msm: iommu: Check for NULL genpools during domain teardown

During domain creation, some of the genpools will be set to NULL if
there is not enough memory for creation. Check for these NULL
genpools during domain destruction to avoid NULL dereferences.

Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Refactor remote spinlock defconfig

Refactor the remote spinlock defconfig to allow it to be used with
subsystems other than GPU. This will enhance the usability of this
feature and minimize the chance of errors when enabling this feature.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add support for selecting remote spinlock in device tree

Certain SoCs need to aquire a remote spinlock before accessing SMMU
registers. This adds support for specifying in the device tree which
SMMUs must take the remote spinlock.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Refactor use of remote spinlock

The remote spinlock was originally meant to synchronize access between
GPU and CPU accessing SMMU. However, there are more use cases that
this remote spinlock serves. This change decouples the spinlock from
GPU and adds support for taking the spinlock only for SMMUs that are
specified in the device tree.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Handle unmapping of PTE properly

The unmap api is currently not handling unmapping of page table
entries (PTE) properly. The generic function that calls the msm
unmap API expects the unmap call to unmap as much as possible
and then return the amount that was unmapped.
In addition the unmap function does not support an arbitrary input
length. However, the function that calls the msm unmap function
assumes that this is supported.

Both these issues can cause mappings to not be unmapped which will
cause subsequent mappings to fail because the mapping already exists.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Refactor page table code

Move code that is specific to short descriptor page table
format to its own file to allow sharing of header file
between long descriptor format page table and short descriptor
page table format.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add standalone support for secure SMMU

Add a configuration option that allows for testing of systems without
a secure environment. When turning on this option all the IOMMUs will
be programmed by the kernel regardless of whether the IOMMU is secure
or not. This allows for early testing during bringup.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add cache maintenance for calls into TZ

The scm_call API is no longer providing implicit cache maintenance for
shared buffers. Add cache flushing for buffers heading towards TZ and
cache invalidation for buffers coming from TZ.

Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: don't rely on structure format coming from TZ

The format of the secure fault register dump structure in TZ could
change over time. However, it should always adhere to the following
format (each row is 4 bytes wide):

    |-----------|
    | dump_size |
    | reg1_addr |
    | reg1_val  |
    | ...       |
    | regn_addr |
    | regn_val  |
    |-----------|

Rather than relying on the format of the structure, iterate over
the (addr, value) pairs.

Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Only flush the exact list size

Before giving a list of memory chunks to trustzone, the list needs
to be flushed. The list is simply an array of physical addresses.
The current flush routine takes into account the size of the memory
chunk which is incorrect. The memory chunk size is not used in
calculating the list length since the list is a list of pointers.
Adjust the cache flushing routine to flush the actual size of the
list: size of each entry times the number of entries.

Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Refactor printing of page fault

Refactor the code that reads the registers during an IOMMU
page fault to make the code more maintainable and make it
easier to add support for new registers.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add printing of 64 bits of TTBR0/1

When we get a page fault we print the value of TTBR0 and
TTBR1. However, we are only printing 32 bits of this 64
bit register.

Print the full 64 bits of this register which will be
helpful when debugging page fault issues.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "msm: iommu: remove tlb_invalidate from the map calls"

This might cause TLB invalidate to hang on unmap calls.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add support for LPAE bfb settings

Certain IOMMUs have support for LPAE and when LPAE is enabled
in these IOMMUs a different set of bfb register settings must
be used to achieve optimal performance.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
hells_defconfig: Refresh
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
build: b6.9-L
net/ping: handle protocol mismatching scenario

ping_lookup() may return a wrong sock if sk_buff's and sock's protocols
dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's
sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong
sock will be returned.
the fix is to "continue" the searching, if no matching, return NULL.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: James Morris <jmorris@namei.org>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Jane Zhou <a17711@motorola.com>
Signed-off-by: Yiwei Zhao <gbjc64@motorola.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
regmap: debugfs: Avoid overflows for very small reads

If count is less than the size of a register then we may hit integer
wraparound when trying to move backwards to check if we're still in
the buffer. Instead move the position forwards to check if it's still
in the buffer, we are unlikely to be able to allocate a buffer
sufficiently big to overflow here.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
regmap: cache Fix regcache-rbtree sync

The last register block, which falls into the specified range, is not handled
correctly. The formula which calculates the number of register which should be
synced is inverse (and off by one). E.g. if all registers in that block should
be synced only one is synced, and if only one should be synced all (but one) are
synced. To calculate the number of registers that need to be synced we need to
subtract the number of the first register in the block from the max register
number and add one. This patch updates the code accordingly.

The issue was introduced in commit ac8d91c ("regmap: Supply ranges to the sync
operations").

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>