Commit graph

406,367 commits

Author SHA1 Message Date
Huang, Tao
91c0b3f7a5 Merge tag 'lsk-v3.10-15.09-android'
LSK Android 15.09 v3.10
2015-09-28 19:16:34 +08:00
Zhangbin Tong
4e5b768771 power_supply: cw2015_battery: code style fixes
Change-Id: I3cf0af574e11b7fd32adaaecbd6dbe83e72c83c9
Signed-off-by: Zhangbin Tong <zebulun.tong@rock-chips.com>
2015-09-28 15:49:22 +08:00
alpha.lin
cfaf327bab IEP: add capabilities query interface
add capabilities query interface for userspace to query
iep device feature in current soc.

Change-Id: I377e686b2ce0357aa75445e4e47e9e4883a077ae
Signed-off-by: alpha.lin <alpha.lin@rock-chips.com>
2015-09-23 18:32:40 +08:00
Mark Yao
c8c06956fb rk_fb: rename yuv444 10bit
HAL_PIXEL_FORMAT_YCrCb_420_SP_10 means yuv444 10bit format, but its
name looks like yuv 420sp 10bit, that is wrong.

Change-Id: I71db8577df6e3d912427ddafe057905870622ab2
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2015-09-23 18:30:30 +08:00
Alpha Lin
44a10edbee IEP: re-caculate the uv address when 4k video input in iommu enable case.
In above case, old code will generate a fault address for
uv address if 4k video input or output.

Change-Id: I22e9793fbaa2da250097ba69a3fd4fdf58585b78
Signed-off-by: Alpha Lin <alpha.lin@rock-chips.com>
2015-09-23 18:13:18 +08:00
alpha.lin
0eb015892d VPU: Support both syscon and virtual address while access to grf resource.
If CONFIG_MFD_SYSCON macro define but no grf resource
define in dts will cause a error before this revision.

Change-Id: I70432530fba9c7a5d0b8f5a0c996d67237eb8198
Signed-off-by: alpha.lin <alpha.lin@rock-chips.com>
2015-09-23 18:09:36 +08:00
Huang Jiachai
7fde8d2fb3 video: rockchip: lcdc: 3288: update for VOP YUV420 to HDMI
Change-Id: I3dbe2208e10318acf99b66e858d853c3d4efab04
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-22 19:03:41 +08:00
Huang Jiachai
db350252e2 video: rockchip: lcdc: 3288: delele some special config for vop full v1.0
Change-Id: Iec4db13e5cde5567d9c9a96f3e063ceb3656b256
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-22 14:37:45 +08:00
Huang Jiachai
5f87823a49 video: rockchip: lcdc: 3288: update CABC config
Change-Id: I88dd84335943580cf81850cffe530ba73190fa7e
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-22 14:37:17 +08:00
Wu Liang feng
591df7e27b usb: gadget: accessory: add compatibility ioctl
Change-Id: I301c1f2f17c906d0a3912248fa16bc20b4a32b3c
Signed-off-by: Wu Liang feng <wulf@rock-chips.com>
2015-09-22 11:42:59 +08:00
Zheng Yang
9ce6f6b608 video: rockchip: hdmi: 3288/3368: set ddc clock to 50KHz.
Change-Id: I00ba32eb9115fe63606b6ccb441ca3b7e3378880
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-21 11:04:18 +08:00
Huang Jiachai
d90ec2f74e dtsi: lcd-F402: update cabc gamma lut
Change-Id: I799d6f607b953912755a4a6517b89a0bd659e6cc
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-21 10:23:30 +08:00
Huang Jiachai
662c3e55e3 video: rockchip: fb: vop driver struct select depend on lcdc id from extent screen
Change-Id: Ied1a53b86ee2e524707a017ba65cd5e648e93bae
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-21 10:23:29 +08:00
Huang Jiachai
4242177a79 video: rockchip: fbsys: add node to display a picture
1. su & stop;
    2. copy the picture bin to /data/fb0.bin;
    3. echo "n xsize ysize format" > /sys/class/graphics/fb0/dsp_buf;

    ps:
	a. n is the number of picture
	b. xsize and ysize is the picture resolution
	c. format:
	     RGBA=1,RGBX=2,RGB=3,YUV420_SP=17

Change-Id: Id256bee73958b6ab6250a17a723b0b73e7197874
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-21 10:23:15 +08:00
Chen Liang
f1eb385d72 rk3228: add dts file for sdk
Change-Id: I628f67408e84974d88645363140f77b887143658
Signed-off-by: Chen Liang <cl@rock-chips.com>
2015-09-18 10:01:08 +08:00
Huibin Hong
812c5163e7 rk3368.dtsi: fiq debug baud rate comment, change 115000 to 115200
Change-Id: I55fe0e8f5cae2d5aa16952e9612331ecc928335d
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2015-09-17 19:04:26 +08:00
Chen Liang
8446bec195 rk3228: initialize platform data
Change-Id: Id7fd0d98ef70641a62bd8520b72214141b5cf199
Signed-off-by: Chen Liang <cl@rock-chips.com>
2015-09-17 18:54:55 +08:00
Huang Jiachai
6631b869a9 video: rockchip: lcdc: 3288: add support yuv420 output
Change-Id: Id1cdc222774b37594eec3ed15633f9c138e6e9b1
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2015-09-17 16:43:12 +08:00
Huibin Hong
7498ed6627 fiq debugger: driver update
1. Change fiq debugger trigger mode, enter “fiq” instead of
F5 with SecureCRT

Change-Id: I3b52ad435af3211675a8416c6e016147886def8d
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2015-09-16 19:45:54 +08:00
Zheng Yang
dbb4cc8d6e video: rockchip: fb: recalculate logo offset to match new screen size
Change-Id: I9f62088f4d0868a9284d1794718da8f5a044f24a
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-16 10:33:06 +08:00
Zheng Yang
44bc4fd736 video: rockchip: lcdc: 3288/3368: read screen regs in uboot mode
Change-Id: I36db50471140d041fd0220283bc4e6ce59ec9d74
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-16 10:31:42 +08:00
Tang Yun ping
52f8f5cff0 rk3368 ddr: add configure ddr timing function
1.add the function of configure ddr timing such us sr_idle, pd_idle, odt
disable frequency, dll bypass frequency, odt strength, driver strength in dts.
2.make sure commit 8be554a502 ("rk3368 dts: add ddr timing node in
rk3368.dtsi" add ddr timing node in dts that user can configure ddr timing in
dts file.) was merged.
3.bl30 must update to rk3368bl30_v2.11.bin.

Change-Id: Ie8ae559c8128eb01788271a4333c465e21954ab1
Signed-off-by: Tang Yun ping <typ@rock-chips.com>
2015-09-15 16:30:38 +08:00
Xiao Feng
1a1394ca73 dvfs: rockchip: modify the pvtm_info of RK3368_v0
Change-Id: If3216b4d8d220411e0c54a657357187315a5d4b5
Signed-off-by: Xiao Feng <xf@rock-chips.com>
2015-09-15 15:51:18 +08:00
zhangqing
cccf1792d7 pmic: rk808: slove set voltage error
rk808 setting voltage had a overshoot question
so we set voltage must step by step.
support 12.5mv/step.

Change-Id: Idfce7b57d6717e51afaff2c170eff7bd16de23af
Signed-off-by: zhangqing <zhangqing@rock-chips.com>
2015-09-15 15:49:20 +08:00
Chris Zhong
0f3661b46e ARM: dts: fix some code style issues
Change-Id: I3f1f5637729171079ca7d108ba59521018c9561d
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
2015-09-15 15:09:36 +08:00
Zheng Yang
f4859250d6 video: rockchip: hdmi: 3368: support vesa dmt mode
Change-Id: Ic2a910cd50beb9b49baff7bd732f6c1bdd78790f
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-15 14:10:01 +08:00
Zheng Yang
ae4c2644f3 video: rockchip: hdmi: 3288/3368: phy pll support more vesa dmt clock
Change-Id: I7382e5554664f2014bb5aa579a2524bf1738d971
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-15 14:09:08 +08:00
Zheng Yang
f6656c7c7f video: rockchip: hdmi: support some vesa dmt mode
Change-Id: I28e935c717ae69fb2b48a7c243f8ce3cc7101a86
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-15 14:08:46 +08:00
Chris Zhong
7650349d79 ARM: dts: add a alias for rockchip_suspend
Since we need overwrite this rockchip_suspend node in sub dts file,
sometimes. Add a alias for before it.

Change-Id: I6d951d1c0bfff1cde619906eb9f11256d057a9fe
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
2015-09-15 10:09:52 +08:00
Huang, Tao
4d732be448 media: camsys_soc_priv: use cpu_is_rk3288 instead of soc_is_rk3288
Change-Id: If54087f71e0b6c923a11a6a37a4420ba86211070
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
2015-09-15 10:03:00 +08:00
Zheng Yang
22a5135d56 video: fbdev: Add additional vesa modes
Change-Id: I485601d679687db9a655f06b48929e66883bdadd
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-15 09:19:01 +08:00
Kevin Hilman
f0b7ed42af Merge branch 'linux-linaro-lsk-v3.10' into linux-linaro-lsk-v3.10-android 2015-09-14 14:16:21 -07:00
Kevin Hilman
4d869de174 This is the 3.10.88 stable release
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJV9Z+KAAoJEDjbvchgkmk+yoUQALEbk57GLCvTzvi59u1l6R7P
 GicrtO6gC8q354AvTlQHCStnpjvdSl3rGoZx9XHMwq9ZlnuWWd6CBHmCoQbn4yi5
 cABQOF+cvVESPAUjag1qavZKWupImRRirSX714jpFj6acjUCVk+4JTP8aNFbF2Rd
 MMCVmy3XCQXdPSaAw8Y7Foxub3eC36hVnx//Af+dt1C1YdIAK1fFo9KMtnP1RDZK
 SpzAnaJcvj1IjAKdyetqZvDj7KBeVBW8Bg16Y6eOe8CHVNy1ro53whrhi3M4PotQ
 NUuLyGZsI4T8Y8JtZXK1qgW0y5iOidAaFSGDwSCu+PGDEMWoFa7K2mWWtc6BW2vx
 gZf/jQfzSJhHJP42qowJshbMvgq2aUUHFFSpzPpAivNbrr9/SOvqWaiOIV7FjyqE
 Z0CDTPWW5j1vOuTpMcvseobvTFM6UYLaVIQ6QXLCzM3JityKZ5uEmgTiPBDhcge5
 LKS5XNXOpzY01jFPYvgzk3gFcunRicK0bK1Tr2Q7sSCA5pbSXxxjkJw2FSorjort
 MqpT7ZG0rE5tadrDw9NrdeLj6fJ1xF6pq5RN4InFpsnfk437RCcxu7c+IkYzmPpg
 z/mGr4RcvJEZx7lohNl4oB2lyyg6om2SNYk6PJlQEM1REhRKXSTEVas4k851JEow
 Mgmxf/EQTFZ+bkhPttnc
 =hBHg
 -----END PGP SIGNATURE-----

Merge tag 'v3.10.88' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.10

This is the 3.10.88 stable release

* tag 'v3.10.88' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (48 commits)
  Linux 3.10.88
  arm64/mm: Remove hack in mmap randomize layout
  crypto: caam - fix memory corruption in ahash_final_ctx
  libfc: Fix fc_fcp_cleanup_each_cmd()
  drm/radeon: add new OLAND pci id
  EDAC, ppc4xx: Access mci->csrows array elements properly
  localmodconfig: Use Kbuild files too
  dm thin metadata: delete btrees when releasing metadata snapshot
  perf: Fix fasync handling on inherited events
  mm/hwpoison: fix page refcount of unknown non LRU page
  ipc/sem.c: update/correct memory barriers
  ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
  Linux 3.10.87
  mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations
  md/bitmap: return an error when bitmap superblock is corrupt.
  kvm: x86: fix kvm_apic_has_events to check for NULL pointer
  signal: fix information leak in copy_siginfo_from_user32
  signal: fix information leak in copy_siginfo_to_user
  signalfd: fix information leak in signalfd_copyinfo
  ARM: 7819/1: fiq: Cast the first argument of flush_icache_range()
  ...
2015-09-14 14:15:32 -07:00
Chris Zhong
cbf1d23ba5 pinctrl: rockchip: fix rk3288 gpio0 configuration
On rk3288, for gpio bank 0, the registers which configure pull-up,
iomux, and drive strength don't implement the enable bits in the upper
half of the register, unlike the other gpio configuration registers,
and so the kernel must perform a read-modify-write of the register to
update a particular gpio in that bank.

Change-Id: I4a6953839307e3a75b2ac554aac3dc865583617d
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
2015-09-14 20:01:03 +08:00
Zheng Yang
92e7da2818 video: rockchip: fb: resize uboot logo if screen size is changed
If hdmi is inserted or removed before android is launched, screen
size is changed and uboot logo is showing on wrong screen position.

For example, screen size is 720x576 in uboot, hdmi is inserted during
kernel is booting, screen size is changed to 1920x1080, logo size
is still 720x576 and shown on left-top.

This case is occurred on box, mid has no problem. So we need to resize
uboot logo to new screen size.

Change-Id: I6247bf8e77d181687986815c960ec72d4c59a757
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-09-14 16:56:39 +08:00
Greg Kroah-Hartman
2ec142700e Linux 3.10.88 2015-09-13 09:08:15 -07:00
Yann Droneaud
82c9aed33b arm64/mm: Remove hack in mmap randomize layout
commit d6c763afab upstream.

Since commit 8a0a9bd4db ('random: make get_random_int() more
random'), get_random_int() returns a random value for each call,
so comment and hack introduced in mmap_rnd() as part of commit
1d18c47c73 ('arm64: MMU fault handling and page table management')
are incorrects.

Commit 1d18c47c73 seems to use the same hack introduced by
commit a5adc91a4b ('powerpc: Ensure random space between stack
and mmaps'), latter copied in commit 5a0efea09f ('sparc64: Sharpen
address space randomization calculations.').

But both architectures were cleaned up as part of commit
fa8cbaaf5a ('powerpc+sparc64/mm: Remove hack in mmap randomize
layout') as hack is no more needed since commit 8a0a9bd4db.

So the present patch removes the comment and the hack around
get_random_int() on AArch64's mmap_rnd().

Cc: David S. Miller <davem@davemloft.net>
Cc: Anton Blanchard <anton@samba.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Dan McGee <dpmcgee@gmail.com>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Matthias Brugger <mbrugger@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Horia Geant?
d51689e20a crypto: caam - fix memory corruption in ahash_final_ctx
commit b310c178e6 upstream.

When doing pointer operation for accessing the HW S/G table,
a value representing number of entries (and not number of bytes)
must be used.

Fixes: 045e36780f ("crypto: caam - ahash hmac support")
Signed-off-by: Horia Geant? <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Bart Van Assche
0a1b726993 libfc: Fix fc_fcp_cleanup_each_cmd()
commit 8f2777f53e upstream.

Since fc_fcp_cleanup_cmd() can sleep this function must not
be called while holding a spinlock. This patch avoids that
fc_fcp_cleanup_each_cmd() triggers the following bug:

BUG: scheduling while atomic: sg_reset/1512/0x00000202
1 lock held by sg_reset/1512:
 #0:  (&(&fsp->scsi_pkt_lock)->rlock){+.-...}, at: [<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
Preemption disabled at:[<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
Call Trace:
 [<ffffffff816c612c>] dump_stack+0x4f/0x7b
 [<ffffffff810828bc>] __schedule_bug+0x6c/0xd0
 [<ffffffff816c87aa>] __schedule+0x71a/0xa10
 [<ffffffff816c8ad2>] schedule+0x32/0x80
 [<ffffffffc0217eac>] fc_seq_set_resp+0xac/0x100 [libfc]
 [<ffffffffc0218b11>] fc_exch_done+0x41/0x60 [libfc]
 [<ffffffffc0225cff>] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc]
 [<ffffffffc0225f43>] fc_eh_device_reset+0x1c3/0x270 [libfc]
 [<ffffffff814a2cc9>] scsi_try_bus_device_reset+0x29/0x60
 [<ffffffff814a3908>] scsi_ioctl_reset+0x258/0x2d0
 [<ffffffff814a2650>] scsi_ioctl+0x150/0x440
 [<ffffffff814b3a9d>] sd_ioctl+0xad/0x120
 [<ffffffff8132f266>] blkdev_ioctl+0x1b6/0x810
 [<ffffffff811da608>] block_ioctl+0x38/0x40
 [<ffffffff811b4e08>] do_vfs_ioctl+0x2f8/0x530
 [<ffffffff811b50c1>] SyS_ioctl+0x81/0xa0
 [<ffffffff816cf8b2>] system_call_fastpath+0x16/0x7a

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Alex Deucher
e7e8231c59 drm/radeon: add new OLAND pci id
commit e037239e5e upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Michael Walle
94c379756b EDAC, ppc4xx: Access mci->csrows array elements properly
commit 5c16179b55 upstream.

The commit

  de3910eb79 ("edac: change the mem allocation scheme to
		 make Documentation/kobject.txt happy")

changed the memory allocation for the csrows member. But ppc4xx_edac was
forgotten in the patch. Fix it.

Signed-off-by: Michael Walle <michael@walle.cc>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Link: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Richard Weinberger
98e5059b20 localmodconfig: Use Kbuild files too
commit c0ddc8c745 upstream.

In kbuild it is allowed to define objects in files named "Makefile"
and "Kbuild".
Currently localmodconfig reads objects only from "Makefile"s and misses
modules like nouveau.

Link: http://lkml.kernel.org/r/1437948415-16290-1-git-send-email-richard@nod.at

Reported-and-tested-by: Leonidas Spyropoulos <artafinde@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Joe Thornber
9cdd5586f1 dm thin metadata: delete btrees when releasing metadata snapshot
commit 7f518ad0a2 upstream.

The device details and mapping trees were just being decremented
before.  Now btree_del() is called to do a deep delete.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Peter Zijlstra
1f6661e256 perf: Fix fasync handling on inherited events
commit fed66e2cdd upstream.

Vince reported that the fasync signal stuff doesn't work proper for
inherited events. So fix that.

Installing fasync allocates memory and sets filp->f_flags |= FASYNC,
which upon the demise of the file descriptor ensures the allocation is
freed and state is updated.

Now for perf, we can have the events stick around for a while after the
original FD is dead because of references from child events. So we
cannot copy the fasync pointer around. We can however consistently use
the parent's fasync, as that will be updated.

Reported-and-Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho deMelo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Wanpeng Li
50deac6cf7 mm/hwpoison: fix page refcount of unknown non LRU page
commit 4f32be677b upstream.

After trying to drain pages from pagevec/pageset, we try to get reference
count of the page again, however, the reference count of the page is not
reduced if the page is still not on LRU list.

Fix it by adding the put_page() to drop the page reference which is from
__get_any_page().

Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Manfred Spraul
30e5bc30f5 ipc/sem.c: update/correct memory barriers
commit 3ed1f8a99d upstream.

sem_lock() did not properly pair memory barriers:

!spin_is_locked() and spin_unlock_wait() are both only control barriers.
The code needs an acquire barrier, otherwise the cpu might perform read
operations before the lock test.

As no primitive exists inside <include/spinlock.h> and since it seems
noone wants another primitive, the code creates a local primitive within
ipc/sem.c.

With regards to -stable:

The change of sem_wait_array() is a bugfix, the change to sem_lock() is a
nop (just a preprocessor redefinition to improve the readability).  The
bugfix is necessary for all kernels that use sem_wait_array() (i.e.:
starting from 3.10).

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Kirill Tkhai <ktkhai@parallels.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-09-13 09:07:59 -07:00
Herton R. Krzesinski
04d2af2854 ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
commit 602b8593d2 upstream.

The current semaphore code allows a potential use after free: in
exit_sem we may free the task's sem_undo_list while there is still
another task looping through the same semaphore set and cleaning the
sem_undo list at freeary function (the task called IPC_RMID for the same
semaphore set).

For example, with a test program [1] running which keeps forking a lot
of processes (which then do a semop call with SEM_UNDO flag), and with
the parent right after removing the semaphore set with IPC_RMID, and a
kernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and
CONFIG_DEBUG_SPINLOCK, you can easily see something like the following
in the kernel log:

   Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64
   000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b  kkkkkkkk.kkkkkkk
   010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
   Prev obj: start=ffff88003b45c180, len=64
   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
   010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff  ...........7....
   Next obj: start=ffff88003b45c200, len=64
   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
   010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff  ........h).<....
   BUG: spinlock wrong CPU on CPU#2, test/18028
   general protection fault: 0000 [#1] SMP
   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
   CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1
   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
   RIP: spin_dump+0x53/0xc0
   Call Trace:
     spin_bug+0x30/0x40
     do_raw_spin_unlock+0x71/0xa0
     _raw_spin_unlock+0xe/0x10
     freeary+0x82/0x2a0
     ? _raw_spin_lock+0xe/0x10
     semctl_down.clone.0+0xce/0x160
     ? __do_page_fault+0x19a/0x430
     ? __audit_syscall_entry+0xa8/0x100
     SyS_semctl+0x236/0x2c0
     ? syscall_trace_leave+0xde/0x130
     entry_SYSCALL_64_fastpath+0x12/0x71
   Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89
   RIP  [<ffffffff810d6053>] spin_dump+0x53/0xc0
    RSP <ffff88003750fd68>
   ---[ end trace 783ebb76612867a0 ]---
   NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053]
   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
   CPU: 3 PID: 18053 Comm: test Tainted: G      D         4.2.0-rc5+ #1
   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
   RIP: native_read_tsc+0x0/0x20
   Call Trace:
     ? delay_tsc+0x40/0x70
     __delay+0xf/0x20
     do_raw_spin_lock+0x96/0x140
     _raw_spin_lock+0xe/0x10
     sem_lock_and_putref+0x11/0x70
     SYSC_semtimedop+0x7bf/0x960
     ? handle_mm_fault+0xbf6/0x1880
     ? dequeue_task_fair+0x79/0x4a0
     ? __do_page_fault+0x19a/0x430
     ? kfree_debugcheck+0x16/0x40
     ? __do_page_fault+0x19a/0x430
     ? __audit_syscall_entry+0xa8/0x100
     ? do_audit_syscall_entry+0x66/0x70
     ? syscall_trace_enter_phase1+0x139/0x160
     SyS_semtimedop+0xe/0x10
     SyS_semop+0x10/0x20
     entry_SYSCALL_64_fastpath+0x12/0x71
   Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9
   Kernel panic - not syncing: softlockup: hung tasks

I wasn't able to trigger any badness on a recent kernel without the
proper config debugs enabled, however I have softlockup reports on some
kernel versions, in the semaphore code, which are similar as above (the
scenario is seen on some servers running IBM DB2 which uses semaphore
syscalls).

The patch here fixes the race against freeary, by acquiring or waiting
on the sem_undo_list lock as necessary (exit_sem can race with freeary,
while freeary sets un->semid to -1 and removes the same sem_undo from
list_proc or when it removes the last sem_undo).

After the patch I'm unable to reproduce the problem using the test case
[1].

[1] Test case used below:

    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/ipc.h>
    #include <sys/sem.h>
    #include <sys/wait.h>
    #include <stdlib.h>
    #include <time.h>
    #include <unistd.h>
    #include <errno.h>

    #define NSEM 1
    #define NSET 5

    int sid[NSET];

    void thread()
    {
            struct sembuf op;
            int s;
            uid_t pid = getuid();

            s = rand() % NSET;
            op.sem_num = pid % NSEM;
            op.sem_op = 1;
            op.sem_flg = SEM_UNDO;

            semop(sid[s], &op, 1);
            exit(EXIT_SUCCESS);
    }

    void create_set()
    {
            int i, j;
            pid_t p;
            union {
                    int val;
                    struct semid_ds *buf;
                    unsigned short int *array;
                    struct seminfo *__buf;
            } un;

            /* Create and initialize semaphore set */
            for (i = 0; i < NSET; i++) {
                    sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT);
                    if (sid[i] < 0) {
                            perror("semget");
                            exit(EXIT_FAILURE);
                    }
            }
            un.val = 0;
            for (i = 0; i < NSET; i++) {
                    for (j = 0; j < NSEM; j++) {
                            if (semctl(sid[i], j, SETVAL, un) < 0)
                                    perror("semctl");
                    }
            }

            /* Launch threads that operate on semaphore set */
            for (i = 0; i < NSEM * NSET * NSET; i++) {
                    p = fork();
                    if (p < 0)
                            perror("fork");
                    if (p == 0)
                            thread();
            }

            /* Free semaphore set */
            for (i = 0; i < NSET; i++) {
                    if (semctl(sid[i], NSEM, IPC_RMID))
                            perror("IPC_RMID");
            }

            /* Wait for forked processes to exit */
            while (wait(NULL)) {
                    if (errno == ECHILD)
                            break;
            };
    }

    int main(int argc, char **argv)
    {
            pid_t p;

            srand(time(NULL));

            while (1) {
                    p = fork();
                    if (p < 0) {
                            perror("fork");
                            exit(EXIT_FAILURE);
                    }
                    if (p == 0) {
                            create_set();
                            goto end;
                    }

                    /* Wait for forked processes to exit */
                    while (wait(NULL)) {
                            if (errno == ECHILD)
                                    break;
                    };
            }
    end:
            return 0;
    }

[akpm@linux-foundation.org: use normal comment layout]
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Acked-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Rafael Aquini <aquini@redhat.com>
CC: Aristeu Rozanski <aris@redhat.com>
Cc: David Jeffery <djeffery@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-13 09:07:58 -07:00
Xiao Feng
31b19d3c43 ddrfreq: rockchip: read the parameters of auto-freq from dts
Change-Id: I50ff96bc66d929009da99b53c39d4b95567ad100
Signed-off-by: Xiao Feng <xf@rock-chips.com>
2015-09-11 18:23:24 +08:00
Xiao Feng
2c97b647f3 arm64: rockchip: rk3368: dts: add the parameters of auto-freq in dts
Change-Id: I8b19961a8a93b1ceb4378b1100d3f4cc8a5a9baa
Signed-off-by: Xiao Feng <xf@rock-chips.com>
2015-09-11 18:22:59 +08:00
Huang zhibao
4b51721783 ARM: dts: rk3368 box add xz3216 dcdc support
Change-Id: I91fab0816784bbdec36b2347f3e911fd402bc83e
Signed-off-by: Huang zhibao <hzb@rock-chips.com>
2015-09-11 18:20:18 +08:00