Commit Graph

649779 Commits

Author SHA1 Message Date
Pratyush Anand
f43365ee17 selftests: arm64: add test for unaligned/inexact watchpoint handling
ARM64 hardware expects 64bit aligned address for watchpoint invocation.
However, it provides byte selection method to select any number of
consecutive byte set within the range of 1-8.

This patch adds support to test all such byte selection option for
different memory write sizes.

Patch also adds a test for handling the case when the cpu does not
report an address which exactly matches one of the regions we have
been watching (which is a situation permitted by the spec if an
instruction accesses both watched and unwatched regions). The test
was failing on a MSM8996pro before this patch series and is
passing now.

Signed-off-by: Pavel Labath <labath@google.com>
Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-11-18 17:26:15 +00:00
Pratyush Anand
0ddb8e0b78 arm64: Allow hw watchpoint of length 3,5,6 and 7
Since, arm64 can support all offset within a double word limit. Therefore,
now support other lengths within that range as well.

Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-11-18 17:26:14 +00:00
Pavel Labath
fdfeff0f9e arm64: hw_breakpoint: Handle inexact watchpoint addresses
Arm64 hardware does not always report a watchpoint hit address that
matches one of the watchpoints set. It can also report an address
"near" the watchpoint if a single instruction access both watched and
unwatched addresses. There is no straight-forward way, short of
disassembling the offending instruction, to map that address back to
the watchpoint.

Previously, when the hardware reported a watchpoint hit on an address
that did not match our watchpoint (this happens in case of instructions
which access large chunks of memory such as "stp") the process would
enter a loop where we would be continually resuming it (because we did
not recognise that watchpoint hit) and it would keep hitting the
watchpoint again and again. The tracing process would never get
notified of the watchpoint hit.

This commit fixes the problem by looking at the watchpoints near the
address reported by the hardware. If the address does not exactly match
one of the watchpoints we have set, it attributes the hit to the
nearest watchpoint we have.  This heuristic is a bit dodgy, but I don't
think we can do much more, given the hardware limitations.

Signed-off-by: Pavel Labath <labath@google.com>
[panand: reworked to rebase on his patches]
Signed-off-by: Pratyush Anand <panand@redhat.com>
[will: use __ffs instead of ffs - 1]
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-11-18 17:25:50 +00:00
Pratyush Anand
b08fb180bb arm64: Allow hw watchpoint at varied offset from base address
ARM64 hardware supports watchpoint at any double word aligned address.
However, it can select any consecutive bytes from offset 0 to 7 from that
base address. For example, if base address is programmed as 0x420030 and
byte select is 0x1C, then access of 0x420032,0x420033 and 0x420034 will
generate a watchpoint exception.

Currently, we do not have such modularity. We can only program byte,
halfword, word and double word access exception from any base address.

This patch adds support to overcome above limitations.

Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-11-18 17:23:17 +00:00
Pratyush Anand
651be3cb08 hw_breakpoint: Allow watchpoint of length 3,5,6 and 7
We only support breakpoint/watchpoint of length 1, 2, 4 and 8. If we can
support other length as well, then user may watch more data with less
number of watchpoints (provided hardware supports it). For example: if we
have to watch only 4th, 5th and 6th byte from a 64 bit aligned address, we
will have to use two slots to implement it currently. One slot will watch a
half word at offset 4 and other a byte at offset 6. If we can have a
watchpoint of length 3 then we can watch it with single slot as well.

ARM64 hardware does support such functionality, therefore adding these new
definitions in generic layer.

Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-11-18 17:23:17 +00:00
Max Kellermann
6753743e11 [media] media-entity: clear media_gobj.mdev in _destroy()
media_gobj_destroy() may be called twice on one instance - once by
media_device_unregister() and again by dvb_media_device_free().  The
function media_remove_intf_links() establishes and documents the
convention that mdev==NULL means that the object is not registered,
but nobody ever NULLs this variable.  So this patch really implements
this behavior, and adds another mdev==NULL check to
media_gobj_destroy() to protect against double removal.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:19:16 -02:00
Max Kellermann
1f862a68df [media] dvb_frontend: move kref to struct dvb_frontend
This commit amends my old commit fe35637b0a ("[media] dvb_frontend:
eliminate blocking wait in dvb_unregister_frontend()"), which added
kref to struct dvb_frontend_private.  It turned out that there are
several use-after-free bugs left, which affect the struct
dvb_frontend.  Protecting it with kref also protects struct
dvb_frontend_private, so we can simply move it.

This is how the use-after-free looks like in KASAN:

    BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0
    Read of size 1 by task kworker/0:2/617
    CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Workqueue: usb_hub_wq hub_event
     0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0
     ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0
     1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe
    Call Trace:
     [...]
     [<ffffffff813a2d2f>] vsnprintf+0x39d/0x7e9
     [<ffffffff813993f9>] add_uevent_var+0x10f/0x1dc
     [<ffffffff814fe5ca>] rc_dev_uevent+0x55/0x6f
     [<ffffffff814438f8>] dev_uevent+0x2e1/0x316
     [<ffffffff81399744>] kobject_uevent_env+0x27e/0x701
     [<ffffffff81399bd2>] kobject_uevent+0xb/0xd
     [<ffffffff81443445>] device_del+0x322/0x383
     [<ffffffff81500c0c>] rc_unregister_device+0x98/0xc3
     [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
     [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
     [...]
    Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16
    Allocated:
     [...]
    Freed:
    PID = 617
     [...]
     [<ffffffff811f034c>] kfree+0xd9/0x166
     [<ffffffff814fe513>] ir_free_table+0x2f/0x51
     [<ffffffff81500bc1>] rc_unregister_device+0x4d/0xc3
     [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
     [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Another one:

    BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0
    Read of size 8 by task tuner on fronte/1042
    CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G    B           4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
     0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80
     ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80
     1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe
    Call Trace:
     [...]
     [<ffffffff812289b3>] do_sys_poll+0x336/0x6b8
     [...]
     [<ffffffff81228ed9>] SyS_poll+0xa9/0x194
     [...]
    Object at ffff88003563fc80, in cache kmalloc-256 size: 256
    Allocated:
     [...]
    Freed:
    PID = 617
     [...]
     [<ffffffff811f034c>] kfree+0xd9/0x166
     [<ffffffff814eb60d>] dvb_unregister_device+0xd6/0xe5
     [<ffffffff814fa4ed>] dvb_unregister_frontend+0x4b/0x66
     [<ffffffff8150810b>] dvb_usb_adapter_frontend_exit+0x69/0xac
     [<ffffffff8150617d>] dvb_usb_exit+0x43/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:13:22 -02:00
David S. Miller
d3c19c0a72 Merge branch 'ethtool-phy-downshift'
Allan W. Nielsen says:

====================
Adding PHY-Tunables and downshift support

(This is a re-post of the v3 patch set with a new cover letter - I was not
aware that the cover letters was used a commit comments in merge commits).

This series add support for PHY tunables, and uses this facility to
configure downshifting. The downshifting mechanism is implemented for MSCC
phys.

This series tries to address the comments provided back in mid October when
this feature was posted along with fast-link-failure. Fast-link-failure has
been separated out, but we would like to pick continue on that if/when we
agree on how the phy-tunables and downshifting should be done.

The proposed generic interface is similar to
ETHTOOL_GTUNABLE/ETHTOOL_STUNABLE, it uses the same type
(ethtool_tunable/tunable_type_id) but a new enum (phy_tunable_id) is added
to reflect the PHY tunable.

The implementation just call the newly added function pointers in
get_tunable/set_tunable phy_device structure.

To configure downshifting, the ethtool_tunable structure is used. 'id' must
be set to 'ETHTOOL_PHY_DOWNSHIFT', 'type_id' must be set to
'ETHTOOL_TUNABLE_U8' and 'data' value configure the amount of downshift
re-tries.

If configured to DOWNSHIFT_DEV_DISABLE, then downshift is disabled If
configured to DOWNSHIFT_DEV_DEFAULT_COUNT, then it is up to the device to
choose a device-specific re-try count.

Tested on Beaglebone Black with VSC 8531 PHY.

Change set:
v0:

- Link Speed downshift and Fast Link failure-2 features coded by using
  Device tree.
v1:
- Split the Downshift and FLF2 features in different set of patches.
- Removed DT access and implemented IOCTL access suggested by Andrew.
- Added function pointers in get_tunable/set_tunable phy_device structure
v2:
- Added trace message with a hist is printed when downshifting clould not
  be eanbled with the requested count
- (ethtool) Syntax is changed from "--set-phy-tunable downshift on|off|%d"
  to "--set-phy-tunable [downshift on|off [count N]]" - as requested by
  Andrew.
v3:
- Fixed Spelling in "net: phy: Add downshift get/set support in Microsemi
  PHYs driver"
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:15 -05:00
Raju Lakkaraju
310d9ad57a net: phy: Add downshift get/set support in Microsemi PHYs driver
Implements the phy tunable function pointers and implement downshift
functionality for MSCC PHYs.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Allan W. Nielsen <allan.nielsen@microsemi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:14 -05:00
Raju Lakkaraju
65feddd5b9 ethtool: Core impl for ETHTOOL_PHY_DOWNSHIFT tunable
Adding validation support for the ETHTOOL_PHY_DOWNSHIFT. Functional
implementation needs to be done in the individual PHY drivers.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Allan W. Nielsen <allan.nielsen@microsemi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:14 -05:00
Raju Lakkaraju
607c702914 ethtool: (uapi) Add ETHTOOL_PHY_DOWNSHIFT to PHY tunables
For operation in cabling environments that are incompatible with
1000BASE-T, PHY device may provide an automatic link speed downshift
operation. When enabled, the device automatically changes its 1000BASE-T
auto-negotiation to the next slower speed after a configured number of
failed attempts at 1000BASE-T.  This feature is useful in setting up in
networks using older cable installations that include only pairs A and B,
and not pairs C and D.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Signed-off-by: Allan W. Nielsen <allan.nielsen@microsemi.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:14 -05:00
Raju Lakkaraju
968ad9da7e ethtool: Implements ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE
Adding get_tunable/set_tunable function pointer to the phy_driver
structure, and uses these function pointers to implement the
ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE ioctls.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Allan W. Nielsen <allan.nielsen@microsemi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:14 -05:00
Raju Lakkaraju
0d27f4e437 ethtool: (uapi) Add ETHTOOL_PHY_GTUNABLE and ETHTOOL_PHY_STUNABLE
Defines a generic API to get/set phy tunables. The API is using the
existing ethtool_tunable/tunable_type_id types which is already being used
for mac level tunables.

Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Allan W. Nielsen <allan.nielsen@microsemi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:12:13 -05:00
Max Kellermann
f686c14364 [media] stb0899: move code to "detach" callback
Ensure that STB0899_POSTPROC_GPIO_POWER is set synchronously.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:10:41 -02:00
Max Kellermann
d812b3caea [media] dvb_frontend: add "detach" callback
Prepare for making "release" asynchronous (via kref).  Some operations
may need to be run synchronously in dvb_frontend_detach(), and that's
why we need a "detach" callback.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:09:41 -02:00
David S. Miller
511d5d5b65 Merge branch 'mlx5-next'
Saeed Mahameed says:

====================
Mellanox 100G mlx5 update 2016-11-15

This series contains four humble mlx5 features.

From Gal,
 - Add the support for PCIe statistics and expose them in ethtool

From Huy,
 - Add the support for port module events reporting and statistics
 - Add the support for driver version setting into FW (for display purposes only)

From Mohamad,
 - Extended the command interface cache flexibility

This series was generated against commit
6a02f5eb6a ("Merge branch 'mlxsw-i2c")

V2:
 - Changed plain "unsigned" to "unsigned int"
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:58 -05:00
Gal Pressman
9c7262399b net/mlx5e: Expose PCIe statistics to ethtool
This patch exposes two groups of PCIe counters:
- Performance counters.
- Timers and states counters.
Queried with ethtool -S <devname>.

Signed-off-by: Gal Pressman <galp@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:58 -05:00
Gal Pressman
7f503169ca net/mlx5: Add MPCNT register infrastructure
Add the needed infrastructure for future use of MPCNT register.

Signed-off-by: Gal Pressman <galp@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:58 -05:00
Huy Nguyen
012e50e109 net/mlx5: Set driver version into firmware
If driver_version capability bit is enabled, set driver version
to firmware after the init HCA command, for display purposes.

Example of driver version: "Linux,mlx5_core,3.0-1"

Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:57 -05:00
Saeed Mahameed
0dbc6fe09f net/mlx5: Set driver version infrastructure
Add driver_version capability bit is enabled, and set driver
version command in mlx5_ifc firmware header.  The only purpose
of this command is to store a driver version/OS string in FW
to be reported and displayed in various management systems,
such as IPMI/BMC.

Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:57 -05:00
Huy Nguyen
bedb7c909c net/mlx5e: Add port module event counters to ethtool stats
Add port module event counters to ethtool -S command

Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:57 -05:00
Huy Nguyen
d4eb4cd78b net/mlx5: Add handling for port module event
For each asynchronous port module event:
  1. print with ratelimit to the dmesg log
  2. increment the corresponding event counter

Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:57 -05:00
Huy Nguyen
4ce3bf2fa8 net/mlx5: Port module event hardware structures
Add hardware structures and constants definitions needed for module
events support.

Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:57 -05:00
Mohamad Haj Yahia
0ac3ea7089 net/mlx5: Make the command interface cache more flexible
Add more cache command size sets and more entries for each set based on
the current commands set different sizes and commands frequency.

Fixes: e126ba97db ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 12:08:56 -05:00
Max Kellermann
967d8e8f4c [media] dvb_frontend: merge the two dvb_frontend_detach() versions
This code duplication is confusing and error prone.  Let's merge them
by moving the release/dvb_detach call into one function with one

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:08:49 -02:00
Max Kellermann
194ced7a5a [media] dvb_frontend: tuner_ops.release returns void
It is not clear what this return value means.  All implemenations
return 0, and the one caller ignores the value.  Let's remove this
useless return value completely.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:07:26 -02:00
Max Kellermann
22a613e898 [media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations
Most release callback functions are identical: free the "tuner_priv"
and clear it.  Let's eliminate some bloat by providing this simple
implementation in the dvb_frontend library.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:05:44 -02:00
Max Kellermann
4d5030b69b [media] dvb-core/en50221: use dvb_remove_device()
Commit da677fe143 ("[media] dvb-core/en50221: use kref to manage
struct dvb_ca_private") moved the dvb_unregister_device() call to the
kref callback, but that left lots of stale device state visible to
userspace (e.g. in sysfs).  By using dvb_remove_device() and
dvb_free_device() instead of dvb_unregister_device(), we can avoid
that.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:03:45 -02:00
Arnd Bergmann
c496f6762b remoteproc: wcnss-pil: add QCOM_SMD dependency
When qcom_smd is a loadable module and wcnss-pil is built-in,
we get a link error:

drivers/remoteproc/qcom_wcnss_pil.o: In function `wcnss_smd_remove':
qcom_wcnss_iris.c:(.text.wcnss_smd_remove+0x10): undefined reference to `qcom_smd_unregister_edge'
drivers/remoteproc/qcom_wcnss_pil.o: In function `wcnss_smd_probe':
qcom_wcnss_iris.c:(.text.wcnss_smd_probe+0x12): undefined reference to `qcom_smd_register_edge'

This adds a Kconfig dependency to avoid this. We can still allow
build-testing with SMD disabled.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2016-11-18 09:03:43 -08:00
Max Kellermann
1f4ed6cd58 [media] dvbdev: split dvb_unregister_device()
dvb_unregister_device() has a major problem: it combines unregistering
with memory disposal.  Sometimes, it is necessary to unregister a
device, but no memory can be freed yet, because a process still has a
(stale) file handle.  Therefore, we need to split
dvb_unregister_device().  This will allow sanitizing a few callers.

With my new design, dvb_unregister_device() appears misnamed, but to
reduce patch noise, I'm not renaming it just yet.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:02:39 -02:00
Max Kellermann
bd336e6344 [media] dvb: make DVB frontend *_ops instances "const"
These are immutable.  Making them "const" allows the compiler to move
them to the "rodata" section.

Note that cxd2841er_t_c_ops cannot be made "const", because
cxd2841er_attach() modifies it.  Ouch!

[mchehab@s-opensource.com: fix merge conflicts]
Signed-off-by: Max Kellermann <max.kellermann@gmail.com>

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:00:22 -02:00
Linus Torvalds
c1717701be sound fixes for 4.9-rc6
Three trivial fixes: a regression fix for ASRock mobo, a
 use-after-free fix at hot-unplug of USB-audio, and a quirk for new
 Thinkpad models.
 -----BEGIN PGP SIGNATURE-----
 
 iQIrBAABCAAVBQJYLsqoDhx0aXdhaUBzdXNlLmRlAAoJEGwxgFQ9KSmkF+gQAIyL
 IJROXA6MWSHMaUUa0zToCBYscF+Z1CXavqLkBVGpaMGLM9m4CLkWavmxIIJkfr/1
 XDTDgu6fvDQ0mRBSp3VnxKZGGf0V9fvdODWD7ueCZNHgdNMxMCMwAPaZwTJVk41L
 1W/OfJG/w059L7zY0ZQ05zNphF9noav8Qdb685QdXY5brD92KbGs4TYNHl/D4bw7
 rkT/dcLAxKfSg3Bnwi0Dong5MmXSH+IqvaapHVlhoBkHala5iHZS4URZKS2JgdUl
 nbHFY1kDK5DBN4hHixrRMWqf6MP+ASA/zdEFUeQzoZ9mo/oYjbHURr63+chYkj5I
 Y3yzn4YOEL9O+SdShRYdr6YCHpIJzuvwZCwIPLUlnXrqHoeJPkBnb4J8JiMmqm7O
 F/REdLJoUldqEp3UhBePSSg53UI9qceB1QMYk8YIQy0yyom20uBuQ4GbXnyKQrLl
 MpRb8sfh1GATaTfEshqH+52t7taRPv9VPtGAmDHOLYpcmWhfrJ7Kc6Mh60yTJJbd
 91V4lNib8fV3eqWsW5+l25xzMku8FSIQHgUtG4zW2uOVD3lQiuYS6L8jYiBBApas
 Tgvuowh3Y0toDDH5VTAtorUzYEKF203uqOytey3SgVyTz4lErrzdp+JyaeobGhHv
 BIZKgV1Q00r+FNi7LC4thS9K6yvXLtXPc2mI4OMu
 =aKgB
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Three trivial fixes:

  A regression fix for ASRock mobo, a use-after-free fix at hot-unplug
  of USB-audio, and a quirk for new Thinkpad models"

* tag 'sound-4.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: Fix use-after-free of usb_device at disconnect
  ALSA: hda - Fix mic regression by ASRock mobo fixup
  ALSA: hda - add a new condition to check if it is thinkpad
2016-11-18 08:56:47 -08:00
David S. Miller
7a8bca043c Merge branch 'sfc-tso-v2'
Edward Cree says:

====================
sfc: Firmware-Assisted TSO version 2

The firmware on 8000 series SFC NICs supports a new TSO API ("FATSOv2"), and
 7000 series NICs will also support this in an imminent release.  This series
 adds driver support for this TSO implementation.
The series also removes SWTSO, as it's now equivalent to GSO.  This does not
 actually remove very much code, because SWTSO was grotesquely intertwingled
 with FATSOv1, which will also be removed once 7000 series supports FATSOv2.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:39 -05:00
Edward Cree
46d1efd852 sfc: remove Software TSO
It gives no advantage over GSO now that xmit_more exists.  If we find
 ourselves unable to handle a TSO skb (because our TXQ doesn't have a
 TSOv2 context and the NIC doesn't support TSOv1), hand it back to GSO.
 Also do that if the TSO handler fails with EINVAL for any other reason.
As Falcon-architecture NICs don't support any firmware-assisted TSO,
 they no longer advertise TSO feature flags at all.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:38 -05:00
Edward Cree
e638ee1d0a sfc: handle failure to allocate TSOv2 contexts
If we fail to init the TXQ because of insufficient TSOv2 contexts,
try again with TSOv2 disabled.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:38 -05:00
Bert Kenward
e9117e5099 sfc: Firmware-Assisted TSO version 2
Add support for FATSOv2 to the driver. FATSOv2 offloads far more of the task
 of TCP segmentation to the firmware, such that we now just pass a single
 super-packet to the NIC. This means TSO has a great deal in common with a
 normal DMA transmit, apart from adding a couple of option descriptors.
 NIC-specific checks have been moved off the fast path and in to
 initialisation where possible.

This also moves FATSOv1/SWTSO to a new file (tx_tso.c).  The end of transmit
 and some error handling is now outside TSO, since it is common with other
 code.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:38 -05:00
Edward Cree
e17705c43b sfc: Update EF10 register definitions
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:37 -05:00
Edward Cree
ece0cc1793 sfc: Update MCDI protocol definitions
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-18 11:55:37 -05:00
Linus Torvalds
bd2bc2b8e6 GPIO fixes for the v4.9 series:
- Finally, after being puzzled by a bunch of recurrent UML
   build failures on randconfigs from the build robot, Keno
   Fischer nailed it: GPIO_DEVRES is optional and depends on
   HAS_IOMEM even though many users just unconditionally rely
   on it to be available. And it *should* be available:
   garbage collection is nice for this and it *certainly* has
   nothing to do with having IOMEM. So we got rid of it, and
   now the UML builds should JustWork(TM).
 
 - Do not call .get_direction() on sleeping GPIO chips on the
   fastpath when locking GPIOs for interrupts: it is done
   from atomic context, no way.
 
 - Some driver fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJYLr35AAoJEEEQszewGV1zdGkP/jPFN1oInhLFxRul2RBoI6kH
 2D681F1c90PuEnLQU4JhzHjXizVn91u3/9tvGV7jpKePYe+Xvj8b1La8B+FPJ+Xr
 jc4OwXiiH0Q5hbDS8WkO6lrR7wY9sqJPl+Z7iOTQy7nuBJgsAq9A+h9clqAttQaI
 9QYrk4lb3V1tEnUZszu9/Bp0F/YQNHOMAgZvvsWz1S5wN1RD0Uk1YpEkXfQLL7H3
 sv20Wvl3IXuggkDoHciSlb7Z/Kjtn0dgYiKSSSsr2Ph9yQTVWVfIf2r1NJUyZ5j5
 C8bvD6/tgSPgoHZY+nx+wOhl7BxLNzTGPGiUVRuL9b2XhS0zyuBZx+SGIMvdaczi
 t8+OLGub5z4Yqk9Fg18iql6KFoPXMtpvYHm9bWlevQm7KwMtky+HUU3VyzgV6UUD
 7/pw62XF9gn06i7DI9mwEqRu2xZTPKEOj3Xz4WgW2g7HL4oXe8OvFvUG1arXTcLp
 vvjD0bG7owmN51vsCu0XbACUEC2bIPLkHncd0Azn8/aWTgDRoukkJvlFx3AOGHIE
 QdUBycQJ2WDlpcfbCuN+6YGFM+NOMWKy0T1R+121tvK3AYae69BuRxhb3L2BldY9
 nNrJ5hOM1+ZA6jN+hjJPZH0JgvEzQyq/91QnjSJiTHnuLLkflP0Sm53YWdbS/OXE
 /tvYeTw/a2O5xWSTtMSu
 =MySu
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v4.9-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "These are hopefully the last GPIO fixes for v4.9. The most important
  is that it fixes the UML randconfig builds that have been nagging me
  for some time and me being confused about where the problem was really
  sitting, now this fix give this nice feeling that everything is solid
  and builds fine.

  Summary:

   - Finally, after being puzzled by a bunch of recurrent UML build
     failures on randconfigs from the build robot, Keno Fischer nailed
     it: GPIO_DEVRES is optional and depends on HAS_IOMEM even though
     many users just unconditionally rely on it to be available. And it
     *should* be available: garbage collection is nice for this and it
     *certainly* has nothing to do with having IOMEM. So we got rid of
     it, and now the UML builds should JustWork(TM).

   - Do not call .get_direction() on sleeping GPIO chips on the fastpath
     when locking GPIOs for interrupts: it is done from atomic context,
     no way.

   - Some driver fixes"

* tag 'gpio-v4.9-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: Remove GPIO_DEVRES option
  gpio: tc3589x: fix up .get_direction()
  gpio: do not double-check direction on sleeping chips
  gpio: pca953x: Move memcpy into mutex lock for set multiple
  gpio: pca953x: Fix corruption of other gpios in set_multiple.
2016-11-18 08:47:47 -08:00
Max Kellermann
c183d3584b [media] rc-main: clear rc_map.name in ir_free_table()
rc_unregister_device() will first call ir_free_table(), and later
device_del(); however, the latter causes a call to rc_dev_uevent(),
which prints rc_map.name, which at this point has already bee freed.

This fixes a use-after-free bug found with KASAN.

As reported by Shuah:

 "I am seeing the following when I do rmmod on au0828

  BUG: KASAN: use-after-free in string+0x170/0x1f0 at addr ffff8801bd513000
  Read of size 1 by task rmmod/1831
  CPU: 1 PID: 1831 Comm: rmmod Tainted: G        W       4.9.0-rc5 #5
  Hardware name: Hewlett-Packard HP ProBook 6475b/180F, BIOS 68TTU Ver. F.04 08/03/2012
  ffff8801aea2f680 ffffffff81b37ad3 ffff8801fa403b80 ffff8801bd513000
  ffff8801aea2f6a8 ffffffff8156c301 ffff8801aea2f738 ffff8801bd513000
  ffff8801fa403b80 ffff8801aea2f728 ffffffff8156c59a ffff8801aea2f770
  Call Trace:
  dump_stack+0x67/0x94
  [<ffffffff8156c301>] kasan_object_err+0x21/0x70
  [<ffffffff8156c59a>] kasan_report_error+0x1fa/0x4d0
  [<ffffffffa116f05f>] ? au0828_exit+0x10/0x21 [au0828]
  [<ffffffff8156c8b3>] __asan_report_load1_noabort+0x43/0x50
  [<ffffffff81b58b20>] ? string+0x170/0x1f0
  [<ffffffff81b58b20>] string+0x170/0x1f0
  [<ffffffff81b621c4>] vsnprintf+0x374/0x1c50
  [<ffffffff81b61e50>] ? pointer+0xa80/0xa80
  [<ffffffff8156b676>] ? save_stack+0x46/0xd0
  [<ffffffff81566faa>] ? __kmalloc+0x14a/0x2a0
  [<ffffffff81b3d70a>] ? kobject_get_path+0x9a/0x200
  [<ffffffff81b408c2>] ? kobject_uevent_env+0x282/0xca0
  [<ffffffff81b412eb>] ? kobject_uevent+0xb/0x10
  [<ffffffff81f10104>] ? device_del+0x434/0x6d0
  [<ffffffffa0fea717>] ? rc_unregister_device+0x177/0x240 [rc_core]
  [<ffffffffa116eeb0>] ? au0828_rc_unregister+0x60/0xb0 [au0828]

 The problem is fixed with this patch on Linux 4.9-rc4"

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 14:31:34 -02:00
Peter Chen
b68002db13 [media] media: platform: ti-vpe: call of_node_put on non-null pointer
It should call of_node_put on non-null poiner.

Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Acked-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 14:23:33 -02:00
Linus Torvalds
12b70ec0d3 i915 fixes + 2 mediatek regressions
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJYLlIgAAoJEAx081l5xIa+mjoP/2wh9hcrX4bG4XWnixR/KSf/
 xAtqsNl87oQE6cq+PGD0WsmyCjnLFKbvi12ChM0slu3r4qSRlAOtmdGaqmha/jkv
 8Km4tBgxrxsh8H+rN/x+1aXCVbt8H2qeOikeQgHTdluX7fnBs37vJAfccw7W010p
 Ezv5N65UEgtS+HxDBKp5hQG3416ycU1gj1cmRMYhzTKp5EFSB48zoZ+r1dH07/MG
 989D1v/YkR/KyKTj+mhdsPZ6lKLdnEWP1SHR7kRQcxrxBJGgtYIiRY4x7TSKBa+x
 EoyX3srhex/TvYrlmlMZqqXhE8ddgvjJmE3zV5mDFJOgDtaSvZBdkU5IxjSPJfzK
 yfEz6vUlLxGxsIxlT6oG7CBghsuZtED7vDbDOdf+2HR1X/i/i3VMnAKrLe/p8Z4L
 VwRkf3Pri+PV4iZpT8jSMFVE0uXLLswK/UyFpAT07JbwqxbPceQa6FB0IlAwcAJd
 ueFq+nQ6CdL4h98YNNqCaKAIa/686lf0Vh+6BHY4Pqp8ePSVdCpbEKd08UDHoAw2
 RYHMNQY6gvS+P7laN+qFUC1nLIvd3ynhHRqIsaZgCraVjKJaGBbkT8WaV9LeGeO+
 /+Se9zbvlZmnFO0ynhRJZITY/n2hgaRcLgzwV611F1qHVk6ZcUac0AOR8NQleXm/
 psGWhW/QNog3VObrlC/M
 =EAA/
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.9-rc6-brown-paper-bag' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "i915 fixes + 2 mediatek regressions.

  So some i915 fixes came in which I thought they might so I'm sending
  those along with two reverts for two patches to the mediatek driver
  that didn't seem to build so well, I've fixed up my -fixes ARM build
  and .config so I could see it, but yes brown paper bag time"

* tag 'drm-fixes-for-v4.9-rc6-brown-paper-bag' of git://people.freedesktop.org/~airlied/linux:
  Revert "drm/mediatek: set vblank_disable_allowed to true"
  Revert "drm/mediatek: fix a typo of OD_CFG to OD_RELAYMODE"
  drm/i915: Assume non-DP++ port if dvo_port is HDMI and there's no AUX ch specified in the VBT
  drm/i915: Refresh that status of MST capable connectors in ->detect()
  drm/i915: Grab the rotation from the passed plane state for VLV sprites
  drm/i915: Mark CPU cache as dirty when used for rendering
2016-11-18 08:22:48 -08:00
Dan Carpenter
c9205e18b4 [media] blackfin: check devm_pinctrl_get() for errors
devm_pinctrl_get() can fail so we should check for that.

Fixes: 0a6824bc10 ('[media] v4l2: blackfin: select proper pinctrl state in ppi_set_params if CONFIG_PINCTRL is enabled')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 14:22:27 -02:00
Andi Shyti
5911f62926 [media] lirc_dev: remove compat_ioctl assignment
There is no need to check for CONFIG_COMPAT and consequently
assign the compat_ioctl.

Signed-off-by: Andi Shyti <andi.shyti@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 14:16:09 -02:00
Bjorn Andersson
1a494c20d1 Merge branch 'topic/st_fdma' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma into rproc-next
* 'topic/st_fdma' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma:
  dmaengine: st_fdma: Revert: "Revert: Update st_fdma to 'depends on REMOTEPROC'"
2016-11-18 08:13:56 -08:00
Robert Jarzmik
74e382b870 ARM: dts: pxa: add pxa27x cpu operating points
Add the relevant data taken from the PXA27x Electrical, Mechanical, and
Thermal Specfication. This will be input data for cpufreq-dt driver.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
2016-11-18 17:09:45 +01:00
Robert Jarzmik
93ab7c8486 ARM: dts: pxa: add pxa25x cpu operating points
Add the relevant data taken from the PXA 25x Electrical, Mechanical, and
Thermal Specfication. This will be input data for cpufreq-dt driver.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
2016-11-18 17:09:44 +01:00
Robert Jarzmik
4852a25eab ARM: dts: pxa: fix gpio0 and gpio1 interrupts
Since gpio-pxa was redesigned to differenciate gpio0, gpio1 and the
gpio-mux interrupt as in the hardware IP, the device-tree description
should be amended so that interrupts from gpio0 and gpio1 can be mapped
to consumers.

This is especially true on lubbock and mainstone devices where gpio0 is
multiplexed on pxa_cplds for ethernet, sa1111, usb udc, and other
devices.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
2016-11-18 17:09:44 +01:00
Vijay Kumar
1e0ced0948 ARM: dts: pxa: fix no. of gpio cells in the pxa gpio binding documentation
Fix the no. of gpio cells in pxa gpio binding documentation.

The no. of gpio cells for the pxa gpio is actually 2. But is
incorrectly specified as 1, in the binding documentation. From the
driver code, the second cell specifies the standard flags as described
in gpio.txt.

Signed-off-by: Vijay Kumar B. <vijaykumar@zilogic.com>
[fixed subject line]
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
2016-11-18 17:09:43 +01:00
Robert Jarzmik
209f4d7a3d ARM: dts: pxa: add pxa25x .dtsi file
This file describes pxa25x SoCs. Not all devices are listed yet, only
the subset which was already tested with a lubbock board.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
2016-11-18 17:09:37 +01:00