Commit Graph

648004 Commits

Author SHA1 Message Date
Yixun Lan
622c221d7d network: enable UDP socket monitoring
PD#167119: network: enable UDP socket monitoring

this is need by VtsKernelNetTests, otherwise some test cases will fail

Error info:

testUdp (sock_diag_test.SockDestroyPermissionTest) ... skipped 'INET_UDP_DIAG not enabled'
testClosesUdpSockets (sock_diag_test.SockDestroyUdpTest) ... skipped 'INET_UDP_DIAG not enabled'
testReadInterrupted (sock_diag_test.SockDestroyUdpTest)
Tests that read() is interrupted by SOCK_DESTROY. ... skipped 'INET_UDP_DIAG not enabled'
testSocketAddressesAfterClose (sock_diag_test.SockDestroyUdpTest) ... skipped 'INET_UDP_DIAG not enabled'

Change-Id: I732f8d654a476614308992c756d5c8a8711bbbc9
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
2018-06-21 01:41:23 -07:00
Yixun Lan
58c13404df network: enable VTI option
PD#167119: network: enable VTI option

this is need by VtsKernelNetTests, otherwise some test cases will fail

Error info:
ERROR: testAddVti (xfrm_tunnel_test.XfrmAddDeleteVtiTest)
Test the creation of a Virtual Tunnel Interface.

Change-Id: I19b05d7684ab97245f02384c4f50cee349f76131
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
2018-06-21 01:40:58 -07:00
Yixun Lan
10a47ac88d crypto: enable sha512 algorithm
PD#167119: crypto: enable sha512 algorithm

this is need by VtsKernelNetTests, the xfrm test case
will require this option to work, otherwise will fail

errors info:
testSocketPolicySimple_cbc-aes_192_hmac-sha512_512_256_IPv4_TCP (xfrm_algorithm_test.XfrmAlgorithmTest) ... ERROR
testSocketPolicySimple_cbc-aes_192_hmac-sha512_512_256_IPv4_UDP (xfrm_algorithm_test.XfrmAlgorithmTest) ... ERROR
testSocketPolicySimple_cbc-aes_192_hmac-sha512_512_256_IPv6_TCP (xfrm_algorithm_test.XfrmAlgorithmTest) ... ERROR
testSocketPolicySimple_cbc-aes_192_hmac-sha512_512_256_IPv6_UDP (xfrm_algorithm_test.XfrmAlgorithmTest) ... ERROR
testSocketPolicySimple_cbc-aes_192_hmac-sha512_512_512_IPv4_TCP (xfrm_algorithm_test.XfrmAlgorithmTest) ... ERROR


Change-Id: I7f2502c4c76c09f00fe2719aac3f26b9b0d7f772
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
2018-06-21 01:40:26 -07:00
xuhua zhang
3a97fb42ca tvin: coverity fix
PD#168718: tvin: coverity fix

Change-Id: I196de9ae44fc443f5cb7050fad92bea9cd138c8a
Signed-off-by: xuhua zhang <xuhua.zhang@amlogic.com>
2018-06-21 00:29:18 -07:00
Yi Zhou
f559e41f2a hdmitx: clean up deadcode
PD#168723: hdmitx: clean up deadcode

Change-Id: I9e9267d748ee002f76e70c0634d43cfaba333988
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>
2018-06-21 00:27:36 -07:00
weijia.zhu
deddcbc9e5 audio: turn some log into debug mode
PD#168597: disable hdmi plugin log print

Change-Id: Ie6731ef35d17f12ad2e696d1f186350d58fda52e
Signed-off-by: weijia.zhu <weijia.zhu@amlogic.com>
2018-06-20 23:05:01 -07:00
Jianxin Qin
aefab40d70 usb: phy2: modify tuning sequence for aml-phy
PD#164286: usb: phy2: modify tuning sequence for aml-phy

The firt two steps of PHY tuning sequence only need to do once, so
we move them to initial function.

Change-Id: Ib6e0daa429aeea17007130a001d7fc0905307c1e
Signed-off-by: Jianxin Qin <jianxin.qin@amlogic.com>
2018-06-20 21:33:04 -07:00
Matthew Shyu
e9cdacdc34 crypto: aml-dma: fix errors found in coverity check
PD#168725: fix errors found in coverity check

Change-Id: I7528dc0c6122d32e3f2937a4b1869031d10851af
Signed-off-by: Matthew Shyu <matthew.shyu@amlogic.com>
2018-06-20 21:11:11 -07:00
Shuai Li
f669cda618 audio: fix lineout L/R phase diff 7 degree issue
PD#168345: audio: fix lineout L/R phase diff 7 degree issue

Change-Id: I6768b9fc8324baf00a9b759f7a6e3faea2695371
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
2018-06-20 06:29:58 -07:00
Huan Biao
2b1ebf192a clk: ringmsr: add osc ring msr for g12 [1/1]
PD#165091:

Problem:
no osc ring msr function

Solution:
add g12 osc ring msr code

Verify:
g12 skt

Change-Id: I1fc9292b750cd402f81d3a0d6d8206cea94098b6
Signed-off-by: Huan Biao <huan.biao@amlogic.com>
2018-06-20 03:49:05 -07:00
Nian Jing
caebb4cabc cvbsout: cvbsout/vdac coverity fix
PD#168730: coverity fix

Change-Id: I0753c4ae9a4eed14a46a1f2bcda4cc11fbb0b351
Signed-off-by: Nian Jing <nian.jing@amlogic.com>
2018-06-20 02:56:57 -07:00
Yu Tu
bc3d4d89e6 uart: fix support sysrq function. [1/1]
PD#167742: uart: support sysrq

Change-Id: I67b183942047428a3aea35cbcf8ffae490319ac8
Signed-off-by: Yu Tu <yu.tu@amlogic.com>
2018-06-20 11:18:30 +08:00
Lei Yang
2aa3dc0fb1 hdmirx: fix HDCP CTS issues
PD#168221: hdmirx: fix HDCP CTS issues

1. disable hdcp 1.1 feature && fastreauth function.
2. ignore dvi recovery logic when aksv was received.

Change-Id: I48c37d4b7e0da7309c743052e16b0d607daa4110
Signed-off-by: Lei Yang <lei.yang@amlogic.com>
2018-06-19 19:50:26 -07:00
MingLiang Dong
82b02c99d8 hdr: optimize hdr/hlg effect
PD#167989: hdr: optimize hdr/hlg effect

1. fix hdr->sdr exposure
2. fix hlg->hdr abnormal image

Change-Id: Ia72178084335940d4d6984f07c7b9d7b7025b5e8
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>
2018-06-19 07:19:14 -07:00
Matthew Shyu
7ad8db81e5 crypto: aml-dma: Enable HW crypto on G12A
PD#167825: Enable HW crypto on G12A and rework sha driver

1. allocate atomic mem to avoid sleep
2. rework import and export function for fixing race conditions
3. rework hmac setkey to avoid HW bug
4. Use fallback on AES-192
5. passed all AES and SHA related tests in tcrypt

Change-Id: I1c0dcbbad025f0d8d7c16f921948a8cb6d4b2548
Signed-off-by: Matthew Shyu <matthew.shyu@amlogic.com>
2018-06-19 17:00:40 +08:00
kieth liu
ea5ec8a557 video: add sysfs video_inuse for vfm map share[1/9]
PD#165474: add sysfs video_inuse for vfm map share

Change-Id: Ic226eaf89cbd55dae14532b3c291485a8585b933
Signed-off-by: kieth liu <kieth.liu@amlogic.com>
2018-06-19 00:54:48 -07:00
Weiguang Ruan
778e267f00 wifi: mac80211 add p2p0 [5/6]
PD#168467: wifi: mac80211 add p2p0 

softmac wifi need mac80211 to register cfg80211 interfaeces
wlan0 is default, add p2p0 for Android WIFI P2P

Change-Id: I6fd48f85e010a1ec9e35954b85205634312c73d9
Signed-off-by: Weiguang Ruan <Weiguang.ruan@amlogic.com>
2018-06-18 22:52:54 -07:00
nengwen.chen
a864abf401 atv_demod: Fix audio always mute and unmute during ATV playing. [1/1]
PD#167378: Modify atv demod for audio driver get atv audio data.

Change-Id: I221c6a94d3756d5361c140fdc88f25b65e33d114
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>
2018-06-18 19:35:45 -07:00
Lianjun Huang
e1815b3eba ANDROID: sdcardfs: fix potential crash when reserved_mb is not zero
sdcardfs_mkdir() calls check_min_free_space(). When reserved_mb is not zero, a negative dentry will be passed to
ext4_statfs() at last and ext4_statfs() will crash. The parent dentry is positive. So we use the parent dentry to
check free space.

Change-Id: I80ab9623fe59ba911f4cc9f0e029a1c6f7ee421b
Signed-off-by: Lianjun Huang <huanglianjun@vivo.com>
2018-06-17 03:46:56 +00:00
Greg Kroah-Hartman
a4230beab3 Merge 4.9.109 into android-4.9
Changes in 4.9.109
	x86/fpu: Hard-disable lazy FPU mode
	bonding: correctly update link status during mii-commit phase
	bonding: fix active-backup transition
	bonding: require speed/duplex only for 802.3ad, alb and tlb
	nvme-pci: initialize queue memory before interrupts
	af_key: Always verify length of provided sadb_key
	x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc32c code
	nvmet: Move serial number from controller to subsystem
	nvmet: don't report 0-bytes in serial number
	nvmet: don't overwrite identify sn/fr with 0-bytes
	gpio: No NULL owner
	KVM: x86: introduce linear_{read,write}_system
	KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system
	staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
	usbip: vhci_sysfs: fix potential Spectre v1
	usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
	usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
	usb: gadget: udc: renesas_usb3: disable the controller's irqs for reconnecting
	serial: sh-sci: Stop using printk format %pCr
	tty/serial: atmel: use port->name as name in request_irq()
	serial: samsung: fix maxburst parameter for DMA transactions
	serial: 8250: omap: Fix idling of clocks for unused uarts
	vmw_balloon: fixing double free when batching mode is off
	tty: pl011: Avoid spuriously stuck-off interrupts
	kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
	Input: goodix - add new ACPI id for GPD Win 2 touch screen
	Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
	crypto: vmx - Remove overly verbose printk from AES init routines
	crypto: omap-sham - fix memleak
	perf: sync up x86/.../cpufeatures.h
	Linux 4.9.109

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-06-16 11:31:13 +02:00
Greg Kroah-Hartman
8e52b94e19 Linux 4.9.109 2018-06-16 09:52:35 +02:00
Greg Kroah-Hartman
f09a7b0eea perf: sync up x86/.../cpufeatures.h
The x86 copy of cpufeatures.h is now out of sync, so fix that.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:35 +02:00
Bin Liu
20f4d771b3 crypto: omap-sham - fix memleak
commit 9dbc8a0328 upstream.

Fixes: 8043bb1ae0 ("crypto: omap-sham - convert driver logic to use sgs for data xmit")

The memory pages freed in omap_sham_finish_req() were less than those
allocated in omap_sham_copy_sgs().

Cc: stable@vger.kernel.org
Signed-off-by: Bin Liu <b-liu@ti.com>
Acked-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:35 +02:00
Michael Ellerman
ef2aa9f3a7 crypto: vmx - Remove overly verbose printk from AES init routines
commit 1411b5218a upstream.

In the vmx AES init routines we do a printk(KERN_INFO ...) to report
the fallback implementation we're using.

However with a slow console this can significantly affect the speed of
crypto operations. Using 'cryptsetup benchmark' the removal of the
printk() leads to a ~5x speedup for aes-cbc decryption.

So remove them.

Fixes: 8676590a15 ("crypto: vmx - Adding AES routines for VMX module")
Fixes: 8c755ace35 ("crypto: vmx - Adding CBC routines for VMX module")
Fixes: 4f7f60d312 ("crypto: vmx - Adding CTR routines for VMX module")
Fixes: cc333cd68d ("crypto: vmx - Adding GHASH routines for VMX module")
Cc: stable@vger.kernel.org # v4.1+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:35 +02:00
Johannes Wienke
05ca7fe5a7 Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
commit e6e7e9cd8e upstream.

Add ELAN0612 to the list of supported touchpads; this ID is used in Lenovo
v330 14IKB devices.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199253
Signed-off-by: Johannes Wienke <languitar@semipol.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Ethan Lee
78e7bbf60c Input: goodix - add new ACPI id for GPD Win 2 touch screen
commit 5ca4d1ae9b upstream.

GPD Win 2 Website: http://www.gpd.hk/gpdwin2.asp

Tested on a unit from the first production run sent to Indiegogo backers

Signed-off-by: Ethan Lee <flibitijibibo@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Paolo Bonzini
13d1c5b17d kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
commit 3c9fa24ca7 upstream.

The functions that were used in the emulation of fxrstor, fxsave, sgdt and
sidt were originally meant for task switching, and as such they did not
check privilege levels.  This is very bad when the same functions are used
in the emulation of unprivileged instructions.  This is CVE-2018-10853.

The obvious fix is to add a new argument to ops->read_std and ops->write_std,
which decides whether the access is a "system" access or should use the
processor's CPL.

Fixes: 129a72a0d3 ("KVM: x86: Introduce segmented_write_std", 2017-01-12)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Dave Martin
018e5191c6 tty: pl011: Avoid spuriously stuck-off interrupts
commit 4a7e625ce5 upstream.

Commit 9b96fbacda ("serial: PL011: clear pending interrupts")
clears the RX and receive timeout interrupts on pl011 startup, to
avoid a screaming-interrupt scenario that can occur when the
firmware or bootloader leaves these interrupts asserted.

This has been noted as an issue when running Linux on qemu [1].

Unfortunately, the above fix seems to lead to potential
misbehaviour if the RX FIFO interrupt is asserted _non_ spuriously
on driver startup, if the RX FIFO is also already full to the
trigger level.

Clearing the RX FIFO interrupt does not change the FIFO fill level.
In this scenario, because the interrupt is now clear and because
the FIFO is already full to the trigger level, no new assertion of
the RX FIFO interrupt can occur unless the FIFO is drained back
below the trigger level.  This never occurs because the pl011
driver is waiting for an RX FIFO interrupt to tell it that there is
something to read, and does not read the FIFO at all until that
interrupt occurs.

Thus, simply clearing "spurious" interrupts on startup may be
misguided, since there is no way to be sure that the interrupts are
truly spurious, and things can go wrong if they are not.

This patch instead clears the interrupt condition by draining the
RX FIFO during UART startup, after clearing any potentially
spurious interrupt.  This should ensure that an interrupt will
definitely be asserted if the RX FIFO subsequently becomes
sufficiently full.

The drain is done at the point of enabling interrupts only.  This
means that it will occur any time the UART is newly opened through
the tty layer.  It will not apply to polled-mode use of the UART by
kgdboc: since that scenario cannot use interrupts by design, this
should not matter.  kgdboc will interact badly with "normal" use of
the UART in any case: this patch makes no attempt to paper over
such issues.

This patch does not attempt to address the case where the RX FIFO
fills faster than it can be drained: that is a pathological
hardware design problem that is beyond the scope of the driver to
work around.  As a failsafe, the number of poll iterations for
draining the FIFO is limited to twice the FIFO size.  This will
ensure that the kernel at least boots even if it is impossible to
drain the FIFO for some reason.

[1] [Qemu-devel] [Qemu-arm] [PATCH] pl011: do not put into fifo
before enabled the interruption
https://lists.gnu.org/archive/html/qemu-devel/2018-01/msg06446.html

Reported-by: Wei Xu <xuwei5@hisilicon.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Fixes: 9b96fbacda ("serial: PL011: clear pending interrupts")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Cc: stable <stable@vger.kernel.org>
Tested-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Gil Kupfer
d9bc59c44d vmw_balloon: fixing double free when batching mode is off
commit b23220fe05 upstream.

The balloon.page field is used for two different purposes if batching is
on or off. If batching is on, the field point to the page which is used
to communicate with with the hypervisor. If it is off, balloon.page
points to the page that is about to be (un)locked.

Unfortunately, this dual-purpose of the field introduced a bug: when the
balloon is popped (e.g., when the machine is reset or the balloon driver
is explicitly removed), the balloon driver frees, unconditionally, the
page that is held in balloon.page.  As a result, if batching is
disabled, this leads to double freeing the last page that is sent to the
hypervisor.

The following error occurs during rmmod when kernel checkers are on, and
the balloon is not empty:

[   42.307653] ------------[ cut here ]------------
[   42.307657] Kernel BUG at ffffffffba1e4b28 [verbose debug info unavailable]
[   42.307720] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[   42.312512] Modules linked in: vmw_vsock_vmci_transport vsock ppdev joydev vmw_balloon(-) input_leds serio_raw vmw_vmci parport_pc shpchp parport i2c_piix4 nfit mac_hid autofs4 vmwgfx drm_kms_helper hid_generic syscopyarea sysfillrect usbhid sysimgblt fb_sys_fops hid ttm mptspi scsi_transport_spi ahci mptscsih drm psmouse vmxnet3 libahci mptbase pata_acpi
[   42.312766] CPU: 10 PID: 1527 Comm: rmmod Not tainted 4.12.0+ #5
[   42.312803] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 09/30/2016
[   42.313042] task: ffff9bf9680f8000 task.stack: ffffbfefc1638000
[   42.313290] RIP: 0010:__free_pages+0x38/0x40
[   42.313510] RSP: 0018:ffffbfefc163be98 EFLAGS: 00010246
[   42.313731] RAX: 000000000000003e RBX: ffffffffc02b9720 RCX: 0000000000000006
[   42.313972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9bf97e08e0a0
[   42.314201] RBP: ffffbfefc163be98 R08: 0000000000000000 R09: 0000000000000000
[   42.314435] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc02b97e4
[   42.314505] R13: ffffffffc02b9748 R14: ffffffffc02b9728 R15: 0000000000000200
[   42.314550] FS:  00007f3af5fec700(0000) GS:ffff9bf97e080000(0000) knlGS:0000000000000000
[   42.314599] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   42.314635] CR2: 00007f44f6f4ab24 CR3: 00000003a7d12000 CR4: 00000000000006e0
[   42.314864] Call Trace:
[   42.315774]  vmballoon_pop+0x102/0x130 [vmw_balloon]
[   42.315816]  vmballoon_exit+0x42/0xd64 [vmw_balloon]
[   42.315853]  SyS_delete_module+0x1e2/0x250
[   42.315891]  entry_SYSCALL_64_fastpath+0x23/0xc2
[   42.315924] RIP: 0033:0x7f3af5b0e8e7
[   42.315949] RSP: 002b:00007fffe6ce0148 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[   42.315996] RAX: ffffffffffffffda RBX: 000055be676401e0 RCX: 00007f3af5b0e8e7
[   42.316951] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055be67640248
[   42.317887] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
[   42.318845] R10: 0000000000000883 R11: 0000000000000206 R12: 00007fffe6cdf130
[   42.319755] R13: 0000000000000000 R14: 0000000000000000 R15: 000055be676401e0
[   42.320606] Code: c0 74 1c f0 ff 4f 1c 74 02 5d c3 85 f6 74 07 e8 0f d8 ff ff 5d c3 31 f6 e8 c6 fb ff ff 5d c3 48 c7 c6 c8 0f c5 ba e8 58 be 02 00 <0f> 0b 66 0f 1f 44 00 00 66 66 66 66 90 48 85 ff 75 01 c3 55 48
[   42.323462] RIP: __free_pages+0x38/0x40 RSP: ffffbfefc163be98
[   42.325735] ---[ end trace 872e008e33f81508 ]---

To solve the bug, we eliminate the dual purpose of balloon.page.

Fixes: f220a80f0c ("VMware balloon: add batching to the vmw_balloon.")
Cc: stable@vger.kernel.org
Reported-by: Oleksandr Natalenko <onatalen@redhat.com>
Signed-off-by: Gil Kupfer <gilkup@gmail.com>
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Xavier Deguillard <xdeguillard@vmware.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Tony Lindgren
f6e6f0c542 serial: 8250: omap: Fix idling of clocks for unused uarts
commit 13dc04d0e5 upstream.

I noticed that unused UARTs won't necessarily idle properly always
unless at least one byte tx transfer is done first.

After some debugging I narrowed down the problem to the scr register
dma configuration bits that need to be set before softreset for the
clocks to idle. Unless we do this, the module clkctrl idlest bits
may be set to 1 instead of 3 meaning the clock will never idle and
is blocking deeper idle states for the whole domain.

This might be related to the configuration done by the bootloader
or kexec booting where certain configurations cause the 8250 or
the clkctrl clock to jam in a way where setting of the scr bits
and reset is needed to clear it. I've tried diffing the 8250
registers for the various modes, but did not see anything specific.
So far I've only seen this on omap4 but I'm suspecting this might
also happen on the other clkctrl using SoCs considering they
already have a quirk enabled for UART_ERRATA_CLOCK_DISABLE.

Let's fix the issue by configuring scr before reset for basic dma
even if we don't use it. The scr register will be reset when we do
softreset few lines after, and we restore scr on resume. We should
do this for all the SoCs with UART_ERRATA_CLOCK_DISABLE quirk flag
set since the ones with UART_ERRATA_CLOCK_DISABLE are all based
using clkctrl similar to omap4.

Looks like both OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL
bits are needed for the clkctrl to idle after a softreset.

And we need to add omap4 to also use the UART_ERRATA_CLOCK_DISABLE
for the related workaround to be enabled. This same compatible
value will also be used for omap5.

Fixes: cdb929e445 ("serial: 8250_omap: workaround errata around idling UART after using DMA")
Cc: Keerthy <j-keerthy@ti.com>
Cc: Matthijs van Duin <matthijsvanduin@gmail.com>
Cc: Sekhar Nori <nsekhar@ti.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Marek Szyprowski
5b91ae57b5 serial: samsung: fix maxburst parameter for DMA transactions
commit aa2f80e752 upstream.

The best granularity of residue that DMA engine can report is in the BURST
units, so the serial driver must use MAXBURST = 1 and DMA_SLAVE_BUSWIDTH_1_BYTE
if it relies on exact number of bytes transferred by DMA engine.

Fixes: 62c37eedb7 ("serial: samsung: add dma reqest/release functions")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Sebastian Andrzej Siewior
41bdf9702c tty/serial: atmel: use port->name as name in request_irq()
commit 9594b5be7e upstream.

I was puzzled while looking at /proc/interrupts and random things showed
up between reboots. This occurred more often but I realised it later. The
"correct" output should be:
|38:      11861  atmel-aic5   2 Level     ttyS0

but I saw sometimes
|38:       6426  atmel-aic5   2 Level     tty1

and accounted it wrongly as correct. This is use after free and the
former example randomly got the "old" pointer which pointed to the same
content. With SLAB_FREELIST_RANDOM and HARDENED I even got
|38:       7067  atmel-aic5   2 Level     E=Started User Manager for UID 0

or other nonsense.
As it turns out the tty, pointer that is accessed in atmel_startup(), is
freed() before atmel_shutdown(). It seems to happen quite often that the
tty for ttyS0 is allocated and freed while ->shutdown is not invoked. I
don't do anything special - just a systemd boot :)

Use dev_name(&pdev->dev) as the IRQ name for request_irq(). This exists
as long as the driver is loaded so no use-after-free here.

Cc: stable@vger.kernel.org
Fixes: 761ed4a945 ("tty: serial_core: convert uart_close to use tty_port_close")
Acked-by: Richard Genoud <richard.genoud@gmail.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Geert Uytterhoeven
70f0a59bbd serial: sh-sci: Stop using printk format %pCr
commit d63c16f8e1 upstream.

Printk format "%pCr" will be removed soon, as clk_get_rate() must not be
called in atomic context.

Replace it by open-coding the operation.  This is safe here, as the code
runs in task context.

Link: http://lkml.kernel.org/r/1527845302-12159-4-git-send-email-geert+renesas@glider.be
To: Jia-Ju Bai <baijiaju1990@gmail.com>
To: Jonathan Corbet <corbet@lwn.net>
To: Michael Turquette <mturquette@baylibre.com>
To: Stephen Boyd <sboyd@kernel.org>
To: Zhang Rui <rui.zhang@intel.com>
To: Eduardo Valentin <edubezval@gmail.com>
To: Eric Anholt <eric@anholt.net>
To: Stefan Wahren <stefan.wahren@i2se.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: linux-doc@vger.kernel.org
Cc: linux-clk@vger.kernel.org
Cc: linux-pm@vger.kernel.org
Cc: linux-serial@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-renesas-soc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org # 4.5+
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Yoshihiro Shimoda
bc62b33d5f usb: gadget: udc: renesas_usb3: disable the controller's irqs for reconnecting
commit bd6bce004d upstream.

This patch fixes an issue that reconnection is possible to fail
because unexpected state handling happens by the irqs. To fix the issue,
the driver disables the controller's irqs when disconnected.

Fixes: 746bfe63bb ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
Cc: <stable@vger.kernel.org> # v4.5+
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Alexander Kappner
244eb27f96 usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
commit ca7d9515d0 upstream.

The "G-Drive" (sold by G-Technology) external USB 3.0 drive
 hangs on write access under UAS and usb-storage:

[  136.079121] sd 15:0:0:0: [sdi] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[  136.079144] sd 15:0:0:0: [sdi] tag#0 Sense Key : Illegal Request [current]
[  136.079152] sd 15:0:0:0: [sdi] tag#0 Add. Sense: Invalid field in cdb
[  136.079176] sd 15:0:0:0: [sdi] tag#0 CDB: Write(16) 8a 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00
[  136.079180] print_req_error: critical target error, dev sdi, sector 0
[  136.079183] Buffer I/O error on dev sdi, logical block 0, lost sync page write
[  136.173148] EXT4-fs (sdi): mounted filesystem with ordered data mode. Opts: (null)
[  140.583998] sd 15:0:0:0: [sdi] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[  140.584010] sd 15:0:0:0: [sdi] tag#0 Sense Key : Illegal Request [current]
[  140.584016] sd 15:0:0:0: [sdi] tag#0 Add. Sense: Invalid field in cdb
[  140.584022] sd 15:0:0:0: [sdi] tag#0 CDB: Write(16) 8a 08 00 00 00 00 e8 c4 00 18 00 00 00 08 00 00
[  140.584025] print_req_error: critical target error, dev sdi, sector 3905159192
[  140.584044] print_req_error: critical target error, dev sdi, sector 3905159192
[  140.584052] Aborting journal on device sdi-8.

The proposed patch adds compatibility quirks. Because the drive requires two
quirks (one to work with UAS, and another to work with usb-storage), adding this
under unusual_devs.h and not just unusual_uas.h so kernels compiled without UAS
receive the quirk. With the patch, the drive works reliably on UAS and usb-
storage.
(tested on NEC Corporation uPD720200 USB 3.0 host controller).

Signed-off-by: Alexander Kappner <agk@godking.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Alexander Kappner
187941e505 usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
commit 8c4e97ddfe upstream.

The ALWAYS_SYNC flag is currently honored by the usb-storage driver but not UAS
and is required to work around devices that become unstable upon being
queried for cache. This code is taken straight from:
drivers/usb/storage/scsiglue.c:284

Signed-off-by: Alexander Kappner <agk@godking.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Gustavo A. R. Silva
14450abb38 usbip: vhci_sysfs: fix potential Spectre v1
commit a0d6ec8809 upstream.

pdev_nr and rhport can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:
drivers/usb/usbip/vhci_sysfs.c:238 detach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:328 attach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:338 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_ss->vdev'
drivers/usb/usbip/vhci_sysfs.c:340 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_hs->vdev'

Fix this by sanitizing pdev_nr and rhport before using them to index
vhcis and vhci->vhci_hcd_ss->vdev respectively.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Laura Abbott
8da07ee9e4 staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
commit 45ad559a29 upstream.

Syzbot reported yet another warning with Ion:

WARNING: CPU: 0 PID: 1467 at drivers/staging/android/ion/ion.c:122
ion_buffer_destroy+0xd4/0x190 drivers/staging/android/ion/ion.c:122
Kernel panic - not syncing: panic_on_warn set ...

This is catching that a buffer was freed with an existing kernel mapping
still present. This can be easily be triggered from userspace by calling
DMA_BUF_SYNC_START without calling DMA_BUF_SYNC_END. Switch to a single
pr_warn_once to indicate the error without being disruptive.

Reported-by: syzbot+cd8bcd40cb049efa2770@syzkaller.appspotmail.com
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Paolo Bonzini
838b0e900a KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system
commit ce14e868a5 upstream.

Int the next patch the emulator's .read_std and .write_std callbacks will
grow another argument, which is not needed in kvm_read_guest_virt and
kvm_write_guest_virt_system's callers.  Since we have to make separate
functions, let's give the currently existing names a nicer interface, too.

Fixes: 129a72a0d3 ("KVM: x86: Introduce segmented_write_std", 2017-01-12)
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Paolo Bonzini
00b1391f95 KVM: x86: introduce linear_{read,write}_system
commit 79367a6574 upstream.

Wrap the common invocation of ctxt->ops->read_std and ctxt->ops->write_std, so
as to have a smaller patch when the functions grow another argument.

Fixes: 129a72a0d3 ("KVM: x86: Introduce segmented_write_std", 2017-01-12)
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Linus Walleij
be1f605bea gpio: No NULL owner
commit 7d18f0a14a upstream.

Sometimes a GPIO is fetched with NULL as parent device, and
that is just fine. So under these circumstances, avoid using
dev_name() to provide a name for the GPIO line.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cc: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Martin Wilck
1c4eb2a50e nvmet: don't overwrite identify sn/fr with 0-bytes
commit 42819eb7a0 upstream.

The merged version of my patch "nvmet: don't report 0-bytes in serial
number" fails to remove two lines which should have been replaced,
so that the space-padded strings are overwritten again with 0-bytes.
Fix it.

Fixes: 42de82a8b5 nvmet: don't report 0-bytes in serial number
Signed-off-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Sagi Grimberg <sagi@grimbeg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:33 +02:00
Martin Wilck
f43d8e4c86 nvmet: don't report 0-bytes in serial number
commit 42de82a8b5 upstream.

The NVME standard mandates that the SN, MN, and FR fields of the Identify
Controller Data Structure be "ASCII strings".  That means that they may
not contain 0-bytes, not even string terminators.

Signed-off-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
[hch: fixed for the move of the serial field, updated description]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Johannes Thumshirn
1e38f8e986 nvmet: Move serial number from controller to subsystem
commit 2e7f5d2af2 upstream.

The NVMe specification defines the serial number as:

"Serial Number (SN): Contains the serial number for the NVM subsystem
that is assigned by the vendor as an ASCII string. Refer to section
7.10 for unique identifier requirements. Refer to section 1.5 for ASCII
string requirements"

So move it from the controller to the subsystem, where it belongs.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Andy Lutomirski
077c9e26bb x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc32c code
commit 02f39b2379 upstream.

The crypto code was checking both use_eager_fpu() and
defined(X86_FEATURE_EAGER_FPU).  The latter was nonsensical, so
remove it.  This will avoid breakage when we remove
X86_FEATURE_EAGER_FPU.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Rik van Riel <riel@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: pbonzini@redhat.com
Link: http://lkml.kernel.org/r/1475627678-20788-2-git-send-email-riel@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Kevin Easton
142b79aa0b af_key: Always verify length of provided sadb_key
commit 4b66af2d63 upstream.

Key extensions (struct sadb_key) include a user-specified number of key
bits.  The kernel uses that number to determine how much key data to copy
out of the message in pfkey_msg2xfrm_state().

The length of the sadb_key message must be verified to be long enough,
even in the case of SADB_X_AALG_NULL.  Furthermore, the sadb_key_len value
must be long enough to include both the key data and the struct sadb_key
itself.

Introduce a helper function verify_key_len(), and call it from
parse_exthdrs() where other exthdr types are similarly checked for
correctness.

Signed-off-by: Kevin Easton <kevin@guarana.org>
Reported-by: syzbot+5022a34ca5a3d49b84223653fab632dfb7b4cf37@syzkaller.appspotmail.com
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Keith Busch
b53761a18e nvme-pci: initialize queue memory before interrupts
commit 161b8be2bd upstream.

A spurious interrupt before the nvme driver has initialized the completion
queue may inadvertently cause the driver to believe it has a completion
to process. This may result in a NULL dereference since the nvmeq's tags
are not set at this point.

The patch initializes the host's CQ memory so that a spurious interrupt
isn't mistaken for a real completion.

Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Andreas Born
ae0c8eeb66 bonding: require speed/duplex only for 802.3ad, alb and tlb
commit ad729bc9ac upstream.

The patch c4adfc822b ("bonding: make speed, duplex setting consistent
with link state") puts the link state to down if
bond_update_speed_duplex() cannot retrieve speed and duplex settings.
Assumably the patch was written with 802.3ad mode in mind which relies
on link speed/duplex settings. For other modes like active-backup these
settings are not required. Thus, only for these other modes, this patch
reintroduces support for slaves that do not support reporting speed or
duplex such as wireless devices. This fixes the regression reported in
bug 196547 (https://bugzilla.kernel.org/show_bug.cgi?id=196547).

Fixes: c4adfc822b ("bonding: make speed, duplex setting consistent
with link state")
Signed-off-by: Andreas Born <futur.andy@googlemail.com>
Acked-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Nate Clark <nate@neworld.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Mahesh Bandewar
bc5ad40583 bonding: fix active-backup transition
commit 3f3c278c94 upstream.

Earlier patch c4adfc822b ("bonding: make speed, duplex setting
consistent with link state") made an attempt to keep slave state
consistent with speed and duplex settings. Unfortunately link-state
transition is used to change the active link especially when used
in conjunction with mii-mon. The above mentioned patch broke that
logic. Also when speed and duplex settings for a link are updated
during a link-event, the link-status should not be changed to
invoke correct transition logic.

This patch fixes this issue by moving the link-state update outside
of the bond_update_speed_duplex() fn and to the places where this fn
is called and update link-state selectively.

Fixes: c4adfc822b ("bonding: make speed, duplex setting consistent
with link state")
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Reviewed-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Nate Clark <nate@neworld.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00
Mahesh Bandewar
c5b9d36f1e bonding: correctly update link status during mii-commit phase
commit b5bf0f5b16 upstream.

bond_miimon_commit() marks the link UP after attempting to get the speed
and duplex settings for the link. There is a possibility that
bond_update_speed_duplex() could fail. This is another place where it
could result into an inconsistent bonding link state.

With this patch the link will be marked UP only if the speed and duplex
values retrieved have sane values and processed further.

Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Nate Clark <nate@neworld.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:32 +02:00