Commit graph

455258 commits

Author SHA1 Message Date
Thierry Reding
9910f5c455 drm/tegra: Remove host1x drm_bus implementation
The DRM core can now cope with drivers that don't have an associated
struct drm_bus, so the host1x implementation is no longer useful.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:14:46 +02:00
Thierry Reding
b528ae7190 drm: Document how to register devices without struct drm_bus
With the recent addition of the drm_set_unique() function, devices can
now be registered without requiring a drm_bus. Add a brief description
to the DRM docbook to show how that can be achieved.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:14:42 +02:00
Thierry Reding
c6a1af8a16 drm: Add device registration documentation
Describe how devices are registered using the drm_*_init() functions.
Adding this to docbook requires a largish set of changes to the comments
in drm_{pci,usb,platform}.c since they are doxygen-style rather than
proper kernel-doc and therefore mess with the docbook generation.

While at it, mark usage of drm_put_dev() as discouraged in favour of
calling drm_dev_unregister() and drm_dev_unref() directly.

Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:14:38 +02:00
Thierry Reding
ca8e2ad710 drm: Introduce drm_dev_set_unique()
Add a helper function that allows drivers to statically set the unique
name of the device. This will allow platform and USB drivers to get rid
of their DRM bus implementations and directly use drm_dev_alloc() and
drm_dev_register().

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:14:32 +02:00
Thierry Reding
0c7dfd36b7 gpu: host1x: Rename internal functions for clarity
The internal host1x_{,un}register_client() functions can potentially be
confused with public the host1x_client_{,un}register() functions.

Rename them to host1x_{add,del}_client() to remove some of the possible
confusion.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:10:30 +02:00
Thierry Reding
540457cc1f drm/tegra: gem - Make tegra_bo_import() static
The function is never used outside of the source file and therefore can
be locally scoped.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:36 +02:00
Thierry Reding
fb7be70e73 drm/tegra: hdmi - Add Tegra124 support
Tegra124 is mostly backwards-compatible with Tegra114. However, Tegra124
supports a few more features (e.g. interlacing, ...). Introduce a new
compatible string and TMDS tables to cope with these differences.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:35 +02:00
Thierry Reding
86f5c52dc9 drm/tegra: sor - Protect CRC debugfs against enable state
Accessing the CRC debugfs file will hang the system if the SOR is not
enabled, so make sure that it is stays enabled until the CRC has been
read.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:35 +02:00
Thierry Reding
76245adbc1 drm/tegra: dsi - Do not needlessly recompute pclk
In some cases the pixel clock used to not be correct, which is why it
had to be recomputed. It turns out that the reason why it wasn't correct
is that it was used wrongly. If used correctly there's not need for the
recomputation.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:34 +02:00
Thierry Reding
91eded9b48 drm/tegra: dc - Compute shift clock divider in output drivers
The shift clock divider is highly dependent on the type of output, so
push computation of it down into the output drivers. The old code used
to work merely by accident.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:33 +02:00
Thierry Reding
dbb3f2f751 drm/tegra: dc - Move around shift clock programming
Program the shift clock divider in tegra_crtc_setup_clk() since that's
where the divider is computed, so passing it around can be avoided.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:32 +02:00
Thierry Reding
cb825d89f5 drm/tegra: dsi - Reset controller on driver unload
Assert the DSI controller's reset when the driver is unloaded to reduce
power consumption and to put the controller into a known state for
subsequent driver reloads.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:31 +02:00
Thierry Reding
79eb7e5dab drm/tegra: dsi - Fix typo when disabling controller
When disabling the DSI controller, the code wasn't really doing what it
was supposed to.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:31 +02:00
Thierry Reding
334ae6b527 drm/tegra: dsi - Add enable guard
To prevent the enable or disable operations to potentially be run
multiple times, add guards to return early when the output is already
in the targetted state.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:30 +02:00
Thierry Reding
17297a2813 drm/tegra: dsi - Initialize proper packet sequences
The packet sequencer needs to be programmed depending on the video mode
of the attached peripheral. Add support for non-burst video modes with
sync events (as opposed to sync pulses) and select either sequence
depending on the video mode.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:29 +02:00
Thierry Reding
3b077afb3a drm/tegra: dsi - Implement VDD supply support
The DSI controllers are powered by a (typically 1.2V) regulator. Usually
this is always on, so there was no need to support enabling or disabling
it thus far. But in order not to consume any power when DSI is inactive,
give the driver a chance to enable or disable the supply as needed.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:28 +02:00
Thierry Reding
bcfc7acbca drm/tegra: dsi - Remove unneeded code
A bunch of registers are initialized to 0 upon during driver probe. It
turns out that none of these are actually needed, so they can simply be
dropped.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:27 +02:00
Thierry Reding
f7d6889b79 drm/tegra: dsi - Use internal pixel format
The pixel format enumeration values used by the Tegra DSI controller
don't match those defined by the DSI framework. Make sure to convert
them to the internal format before writing it to the register.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:26 +02:00
Thierry Reding
7e2464304b drm/tegra: hdmi - Fix disable sequence
For some reason when the PW*_ENABLE and PM*_ENABLE fields are cleared
during disable, the HDMI output stops working properly. Resetting and
initializing doesn't help.

Comment out those accesses for now until it has been determined what to
do about them.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:26 +02:00
Thierry Reding
9cbfc73e11 drm/tegra: hdmi - Disable LVDS mode
Disable LVDS mode according to register documentation. It seems like
this has no effect on the operation of HDMI, but it's probably a good
idea to do this anyway.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:25 +02:00
Thierry Reding
8c8282c04d drm/tegra: hdmi - Use proper power-up sequence
This reflects the power-up sequence as described in the documentation,
but it doesn't seem to be strictly necessary to get HDMI to work.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:24 +02:00
Thierry Reding
d06e7f8f66 drm/tegra: hdmi - Clean up clock usage
Clocks are never enabled or disabled in atomic context, so we can use
the clk_prepare_enable() and clk_disable_unprepare() helpers instead.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:23 +02:00
Thierry Reding
8868568718 drm/tegra: hdmi - Reverse regulator enable ordering
Schematics indicate that the AVDD_HDMI_PLL supply should be enabled
prior to the AVDD_HDMI supply.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:22 +02:00
Thierry Reding
80b9213913 drm/tegra: hdmi - Remove duplicate code
The generic Tegra output code already sets up the clocks properly, so
there's no need to do it again when the HDMI output is enabled.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:21 +02:00
Thierry Reding
fb50a116bb drm/tegra: hdmi - Add connector supply support
Revert commit 18ebc0f404 "drm/tegra: hdmi: Enable VDD earlier for
hotplug/DDC" and instead add a new supply for the +5V pin on the HDMI
connector.

The vdd-supply property refers to the regulator that supplies the
AVDD_HDMI input on Tegra, rather than the +5V HDMI connector pin. This
was never a problem before, because all boards had that pin hooked up to
a regulator that was always on. Starting with Dalmore and continuing
with Venice2, the +5V pin is controllable via a GPIO. For reasons
unknown, the GPIO ended up as the controlling GPIO of the AVDD_HDMI
supply in the Dalmore and Venice2 DTS files. But that's not correct.
Instead, a separate supply must be introduced so that the +5V pin can be
controlled separately from the supplies that feed the HDMI block within
Tegra.

A new hdmi-supply property is introduced that takes the place of the
vdd-supply and vdd-supply is only enabled when HDMI is enabled rather
than all the time.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:21 +02:00
Thierry Reding
0444c0ff3c drm/tegra: dc - Use proper H/V ref-to-sync values
For HDMI compliance both of these values need to be set to 1.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:20 +02:00
Thierry Reding
501bcbd1b2 drm/tegra: dc - Do not touch power control register
Setting the bits in this register is dependent on the output type driven
by the display controller. All output drivers already set these properly
so there is no need to do it here again.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:19 +02:00
Thierry Reding
10288eea88 drm/tegra: dc - Reshuffle code to get rid of prototypes
The tegra_dc_format() and tegra_dc_setup_window() functions are only
used internally by the display controller driver. Move them upwards in
order to make them static and get rid of the function prototypes.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:18 +02:00
Thierry Reding
eba66501ac drm/tegra: dc - Rename INVERT_V to V_DIRECTION
V_DIRECTION is the name of the field in the documentation, so use that
for consistency. Also add the H_DIRECTION field for completeness.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:17 +02:00
Thierry Reding
a82752e199 drm/tegra: sor - Add CRC debugfs support
The SOR allows the computation of a 32 bit CRC of the content that it
transmits. This functionality is exposed via debugfs and is useful to
verify proper operation of the SOR.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:17 +02:00
Thierry Reding
f925390efc drm/tegra: dc - Add YUYV support
YUYV is UYVY with swapped bytes. Luckily the Tegra DC hardware can swap
bytes during scan-out, so supporting YUYV is simply a matter of writing
the correct value to the byteswap register.

This patch modifies tegra_dc_format() to return the byte swap parameter
via an output parameter in addition to returning the pixel format. Many
other formats can potentially be supported in a similar way.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:16 +02:00
Thierry Reding
688c59afbf drm/tegra: Cleanup header file
Remove extern keyword from function prototypes since it isn't needed and
drop an unnecessary forward declaration.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2014-06-05 23:09:15 +02:00
Daniel Vetter
c7560f1281 drm: Fix getconnector connection_mutex locking
I've fumbled my own idea and enthusiastically wrapped all the
getconnector code with the connection_mutex. But we only need it to
chase the connector->encoder link. Even there it's not really needed
since races with userspace won't matter, but better paranoid and
consistent about this stuff.

If we grap it everywhere connector probe callbacks can't grab it
themselves, which means they'll deadlock. i915 does that for the load
detect pipe. Furthermore i915 needs to do a ww dance since we also
need to grab the mutex of the load detect crtc.

This is a regression from

commit 6e9f798d91
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu May 29 23:54:47 2014 +0200

    drm: Split connection_mutex out of mode_config.mutex (v3)

Cc: Rob Clark <robdclark@gmail.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-06-06 07:08:17 +10:00
Rafael J. Wysocki
751109aad5 ACPI / video: Change the default for video.use_native_backlight to 1
Now that we're hoping to have resolved all of the problems with
video.use_native_backlight=1, make that the default at last.

Link: http://marc.info/?l=linux-acpi&m=139716088401106&w=2
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-06-05 22:47:35 +02:00
Santosh Shilimkar
bbea06f3ef ARM: keystone: Drop use of meminfo since its not available anymore
Laura's series removed the meminfo structure and its no longer available.
Update keystone code to remove the usage of it.

Reported-by: Russell King - ARM Linux <linux@arm.linux.org.uk>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-06-05 22:20:54 +02:00
Linus Torvalds
c3c55a0720 Merge branch 'arm64-efi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
Pull ARM64 EFI update from Peter Anvin:
 "By agreement with the ARM64 EFI maintainers, we have agreed to make
  -tip the upstream for all EFI patches.  That is why this patchset
  comes from me :)

  This patchset enables EFI stub support for ARM64, like we already have
  on x86"

* 'arm64-efi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  arm64: efi: only attempt efi map setup if booting via EFI
  efi/arm64: ignore dtb= when UEFI SecureBoot is enabled
  doc: arm64: add description of EFI stub support
  arm64: efi: add EFI stub
  doc: arm: add UEFI support documentation
  arm64: add EFI runtime services
  efi: Add shared FDT related functions for ARM/ARM64
  arm64: Add function to create identity mappings
  efi: add helper function to get UEFI params from FDT
  doc: efi-stub.txt updates for ARM
  lib: add fdt_empty_tree.c
2014-06-05 13:15:32 -07:00
H. Peter Anvin
177875423e * Fix earlyprintk=efi,keep support by switching to an ioremap() mapping
of the framebuffer when early_ioremap() is no longer available and
    dropping __init from functions that may be invoked after
    free_initmem() - Dave Young
 
  * We shouldn't be exporting the EFI runtime map in sysfs if not using
    the new 1:1 EFI mapping code since in that case the mappings are not
    static across a kexec reboot - Dave Young
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTj0xzAAoJEC84WcCNIz1VgBgP/3rzGcVB6JBT5qAy2SCcKkL1
 zKAvMNiFWpfyOwICE1gbfZzDky9DIVRXpzriLIe27aQzgn/GYBLH9hAIsYO/5W1m
 uw/KRMKbUkvfnUKPxZUMe95OMsXqwhYth7oGJXq1yFa6SsQdCU4jnmMflUQ6IWfy
 sXtQzlV7frFO0W55Gxv4jRB/nxrExtTHm9Fc01H9xvguKO2l0KEh0C9PbyfZLQp0
 FffxGhcVSZXG23fB5eU0yKLV69buDk83O1y4lQ79zETvCTjuzbpGe2agFDxrlJ/u
 wxZROMStvthkHqapheGwwBu4SySoKsuNRQHKxeJ2t3XEVSBuW+c9jiYYMmpDS0t6
 LhIdLdDtBk8ItsTY60r6w86oLvQVTnkwLxwX/XdzUyA/bSzf/EzHENw2iPbJhpjn
 qfq2ZonXD8j/EVPyYXk65wUea4tMmG1QYpi9oPqMp3b4hCgoJr7qosOqvT9v+E3/
 bbGTjr6bgzOaXdctOocmEg0qfhMw/Ol63V9P4wsiN5mUq1nRJnJcKQtqA3Do08IP
 RgZJg8yQAe9FAfZ0RDaRKs5OSPgnC42t/d6pr9JdiFzgR5Ktw7BymfmOu52o7Koq
 EJFf1TlD+Kipdyo/1Q4s9vtZ1ijO5If6FSL9rYJoduWMWCPSZ9by43uCIbEobEQh
 aXD9ZvSyeu5IwD4BoBiO
 =7zSB
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' into x86/urgent

 * Fix earlyprintk=efi,keep support by switching to an ioremap() mapping
   of the framebuffer when early_ioremap() is no longer available and
   dropping __init from functions that may be invoked after
   free_initmem() - Dave Young

 * We shouldn't be exporting the EFI runtime map in sysfs if not using
   the new 1:1 EFI mapping code since in that case the mappings are not
   static across a kexec reboot - Dave Young

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2014-06-05 13:09:44 -07:00
David S. Miller
d68de60f73 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next
Jeff Kirsher says:

====================
Intel Wired LAN Driver Updates 2014-06-05

This series contains updates to i40e and i40evf.

Jesse fixes an issue reported by Dave Jones where a couple of FD checks
ended up using bitwise OR where it should have been bitwise AND.

Neerav removes unused defines and macros for receive LRO.  Fix the driver
from allowing the user to set a larger MTU size that the hardware was
being configured to support.  Refactors send version which moves code in
two places into a small helper function.

Kamil modifies register diagnostics since register ranges can vary among
the different NVMs to avoid false test results.  So now we try to identify
the full range and use it for a register test and if we fail to define the
proper register range, we will only test the first register from that
group.  Then removes the check for large buffer since this was added in the
case this structure changed in the future, since the AQ definition is now
mature enough that this check is no longer necessary.

Mitch fixes i40evf driver to allocate descriptors in groups of 32 since the
hardware requires it.  Also fixes a crash when the ring size changed because
it would change the count before deallocating resources, causing the driver
to either free nonexistent buffers or leak leftover buffers.  Fixed the
driver to notify the VF for all types of resets so the VF can attempt a
graceful reinit.

Shannon refactors stats collection to create a unifying stats update routine
to call the various stat collection routines.  Removes rx_errors and
rx_missed stats since they were removed from the chip design.  Added
missing VSI statistics that the hardware offers but are not apart of the
standard netdev stats.

v2: dropped patch "i40e: Allow disabling of DCB via debugfs" from Neerav
    based on feedback from David Miller.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-06-05 13:04:31 -07:00
Linus Torvalds
951e273060 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
 "Two last minute tooling fixes"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf probe: Fix perf probe to find correct variable DIE
  perf probe: Fix a segfault if asked for variable it doesn't find
2014-06-05 12:51:05 -07:00
Jens Axboe
762380ad93 block: add notion of a chunk size for request merging
Some drivers have different limits on what size a request should
optimally be, depending on the offset of the request. Similar to
dividing a device into chunks. Add a setting that allows the driver
to inform the block layer of such a chunk size. The block layer will
then prevent merging across the chunks.

This is needed to optimally support NVMe with a non-zero stripe size.

Signed-off-by: Jens Axboe <axboe@fb.com>
2014-06-05 13:38:39 -06:00
Linus Torvalds
1c5aefb5b1 Merge branch 'futex-fixes' (futex fixes from Thomas Gleixner)
Merge futex fixes from Thomas Gleixner:
 "So with more awake and less futex wreckaged brain, I went through my
  list of points again and came up with the following 4 patches.

  1) Prevent pi requeueing on the same futex

     I kept Kees check for uaddr1 == uaddr2 as a early check for private
     futexes and added a key comparison to both futex_requeue and
     futex_wait_requeue_pi.

     Sebastian, sorry for the confusion yesterday night.  I really
     misunderstood your question.

     You are right the check is pointless for shared futexes where the
     same physical address is mapped to two different virtual addresses.

  2) Sanity check atomic acquisiton in futex_lock_pi_atomic

     That's basically what Darren suggested.

     I just simplified it to use futex_top_waiter() to find kernel
     internal state.  If state is found return -EINVAL and do not bother
     to fix up the user space variable.  It's corrupted already.

  3) Ensure state consistency in futex_unlock_pi

     The code is silly versus the owner died bit.  There is no point to
     preserve it on unlock when the user space thread owns the futex.

     What's worse is that it does not update the user space value when
     the owner died bit is set.  So the kernel itself creates observable
     inconsistency.

     Another "optimization" is to retry an atomic unlock.  That's
     pointless as in a sane environment user space would not call into
     that code if it could have unlocked it atomically.  So we always
     check whether there is kernel state around and only if there is
     none, we do the unlock by setting the user space value to 0.

  4) Sanitize lookup_pi_state

     lookup_pi_state is ambigous about TID == 0 in the user space value.

     This can be a valid state even if there is kernel state on this
     uaddr, but we miss a few corner case checks.

     I tried to come up with a smaller solution hacking the checks into
     the current cruft, but it turned out to be ugly as hell and I got
     more confused than I was before.  So I rewrote the sanity checks
     along the state documentation with awful lots of commentry"

* emailed patches from Thomas Gleixner <tglx@linutronix.de>:
  futex: Make lookup_pi_state more robust
  futex: Always cleanup owner tid in unlock_pi
  futex: Validate atomic acquisition in futex_lock_pi_atomic()
  futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)
2014-06-05 12:31:32 -07:00
Thomas Gleixner
54a217887a futex: Make lookup_pi_state more robust
The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex.  We can get into the kernel
even if the TID value is 0, because either there is a stale waiters bit
or the owner died bit is set or we are called from the requeue_pi path
or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address.  This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

       Waiter | pi_state | pi->owner | uTID      | uODIED | ?

  [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
  [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

  [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

  [4]  Found  | Found    | NULL      | 0         | 1      | Valid
  [5]  Found  | Found    | NULL      | >0        | 1      | Invalid

  [6]  Found  | Found    | task      | 0         | 1      | Valid

  [7]  Found  | Found    | NULL      | Any       | 0      | Invalid

  [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
  [9]  Found  | Found    | task      | 0         | 0      | Invalid
  [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

 [1] Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

 [2] Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

 [3] Invalid. The waiter is queued on a non PI futex

 [4] Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

 [5] The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

 [6] Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

 [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.

 [8] Owner and user space value match

 [9] There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-05 12:31:07 -07:00
Thomas Gleixner
13fbca4c6e futex: Always cleanup owner tid in unlock_pi
If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex.  So the owner TID of the current owner
(the unlocker) persists.  That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-05 12:31:07 -07:00
Thomas Gleixner
b3eaa9fc5c futex: Validate atomic acquisition in futex_lock_pi_atomic()
We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state.  If
it has, return -EINVAL.  The state is corrupted already, so no point in
cleaning it up.  Subsequent calls will fail as well.  Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-05 12:31:07 -07:00
Thomas Gleixner
e9c243a5a6 futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)
If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-05 12:31:07 -07:00
Andrea Merello
c678de5536 at76c50x: fix scan does not work with latest mac80211
since commit 3afc2167f6 scan in not
working anymore, due to mac80211 requires rx frequency status
information.

This patch makes the driver report this information.

While NOT scanning this is straightforward.
While scanning the firmware performs RF sweep and we cannot track
the actual tuning frequency, so this is guessed by parsing beacons
and probe responses.
This should be enough for ensuring functionality.

Thanks-to: Johannes Berg <johannes@sipsolutions.net> [ for suggestions and reviewing ]
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-06-05 14:15:08 -04:00
John W. Linville
67be1e4f4b Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2014-06-05 14:10:07 -04:00
Trond Myklebust
abbec2da13 NFS: Use raw_write_seqcount_begin/end int nfs4_reclaim_open_state
The addition of lockdep code to write_seqcount_begin/end has lead to
a bunch of false positive claims of ABBA deadlocks with the so_lock
spinlock. Audits show that this simply cannot happen because the
read side code does not spin while holding so_lock.

Cc: <stable@vger.kernel.org> # 3.13.x
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2014-06-05 13:02:47 -04:00
Haggai Eran
584482ac80 IB/core: Fix kobject leak on device register error flow
The ports kobject isn't being released during error flow in device
registration.  This patch refactors the ports kobject cleanup into a
single function called from both the error flow in device registration
and from the unregistration function.

A couple of attributes aren't being deleted (iw_stats_group, and
ib_class_attributes).  While this may be handled implicitly by the
destruction of their kobjects, it seems better to handle all the
attributes the same way.

Signed-off-by: Haggai Eran <haggaie@mellanox.com>

[ Make free_port_list_attributes() static.  - Roland ]

Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-06-05 09:37:10 -07:00
Yoshihiro YUNOMAE
939c7a4f04 tracing: Introduce saved_cmdlines_size file
Introduce saved_cmdlines_size file for changing the number of saved pid-comms.
saved_cmdlines currently stores 128 command names using SAVED_CMDLINES, but
'no-existing processes' names are often lost in saved_cmdlines when we
read the trace data. So, by introducing saved_cmdlines_size file, we can
now change the 128 command names saved to something much larger if needed.

When we write a value to saved_cmdlines_size, the number of the value will
be stored in pid-comm list:

	# echo 1024 > /sys/kernel/debug/tracing/saved_cmdlines_size

Here, 1024 command names can be stored. The default number is 128 and the maximum
number is PID_MAX_DEFAULT (=32768 if CONFIG_BASE_SMALL is not set). So, if we
want to avoid losing any command names, we need to set 32768 to
saved_cmdlines_size.

We can read the maximum number of the list:

	# cat /sys/kernel/debug/tracing/saved_cmdlines_size
	128

Link: http://lkml.kernel.org/p/20140605012427.22115.16173.stgit@yunodevel

Signed-off-by: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2014-06-05 12:35:49 -04:00