert DisplayPort fast link training feature
Mika Kahola [Mon, 20 Jun 2016 08:10:26 +0000 (11:10 +0300)]
drm/i915: Revert DisplayPort fast link training feature

commit 34511dce4b35685d3988d5c8b100d11a068db5bd upstream.

It has been found out that in some HW combination the DisplayPort
fast link training feature caused screen flickering. Let's revert
this feature for now until we can ensure that the feature works for
all platforms.

This is a manual revert of commits 5fa836a9d859 ("drm/i915: DP link
training optimization") and 4e96c97742f4 ("drm/i915: eDP link training
optimization").

Fixes: 5fa836a9d859 ("drm/i915: DP link training optimization")
Fixes: 4e96c97742f4 ("drm/i915: eDP link training optimization")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91393
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Mika Kahola <mika.kahola@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1466410226-19543-1-git-send-email-mika.kahola@intel.com
(cherry picked from commit 91df09d92ad82c8778ca218097bf827f154292ca)
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agotmpfs: fix regression hang in fallocate undo
Hugh Dickins [Sun, 10 Jul 2016 23:46:32 +0000 (16:46 -0700)]
tmpfs: fix regression hang in fallocate undo

commit 7f556567036cb7f89aabe2f0954b08566b4efb53 upstream.

The well-spotted fallocate undo fix is good in most cases, but not when
fallocate failed on the very first page.  index 0 then passes lend -1
to shmem_undo_range(), and that has two bad effects: (a) that it will
undo every fallocation throughout the file, unrestricted by the current
range; but more importantly (b) it can cause the undo to hang, because
lend -1 is treated as truncation, which makes it keep on retrying until
every page has gone, but those already fully instantiated will never go
away.  Big thank you to xfstests generic/269 which demonstrates this.

Fixes: b9b4bb26af01 ("tmpfs: don't undo fallocate past its last page")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agotmpfs: don't undo fallocate past its last page
Anthony Romano [Fri, 24 Jun 2016 21:48:43 +0000 (14:48 -0700)]
tmpfs: don't undo fallocate past its last page

commit b9b4bb26af017dbe930cd4df7f9b2fc3a0497bfe upstream.

When fallocate is interrupted it will undo a range that extends one byte
past its range of allocated pages.  This can corrupt an in-use page by
zeroing out its first byte.  Instead, undo using the inclusive byte
range.

Fixes: 1635f6a74152f1d ("tmpfs: undo fallocation on failure")
Link: http://lkml.kernel.org/r/1462713387-16724-1-git-send-email-anthony.romano@coreos.com
Signed-off-by: Anthony Romano <anthony.romano@coreos.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Cc: Brandon Philips <brandon@ifup.co>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agocrypto: qat - make qat_asym_algs.o depend on asn1 headers
Jan Stancek [Thu, 30 Jun 2016 10:23:51 +0000 (12:23 +0200)]
crypto: qat - make qat_asym_algs.o depend on asn1 headers

commit 81dc0365cfa7bc7c08a0e44d9ee04964df782e19 upstream.

Parallel build can sporadically fail because asn1 headers may
not be built yet by the time qat_asym_algs.o is compiled:
  drivers/crypto/qat/qat_common/qat_asym_algs.c:55:32: fatal error: qat_rsapubkey-asn1.h: No such file or directory
   #include "qat_rsapubkey-asn1.h"

Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoxen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
Jan Beulich [Fri, 8 Jul 2016 12:15:07 +0000 (06:15 -0600)]
xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7

commit 6f2d9d99213514360034c6d52d2c3919290b3504 upstream.

As of Xen 4.7 PV CPUID doesn't expose either of CPUID[1].ECX[7] and
CPUID[0x80000007].EDX[7] anymore, causing the driver to fail to load on
both Intel and AMD systems. Doing any kind of hardware capability
checks in the driver as a prerequisite was wrong anyway: With the
hypervisor being in charge, all such checking should be done by it. If
ACPI data gets uploaded despite some missing capability, the hypervisor
is free to ignore part or all of that data.

Ditch the entire check_prereq() function, and do the only valid check
(xen_initial_domain()) in the caller in its place.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoFile names with trailing period or space need special case conversion
Steve French [Thu, 23 Jun 2016 02:07:32 +0000 (21:07 -0500)]
File names with trailing period or space need special case conversion

commit 45e8a2583d97ca758a55c608f78c4cef562644d1 upstream.

POSIX allows files with trailing spaces or a trailing period but
SMB3 does not, so convert these using the normal Services For Mac
mapping as we do for other reserved characters such as
: < > | ? *
This is similar to what Macs do for the same problem over SMB3.

Signed-off-by: Steve French <steve.french@primarydata.com>
Acked-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agocifs: dynamic allocation of ntlmssp blob
Jerome Marchand [Thu, 26 May 2016 09:52:25 +0000 (11:52 +0200)]
cifs: dynamic allocation of ntlmssp blob

commit b8da344b74c822e966c6d19d6b2321efe82c5d97 upstream.

In sess_auth_rawntlmssp_authenticate(), the ntlmssp blob is allocated
statically and its size is an "empirical" 5*sizeof(struct
_AUTHENTICATE_MESSAGE) (320B on x86_64). I don't know where this value
comes from or if it was ever appropriate, but it is currently
insufficient: the user and domain name in UTF16 could take 1kB by
themselves. Because of that, build_ntlmssp_auth_blob() might corrupt
memory (out-of-bounds write). The size of ntlmssp_blob in
SMB2_sess_setup() is too small too (sizeof(struct _NEGOTIATE_MESSAGE)
+ 500).

This patch allocates the blob dynamically in
build_ntlmssp_auth_blob().

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoFix reconnect to not defer smb3 session reconnect long after socket reconnect
Steve French [Thu, 23 Jun 2016 01:12:05 +0000 (20:12 -0500)]
Fix reconnect to not defer smb3 session reconnect long after socket reconnect

commit 4fcd1813e6404dd4420c7d12fb483f9320f0bf93 upstream.

Azure server blocks clients that open a socket and don't do anything on it.
In our reconnect scenarios, we can reconnect the tcp session and
detect the socket is available but we defer the negprot and SMB3 session
setup and tree connect reconnection until the next i/o is requested, but
this looks suspicous to some servers who expect SMB3 negprog and session
setup soon after a socket is created.

In the echo thread, reconnect SMB3 sessions and tree connections
that are disconnected.  A later patch will replay persistent (and
resilient) handle opens.

Signed-off-by: Steve French <steve.french@primarydata.com>
Acked-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years ago53c700: fix BUG on untagged commands
James Bottomley [Tue, 14 Jun 2016 05:00:07 +0000 (22:00 -0700)]
53c700: fix BUG on untagged commands

commit 8beb330044d0d1878c7b92290e91c0b889e92633 upstream.

The untagged command case in the 53c700 driver has been broken since
host wide tags were enabled because the replaced scsi_find_tag()
function had a special case for the tag value SCSI_NO_TAG to retrieve
sdev->current_cmnd.  The replacement function scsi_host_find_tag() has
no such special case and returns NULL causing untagged commands to
trigger a BUG() in the driver.  Inspection shows that the 53c700 is the
only driver using this SCSI_NO_TAG case, so a local fix in the driver
suffices to fix this problem globally.

Fixes: 64d513ac31b - "scsi: use host wide tags by default"
Reported-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agos390: fix test_fp_ctl inline assembly contraints
Martin Schwidefsky [Mon, 27 Jun 2016 15:06:45 +0000 (17:06 +0200)]
s390: fix test_fp_ctl inline assembly contraints

commit bcf4dd5f9ee096bd1510f838dd4750c35df4e38b upstream.

The test_fp_ctl function is used to test if a given value is a valid
floating-point control. The inline assembly in test_fp_ctl uses an
incorrect constraint for the 'orig_fpc' variable. If the compiler
chooses the same register for 'fpc' and 'orig_fpc' the test_fp_ctl()
function always returns true. This allows user space to trigger
kernel oopses with invalid floating-point control values on the
signal stack.

This problem has been introduced with git commit 4725c86055f5bbdcdf
"s390: fix save and restore of the floating-point-control register"

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoscsi: fix race between simultaneous decrements of ->host_failed
Wei Fang [Tue, 7 Jun 2016 06:53:56 +0000 (14:53 +0800)]
scsi: fix race between simultaneous decrements of ->host_failed

commit 72d8c36ec364c82bf1bf0c64dfa1041cfaf139f7 upstream.

sas_ata_strategy_handler() adds the works of the ata error handler to
system_unbound_wq. This workqueue asynchronously runs work items, so the
ata error handler will be performed concurrently on different CPUs. In
this case, ->host_failed will be decreased simultaneously in
scsi_eh_finish_cmd() on different CPUs, and become abnormal.

It will lead to permanently inequality between ->host_failed and
->host_busy, and scsi error handler thread won't start running. IO
errors after that won't be handled.

Since all scmds must have been handled in the strategy handler, just
remove the decrement in scsi_eh_finish_cmd() and zero ->host_busy after
the strategy handler to fix this race.

Fixes: 50824d6c5657 ("[SCSI] libsas: async ata-eh")
Signed-off-by: Wei Fang <fangwei1@huawei.com>
Reviewed-by: James Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoovl: verify upper dentry in ovl_remove_and_whiteout()
Maxim Patlasov [Fri, 22 Jul 2016 01:24:26 +0000 (18:24 -0700)]
ovl: verify upper dentry in ovl_remove_and_whiteout()

commit cfc9fde0b07c3b44b570057c5f93dda59dca1c94 upstream.

The upper dentry may become stale before we call ovl_lock_rename_workdir.
For example, someone could (mistakenly or maliciously) manually unlink(2)
it directly from upperdir.

To ensure it is not stale, let's lookup it after ovl_lock_rename_workdir
and and check if it matches the upper dentry.

Essentially, it is the same problem and similar solution as in
commit 11f3710417d0 ("ovl: verify upper dentry before unlink and rename").

Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoovl: Copy up underlying inode's ->i_mode to overlay inode
Vivek Goyal [Fri, 1 Jul 2016 20:34:25 +0000 (16:34 -0400)]
ovl: Copy up underlying inode's ->i_mode to overlay inode

commit 07a2daab49c549a37b5b744cbebb6e3f445f12bc upstream.

Right now when a new overlay inode is created, we initialize overlay
inode's ->i_mode from underlying inode ->i_mode but we retain only
file type bits (S_IFMT) and discard permission bits.

This patch changes it and retains permission bits too. This should allow
overlay to do permission checks on overlay inode itself in task context.

[SzM] It also fixes clearing suid/sgid bits on write.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Reported-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoARM: mvebu: fix HW I/O coherency related deadlocks
Thomas Petazzoni [Thu, 16 Jun 2016 13:42:25 +0000 (15:42 +0200)]
ARM: mvebu: fix HW I/O coherency related deadlocks

commit c5379ba8fccd99d5f99632c789f0393d84a57805 upstream.

Until now, our understanding for HW I/O coherency to work on the
Cortex-A9 based Marvell SoC was that only the PCIe regions should be
mapped strongly-ordered. However, we were still encountering some
deadlocks, especially when testing the CESA crypto engine. After
checking with the HW designers, it was concluded that all the MMIO
registers should be mapped as strongly ordered for the HW I/O coherency
mechanism to work properly.

This fixes some easy to reproduce deadlocks with the CESA crypto engine
driver (dmcrypt on a sufficiently large disk partition).

Tested-by: Terry Stockert <stockert@inkblotadmirer.me>
Tested-by: Romain Perier <romain.perier@free-electrons.com>
Cc: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Romain Perier <romain.perier@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
Thomas Petazzoni [Thu, 16 Jun 2016 13:42:27 +0000 (15:42 +0200)]
ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys

commit 929e604efa3dc0522214e0dc18984be23993e9f0 upstream.

When the support for the Marvell crypto engine was added in the Device
Tree of the various Armada 385 Device Tree files in commit
d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x
boards"), a typo was made in the MBus window attributes for the Armada
385 Linksys board: 0x09/0x05 are used instead of 0x19/0x15. This commit
fixes this typo, which makes the CESA engines operational on Armada 385
Linksys boards.

Reported-by: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x boards")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
Boris Brezillon [Wed, 15 Jun 2016 11:20:19 +0000 (13:20 +0200)]
ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13

commit 5fc39d347267bd029fcc9099c70e2fe2d53130e9 upstream.

The sun4i-timer driver registers its sched_clock only if the machine is
compatible with "allwinner,sun5i-a13", "allwinner,sun5i-a10s" or
"allwinner,sun4i-a10".
Add the missing "allwinner,sun5i-a13" string to the machine compatible.

Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 465a225fb2af ("ARM: sun5i: Add C.H.I.P DTS")
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda: add AMD Stoney PCI ID with proper driver caps
Awais Belal [Tue, 12 Jul 2016 10:21:28 +0000 (15:21 +0500)]
ALSA: hda: add AMD Stoney PCI ID with proper driver caps

commit d716fb03f76411fc7e138692e33b749cada5c094 upstream.

This allows the device to correctly show up as ATI HDMI
rather than a generic one and allows the driver to use
the available caps.

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda - fix use-after-free after module unload
Peter Wu [Mon, 11 Jul 2016 17:51:06 +0000 (19:51 +0200)]
ALSA: hda - fix use-after-free after module unload

commit ab58d8cc870ef3f0771c197700441936898d1f1d upstream.

register_vga_switcheroo() sets the PM ops from the hda structure which
is freed later in azx_free. Make sure that these ops are cleared.

Caught by KASAN, initially noticed due to a general protection fault.

Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)")
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: ctl: Stop notification after disconnection
Takashi Iwai [Fri, 8 Jul 2016 06:05:19 +0000 (08:05 +0200)]
ALSA: ctl: Stop notification after disconnection

commit f388cdcdd160687c6650833f286b9c89c50960ff upstream.

snd_ctl_remove() has a notification for the removal event.  It's
superfluous when done during the device got disconnected.  Although
the notification itself is mostly harmless, it may potentially be
harmful, and should be suppressed.  Actually some components PCM may
free ctl elements during the disconnect or free callbacks, thus it's
no theoretical issue.

This patch adds the check of card->shutdown flag for avoiding
unnecessary notifications after (or during) the disconnect.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: pcm: Free chmap at PCM free callback, too
Takashi Iwai [Fri, 8 Jul 2016 06:23:43 +0000 (08:23 +0200)]
ALSA: pcm: Free chmap at PCM free callback, too

commit a8ff48cb70835f48de5703052760312019afea55 upstream.

The chmap ctls assigned to PCM streams are freed in the PCM disconnect
callback.  However, since the disconnect callback isn't called when
the card gets freed before registering, the chmap ctls may still be
left assigned.  They are eventually freed together with other ctls,
but it may cause an Oops at pcm_chmap_ctl_private_free(), as the
function refers to the assigned PCM stream, while the PCM objects have
been already freed beforehand.

The fix is to free the chmap ctls also at PCM free callback, not only
at PCM disconnect.

Reported-by: Laxminath Kasam <b_lkasam@codeaurora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda/realtek - add new pin definition in alc225 pin quirk table
Hui Wang [Fri, 8 Jul 2016 06:26:57 +0000 (14:26 +0800)]
ALSA: hda/realtek - add new pin definition in alc225 pin quirk table

commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 upstream.

We have some Dell laptops which can't detect headset mic, the machines
use the codec ALC225, they have some new pin configuration values,
after adding them in the alc225 pin quirk table, they work well.

Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda - fix read before array start
Bob Copeland [Sat, 25 Jun 2016 11:58:45 +0000 (07:58 -0400)]
ALSA: hda - fix read before array start

commit 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc upstream.

UBSAN reports the following warning from accessing path->path[-1]
in set_path_power():

[   16.078040] ================================================================================
[   16.078124] UBSAN: Undefined behaviour in sound/pci/hda/hda_generic.c:3981:17
[   16.078198] index -1 is out of range for type 'hda_nid_t [10]'
[   16.078270] CPU: 2 PID: 1738 Comm: modprobe Not tainted 4.7.0-rc1-wt+ #47
[   16.078274] Hardware name: LENOVO 3443CTO/3443CTO, BIOS G6ET23WW (1.02 ) 08/14/2012
[   16.078278]  ffff8800cb246000 ffff8800cb3638b8 ffffffff815c4fe3 0000000000000032
[   16.078286]  ffff8800cb3638e0 ffffffffffffffff ffff8800cb3638d0 ffffffff8162443d
[   16.078294]  ffffffffa0894200 ffff8800cb363920 ffffffff81624af7 0000000000000292
[   16.078302] Call Trace:
[   16.078311]  [<ffffffff815c4fe3>] dump_stack+0x86/0xd3
[   16.078317]  [<ffffffff8162443d>] ubsan_epilogue+0xd/0x40
[   16.078324]  [<ffffffff81624af7>] __ubsan_handle_out_of_bounds+0x67/0x70
[   16.078335]  [<ffffffffa087665f>] set_path_power+0x1bf/0x230 [snd_hda_codec_generic]
[   16.078344]  [<ffffffffa087880d>] add_pin_power_ctls+0x8d/0xc0 [snd_hda_codec_generic]
[   16.078352]  [<ffffffffa087f190>] ? pin_power_down_callback+0x20/0x20 [snd_hda_codec_generic]
[   16.078360]  [<ffffffffa0878947>] add_all_pin_power_ctls+0x107/0x150 [snd_hda_codec_generic]
[   16.078370]  [<ffffffffa08842b3>] snd_hda_gen_parse_auto_config+0x2d73/0x49e0 [snd_hda_codec_generic]
[   16.078376]  [<ffffffff81173360>] ? trace_hardirqs_on_caller+0x1b0/0x2c0
[   16.078390]  [<ffffffffa089df27>] alc_parse_auto_config+0x147/0x310 [snd_hda_codec_realtek]
[   16.078402]  [<ffffffffa08a332a>] patch_alc269+0x23a/0x560 [snd_hda_codec_realtek]
[   16.078417]  [<ffffffffa0838644>] hda_codec_driver_probe+0xa4/0x1a0 [snd_hda_codec]
[   16.078424]  [<ffffffff817bbac1>] driver_probe_device+0x101/0x380
[   16.078430]  [<ffffffff817bbdf9>] __driver_attach+0xb9/0x100
[   16.078438]  [<ffffffff817bbd40>] ? driver_probe_device+0x380/0x380
[   16.078444]  [<ffffffff817b8d20>] bus_for_each_dev+0x70/0xc0
[   16.078449]  [<ffffffff817bb087>] driver_attach+0x27/0x50
[   16.078454]  [<ffffffff817ba956>] bus_add_driver+0x166/0x2c0
[   16.078460]  [<ffffffffa0369000>] ? 0xffffffffa0369000
[   16.078465]  [<ffffffff817bd13d>] driver_register+0x7d/0x130
[   16.078477]  [<ffffffffa083816f>] __hda_codec_driver_register+0x6f/0x90 [snd_hda_codec]
[   16.078488]  [<ffffffffa036901e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek]
[   16.078493]  [<ffffffff8100215e>] do_one_initcall+0x4e/0x1d0
[   16.078499]  [<ffffffff8119f54d>] ? rcu_read_lock_sched_held+0x6d/0x80
[   16.078504]  [<ffffffff813701b1>] ? kmem_cache_alloc_trace+0x391/0x560
[   16.078510]  [<ffffffff812bb314>] ? do_init_module+0x28/0x273
[   16.078515]  [<ffffffff812bb387>] do_init_module+0x9b/0x273
[   16.078522]  [<ffffffff811e3782>] load_module+0x20b2/0x3410
[   16.078527]  [<ffffffff811df140>] ? m_show+0x210/0x210
[   16.078533]  [<ffffffff813b2b26>] ? kernel_read+0x66/0xe0
[   16.078541]  [<ffffffff811e4cfa>] SYSC_finit_module+0xba/0xc0
[   16.078547]  [<ffffffff811e4d1e>] SyS_finit_module+0xe/0x10
[   16.078552]  [<ffffffff81a860fc>] entry_SYSCALL_64_fastpath+0x1f/0xbd
[   16.078556] ================================================================================

Fix by checking path->depth before use.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda - Add PCI ID for Kabylake-H
Vinod Koul [Wed, 29 Jun 2016 04:57:52 +0000 (10:27 +0530)]
ALSA: hda - Add PCI ID for Kabylake-H

commit 6858107e78b4ecb9f244db814ffbdba1b5ce759b upstream.

Kabylake-H shows up as PCI ID 0xa2f0. We missed adding this
earlier with other KBL IDs.

Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
Torsten Hilbrich [Tue, 5 Jul 2016 08:40:22 +0000 (10:40 +0200)]
ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup

commit 9cd25743765cfe851aed8d655a62d60156aed293 upstream.

This solves the issue that a headphone is not working on the docking
unit.

Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: timer: Fix negative queue usage by racy accesses
Takashi Iwai [Mon, 4 Jul 2016 12:02:15 +0000 (14:02 +0200)]
ALSA: timer: Fix negative queue usage by racy accesses

commit 3fa6993fef634e05d200d141a85df0b044572364 upstream.

The user timer tu->qused counter may go to a negative value when
multiple concurrent reads are performed since both the check and the
decrement of tu->qused are done in two individual locked contexts.
This results in bogus read outs, and the endless loop in the
user-space side.

The fix is to move the decrement of the tu->qused counter into the
same spinlock context as the zero-check of the counter.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: echoaudio: Fix memory allocation
Christophe JAILLET [Mon, 27 Jun 2016 19:06:51 +0000 (21:06 +0200)]
ALSA: echoaudio: Fix memory allocation

commit 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 upstream.

'commpage_bak' is allocated with 'sizeof(struct echoaudio)' bytes.
We then copy 'sizeof(struct comm_page)' bytes in it.
On my system, smatch complains because one is 2960 and the other is 3072.

This would result in memory corruption or a oops.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
Takashi Iwai [Wed, 29 Jun 2016 13:23:08 +0000 (15:23 +0200)]
ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()

commit 62db7152c924e4c060e42b34a69cd39658e8a0dc upstream.

vortex_wtdma_bufshift() function does calculate the page index
wrongly, first masking then shift, which always results in zero.
The proper computation is to first shift, then mask.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup
Jaroslav Kysela [Fri, 24 Jun 2016 13:13:16 +0000 (15:13 +0200)]
ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup

commit 0f087ee3f3b86a4507db4ff1d2d5a3880e4cfd16 upstream.

  See: https://bugzilla.redhat.com/show_bug.cgi?id=1349539
  See: https://bugzilla.kernel.org/show_bug.cgi?id=120961

Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: hda - Fix the headset mic jack detection on Dell machine
Woodrow Shen [Fri, 24 Jun 2016 07:58:34 +0000 (15:58 +0800)]
ALSA: hda - Fix the headset mic jack detection on Dell machine

commit f83c32925d45926cd0e0f18bf28e6039116c4486 upstream.

The new Dell laptop with codec 3246 can't detect headset mic when
headset was inserted on the machine. So adding pin configurations
into quirk table makes headset mic work correctly.

Codec: Realtek ALC3246
Vendor Id: 0x10ec0256
Subsystem Id: 0x10280781

Signed-off-by: Woodrow Shen <woodrow.shen@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
4 years agoALSA: dummy: Fix a use-after-free at closing
Takashi Iwai [Fri, 24 Jun 2016 13:15:26 +0000 (15:15 +0200)]
ALSA: dummy: Fix a use-after-free at closing

commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.

syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
>  Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [<      none      >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [<      none      >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
>  [<ffffffff8179e59e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
>  [<     inline     >] rb_set_parent include/linux/rbtree_augmented.h:111
>  [<     inline     >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
>  [<ffffffff82ca5787>] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
>  [<ffffffff82cb02e8>] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
>  [<ffffffff814d0c80>] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
>  [<     inline     >] remove_hrtimer kernel/time/hrtimer.c:945
>  [<ffffffff814d23da>] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
>  [<ffffffff814d2742>] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
>  [<ffffffff85420531>] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
>  [<ffffffff854228bf>] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
>  [<ffffffff85392170>] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
>  [<ffffffff85391b26>] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
>  [<ffffffff85391e01>] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
>  [<     inline     >] snd_pcm_stop sound/core/pcm_native.c:1139
>  [<ffffffff8539754d>] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
>  [<ffffffff8539d3be>] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
>  [<ffffffff8539ee91>] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
>  [<ffffffff8539f2ec>] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
>  [<ffffffff853d9a44>] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
>  [<ffffffff853da27d>] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
>  .....

A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>