Commit Graph

598803 Commits

Author SHA1 Message Date
Ørjan Eide
dd7968cf8a CHROMIUM: drm/rockchip: Respect page offset in IOMMU mmap
When mapping buffers through the PRIME DMA-buf mmap path we might be
given an offset which has to be respected. The DRM GEM mmap path already
takes care of zeroing out the fake mmap offset, so we can just make the
IOMMU mmap implementation always respect the offset.

BUG=chrome-os-partner:56615
TEST=graphics_GLBench

Change-Id: Iec83e720b24ddd35a92f3df8312015bc5af798f0
Signed-off-by: rjan Eide <orjan.eide@arm.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/386477
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:32:34 +08:00
Ørjan Eide
4edac39a91 CHROMIUM: drm/rockchip: Respect page offset for PRIME mmap calls
When mapping external DMA-bufs through the PRIME mmap call, we might be
given an offset which has to be respected. However for the internal DRM
GEM mmap path, we have to ignore the fake mmap offset used to identify
the buffer only. Currently the code always zeroes out vma->vm_pgoff,
which breaks the former.

This patch fixes the problem by moving the vm_pgoff assignment to a
function that is used only for GEM mmap path, so that the PRIME path
retains the original offset.

BUG=chrome-os-partner:56615
TEST=graphics_GLBench

Change-Id: Iec6e996707b0fe7e95a019423a944d98c80beaab
Signed-off-by: rjan Eide <orjan.eide@arm.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/381332
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:32:27 +08:00
Tomasz Figa
31bae78bcc CHROMIUM: drm/rockchip: Call drm_gem_object_release() to destroy GEM base
When converting the driver to use shmem-backed GEMs for IOMMU-enabled
systems, we forgot to add calls to drm_gem_object_release(), which gave
us a quite nice memory leak. This patch adds the missing calls.

Fixes: f11d5f0 ("FROMLIST: drm/rockchip: Do not use DMA mapping API if
attached to IOMMU domain")

BUG=chrome-os-partner:57158
TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 &&
 backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/385456
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_gem.c

Change-Id: I3c7b21ed22cfb38f512150f76fced3b0cc2b296d
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:32:20 +08:00
Tomasz Figa
909a224e0c CHROMIUM: drm/rockchip: Fix the call to drm_gem_put_pages()
When freeing the buffer we don't have any means of determining if the
buffer was read or written, so we must assume both and pass true for
both arguments of drm_gem_put_pages(). Let's fix the code which
currently passes false.

BUG=chrome-os-partner:56378
TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 &&
 backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Change-Id: I7da2fd81e7e728e0ef242837b70819c4a3aee7bf
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/382934
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:32:02 +08:00
Shunqian Zheng
cacb6f5876 FROMLIST: drm/rockchip: Use common IOMMU API to attach devices
Rockchip DRM used the arm special API, arm_iommu_*(), to attach
iommu for ARM32 SoCs. This patch convert to common iommu API
so it would support ARM64 like RK3399.

Since previous patch added support for direct IOMMU address space
management, there is no need to use DMA API anymore and this patch wires
things to use the new method.

Signed-off-by: Shunqian Zheng <zhengsq@rock-chips.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
(am from https://patchwork.kernel.org/patch/9196389/)

BUG=chrome-os-partner:53565
TEST=boot to ui on Gru

Reviewed-on: https://chromium-review.googlesource.com/349521
Commit-Ready: Tomasz Figa <tfiga@chromium.org>
Tested-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_drv.c

Change-Id: Ide4ce9f74fd431f0b7cd480e38b683f833733b40
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:31:06 +08:00
Mark Yao
0d25ebc825 UPSTREAM: drm/rockchip: support non-iommu buffer path
Some rockchip vop not support iommu, need use non-iommu
buffer for it. And if we get iommu issues, we can compare
the issues with non-iommu path, that would help the debug.

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_drv.c

Change-Id: I843f087281300359b07faac1de156cd648325b45
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
(cherry picked from commit 2d90d47743)
2016-12-07 14:29:53 +08:00
John Keeping
e680ec3a13 UPSTREAM: drm/rockchip: don't leak iommu mapping
arm_iommu_attach_device() takes its own reference to the mapping we give
it.  Since we do not keep a reference to the mapping ourselves, we must
release it before returning.

Also fix the error path, which fails to release the mapping if it has
called arm_iommu_detach_device() since that clears archdata.mapping.

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_drv.c

Change-Id: Ia20334afbce08ece5a3238a7b0786547ec0cafb2
Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Randy Li <randy.li@rock-chips.com>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 69b007968e)
2016-12-07 14:21:42 +08:00
John Keeping
2097aa410e UPSTREAM: drm/rockchip: remove redundant statement
The call to arm_iommu_detach_device() on the previous line sets
dev->archdata.mapping to NULL so this call is always a no-op.

Change-Id: I09b41c284c61885fb4b989a64839e96bcc316aa6
Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit aa1ac27f48)
2016-12-07 14:17:44 +08:00
Haixia Shi
1a1ef00409 CHROMIUM: rockchip: support prime import sg table
The prime fd to handle ioctl was not used with rockchip before. Support
was added in order to pass graphics_Gbm and to support potential uses
within Chrome OS (e.g. zero-copy video decode, camera).

Difference from kernel 3.14 implementation:
- prime_import_sg_table passes dma-buf as argument instead of size
- need to handle import sg_table for both DMA and IOMMU paths

TEST=test_that graphics_Gbm on kevin
BUG=chrome-os-partner:56526

Reviewed-on: https://chromium-review.googlesource.com/381991
Tested-by: Haixia Shi <hshi@chromium.org>
Commit-Queue: Haixia Shi <hshi@chromium.org>
Trybot-Ready: Haixia Shi <hshi@chromium.org>
Reviewed-by: Haixia Shi <hshi@chromium.org>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_gem.c

Change-Id: I7aae5b0e227de61ac17adf98996152da8db097d2
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:08:46 +08:00
Tomasz Figa
103866399a FROMLIST: drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain
The API is not suitable for subsystems consisting of multiple devices
and requires severe hacks to use it. To mitigate this, this patch
implements allocation and address space management locally by using
helpers provided by DRM framework, like other DRM drivers do, e.g.
Tegra.

This patch should not introduce any functional changes until the driver
is made to attach subdevices into an IOMMU domain with the generic IOMMU
API, which will happen in following patch. Based heavily on GEM
implementation of Tegra DRM driver.

Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Shunqian Zheng <zhengsq@rock-chips.com>
(am from https://patchwork.kernel.org/patch/9196387/)

BUG=chrome-os-partner:53565
TEST=boot to ui on Gru

Reviewed-on: https://chromium-review.googlesource.com/353591
Commit-Ready: Tomasz Figa <tfiga@chromium.org>
Tested-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_drv.h
	drivers/gpu/drm/rockchip/rockchip_drm_gem.c
	drivers/gpu/drm/rockchip/rockchip_drm_gem.h

Change-Id: I599b2551e8e8000024894426e4e19d7543af3b0a
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:08:38 +08:00
Jeffy Chen
982ceedab0 Revert "drm/rockchip: rewrite IOMMU support code"
This reverts commit b435f1a281.

Conflicts:
	drivers/gpu/drm/rockchip/Kconfig
	drivers/gpu/drm/rockchip/rockchip_drm_drv.h

Change-Id: I15d2d598514c2878a574219fe2268ee8d530d6e2
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:08:31 +08:00
Jeffy Chen
6bab72066b Revert "drm/rockchip: gem: import dma_buf to gem"
This reverts commit a05932da07.

Change-Id: I91f9efb690fe4f82b5bf34debca6f7612bbd9e4e
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:08:23 +08:00
Randy Li
9497a6ec97 video: build rockchip video driver modules independently
There is not need to force the video driver dependency in parent
tree.

Also there would be too many entries in a menu, I create a submenu
for them.

Change-Id: Id3bd54fa6274b1311ff6b20f95ffeb0d1851d9f9
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 11:02:14 +08:00
Randy Li
5e9627e661 ARM: dts: rockchip: switch to vpu-service in asus miniarm
We decide to offer the video support in old way.

Change-Id: I0b30f7b2b559596ee124b8558cd54e0ff090ab79
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 11:00:30 +08:00
Randy Li
90a43a889a ARM: dts: rockchip: rk3288 hevc using same clk freqs as android
If you meet a performance issue, I would suggest you to set
500MHZ for ACLK_HEVC at rk3288. It could solve the decoding quite
slow for some video resources.

Change-Id: Iedc2bc90fb13ae89d204dc6b5f5d897acae6812d
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 10:56:54 +08:00
Huang, Tao
ef179e79e9 Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git
* linux-linaro-lsk-v4.4-android: (61 commits)
  Linux 4.4.36
  scsi: mpt3sas: Unblock device after controller reset
  flow_dissect: call init_default_flow_dissectors() earlier
  mei: fix return value on disconnection
  mei: me: fix place for kaby point device ids.
  mei: me: disable driver on SPT SPS firmware
  drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
  mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
  parisc: Also flush data TLB in flush_icache_page_asm
  parisc: Fix race in pci-dma.c
  parisc: Fix races in parisc_setup_cache_timing()
  NFSv4.x: hide array-bounds warning
  apparmor: fix change_hat not finding hat after policy replacement
  cfg80211: limit scan results cache size
  tile: avoid using clocksource_cyc2ns with absolute cycle count
  scsi: mpt3sas: Fix secure erase premature termination
  Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
  USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad
  USB: serial: cp210x: add ID for the Zone DPMX
  usb: chipidea: move the lock initialization to core file
  ...
2016-12-06 20:58:56 +08:00
Robin Murphy
cdcf0e81e0 UPSTREAM: iommu/dma: Implement scatterlist segment merging
Stop wasting IOVA space by over-aligning scatterlist segments for a
theoretical worst-case segment boundary mask, and instead take the real
limits into account to merge consecutive segments wherever appropriate,
so our callers can benefit from getting back nicely simplified lists.

This also represents the last piece of functionality wanted by users of
the current arch/arm implementation, thus brings us a small step closer
to converting that over to the common code.

Change-Id: Ie583142efece02dfa6678d5e8607b5bc7266f50c
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 809eac54cd)
2016-12-06 20:48:37 +08:00
dalong.zhang
6c629fe42a camera: rockchip: camsys driver v0.0x21.8
Change-Id: Ib0fed5df3edfe4dae042999e71c50d67a490f88e
Signed-off-by: dalong.zhang <dalon.zhang@rock-chips.com>
2016-12-06 20:09:32 +08:00
Mark Yao
ed7a71b986 ARM64: dts: rk3399: sapphire: add uboot logo support for android next
Change-Id: If206ba4d67f3609e56fe0bfe1f4063e0616ba50a
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-06 18:39:44 +08:00
Elaine Zhang
7bd6c00e01 ARM: dts: rockchip: rk3288: add qos node
when pd power on/off, the qos regs need to save and restore.

Change-Id: Idd6854022fb25538e82238f25a650a687e918a56
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
2016-12-06 18:35:33 +08:00
Alex Shi
bdcf7d8df4 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Conflicts:
	keep low scan freq in android in net/wireless/scan.c
2016-12-06 13:01:29 +08:00
Zorro Liu
0a868c9579 arm64: dts: rk3399-sapphire-excavator-linux: add fiq_debugger node
Change-Id: I6d2c97a06a7c252eec47ab3b1e686b1799780171
Signed-off-by: Zorro Liu <lyx@rock-chips.com>
2016-12-05 21:29:40 +08:00
Luo wei
c88222e493 hid: rkvr: add 0x110 key event used for touchpad
Change-Id: I8a57bbddcf1115414c1567aa05c4c19ecb1ce02c
Signed-off-by: Luo wei <lw@rock-chips.com>
2016-12-05 20:48:07 +08:00
Bin Yang
15d0aa3c47 arm64: dts: rockchip: enable isp node for rk3399-mid-818-android-next
Change-Id: Ic6d489ab7a65cf9ec3c7d03b00541f946cb57b84
Signed-off-by: Bin Yang <yangbin@rock-chips.com>
2016-12-05 20:42:53 +08:00
Bin Yang
625abf44e6 arm64: dts: rockchip: Add RK3399 Excavator dts for drm
Change-Id: I8da4f4bc4a903e4e3702f6e5dbedb72cd5ee627f
Signed-off-by: Cody Xie <xkd@rock-chips.com>
Signed-off-by: Bin Yang <yangbin@rock-chips.com>
2016-12-05 20:42:18 +08:00
Dan Carpenter
f9afe485c7 UPSTREAM: PCI: rockchip: Indent an if statement
The if statement wasn't intended.  Add a tab.

Change-Id: I33e4fce2cc2052dc45c3c7a2617586cdd6a6b664
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
(cherry picked from commit 08015ee0ff)
2016-12-05 20:18:31 +08:00
Alex Shi
3ba1692e72 Merge tag 'v4.4.36' into linux-linaro-lsk-v4.4
This is the 4.4.36 stable release
2016-12-05 12:01:22 +08:00
Huang, Tao
45cd824a30 Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git
* linux-linaro-lsk-v4.4-android: (315 commits)
  Linux 4.4.35
  netfilter: nft_dynset: fix element timeout for HZ != 1000
  IB/cm: Mark stale CM id's whenever the mad agent was unregistered
  IB/uverbs: Fix leak of XRC target QPs
  IB/core: Avoid unsigned int overflow in sg_alloc_table
  IB/mlx5: Fix fatal error dispatching
  IB/mlx5: Use cache line size to select CQE stride
  IB/mlx4: Fix create CQ error flow
  IB/mlx4: Check gid_index return value
  PM / sleep: don't suspend parent when async child suspend_{noirq, late} fails
  PM / sleep: fix device reference leak in test_suspend
  uwb: fix device reference leaks
  mfd: core: Fix device reference leak in mfd_clone_cell
  iwlwifi: pcie: fix SPLC structure parsing
  rtc: omap: Fix selecting external osc
  clk: mmp: mmp2: fix return value check in mmp2_clk_init()
  clk: mmp: pxa168: fix return value check in pxa168_clk_init()
  clk: mmp: pxa910: fix return value check in pxa910_clk_init()
  drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)
  crypto: caam - do not register AES-XTS mode on LP units
  ...

Change-Id: Ic14c01a22a5e8a0356d6c0ef6bcca7bc6cad6b4b
2016-12-02 20:31:31 +08:00
Huang, Tao
51691b93c5 Revert "FROMLIST: PM / sleep: don't suspend parent when async child suspend_{noirq,late} fails"
This reverts commit 11b2dcefd8.
Fixed by 04c0800c73 ("PM / sleep: don't suspend parent when
async child suspend_{noirq, late} fails").
2016-12-02 19:53:55 +08:00
Huang, Tao
ff3e800bfc rockchip/vcodec: drop needless devm_clk_put
Also make sure clk is NULL if get failed.

Change-Id: I102175a108c6e7a91948d82cce97c1a1d88a071e
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
2016-12-02 19:38:33 +08:00
Mark Yao
a0789a0c38 ARM64: dts: rk3399-android-next: default use vopb for primary display
Change-Id: I2655905aa3f63e19c8367701af36f462d399d2f3
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 19:10:41 +08:00
Mark Yao
a8091fbafa drm/rockchip: vop: skip config timing on vblank
Change-Id: I7aace5e26f6c9889c9e216f7b7233ec7e5530776
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 19:10:40 +08:00
Mark Yao
433e5da577 drm/rockchip: vop: fix display logo flash with line flag
Use standy with dsp_hold intr would effect display timing,
Some display controller can't not allow this, such as edp,
edp panel would flash with it.

Use line flag instead it seems good.

Change-Id: Iecf818c0dbd5a7833e6cec0da60fe3e693b3dc9d
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 19:10:39 +08:00
Tomasz Figa
b8c785afcf CHROMIUM: drm/rockchip: Clear interrupt status bits before enabling
The enable register only masks the raw status bits to signal CPU
interrupt only for enabled interrupts. The status bits are activated
regardless of the enable register. This means that we might have an old
interrupt event queued, which we are not interested in. To avoid getting
a spurious interrupt signalled, we have to clear the old bit before we
update the enable register.

BUG=chrome-os-partner:56378
BUG=chrome-os-partner:56580
TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 && backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Change-Id: I1b8286097f3ba102663ee3a7566fd96492e12d26
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/382973
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 17:11:23 +08:00
Yakir Yang
0e61acfb30 FROMLIST: drm/rockchip: vop: export line flag function
VOP have integrated a hardware counter which indicate the exact display
line that vop is scanning. And if we're interested in a specific line,
we can set the line number to vop line_flag register, and then vop would
generate a line_flag interrupt for it.

For example eDP PSR function is interested in the vertical blanking
period, then driver could set the line number to zero.

This patch have exported a symbol that allow other driver to listen the
line flag event with given timeout limit:
- rockchip_drm_wait_line_flag()

BUG=chrome-os-partner:54785
TEST=Success to call rockchip_drm_wait_line_flag()

Change-Id: Id7605bada87c8ead0e549d4ff113ee49d29ad126
Signed-off-by: Yakir Yang <ykk@rock-chips.com>
(am from https://patchwork.kernel.org/patch/9231675/)
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
Reviewed-on: https://chromium-review.googlesource.com/349084
Commit-Ready: Sean Paul <seanpaul@google.com>
Tested-by: Sean Paul <seanpaul@google.com>
Reviewed-by: Sean Paul <seanpaul@google.com>
2016-12-02 17:07:19 +08:00
Mark Yao
c69d9335f3 drm/rockchip: add loader protect ops to drm connector
Change-Id: Iae26ac5c994727b98db045ae00c62d641f31c4b1
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 17:06:56 +08:00
Greg Kroah-Hartman
87c6c6ef5b Linux 4.4.36 2016-12-02 09:09:18 +01:00
Suganath Prabu S
6eddf5c993 scsi: mpt3sas: Unblock device after controller reset
commit 7ff723ad0f upstream.

While issuing any ATA passthrough command to firmware the driver will
block the device. But it will unblock the device only if the I/O
completes through the ISR path. If a controller reset occurs before
command completion the device will remain in blocked state.

Make sure we unblock the device following a controller reset if an ATA
passthrough command was queued.

[mkp: clarified patch description]

Fixes: ac6c2a93bd07 ("mpt3sas: Fix for SATA drive in blocked state, after diag reset")
Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:02 +01:00
Eric Dumazet
c178e4809d flow_dissect: call init_default_flow_dissectors() earlier
commit c9b8af1330 upstream.

Andre Noll reported panics after my recent fix (commit 34fad54c25
"net: __skb_flow_dissect() must cap its return value")

After some more headaches, Alexander root caused the problem to
init_default_flow_dissectors() being called too late, in case
a network driver like IGB is not a module and receives DHCP message
very early.

Fix is to call init_default_flow_dissectors() much earlier,
as it is a core infrastructure and does not depend on another
kernel service.

Fixes: 06635a35d1 ("flow_dissect: use programable dissector in skb_flow_dissect and friends")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andre Noll <maan@tuebingen.mpg.de>
Diagnosed-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:02 +01:00
Tomas Winkler
0b7860d6e8 mei: fix return value on disconnection
commit 2d4d5481e2 upstream.

Correct errno on client disconnection is -ENODEV not -EBUSY

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:02 +01:00
Tomas Winkler
bab2f72f70 mei: me: fix place for kaby point device ids.
This is fix of the backported patch only, it places
KBL DIDs on correct place to easy on backporting of
further DIDs.

Fixes: 5c99f32c46 ('mei: me: add kaby point device ids')
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
Tomas Winkler
4f13967ecd mei: me: disable driver on SPT SPS firmware
commit 8c57cac145 upstream.

Sunrise Point PCH with SPS Firmware doesn't expose working
MEI interface, we need to quirk it out.
The SPS Firmware is identifiable only on the first PCI function
of the device.

Tested-by: Sujith Pandel <sujith_pandel@dell.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
Michel Dänzer
e1049372d7 drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
NOTE: This patch only applies to 4.5.y or older kernels. With newer
kernels, this problem cannot happen because the driver now uses
drm_crtc_vblank_on/off instead of drm_vblank_pre/post_modeset[0]. I
consider this patch safer for older kernels than backporting the API
change, because drm_crtc_vblank_on/off had various issues in older
kernels, and I'm not sure all fixes for those have been backported to
all stable branches where this patch could be applied.

    ---------------------

Fixes the vblank interrupt being disabled when it should be on, which
can cause at least the following symptoms:

* Hangs when running 'xset dpms force off' in a GNOME session with
  gnome-shell using DRI2.
* RandR 1.4 slave outputs freezing with garbage displayed using
  xf86-video-ati 7.8.0 or newer.

[0] See upstream commit:

commit 777e3cbc79
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Jan 21 11:08:57 2016 +0100

    drm/radeon: Switch to drm_vblank_on/off

Reported-and-Tested-by: Max Staudt <mstaudt@suse.de>
Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
2016-12-02 09:09:01 +01:00
Andrey Ryabinin
2490908309 mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
commit f5527fffff upstream.

This fixes CVE-2016-8650.

If mpi_powm() is given a zero exponent, it wants to immediately return
either 1 or 0, depending on the modulus.  However, if the result was
initalised with zero limb space, no limbs space is allocated and a
NULL-pointer exception ensues.

Fix this by allocating a minimal amount of limb space for the result when
the 0-exponent case when the result is 1 and not touching the limb space
when the result is 0.

This affects the use of RSA keys and X.509 certificates that carry them.

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
PGD 0
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804011944c0 task.stack: ffff880401294000
RIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP: 0018:ffff880401297ad8  EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
FS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
Stack:
 ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
Call Trace:
 [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
 [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
 [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee
 [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
 [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e
 [<ffffffff81001c2b>] do_syscall_64+0x80/0x191
 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
RIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
 RSP <ffff880401297ad8>
CR2: 0000000000000000
---[ end trace d82015255d4a5d8d ]---

Basically, this is a backport of a libgcrypt patch:

	http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526

Fixes: cdec9cb516 ("crypto: GnuPG based MPI lib - source files (part 1)")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
cc: linux-ima-devel@lists.sourceforge.net
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
John David Anglin
cd4235a794 parisc: Also flush data TLB in flush_icache_page_asm
commit 5035b230e7 upstream.

This is the second issue I noticed in reviewing the parisc TLB code.

The fic instruction may use either the instruction or data TLB in
flushing the instruction cache.  Thus, on machines with a split TLB, we
should also flush the data TLB after setting up the temporary alias
registers.

Although this has no functional impact, I changed the pdtlb and pitlb
instructions to consistently use the index register %r0.  These
instructions do not support integer displacements.

Tested on rp3440 and c8000.

Signed-off-by: John David Anglin  <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
John David Anglin
7a1ab6a2bf parisc: Fix race in pci-dma.c
commit c0452fb9fb upstream.

We are still troubled by occasional random segmentation faults and
memory memory corruption on SMP machines.  The causes quite a few
package builds to fail on the Debian buildd machines for parisc.  When
gcc-6 failed to build three times in a row, I looked again at the TLB
related code.  I found a couple of issues.  This is the first.

In general, we need to ensure page table updates and corresponding TLB
purges are atomic.  The attached patch fixes an instance in pci-dma.c
where the page table update was not guarded by the TLB lock.

Tested on rp3440 and c8000.  So far, no further random segmentation
faults have been observed.

Signed-off-by: John David Anglin  <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
John David Anglin
e541fd815d parisc: Fix races in parisc_setup_cache_timing()
commit 741dc7bf1c upstream.

Helge reported to me the following startup crash:

[    0.000000] Linux version 4.8.0-1-parisc64-smp (debian-kernel@lists.debian.org) (gcc version 5.4.1 20161019 (GCC) ) #1 SMP Debian 4.8.7-1 (2016-11-13)
[    0.000000] The 64-bit Kernel has started...
[    0.000000] Kernel default page size is 4 KB. Huge pages enabled with 1 MB physical and 2 MB virtual size.
[    0.000000] Determining PDC firmware type: System Map.
[    0.000000] model 9000/785/J5000
[    0.000000] Total Memory: 2048 MB
[    0.000000] Memory: 2018528K/2097152K available (9272K kernel code, 3053K rwdata, 1319K rodata, 1024K init, 840K bss, 78624K reserved, 0K cma-reserved)
[    0.000000] virtual kernel memory layout:
[    0.000000]     vmalloc : 0x0000000000008000 - 0x000000003f000000   (1007 MB)
[    0.000000]     memory  : 0x0000000040000000 - 0x00000000c0000000   (2048 MB)
[    0.000000]       .init : 0x0000000040100000 - 0x0000000040200000   (1024 kB)
[    0.000000]       .data : 0x0000000040b0e000 - 0x0000000040f533e0   (4372 kB)
[    0.000000]       .text : 0x0000000040200000 - 0x0000000040b0e000   (9272 kB)
[    0.768910] Brought up 1 CPUs
[    0.992465] NET: Registered protocol family 16
[    2.429981] Releasing cpu 1 now, hpa=fffffffffffa2000
[    2.635751] CPU(s): 2 out of 2 PA8500 (PCX-W) at 440.000000 MHz online
[    2.726692] Setting cache flush threshold to 1024 kB
[    2.729932] Not-handled unaligned insn 0x43ffff80
[    2.798114] Setting TLB flush threshold to 140 kB
[    2.928039] Unaligned handler failed, ret = -1
[    3.000419]       _______________________________
[    3.000419]      < Your System ate a SPARC! Gah! >
[    3.000419]       -------------------------------
[    3.000419]              \   ^__^
[    3.000419]                  (__)\       )\/\
[    3.000419]                   U  ||----w |
[    3.000419]                      ||     ||
[    9.340055] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-1-parisc64-smp #1 Debian 4.8.7-1
[    9.448082] task: 00000000bfd48060 task.stack: 00000000bfd50000
[    9.528040]
[   10.760029] IASQ: 0000000000000000 0000000000000000 IAOQ: 000000004025d154 000000004025d158
[   10.868052]  IIR: 43ffff80    ISR: 0000000000340000  IOR: 000001ff54150960
[   10.960029]  CPU:        1   CR30: 00000000bfd50000 CR31: 0000000011111111
[   11.052057]  ORIG_R28: 000000004021e3b4
[   11.100045]  IAOQ[0]: irq_exit+0x94/0x120
[   11.152062]  IAOQ[1]: irq_exit+0x98/0x120
[   11.208031]  RP(r2): irq_exit+0xb8/0x120
[   11.256074] Backtrace:
[   11.288067]  [<00000000402cd944>] cpu_startup_entry+0x1e4/0x598
[   11.368058]  [<0000000040109528>] smp_callin+0x2c0/0x2f0
[   11.436308]  [<00000000402b53fc>] update_curr+0x18c/0x2d0
[   11.508055]  [<00000000402b73b8>] dequeue_entity+0x2c0/0x1030
[   11.584040]  [<00000000402b3cc0>] set_next_entity+0x80/0xd30
[   11.660069]  [<00000000402c1594>] pick_next_task_fair+0x614/0x720
[   11.740085]  [<000000004020dd34>] __schedule+0x394/0xa60
[   11.808054]  [<000000004020e488>] schedule+0x88/0x118
[   11.876039]  [<0000000040283d3c>] rescuer_thread+0x4d4/0x5b0
[   11.948090]  [<000000004028fc4c>] kthread+0x1ec/0x248
[   12.016053]  [<0000000040205020>] end_fault_vector+0x20/0xc0
[   12.092239]  [<00000000402050c0>] _switch_to_ret+0x0/0xf40
[   12.164044]
[   12.184036] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-1-parisc64-smp #1 Debian 4.8.7-1
[   12.244040] Backtrace:
[   12.244040]  [<000000004021c480>] show_stack+0x68/0x80
[   12.244040]  [<00000000406f332c>] dump_stack+0xec/0x168
[   12.244040]  [<000000004021c74c>] die_if_kernel+0x25c/0x430
[   12.244040]  [<000000004022d320>] handle_unaligned+0xb48/0xb50
[   12.244040]
[   12.632066] ---[ end trace 9ca05a7215c7bbb2 ]---
[   12.692036] Kernel panic - not syncing: Attempted to kill the idle task!

We have the insn 0x43ffff80 in IIR but from IAOQ we should have:
   4025d150:   0f f3 20 df     ldd,s r19(r31),r31
   4025d154:   0f 9f 00 9c     ldw r31(ret0),ret0
   4025d158:   bf 80 20 58     cmpb,*<> r0,ret0,4025d18c <irq_exit+0xcc>

Cpu0 has just completed running parisc_setup_cache_timing:

[    2.429981] Releasing cpu 1 now, hpa=fffffffffffa2000
[    2.635751] CPU(s): 2 out of 2 PA8500 (PCX-W) at 440.000000 MHz online
[    2.726692] Setting cache flush threshold to 1024 kB
[    2.729932] Not-handled unaligned insn 0x43ffff80
[    2.798114] Setting TLB flush threshold to 140 kB
[    2.928039] Unaligned handler failed, ret = -1

From the backtrace, cpu1 is in smp_callin:

void __init smp_callin(void)
{
       int slave_id = cpu_now_booting;

       smp_cpu_init(slave_id);
       preempt_disable();

       flush_cache_all_local(); /* start with known state */
       flush_tlb_all_local(NULL);

       local_irq_enable();  /* Interrupts have been off until now */

       cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);

So, it has just flushed its caches and the TLB. It would seem either the
flushes in parisc_setup_cache_timing or smp_callin have corrupted kernel
memory.

The attached patch reworks parisc_setup_cache_timing to remove the races
in setting the cache and TLB flush thresholds. It also corrects the
number of bytes flushed in the TLB calculation.

The patch flushes the cache and TLB on cpu0 before starting the
secondary processors so that they are started from a known state.

Tested with a few reboots on c8000.

Signed-off-by: John David Anglin  <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
Arnd Bergmann
0c0ddbf7ef NFSv4.x: hide array-bounds warning
commit d55b352b01 upstream.

A correct bugfix introduced a harmless warning that shows up with gcc-7:

fs/nfs/callback.c: In function 'nfs_callback_up':
fs/nfs/callback.c:214:14: error: array subscript is outside array bounds [-Werror=array-bounds]

What happens here is that the 'minorversion == 0' check tells the
compiler that we assume minorversion can be something other than 0,
but when CONFIG_NFS_V4_1 is disabled that would be invalid and
result in an out-of-bounds access.

The added check for IS_ENABLED(CONFIG_NFS_V4_1) tells gcc that this
really can't happen, which makes the code slightly smaller and also
avoids the warning.

The bugfix that introduced the warning is marked for stable backports,
we want this one backported to the same releases.

Fixes: 98b0f80c23 ("NFSv4.x: Fix a refcount leak in nfs_callback_up_net")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
John Johansen
be79d7fa43 apparmor: fix change_hat not finding hat after policy replacement
commit 3d40658c97 upstream.

After a policy replacement, the task cred may be out of date and need
to be updated. However change_hat is using the stale profiles from
the out of date cred resulting in either: a stale profile being applied
or, incorrect failure when searching for a hat profile as it has been
migrated to the new parent profile.

Fixes: 01e2b670aa (failure to find hat)
Fixes: 898127c34e (stale policy being applied)
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00
Johannes Berg
8316338a20 cfg80211: limit scan results cache size
commit 9853a55ef1 upstream.

It's possible to make scanning consume almost arbitrary amounts
of memory, e.g. by sending beacon frames with random BSSIDs at
high rates while somebody is scanning.

Limit the number of BSS table entries we're willing to cache to
1000, limiting maximum memory usage to maybe 4-5MB, but lower
in practice - that would be the case for having both full-sized
beacon and probe response frames for each entry; this seems not
possible in practice, so a limit of 1000 entries will likely be
closer to 0.5 MB.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:01 +01:00