Commit Graph

507837 Commits

Author SHA1 Message Date
Linus Torvalds 4e8a4830dc irqchip fixes for v4.0 (round 2)
- GICv3 ITS
     - Small batch of fixes discovered while writing the kvm ITS emulation
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJVHcHDAAoJEP45WPkGe8ZnrXUP/Rp67onmizG6AtVNTCB5HT0V
 6HNrLS4cnlpkFpWLf75ojZKfjJ/Gi3Bo4aqie9iWbOgGuI4/vxo35FdoBP8992k2
 Stm++FR1jWdxbsTZJxdIqkl2uw7enA/0wpJL2JttdHFb+7Inirh0rphEyNAw24y4
 Qe1hQT+c4CzCLA6ED5bqN7z28X9RoesW6dt8zDk/08IrolVsVSt+ZEdepBBBIZYf
 u3d+mOP0UohAew+g+hVLvwTplcQVQK+ZGdnzoyMf9s/3r2bAobGFZvCQxoJLm7fw
 tAV1Uf/iYFkqBzWYj8VC9crxY7QK2sr68OA+QMAkJoBYW0ypBowvggx+noAd4FO4
 jPKGbmEJrYxbk3woxwZKvihU1fXbsQq8OykEk/urZeZyCPIXz9TIDneiI+RGGh9a
 1o6Iu605bbKttwzlHjzU8C0y34qDLyJpA+zjIQJbXWOExyHynP4jIDEkvV7PGIQn
 Z88QKvkDn0TUdnPkaBUHOI1Y6SJm/ernR0FomIKWyd4innwfjyQCTRXaCryfRVWW
 lLRSakFyaRWjmNX50eDRp8x8yUPJhyg4Dd25Dd4KWZv5QhD7DJctywwjDCf+l9jC
 8U8BbvhbPO2pwXratGNcbjapotAHX9Y46BHr0TrI4nbcaUz5+JvPLMQE6UA/92SQ
 aT8pb4m7zfS5zhZPL06D
 =Q4Dt
 -----END PGP SIGNATURE-----

Merge tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linux

Pull irqchip fixes from Jason Cooper:
 "This is the second round of fixes for irqchip.  It contains some fixes
  found while the arm64 guys were writing the kvm gicv3 its emulation.

  GICv3 ITS:
    - Small batch of fixes discovered while writing the kvm ITS emulation"

* tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linux:
  irqchip: gicv3-its: Use non-cacheable accesses when no shareability
  irqchip: gicv3-its: Fix PROP/PEND and BASE/CBASE confusion
  irqchip: gicv3-its: Fix device ID encoding
  irqchip: gicv3-its: Fix encoding of collection's target redistributor
2015-04-02 16:37:56 -07:00
Dave Airlie 51b52fac9b Merge branch 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
Just two small fixes for radeon, both destined for stable.

* 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix wait in radeon_mn_invalidate_range_start
  drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
2015-04-03 09:28:55 +10:00
Dave Airlie 165b11bfe4 Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes
Fix display on issue to Exynos5250 based Snow(1366x768) board.

* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm: Exynos: Respect framebuffer pitch for FIMD/Mixer
2015-04-03 09:28:18 +10:00
Dave Airlie 3fa50dc3be Merge tag 'drm-intel-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel into drm-fixes
one oops fixes and a 0-length allocation fix from next backported.

* tag 'drm-intel-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Reject the colorkey ioctls for primary and cursor planes
  drm/i915: Skip allocating shadow batch for 0-length batches
2015-04-03 09:27:48 +10:00
Dave Airlie c7d748743f Merge tag 'topic/drm-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel into drm-fixes
Here's a single drm core fix, cc: stable, that affects i915
users.

* tag 'topic/drm-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel:
  drm/edid: set ELD for firmware and debugfs override EDIDs
2015-04-03 09:27:15 +10:00
Linus Torvalds b0838b1501 xen: regression fixes for 4.0-rc6
- Fix two regressions in the balloon driver's use of memory hotplug
   when used in a PV guest.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJVHWimAAoJEFxbo/MsZsTRSFkH/A1SYwcqUADPVZYDSc2T10Km
 1kF7UifizlJ8/gCbEbhzLMDSPTwEENzN5ONWXQ+a3EXuK0UwLBnic9uKWAg2Q8cp
 +uIpU1P15yM7rJFRaf6PZ2BqFdvWpXUJgNnof4+r0uqqa57hdmVOmVMKFenlf/h7
 2jj0b19wS6jhuwl9PzgKTKQyjnpWrmkhfg5tDQzn1qUCHoKDIhM7ROUP7wsYfIu8
 iAT3JV9lmNwdGT5jwf4MgRmBpqGZzQs03xaAz2E9/fnWWv7u4EuZcmbDcooUmi7H
 luHQ2Dds1ajhjgtRwPoxT0tHFuRl7s0jsyJ8GOLsdmoMkJTAQnQA21egI7Bpdfo=
 =HHbI
 -----END PGP SIGNATURE-----

Merge tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen regression fixes from David Vrabel:
 "Fix two regressions in the balloon driver's use of memory hotplug when
  used in a PV guest"

* tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/balloon: before adding hotplugged memory, set frames to invalid
  x86/xen: prepare p2m list for memory hotplug
2015-04-02 13:53:53 -07:00
Linus Torvalds 1d514333da powerpc fixes for 4.0 # 3
- fix memory corruption by pnv_alloc_idle_core_states
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVHQVRAAoJEFHr6jzI4aWAo/EP/3PP2mtINAbrOxRYNkSVxTJB
 L49XFuIIVPvZPv7PKps5nZ39Gvxlr/hNI64u0y7zrKMhtu5/YczzOSU2KCsvO3ky
 b3eohWGeifXGHQhswua/IF69sJ0mV+5iMAhOiIzYDuqb5vY2fgWjSgm9E5FJtmh8
 6Odsbs4GZnYh3fxMaqurJ2xRV7jVXiK2s9N7x3bXgSrHMjGyaEKI50yuAdFdMTNE
 xal/lAxTdO8I7HqBdU090d3bCltA19XX3DkZFi9JRjb7+sF5HIfNNC2EJfLzCY1v
 HhOHLbpUkqJiEb6cYTCsOgDpGhbDFBb797ZEPYYGHLDHEJotXRad44h8j3kiErLe
 Ig0dwgtNPgpWWuBW+f70KK/G0GqQ6cGDH7LYCkvUxCJu2Qx7uxr+A++KpBcEbJFo
 TOsL6fR11FfeHozBrOBiYLvZLUZHBdeCAN2FcrhNLeiheMclxwfZcyaFjM7Ssbih
 Wyk4lFTGvaFSBmtfXvTklpX8Z6V4n/yA/ZFfVuAvGYw5XMK29c/0gvgWc6PPu0X6
 DVdkFJjR2PAf4iln2/NItiT7fKYrjFqga9Rsu1WTFhBZ342auYgLSlnZKYZTax9d
 hxoj8Y1GYkq5VKaFY8ekpeVixdc+2zuha3T2Hr7DpPIZZZVYztTnfLsWuAm5yAQ6
 WO+LsGv/5nPMbrKO9TLF
 =PeVe
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux

Pull powerpc fix from Michael Ellerman:
 "Fix memory corruption by pnv_alloc_idle_core_states"

* tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
  powerpc: fix memory corruption by pnv_alloc_idle_core_states
2015-04-02 13:48:43 -07:00
Neal Cardwell 666b805150 tcp: fix FRTO undo on cumulative ACK of SACKed range
On processing cumulative ACKs, the FRTO code was not checking the
SACKed bit, meaning that there could be a spurious FRTO undo on a
cumulative ACK of a previously SACKed skb.

The FRTO code should only consider a cumulative ACK to indicate that
an original/unretransmitted skb is newly ACKed if the skb was not yet
SACKed.

The effect of the spurious FRTO undo would typically be to make the
connection think that all previously-sent packets were in flight when
they really weren't, leading to a stall and an RTO.

Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Fixes: e33099f96d ("tcp: implement RFC5682 F-RTO")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-04-02 16:35:58 -04:00
Linus Torvalds 06459fc02f One 4.0 RDMA change:
- Fix for exploitable integer overflow in uverbs interface.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJVHXfzAAoJEENa44ZhAt0hRzoP/00LTWa/XN9lyaF55vPwTvI1
 AeTAIomgiazCqPNS5/gy+V0qaG9rwMD40K1+zWZJDQazswioG7CA9uA0aEBusJke
 bwoAIVW3ozBC/+e0BOdQENuVKm49a9Vjar2UJUPNQzwGvbyTTQy+7+3JZZ9ZYP1p
 rkP3/E7ql/qhDhfWLWrj81/mZI5WXQbkgW7F/vRS5Q+ltosE8DJUNFC1QhW0bo7y
 LmcTM72C/sBeVorTsYT2q03aA5YyAyHf3EzdebRUn1WpH3B/w/3QOHLRynEjyWxo
 7QgWtdqKIdy9z9CzD/KFdSJowtByjcZHutdS5v3GL2IL80XEbILwh9X+7sE9q9RU
 FFDl5JLNkxjQ3fF+wCk4NMpjoFxeTa42YDyYVyOhc3WXITtnVacAkPh+62//tG4D
 Z/Mcoa0fcuQRDfT6kW5jVQf0BSTcgNuv+fVt2d50Kase2IU5f96G54zl2WnqTvQR
 aVvr2E+O5jfPJEmKyjjNWurkE3pUARSzN8aoRlxrWdqrrBIS6elJqWFmA4ZChuvS
 ITLt6ErWNyyLD6WtdnDBu70jPhX6w9sAbyF3QtBB0LYo5jWLW4qLdTrDkVU2bI+D
 64ZK4PdMXaI4+AiJY0QlgnusQ0nmgWu1FjkIiOVEBH/DDaraxET9f716cpr1V9Qn
 WzPu/hNmXclaePHC3yvy
 =KygA
 -----END PGP SIGNATURE-----

Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

Pull infiniband/rdma fix from Roland Dreier:
 "Fix for exploitable integer overflow in uverbs interface"

* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
2015-04-02 13:35:58 -07:00
Jonathan Davies 0c36820e2a xen-netfront: transmit fully GSO-sized packets
xen-netfront limits transmitted skbs to be at most 44 segments in size. However,
GSO permits up to 65536 bytes, which means a maximum of 45 segments of 1448
bytes each. This slight reduction in the size of packets means a slight loss in
efficiency.

Since c/s 9ecd1a75d, xen-netfront sets gso_max_size to
    XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER,
where XEN_NETIF_MAX_TX_SIZE is 65535 bytes.

The calculation used by tcp_tso_autosize (and also tcp_xmit_size_goal since c/s
6c09fa09d) in determining when to split an skb into two is
    sk->sk_gso_max_size - 1 - MAX_TCP_HEADER.

So the maximum permitted size of an skb is calculated to be
    (XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER) - 1 - MAX_TCP_HEADER.

Intuitively, this looks like the wrong formula -- we don't need two TCP headers.
Instead, there is no need to deviate from the default gso_max_size of 65536 as
this already accommodates the size of the header.

Currently, the largest skb transmitted by netfront is 63712 bytes (44 segments
of 1448 bytes each), as observed via tcpdump. This patch makes netfront send
skbs of up to 65160 bytes (45 segments of 1448 bytes each).

Similarly, the maximum allowable mtu does not need to subtract MAX_TCP_HEADER as
it relates to the size of the whole packet, including the header.

Fixes: 9ecd1a75d9 ("xen-netfront: reduce gso_max_size to account for max TCP header")
Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-04-02 16:18:58 -04:00
Linus Torvalds 0a4812798f Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Pull dmaengine fixes from Vinod Koul:
 "This time we have addition of caps for jz4740 which fixes intentional
  warning at boot.  Then we have memory leak issues in drivers using
  virt-dma by Peter on few drive"

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: moxart-dma: Fix memory leak when stopping a running transfer
  dmaengine: bcm2835-dma: Fix memory leak when stopping a running transfer
  dmaengine: omap-dma: Fix memory leak when terminating running transfer
  dmaengine: edma: fix memory leak when terminating running transfers
  dmaengine: jz4740: Define capabilities
2015-04-02 11:30:36 -07:00
Linus Torvalds 8172ba51e2 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Fix use-after-free with mac80211 RX A-MPDU reorder timer, from
    Johannes Berg.

 2) iwlwifi leaks memory every module load/unload cycles, fix from Larry
    Finger.

 3) Need to use for_each_netdev_safe() in rtnl_group_changelink()
    otherwise we can crash, from WANG Cong.

 4) mlx4 driver does register_netdev() too early in the probe sequence,
    from Ido Shamay.

 5) Don't allow router discovery hop limit to decrease the interface's
    hop limit, from D.S. Ljungmark.

 6) tx_packets and tx_bytes improperly accounted for certain classes of
    USB network devices, fix from Ben Hutchings.

 7) ip{6}mr_rules_init() mistakenly use plain kfree to release the ipmr
    tables in the error path, they must instead use ip{6}mr_free_table().
    Fix from WANG Cong.

 8) cxgb4 doesn't properly quiesce all RX activity before unregistering
    the netdevice.  Fix from Hariprasad Shenai.

 9) Fix hash corruptions in ipvlan driver, from Jiri Benc.

10) nla_memcpy(), like a real memcpy, should fully initialize the
    destination buffer, even if the source attribute is smaller.  Fix
    from Jiri Benc.

11) Fix wrong error code returned from iucv_sock_sendmsg().  We should
    use whatever sock_alloc_send_skb() put into 'err'.  From Eugene
    Crosser.

12) Fix slab object leak on module unload in TIPC, from Ying Xue.

13) Need a READ_ONCE() when reading the cached RX socket route in
    tcp_v{4,6}_early_demux().  From Michal Kubecek.

14) Still too many problems with TPC support in the ath9k driver, so
    disable it for now.  From Felix Fietkau.

15) When in AP mode the rtlwifi driver can leak DMA mappings, fix from
    Larry Finger.

16) Missing kzalloc() failure check in gs_usb CAN driver, from Colin Ian
    King.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
  cxgb4: Fix to dump devlog, even if FW is crashed
  cxgb4: Firmware macro changes for fw verison 1.13.32.0
  bnx2x: Fix kdump when iommu=on
  bnx2x: Fix kdump on 4-port device
  mac80211: fix RX A-MPDU session reorder timer deletion
  MAINTAINERS: Update Intel Wired Ethernet Driver info
  tipc: fix a slab object leak
  net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet
  af_iucv: fix AF_IUCV sendmsg() errno
  openvswitch: Return vport module ref before destruction
  netlink: pad nla_memcpy dest buffer with zeroes
  bonding: Bonding Overriding Configuration logic restored.
  ipvlan: fix check for IP addresses in control path
  ipvlan: do not use rcu operations for address list
  ipvlan: protect against concurrent link removal
  ipvlan: fix addr hash list corruption
  net: fec: setup right value for mdio hold time
  net: tcp6: fix double call of tcp_v6_fill_cb()
  cxgb4vf: Fix sparse warnings
  netns: don't clear nsid too early on removal
  ...
2015-04-02 11:09:41 -07:00
Philipp Zabel 1c550fa193 drm/panel: Add support for Ampire AM-800480R3TMQW-A1H 800x480 7" panel
This adds support for the AM-800480R3TMQW-A1H 7" 800x480 panel to the
DRM simple panel driver.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:15 +02:00
Philipp Zabel 9df6d49adb of: Add vendor prefix for Ampire Co., Ltd.
Add Ampire Co., Ltd. to the list of device tree vendor prefixes.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:14 +02:00
Philipp Zabel ab07725abc drm/panel: Add display timing for HannStar HSD070PWW1
The HannStar HSD070PWW1 LVDS panel data sheet lists allowed ranges
additionally to the typical values for pixel clock rate (64.3-82 MHz)
and blanking intervals (54-681 clock cycles horizontally, 3-23 lines
vertically).

This patch replaces this panel's display mode with the display timing
information to describe acceptable timings. Since the HSYNC and VSYNC
are unused, the distribution between front porches, back porches, and
sync pulse lengths was chosen at will.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:14 +02:00
Philipp Zabel a5d3e62514 drm/panel: simple: Add display timing support
The simple panel driver's ->get_modes() implementation calculates the
display mode list from the typical timings and the ->get_timings()
implementation returns the timings to the connected encoder for mode
validation and fixup.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
[treding@nvidia.com: select VIDEOMODE_HELPERS]
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:13 +02:00
Philipp Zabel 2938931f37 drm/panel: Add display timing support
Many panel data sheets, additionally to typical values, list allowed
ranges for timings such as hsync/vsync lengths, porches, and the pixel
clock rate. These can be stored in a struct display_timing, to be used
by an encoder mode_fixup callback to clamp user provided timing values
or to validate workarounds for clock source limitations.

This patch adds a new drm_panel_funcs callback that returns the panel's
available display_timing entries.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:12 +02:00
Philipp Zabel 725c9d40f3 drm/panel: Add support for OrtusTech COM43H4M85ULC panel
This adds support for the COM43H4M85ULC 3.7" 800x480 panel to the
DRM simple panel driver.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:12 +02:00
Philipp Zabel d75ce3854b of: Add vendor prefix for Ortus Technology Co., Ltd.
Add Ortus Technology Co., Ltd. to the list of device tree vendor prefixes.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:11 +02:00
Philipp Zabel 33536a09f0 drm/panel: Add bus format for Giantplus GPG482739QS5 panel
This patch adds the bus_format field to the GPG482739QS5 panel structure.

Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:11 +02:00
Huang Lin a531bc3d95 drm/panel: simple: Add support for AUO b101ean01 panel
The AUO b101ean01 panel is a 10.1" 1280x800 panel which can be supported
by the simple panel driver.

Signed-off-by: Huang Lin <hl@rock-chips.com>
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:10 +02:00
Michael Grzeschik bccac3f121 drm/panel: simple: Add support for Innolux ZJ070NA-01P
The Innolux ZJ070NA-01P is a 7.0" TFT LCD panel with an integrated LED
backlight unit.

This panel is used on the Technexion Toucan.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:10 +02:00
Nicolas Ferre 41bcceb4de drm/panel: simple: Add support for Innolux AT043TN24
The Innolux AT043TN24 4.3" WQVGA TFT LCD panel.
This panel with backlight is found in PDA 4.3" LCD screen (TM43xx series for
instance).

Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:09 +02:00
Boris BREZILLON 9c6615bc37 drm/panel: simple: Add support for Shelly SCA07010-BFN-LNN
The Shelly SCA07010-BFN-LNN is a 7.0" WVGA TFT LCD panel.
This panel with backlight is found in PDA 7" LCD screen (TM70xx series for
instance).

Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:08 +02:00
Stéphane Marchesin 0c934306ec drm/panel: simple: Add support for Samsung LTN140AT29 panel
This panel is used by the Nyan Blaze board and can be supported by the
simple-panel driver.

Signed-off-by: Stéphane Marchesin <marcheu@chromium.org>
[tomeu.vizoso@collabora.com: add device tree binding document]
Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Acked-by: Stephen Warren <swarren@nvidia.com>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 19:04:08 +02:00
Shachar Raindel 8494057ab5 IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.

Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.

This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.

Addresses: CVE-2014-8159
Cc: <stable@vger.kernel.org>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2015-04-02 09:53:59 -07:00
Tomeu Vizoso 535a65db48 drm/tegra: sor: Reset during initialization
As there isn't a way for the firmware on the Nyan Chromebooks to hand
over the display to the kernel, and the kernel isn't redoing the whole
configuration at present.

With this patch, the SOR is brought to a known state and we get correct
display on every boot.

Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:24 +02:00
Sean Paul bdf765071a drm/tegra: gem: Return 64-bit offset for mmap(2)
On 64-bit targets, tegra_gem_mmap() only returns a partial offset to
userspace. As such, subsequent calls to mmap(2) may fail. Change the
arguments to use a 64-bit offset to fix this.

Signed-off-by: Sean Paul <seanpaul@chromium.org>
Acked-by: Erik Faye-Lund <kusmabite@gmail.com>
[treding@nvidia.com: tweak commit message]
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:23 +02:00
Thierry Reding 5c1c071a36 drm/tegra: hdmi: Name register fields consistently
Name the fields of the SOR_SEQ_CTL register consistently.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:23 +02:00
Thierry Reding 375e118437 drm/tegra: hdmi: Resets are synchronous
Resets on Tegra are synchronous, so keep the clock enabled while
asserting the reset.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:22 +02:00
Thierry Reding 9d910b6068 drm/tegra: dc: Document tegra_dc_state_setup_clock()
This function is called by output drivers so should be documented. While
at it, move it to a more appropriate location.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:22 +02:00
Thierry Reding d0852ab9bb drm/tegra: dc: Remove unused callbacks
The ->mode_set() and ->mode_set_base() callbacks are no longer used with
full atomic mode-setting drivers, so remove them.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:21 +02:00
Thierry Reding 3774363c75 drm/tegra: dc: Remove unused function
The tegra_dc_setup_clock() function is unused after the conversion to
atomic mode-setting, so remove it.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:21 +02:00
Thierry Reding 3b59b7ac02 drm/tegra: dc: Use base atomic state helpers
Instead of duplicating the code, make use of the newly introduced atomic
state duplicate and destroy helpers. This allows changes to the base
atomic state handling to automatically propagate to the Tegra driver and
thereby prevent breakage resulting from both copies going out of sync.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:49:20 +02:00
Thierry Reding f5e7840b0c drm/atomic: Add helpers for state-subclassing drivers
Drivers that subclass CRTC, plane or connector state need to carefully
duplicate the code that the atomic helpers have. This is bound to cause
breakage eventually because it requires auditing all drivers and update
them when code is added to the helpers.

In order to avoid that, implement new helpers that perform the required
steps when copying and destroying state. These new helpers are exported
so that state-subclassing drivers can use them. The default helpers are
implemented using them as well, providing a single location that needs
to be changed when adding to base atomic states.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:48:32 +02:00
Thierry Reding 42e9ce0523 drm/tegra: dc: Implement hardware VBLANK counter
The display controller on Tegra can use syncpoints to count VBLANK
events. syncpoints are 32-bit unsigned integers, so well suited as
VBLANK counters.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:21 +02:00
Thierry Reding b4a20144e0 gpu: host1x: Export host1x_syncpt_read()
This function is used to read the current value of the syncpt and is
useful in situations where drivers don't schedule work and wait for the
syncpoint to increment. One particular use-case is using the syncpoint
as a VBLANK counter.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:20 +02:00
Thierry Reding dab163366a drm/tegra: sor: Dump registers via debugfs
Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:18 +02:00
Thierry Reding 28fe207600 drm/tegra: sor: Registers are 32-bit
Use a sized unsigned 32-bit data type (u32) to store register contents.
The SOR registers are 32 bits wide irrespective of the architecture's
data width.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:16 +02:00
Thierry Reding 28c23373b8 drm/tegra: Provide debugfs file for the IOVA space
The Tegra DRM driver uses a single IO virtual address space for buffer
mappings. Provide a table of the address space usage in debugfs.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:14 +02:00
Thierry Reding d29827484b drm/tegra: dc: Check for valid parent clock
Check that the desired parent clock is indeed a valid parent for the
display controller clock. This is purely cosmetic at this point since
the parent clocks are specified in DT and all the currently defined
parents are in fact valid parents of the display controller clock.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-04-02 18:46:13 +02:00
Andi Kleen c420f19b9c perf/x86/intel: Fix Haswell CYCLE_ACTIVITY.* counter constraints
Some of the CYCLE_ACTIVITY.* events can only be scheduled on
counter 2.  Due to a typo Haswell matched those with
INTEL_EVENT_CONSTRAINT, which lead to the events never
matching as the comparison does not expect anything
in the umask too. Fix the typo.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1425925222-32361-1-git-send-email-andi@firstfloor.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-04-02 17:07:43 +02:00
Kan Liang 687805e4a6 perf/x86/intel: Filter branches for PEBS event
For supporting Intel LBR branches filtering, Intel LBR sharing logic
mechanism is introduced from commit b36817e886 ("perf/x86: Add Intel
LBR sharing logic"). It modifies __intel_shared_reg_get_constraints() to
config lbr_sel, which is finally used to set LBR_SELECT.

However, the intel_shared_regs_constraints() function is called after
intel_pebs_constraints(). The PEBS event will return immediately after
intel_pebs_constraints(). So it's impossible to filter branches for PEBS
events.

This patch moves intel_shared_regs_constraints() ahead of
intel_pebs_constraints().

We can safely do that because the intel_shared_regs_constraints() function
only returns empty constraint if its rejecting the event, otherwise it
returns NULL such that we continue calling intel_pebs_constraints() and
x86_get_event_constraint().

Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1427467105-9260-1-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-04-02 17:07:42 +02:00
Christian König 22e2e86560 drm/radeon: fix wait in radeon_mn_invalidate_range_start
We need to wait for all fences, not just the exclusive one.

Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-04-02 10:03:29 -04:00
Christian König 863653fed0 drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
We somehow try to free the SG table twice.

Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734

Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-04-02 10:03:29 -04:00
Daniel Stone adacb228d7 drm: Exynos: Respect framebuffer pitch for FIMD/Mixer
When performing a modeset, use the framebuffer pitch value to set FIMD
IMG_SIZE and Mixer SPAN registers. These are both defined as pitch - the
distance between contiguous lines (bytes for FIMD, pixels for mixer).

Fixes display on Snow (1366x768).

Signed-off-by: Daniel Stone <daniels@collabora.com>
Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2015-04-02 22:37:13 +09:00
Steffen Liebergeld f59df35fc2 kgdb/x86: Fix reporting of 'si' in kgdb on x86_64
This patch fixes an error in kgdb for x86_64 which would report
the value of dx when asked to give the value of si.

Signed-off-by: Steffen Liebergeld <steffen.liebergeld@kernkonzept.com>
Cc: Jason Wessel <jason.wessel@windriver.com>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-04-02 11:32:16 +02:00
Andy Lutomirski 7ea2416909 x86/asm/entry/64: Disable opportunistic SYSRET if regs->flags has TF set
When I wrote the opportunistic SYSRET code, I missed an important difference
between SYSRET and IRET.

Both instructions are capable of setting EFLAGS.TF, but they behave differently
when doing so:

 - IRET will not issue a #DB trap after execution when it sets TF.
   This is critical -- otherwise you'd never be able to make forward progress when
   returning to userspace.

 - SYSRET, on the other hand, will trap with #DB immediately after
   returning to CPL3, and the next instruction will never execute.

This breaks anything that opportunistically SYSRETs to a user
context with TF set.  For example, running this code with TF set
and a SIGTRAP handler loaded never gets past 'post_nop':

	extern unsigned char post_nop[];
	asm volatile ("pushfq\n\t"
		      "popq %%r11\n\t"
		      "nop\n\t"
		      "post_nop:"
		      : : "c" (post_nop) : "r11");

In my defense, I can't find this documented in the AMD or Intel manual.

Fix it by using IRET to restore TF.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 2a23c6b8a9 ("x86_64, entry: Use sysret to return to userspace when possible")
Link: http://lkml.kernel.org/r/9472f1ca4c19a38ecda45bba9c91b7168135fcfa.1427923514.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-04-02 11:09:54 +02:00
Ville Syrjälä 840a1cf0cd drm/i915: Reject the colorkey ioctls for primary and cursor planes
The legcy colorkey ioctls are only implemented for sprite planes, so
reject the ioctl for primary/cursor planes. If we want to support
colorkeying with these planes (assuming we have hw support of course)
we should just move ahead with the colorkey property conversion.

Testcase: kms_legacy_colorkey
Cc: Tommi Rantala <tt.rantala@gmail.com>
Cc: stable@vger.kernel.org
Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com
Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-04-02 11:25:50 +03:00
Hai Li d5af49c92a drm/msm/mdp5: Enable DSI connector in msm drm driver
This change adds the support in mdp5 kms driver for single
and dual DSI. Dual DSI case depends on the framework API
and sequence change to support dual data path.

v1: Initial change
v2: Address Rob Clark's comment
- Separate command mode encoder to a new file mdp5_cmd_encoder.c
- Rebase to not depend on msm_drm_sub_dev change

Signed-off-by: Hai Li <hali@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2015-04-01 19:29:38 -04:00