android-sdk/kernel-video.git
6 years agoTEMP: ARM: dts: dra7-evm: add i2c2 pinmux back in kernel
Vishal Mahaveer [Tue, 17 Mar 2015 20:25:18 +0000 (15:25 -0500)]
TEMP: ARM: dts: dra7-evm: add i2c2 pinmux back in kernel

Temporary fix to handle LCD UI breakage on DRA7 EVM.
Previously LCD was primary or first display, now HDMI is the first display.

This patch brings back LCD as the first display.

Change-Id: Ibd00257bbbcf4777fe816a5d1be7e5ecd25e6f23
Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' into p-ti-linux-3.14.y-common
Praneeth Bajjuri [Mon, 23 Mar 2015 19:16:46 +0000 (14:16 -0500)]
Merge branch 'ti-linux-3.14.y' into p-ti-linux-3.14.y-common

* ti-linux-3.14.y:
  ARM: dts: AM4372: add dma properties for uart
  ARM: dts: am437x-gp-evm: move mmc3 dma events from uart3
  tty: 8250: workaround errata around disabling UART after using DMA
  tty: 8250: omap eliminate use of of_machine_is_compatible()
  tty: 8250: omap: introduce function to update mdr1
  bus: ocp2scp: SYNC2 value should be changed to 0x6
  ARM: dts: am4372: Add "ti, am437x-ocp2scp" as compatible string for OCP2SCP

Change-Id: I9978a5a83845ba87e46248ef02b478cfdbbc3709
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat... ti2014.10.02
Dan Murphy [Fri, 20 Mar 2015 15:33:48 +0000 (10:33 -0500)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: AM4372: add dma properties for uart
  ARM: dts: am437x-gp-evm: move mmc3 dma events from uart3
  tty: 8250: workaround errata around disabling UART after using DMA
  tty: 8250: omap eliminate use of of_machine_is_compatible()
  tty: 8250: omap: introduce function to update mdr1

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoARM: dts: AM4372: add dma properties for uart
Sekhar Nori [Tue, 17 Mar 2015 15:46:23 +0000 (21:16 +0530)]
ARM: dts: AM4372: add dma properties for uart

Add DMA properties for uart modules instances where
direct mapped channels are available. For other uarts
which are on EDMA crossbar, the mapping needs to be done
based on channel usage on the board they are used on.

AM437x UARTs are compatible to AM335x UARTs in terms of
DMA quirks required, so add "ti,am3352-uart" to the
compatible list. This does not break backward compatibility
as existing DTBs should continue to work with newer kernels
albeit without DMA support.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoARM: dts: am437x-gp-evm: move mmc3 dma events from uart3
Sekhar Nori [Wed, 18 Mar 2015 05:42:20 +0000 (11:12 +0530)]
ARM: dts: am437x-gp-evm: move mmc3 dma events from uart3

Move MMC3 crossbar mapped  dma events from uart3 to gpio0 and
gpio1

GPIO DMA events are much less likely to be used in future than
uart3 which recently gained support for DMA.

Cc: Eyal Reizer <eyalr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agotty: 8250: workaround errata around disabling UART after using DMA
Sekhar Nori [Fri, 13 Mar 2015 15:50:48 +0000 (21:20 +0530)]
tty: 8250: workaround errata around disabling UART after using DMA

AM335x and AM437x SoCs have an errata due to which UART cannot be
disabled after it has been used with DMA. OMAP3 has a similar errata
which has been worked around in a2fc36613ac1af2e9 ("ARM: OMAP3:
Use manual idle for UARTs because of DMA errata"), but the workaround
used there does not apply to AM335x and AM437x SoCs.

These SoCs need a softreset of UART before disabling them.

This patch implements that errata workaround. It is expected that
UART will be used with DMA so no explicit check for DMA usage
has been added for errata applicability.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agotty: 8250: omap eliminate use of of_machine_is_compatible()
Sekhar Nori [Fri, 13 Mar 2015 14:25:17 +0000 (19:55 +0530)]
tty: 8250: omap eliminate use of of_machine_is_compatible()

Use of of_machine_is_compatible() for AM335x specific DMA
quirk in 8250_omap driver makes it ugly to extend the
quirk for other platforms. Instead use a new compatible.

The new compatible will also make it easier to care of other
quirks specific to AM335x and like SoCs.

This patch does break backward DTB compatibility for users of
8250_omap driver on AM335x boards. However, the 8250_omap driver
is new and omap_serial is still the default choice driver for UART
and so choosing to break compatibility over keeping the code
around forever.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agotty: 8250: omap: introduce function to update mdr1
Sekhar Nori [Fri, 13 Mar 2015 11:20:29 +0000 (16:50 +0530)]
tty: 8250: omap: introduce function to update mdr1

updating mdr1 register on OMAP needs to take care of
errata i202. Introduce a function to update mdr1.

This will be useful later on when mdr1 needs to be
written to from other places. No functional change.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Dan Murphy [Thu, 19 Mar 2015 13:09:28 +0000 (08:09 -0500)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  bus: ocp2scp: SYNC2 value should be changed to 0x6
  ARM: dts: am4372: Add "ti, am437x-ocp2scp" as compatible string for OCP2SCP

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agobus: ocp2scp: SYNC2 value should be changed to 0x6
Kishon Vijay Abraham I [Tue, 17 Mar 2015 11:24:51 +0000 (16:54 +0530)]
bus: ocp2scp: SYNC2 value should be changed to 0x6

As per the TRMs of AM572x, OMAP4430, OMAP4460, OMAP543x, the value of
SYNC2 must be set to 0x6 in order to ensure correct operation.

So modified the SYNC2 value of OCP2SCP TIMING register to 0x6 in all the
platforms that use OCP2SCP driver except AM437x. Also introduced a new
compatible property since we don't want to modify the OCP2SCP TIMING
register for AM437x.

The sections in TRM where the above caution can be found is mentioned below.
AM572x TRM SPRUHZ6 (http://www.ti.com/lit/ug/spruhz6/spruhz6.pdf) under
section 26.3.2.2, table 26-26.

OMAP4430 TRM SWPU231AP (http://www.ti.com/lit/ug/swpu231ap/swpu231ap.pdf)
under section 23.12.6.2.2 , Table 23-1213.

OMAP4460 TRM SWPU235AB (http://www.ti.com/lit/ug/swpu235ab/swpu235ab.pdf)
under section 23.12.6.2.2, Table 23-1213.

OMAP543x TRM SWPU249 (http://www.ti.com/lit/pdf/swpu249)
under section 27.3.2.2, Table 27-27.

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoARM: dts: am4372: Add "ti, am437x-ocp2scp" as compatible string for OCP2SCP
Kishon Vijay Abraham I [Tue, 17 Mar 2015 11:24:50 +0000 (16:54 +0530)]
ARM: dts: am4372: Add "ti, am437x-ocp2scp" as compatible string for OCP2SCP

Added a new compatible string "ti,am437x-ocp2scp" for OCP2SCP module.
This is needed since except for the OCP2SCP used in AM437x, SYNC2 value
in OCP2SCP TIMING should be changed whereas the default value is sufficient
in AM437x.

Cc: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoMerge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android...
Praneeth Bajjuri [Tue, 17 Mar 2015 21:05:04 +0000 (16:05 -0500)]
Merge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio into p-ti-linux-3.14.y-common

* 'p-ti-linux-3.14.y-common/audio-for-next' of git://git.ti.com/android-sdk/kernel-audio:
  ti_config_fragments: auto: Enable JAMR3 sound card
  ASoC: dra7xx: Add support for JAMR3 board
  ASoC: core: Add name prefix DT property for codecs
  ASoC: dapm: Fix paths for widgets with name prefix
  ASoC: Add support for DAI multicodec
  ASoC: core: Refactor ac97 CODEC registration
  ASoC: core: Refactor dai link and aux dev init
  ASoC: core: Refactor CODEC/CODEC_DAI search
  ASoC: core: Refactor DAI widgets linking
  ASoC: core: Refactor CODEC DAI probe/remove
  ASoC: core: Get dev from runtime data
  ASoC: core: Allow setting CODEC conf by DT/OF node

Change-Id: I72c66daea17255f5fb2c57d88199191b03873d99
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel...
Praneeth Bajjuri [Tue, 17 Mar 2015 19:20:09 +0000 (14:20 -0500)]
Merge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel into p-ti-linux-3.14.y-common

* 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel:
  arm: dra72-evm: add wilink8 wlan and bt support
  ARM: dts: am57xx-evm: Add touch panel support
  Input: pixcir_i2c_ts - Add RESET gpio
  ARM: dts: DRA7-evm: Remove wlan pinmux
  ARM: dts: am57xx-evm: Remove wlan and bt pinmux
  OMAPDSS: HDMI: Remove unused label
  ARM: dts: am57xx-beagle-x15: Remove MCP rtc pin mux

Conflicts:
arch/arm/boot/dts/dra72-evm.dts

Change-Id: I8ba525493c234c14a2d3f3b350af6871536098dd
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti...
Dan Murphy [Thu, 12 Mar 2015 15:31:21 +0000 (10:31 -0500)]
Merge branch 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: wlcore
TI-Tree: git@git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel.git
TI-Branch: ti-linux-3.14.y-wlcore

* 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel:
  arm: dra72-evm: add wilink8 wlan and bt support

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Dan Murphy [Thu, 12 Mar 2015 14:57:19 +0000 (09:57 -0500)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: am57xx-evm: Add touch panel support
  Input: pixcir_i2c_ts - Add RESET gpio

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoarm: dra72-evm: add wilink8 wlan and bt support
Eyal Reizer [Wed, 11 Mar 2015 12:26:34 +0000 (14:26 +0200)]
arm: dra72-evm: add wilink8 wlan and bt support

The wilink8 module is a combo wireless connectivity card based
on Texas Instrument's wl18xx solution.

* Add support for the wlan capabilities of this module by muxing
  the relevant mmc and gpio lines, and setting the required
  platform data.
* Add device tree initilization for kim and ti shared transport
* Mux the uart pins used for connection to Wilink8 bluetooth
  and the bluetooth enable gpio pin

Signed-off-by: Eyal Reizer <eyalr@ti.com>
6 years agoARM: dts: am57xx-evm: Add touch panel support
Roger Quadros [Wed, 11 Mar 2015 17:25:15 +0000 (19:25 +0200)]
ARM: dts: am57xx-evm: Add touch panel support

The touch panel controller is Pixcir Tango C with
1024x600 resolution.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoInput: pixcir_i2c_ts - Add RESET gpio
Roger Quadros [Wed, 11 Mar 2015 17:25:14 +0000 (19:25 +0200)]
Input: pixcir_i2c_ts - Add RESET gpio

The controller has a RESET pin which is usually controlled over
a GPIO line. If such a GPIO is provided, perform a RESET
during probe.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoARM: dts: dra7-evm: remove McASP2, McASP6, radio and TSC pinmux
Praneeth Bajjuri [Tue, 10 Mar 2015 22:05:52 +0000 (17:05 -0500)]
ARM: dts: dra7-evm: remove McASP2, McASP6, radio and TSC pinmux

With the IODelay changes, bootloader now does the pinmuxing,
hence remove McASP2, McASP6, Radio and TSC pin ctrls from kernel.

Note: u-boot has to be updated to ensure functionality of these
modules.

Change-Id: I5127402f4e3dd1f2e27b14414ab9bfd7deda55fc
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti...
Dan Murphy [Wed, 11 Mar 2015 19:42:35 +0000 (14:42 -0500)]
Merge branch 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: wlcore
TI-Tree: git@git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel.git
TI-Branch: ti-linux-3.14.y-wlcore

* 'ti-linux-3.14.y-wlcore' of git.ti.com:wilink8-wlan/wilink8-wlan-ti-linux-kernel:
  ARM: dts: DRA7-evm: Remove wlan pinmux
  ARM: dts: am57xx-evm: Remove wlan and bt pinmux

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoARM: dts: DRA7-evm: Remove wlan pinmux
Lokesh Vutla [Wed, 11 Mar 2015 15:22:35 +0000 (17:22 +0200)]
ARM: dts: DRA7-evm: Remove wlan pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
dts files. This patch removes pinmuxing for wlan.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
6 years agoARM: dts: am57xx-evm: Remove wlan and bt pinmux
Lokesh Vutla [Wed, 11 Mar 2015 15:17:40 +0000 (17:17 +0200)]
ARM: dts: am57xx-evm: Remove wlan and bt pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for wlan and bt.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
6 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Dan Murphy [Wed, 11 Mar 2015 15:21:11 +0000 (10:21 -0500)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  OMAPDSS: HDMI: Remove unused label

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Dan Murphy [Wed, 11 Mar 2015 13:48:45 +0000 (08:48 -0500)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: am57xx-beagle-x15: Remove MCP rtc pin mux

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoOMAPDSS: HDMI: Remove unused label
Roger Quadros [Wed, 11 Mar 2015 10:03:21 +0000 (12:03 +0200)]
OMAPDSS: HDMI: Remove unused label

Fixes the following build warning:
drivers/video/fbdev/omap2/dss/hdmi4.c: In function ‘audio_enable’:
drivers/video/fbdev/omap2/dss/hdmi4.c:660:1: warning: label ‘out’ defined but not used [-Wunused-label]

Fixes: commit c2aebc0ed076 (" OMAPDSS ASoC: omap-hdmi-audio: Forbid audio playback if display is off")

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoMerge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel...
Praneeth Bajjuri [Tue, 10 Mar 2015 19:56:54 +0000 (14:56 -0500)]
Merge branch 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel into p-ti-linux-3.14.y-common

* 'ti-linux-3.14.y' of git://git.ti.com/ti-linux-kernel/ti-linux-kernel: (99 commits)
  ARM: DTS: am57xx-beagle-x15: Remove pinctrl entries for clkout2 and McASP3
  [TI-Integration]: ARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux
  ARM: dts: am57xx-evm: Remove VIP and mt9t11x pinmux
  ARM: dts: am57xx-evm: use pwm backlight
  ARM: dts: am57xx: move epwmss1 node to proper place
  ARM: dts: am57xx-evm: Remove LCD pinmux
  ARM: dts: BeagleBoard-x15: Remove HDMI pinmux
  ARM: DTS: dra7-evm: Remove McASP3 and ATL2 pinmux
  Linux 3.14.35
  x86, mm/ASLR: Fix stack randomization on 64-bit systems
  blk-throttle: check stats_cpu before reading it from sysfs
  btrfs: fix leak of path in btrfs_find_item
  btrfs: set proper message level for skinny metadata
  jffs2: fix handling of corrupted summary length
  EDAC, amd64_edac: Prevent OOPS with >16 memory controllers
  md/raid1: fix read balance when a drive is write-mostly.
  md/raid5: Fix livelock when array is both resyncing and degraded.
  metag: Fix KSTK_EIP() and KSTK_ESP() macros
  xfs: Fix quota type in quota structures when reusing quota file
  gpio: tps65912: fix wrong container_of arguments
  ...

Conflicts:
arch/arm/boot/dts/dra7-evm.dts

Change-Id: I708a8ee82fe1256fef5ae9460de7e59ff214e6ad
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoti_config_fragments: auto: Enable JAMR3 sound card
Manish Badarkhe [Tue, 16 Dec 2014 09:34:50 +0000 (15:04 +0530)]
ti_config_fragments: auto: Enable JAMR3 sound card

Change-Id: I6a77b31efb5ce6c679087137860a62cfa80e8910
Signed-off-by: Manish Badarkhe <manishvb@ti.com>
6 years agoASoC: dra7xx: Add support for JAMR3 board
Manish Badarkhe [Wed, 4 Feb 2015 05:27:51 +0000 (10:57 +0530)]
ASoC: dra7xx: Add support for JAMR3 board

JAMR3 is a companion board that features three instances of the tlv320aic3106
codec, which can be connected to the McASP6 in the DRA7 EVM boards. The JAMR3
DAI link is configured in TDM mode, and each stereo CODEC instance receives two
channels of the stream.

+--o tlv320aic3106 (Instance A)
tdm |
McASP6----------|--o tlv320aic3106 (Instance B)
|
+--o tlv320aic3106 (Instance C)

Change-Id: I3e397781b0be3bd76606304e5504d17389925762
Signed-off-by: Manish Badarkhe <manishvb@ti.com>
6 years agoASoC: core: Add name prefix DT property for codecs
Misael Lopez Cruz [Fri, 7 Nov 2014 09:37:31 +0000 (03:37 -0600)]
ASoC: core: Add name prefix DT property for codecs

The name prefix for CODECs is used to avoid name collisions
when multiple instances of a given CODEC are present in the
sound card.

The name prefix was being mapped statically to its corresponding
CODEC using the CODEC's device name. Passing the name prefix
through DT property ("name-prefix") provides more flexibility
and avoids hard-coding the CODEC's device name in the machine
drivers.

Change-Id: Ibb9ef3e53648fb440f9ce4212faaf7ad00aacb21
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoASoC: dapm: Fix paths for widgets with name prefix
Misael Lopez Cruz [Mon, 4 Aug 2014 15:51:40 +0000 (10:51 -0500)]
ASoC: dapm: Fix paths for widgets with name prefix

The path between prefixed DAI widgets (e.g. widget's name
"<PREFIX> Playback") and stream widgets (e.g. widget's sname
"Left Playback") are currently being skipped while trying to
prevent duplicate paths.

The duplicate paths are now prevented by looking at the DAI
widget type instead, since the prefix prevents the substring
search to succeed.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: I844e8d3d1fc084a755287c15b9ad53d946722e24
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
6 years agoASoC: Add support for DAI multicodec
Misael Lopez Cruz [Wed, 26 Jun 2013 08:08:48 +0000 (03:08 -0500)]
ASoC: Add support for DAI multicodec

Add support for DAI links composed of a single CPU DAI and multiple
CODECs. Sound cards have to pass the CODECs array in the corresponding
DAI link through a new 'snd_soc_dai_link_codec' struct. Each CODEC in
this array is described in the same manner single CODEC DAIs are
(either DT/OF node or codec_name).

CPU DAI in a multicodec DAI link can have more channels than what each
CODEC has. The number of channels each CODEC is responsible for is
machine specific, hence it's fixed up in machine drivers in a similar
way to what DPCM does.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: Id7dbe7675d0082f685f16b824dd64de06820a9bf
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Manish Badarkhe <manishvb@ti.com>
6 years agoASoC: core: Refactor ac97 CODEC registration
Misael Lopez Cruz [Wed, 5 Jun 2013 08:38:22 +0000 (03:38 -0500)]
ASoC: core: Refactor ac97 CODEC registration

CODEC registration specific function is added in preparation for
DAI-multicodec support.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: Ic74d55963625f79fbb48762ee323f461ae9c1eba
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Refactor dai link and aux dev init
Misael Lopez Cruz [Wed, 19 Jun 2013 21:35:59 +0000 (16:35 -0500)]
ASoC: core: Refactor dai link and aux dev init

Separate DAI link and aux dev initialization in preparation for
DAI multicodec support, since aux dev will remain using single
codecs but DAI links will be able to support multiple codecs.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: I6fed114e57b0d95742c3936d025138597f15b52a
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Refactor CODEC/CODEC_DAI search
Misael Lopez Cruz [Wed, 5 Jun 2013 08:25:59 +0000 (03:25 -0500)]
ASoC: core: Refactor CODEC/CODEC_DAI search

Refactor CODEC and CODEC DAI search in preparation for DAI-multicodec.
Dedicated functions for CODEC/CODEC_DAI search are added.

Previous implementation unnecessarily kept searching for a matching CODEC
in the remaining register CODECS even if it was already found.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: Icc7c29b29e43ada4aa1353c990384f703b0d191e
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Refactor DAI widgets linking
Misael Lopez Cruz [Wed, 5 Jun 2013 08:07:03 +0000 (03:07 -0500)]
ASoC: core: Refactor DAI widgets linking

Refactor DAI widgets linking in preparation for DAI-multicodec
support.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: I4d0196bffd3fc0e9f76abcf603eed8ec7ee3988c
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Refactor CODEC DAI probe/remove
Misael Lopez Cruz [Wed, 5 Jun 2013 06:59:08 +0000 (01:59 -0500)]
ASoC: core: Refactor CODEC DAI probe/remove

Refactor CODEC DAI probe and remove in preparation for DAI-multicodec
support.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: If79e9a04eafdcee2075cc496a5a6b66255eb35d9
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Get dev from runtime data
Misael Lopez Cruz [Sun, 16 Jun 2013 05:16:07 +0000 (00:16 -0500)]
ASoC: core: Get dev from runtime data

Get dev pointer for dev_err() from runtime data instead of
codec in preparation for DAI-multicodec support.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: Id4111cee535cf07c8e5f1113d631f1a3984b6085
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
6 years agoASoC: core: Allow setting CODEC conf by DT/OF node
Misael Lopez Cruz [Sun, 9 Jun 2013 22:12:01 +0000 (17:12 -0500)]
ASoC: core: Allow setting CODEC conf by DT/OF node

Extend CODEC configuration to allow passing DT/OF node
or the dev_name.
Previously, it was possible only via dev_name.

This patch is ported from p-ti-linux-3.8.y released kernel branch
tree.(Kernel Version:3.8).

Change-Id: I06d801f13652f1b214c040e65fa88d586a51d65a
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>
Signed-off-by: Charulatha Varadarajan <charu@ti.com>
Signed-off-by: Manish Badarkhe <manishvb@ti.com>
6 years agoARM: dts: am57xx-beagle-x15: Remove MCP rtc pin mux
Nishanth Menon [Mon, 9 Mar 2015 20:07:09 +0000 (15:07 -0500)]
ARM: dts: am57xx-beagle-x15: Remove MCP rtc pin mux

Remove the MCP RTC pins from DT. this needs is now done
in bootloader thanks to the need of muxing in IO isolation.

Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
6 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Dan Murphy [Mon, 9 Mar 2015 17:39:25 +0000 (12:39 -0500)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  ARM: DTS: am57xx-beagle-x15: Remove pinctrl entries for clkout2 and McASP3
  ARM: dts: am57xx-evm: Remove VIP and mt9t11x pinmux

Signed-off-by: Dan Murphy <DMurphy@ti.com>
6 years agoARM: DTS: am57xx-beagle-x15: Remove pinctrl entries for clkout2 and McASP3
Peter Ujfalusi [Mon, 9 Mar 2015 09:08:38 +0000 (11:08 +0200)]
ARM: DTS: am57xx-beagle-x15: Remove pinctrl entries for clkout2 and McASP3

Remove audio related pinmux from the DTS.
These pins now configured by the bootloader.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years ago[TI-Integration]: ARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux
Sekhar Nori [Wed, 4 Mar 2015 16:00:44 +0000 (21:30 +0530)]
[TI-Integration]: ARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for cpsw, mdio, nand and tsc.

[dmurphy] - Cherry picked this commit back into the tree as the
audio/display merge caused pinmux nodes to come back for connectivity
in the dra7-evm.dts that were removed in the original
commit afdcaf98f8642e51dee41a7e4f0e218f85390e95

Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Conflicts:
arch/arm/boot/dts/dra7-evm.dts

6 years agoARM: dts: am57xx-evm: Remove VIP and mt9t11x pinmux
Benoit Parrot [Mon, 9 Mar 2015 14:56:40 +0000 (09:56 -0500)]
ARM: dts: am57xx-evm: Remove VIP and mt9t11x pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
dts files. This patch removes pinmuxing related to vip and mt9t11x related.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Texas Instruments Auto Merger [Mon, 9 Mar 2015 10:21:09 +0000 (05:21 -0500)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  ARM: dts: am57xx-evm: use pwm backlight
  ARM: dts: am57xx: move epwmss1 node to proper place
  ARM: dts: am57xx-evm: Remove LCD pinmux
  ARM: dts: BeagleBoard-x15: Remove HDMI pinmux
  ARM: DTS: dra7-evm: Remove McASP3 and ATL2 pinmux

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
6 years agoARM: dts: am57xx-evm: use pwm backlight
Tomi Valkeinen [Thu, 5 Mar 2015 11:11:03 +0000 (13:11 +0200)]
ARM: dts: am57xx-evm: use pwm backlight

Use the backlight in PWM mode isntead of GPIO.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Vignesh R <vigneshr@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoARM: dts: am57xx: move epwmss1 node to proper place
Tomi Valkeinen [Thu, 5 Mar 2015 11:12:43 +0000 (13:12 +0200)]
ARM: dts: am57xx: move epwmss1 node to proper place

AM57xx EVM uses epwmss1 for backlight. X15 does not use it for anything.
So let's move the node that enables epwmss1 from am57xx-beagle-x15.dts
to am57xx-evm.dts.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Vignesh R <vigneshr@ti.com>
Acked-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoARM: dts: am57xx-evm: Remove LCD pinmux
Tomi Valkeinen [Thu, 5 Mar 2015 15:11:44 +0000 (17:11 +0200)]
ARM: dts: am57xx-evm: Remove LCD pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files.

Remove LCD related pinmuxing from am57xx-evm.dts.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoARM: dts: BeagleBoard-x15: Remove HDMI pinmux
Tomi Valkeinen [Thu, 5 Mar 2015 15:10:29 +0000 (17:10 +0200)]
ARM: dts: BeagleBoard-x15: Remove HDMI pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files.

Remove HDMI related pinmuxing from am57xx-beagle-x15.dts.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoARM: DTS: dra7-evm: Remove McASP3 and ATL2 pinmux
Peter Ujfalusi [Wed, 4 Mar 2015 07:43:44 +0000 (09:43 +0200)]
ARM: DTS: dra7-evm: Remove McASP3 and ATL2 pinmux

The pin configuration has been moved to u-boot.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
6 years agoMerge tag 'v3.14.35' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Texas Instruments Auto Merger [Sat, 7 Mar 2015 11:12:15 +0000 (05:12 -0600)]
Merge tag 'v3.14.35' of git./linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.35 stable release

* tag 'v3.14.35' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (77 commits)
  Linux 3.14.35
  x86, mm/ASLR: Fix stack randomization on 64-bit systems
  blk-throttle: check stats_cpu before reading it from sysfs
  btrfs: fix leak of path in btrfs_find_item
  btrfs: set proper message level for skinny metadata
  jffs2: fix handling of corrupted summary length
  EDAC, amd64_edac: Prevent OOPS with >16 memory controllers
  md/raid1: fix read balance when a drive is write-mostly.
  md/raid5: Fix livelock when array is both resyncing and degraded.
  metag: Fix KSTK_EIP() and KSTK_ESP() macros
  xfs: Fix quota type in quota structures when reusing quota file
  gpio: tps65912: fix wrong container_of arguments
  gpiolib: of: allow of_gpiochip_find_and_xlate to find more than one chip per node
  arm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian
  hx4700: regulator: declare full constraints
  KVM: x86: update masterclock values on TSC writes
  KVM: MIPS: Don't leak FPU/DSP to guest
  ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE
  ntp: Fixup adjtimex freq validation on 32-bit systems
  kdb: fix incorrect counts in KDB summary command output
  ...

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
6 years agoinput: touchscreen: ldc3001: Fix build error if !CONFIG_PM_SLEEP
Grygorii Strashko [Thu, 5 Feb 2015 09:37:34 +0000 (11:37 +0200)]
input: touchscreen: ldc3001: Fix build error if !CONFIG_PM_SLEEP

Fix following build error if CONFIG_PM_SLEEP is not set:

drivers/input/touchscreen/ldc3001_ts.c:513:10: error: 'ldc3001_dev_pm_ops' undeclared here (not in a function)
   .pm = &ldc3001_dev_pm_ops,
          ^
make[3]: *** [drivers/input/touchscreen/ldc3001_ts.o] Error 1

Change-Id: I691524135506c98008f1ff9cb53dc28a3f20cbc5
Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
[added change-id]
Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
6 years agoLinux 3.14.35
Greg Kroah-Hartman [Fri, 6 Mar 2015 22:44:34 +0000 (14:44 -0800)]
Linux 3.14.35

6 years agox86, mm/ASLR: Fix stack randomization on 64-bit systems
Hector Marco-Gisbert [Sat, 14 Feb 2015 17:33:50 +0000 (09:33 -0800)]
x86, mm/ASLR: Fix stack randomization on 64-bit systems

commit 4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 upstream.

The issue is that the stack for processes is not properly randomized on
64 bit architectures due to an integer overflow.

The affected function is randomize_stack_top() in file
"fs/binfmt_elf.c":

  static unsigned long randomize_stack_top(unsigned long stack_top)
  {
           unsigned int random_variable = 0;

           if ((current->flags & PF_RANDOMIZE) &&
                   !(current->personality & ADDR_NO_RANDOMIZE)) {
                   random_variable = get_random_int() & STACK_RND_MASK;
                   random_variable <<= PAGE_SHIFT;
           }
           return PAGE_ALIGN(stack_top) + random_variable;
           return PAGE_ALIGN(stack_top) - random_variable;
  }

Note that, it declares the "random_variable" variable as "unsigned int".
Since the result of the shifting operation between STACK_RND_MASK (which
is 0x3fffff on x86_64, 22 bits) and PAGE_SHIFT (which is 12 on x86_64):

  random_variable <<= PAGE_SHIFT;

then the two leftmost bits are dropped when storing the result in the
"random_variable". This variable shall be at least 34 bits long to hold
the (22+12) result.

These two dropped bits have an impact on the entropy of process stack.
Concretely, the total stack entropy is reduced by four: from 2^28 to
2^30 (One fourth of expected entropy).

This patch restores back the entropy by correcting the types involved
in the operations in the functions randomize_stack_top() and
stack_maxrandom_size().

The successful fix can be tested with:

  $ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done
  7ffeda566000-7ffeda587000 rw-p 00000000 00:00 0                          [stack]
  7fff5a332000-7fff5a353000 rw-p 00000000 00:00 0                          [stack]
  7ffcdb7a1000-7ffcdb7c2000 rw-p 00000000 00:00 0                          [stack]
  7ffd5e2c4000-7ffd5e2e5000 rw-p 00000000 00:00 0                          [stack]
  ...

Once corrected, the leading bytes should be between 7ffc and 7fff,
rather than always being 7fff.

Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Ismael Ripoll <iripoll@upv.es>
[ Rebased, fixed 80 char bugs, cleaned up commit message, added test example and CVE ]
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Fixes: CVE-2015-1593
Link: http://lkml.kernel.org/r/20150214173350.GA18393@www.outflux.net
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoblk-throttle: check stats_cpu before reading it from sysfs
Thadeu Lima de Souza Cascardo [Mon, 16 Feb 2015 19:16:45 +0000 (17:16 -0200)]
blk-throttle: check stats_cpu before reading it from sysfs

commit 045c47ca306acf30c740c285a77a4b4bda6be7c5 upstream.

When reading blkio.throttle.io_serviced in a recently created blkio
cgroup, it's possible to race against the creation of a throttle policy,
which delays the allocation of stats_cpu.

Like other functions in the throttle code, just checking for a NULL
stats_cpu prevents the following oops caused by that race.

[ 1117.285199] Unable to handle kernel paging request for data at address 0x7fb4d0020
[ 1117.285252] Faulting instruction address: 0xc0000000003efa2c
[ 1137.733921] Oops: Kernel access of bad area, sig: 11 [#1]
[ 1137.733945] SMP NR_CPUS=2048 NUMA PowerNV
[ 1137.734025] Modules linked in: bridge stp llc kvm_hv kvm binfmt_misc autofs4
[ 1137.734102] CPU: 3 PID: 5302 Comm: blkcgroup Not tainted 3.19.0 #5
[ 1137.734132] task: c000000f1d188b00 ti: c000000f1d210000 task.ti: c000000f1d210000
[ 1137.734167] NIP: c0000000003efa2c LR: c0000000003ef9f0 CTR: c0000000003ef980
[ 1137.734202] REGS: c000000f1d213500 TRAP: 0300   Not tainted  (3.19.0)
[ 1137.734230] MSR: 9000000000009032 <SF,HV,EE,ME,IR,DR,RI>  CR: 42008884  XER: 20000000
[ 1137.734325] CFAR: 0000000000008458 DAR: 00000007fb4d0020 DSISR: 40000000 SOFTE: 0
GPR00: c0000000003ed3a0 c000000f1d213780 c000000000c59538 0000000000000000
GPR04: 0000000000000800 0000000000000000 0000000000000000 0000000000000000
GPR08: ffffffffffffffff 00000007fb4d0020 00000007fb4d0000 c000000000780808
GPR12: 0000000022000888 c00000000fdc0d80 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 000001003e120200 c000000f1d5b0cc0 0000000000000200 0000000000000000
GPR24: 0000000000000001 c000000000c269e0 0000000000000020 c000000f1d5b0c80
GPR28: c000000000ca3a08 c000000000ca3dec c000000f1c667e00 c000000f1d213850
[ 1137.734886] NIP [c0000000003efa2c] .tg_prfill_cpu_rwstat+0xac/0x180
[ 1137.734915] LR [c0000000003ef9f0] .tg_prfill_cpu_rwstat+0x70/0x180
[ 1137.734943] Call Trace:
[ 1137.734952] [c000000f1d213780] [d000000005560520] 0xd000000005560520 (unreliable)
[ 1137.734996] [c000000f1d2138a0] [c0000000003ed3a0] .blkcg_print_blkgs+0xe0/0x1a0
[ 1137.735039] [c000000f1d213960] [c0000000003efb50] .tg_print_cpu_rwstat+0x50/0x70
[ 1137.735082] [c000000f1d2139e0] [c000000000104b48] .cgroup_seqfile_show+0x58/0x150
[ 1137.735125] [c000000f1d213a70] [c0000000002749dc] .kernfs_seq_show+0x3c/0x50
[ 1137.735161] [c000000f1d213ae0] [c000000000218630] .seq_read+0xe0/0x510
[ 1137.735197] [c000000f1d213bd0] [c000000000275b04] .kernfs_fop_read+0x164/0x200
[ 1137.735240] [c000000f1d213c80] [c0000000001eb8e0] .__vfs_read+0x30/0x80
[ 1137.735276] [c000000f1d213cf0] [c0000000001eb9c4] .vfs_read+0x94/0x1b0
[ 1137.735312] [c000000f1d213d90] [c0000000001ebb38] .SyS_read+0x58/0x100
[ 1137.735349] [c000000f1d213e30] [c000000000009218] syscall_exit+0x0/0x98
[ 1137.735383] Instruction dump:
[ 1137.735405] 7c6307b4 7f891800 409d00b8 60000000 60420000 3d420004 392a63b0 786a1f24
[ 1137.735471] 7d49502a e93e01c8 7d495214 7d2ad214 <7cead02ae9090008 e9490010 e9290018

And here is one code that allows to easily reproduce this, although this
has first been found by running docker.

void run(pid_t pid)
{
int n;
int status;
int fd;
char *buffer;
buffer = memalign(BUFFER_ALIGN, BUFFER_SIZE);
n = snprintf(buffer, BUFFER_SIZE, "%d\n", pid);
fd = open(CGPATH "/test/tasks", O_WRONLY);
write(fd, buffer, n);
close(fd);
if (fork() > 0) {
fd = open("/dev/sda", O_RDONLY | O_DIRECT);
read(fd, buffer, 512);
close(fd);
wait(&status);
} else {
fd = open(CGPATH "/test/blkio.throttle.io_serviced", O_RDONLY);
n = read(fd, buffer, BUFFER_SIZE);
close(fd);
}
free(buffer);
exit(0);
}

void test(void)
{
int status;
mkdir(CGPATH "/test", 0666);
if (fork() > 0)
wait(&status);
else
run(getpid());
rmdir(CGPATH "/test");
}

int main(int argc, char **argv)
{
int i;
for (i = 0; i < NR_TESTS; i++)
test();
return 0;
}

Reported-by: Ricardo Marin Matinata <rmm@br.ibm.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agobtrfs: fix leak of path in btrfs_find_item
David Sterba [Fri, 2 Jan 2015 17:45:16 +0000 (18:45 +0100)]
btrfs: fix leak of path in btrfs_find_item

commit 381cf6587f8a8a8e981bc0c1aaaa8859b51dc756 upstream.

If btrfs_find_item is called with NULL path it allocates one locally but
does not free it. Affected paths are inserting an orphan item for a file
and for a subvol root.

Move the path allocation to the callers.

Fixes: 3f870c289900 ("btrfs: expand btrfs_find_item() to include find_orphan_item functionality")
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agobtrfs: set proper message level for skinny metadata
David Sterba [Fri, 19 Dec 2014 17:38:47 +0000 (18:38 +0100)]
btrfs: set proper message level for skinny metadata

commit 5efa0490cc94aee06cd8d282683e22a8ce0a0026 upstream.

This has been confusing people for too long, the message is really just
informative.

Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agojffs2: fix handling of corrupted summary length
Chen Jie [Tue, 10 Feb 2015 20:49:48 +0000 (12:49 -0800)]
jffs2: fix handling of corrupted summary length

commit 164c24063a3eadee11b46575c5482b2f1417be49 upstream.

sm->offset maybe wrong but magic maybe right, the offset do not have CRC.

Badness at c00c7580 [verbose debug info unavailable]
NIP: c00c7580 LR: c00c718c CTR: 00000014
REGS: df07bb40 TRAP: 0700   Not tainted  (2.6.34.13-WR4.3.0.0_standard)
MSR: 00029000 <EE,ME,CE>  CR: 22084f84  XER: 00000000
TASK = df84d6e0[908] 'mount' THREAD: df07a000
GPR00: 00000001 df07bbf0 df84d6e0 00000000 00000001 00000000 df07bb58 00000041
GPR08: 00000041 c0638860 00000000 00000010 22084f88 100636c8 df814ff8 00000000
GPR16: df84d6e0 dfa558cc c05adb90 00000048 c0452d30 00000000 000240d0 000040d0
GPR24: 00000014 c05ae734 c05be2e0 00000000 00000001 00000000 00000000 c05ae730
NIP [c00c7580] __alloc_pages_nodemask+0x4d0/0x638
LR [c00c718c] __alloc_pages_nodemask+0xdc/0x638
Call Trace:
[df07bbf0] [c00c718c] __alloc_pages_nodemask+0xdc/0x638 (unreliable)
[df07bc90] [c00c7708] __get_free_pages+0x20/0x48
[df07bca0] [c00f4a40] __kmalloc+0x15c/0x1ec
[df07bcd0] [c01fc880] jffs2_scan_medium+0xa58/0x14d0
[df07bd70] [c01ff38c] jffs2_do_mount_fs+0x1f4/0x6b4
[df07bdb0] [c020144c] jffs2_do_fill_super+0xa8/0x260
[df07bdd0] [c020230c] jffs2_fill_super+0x104/0x184
[df07be00] [c0335814] get_sb_mtd_aux+0x9c/0xec
[df07be20] [c033596c] get_sb_mtd+0x84/0x1e8
[df07be60] [c0201ed0] jffs2_get_sb+0x1c/0x2c
[df07be70] [c0103898] vfs_kern_mount+0x78/0x1e8
[df07bea0] [c0103a58] do_kern_mount+0x40/0x100
[df07bec0] [c011fe90] do_mount+0x240/0x890
[df07bf10] [c0120570] sys_mount+0x90/0xd8
[df07bf40] [c00110d8] ret_from_syscall+0x0/0x4

=== Exception: c01 at 0xff61a34
    LR = 0x100135f0
Instruction dump:
38800005 38600000 48010f41 4bfffe1c 4bfc2d15 4bfffe8c 72e90200 4082fc28
3d20c064 39298860 8809000d 68000001 <0f0000002f800000 419efc0c 38000001
mount: mounting /dev/mtdblock3 on /common failed: Input/output error

Signed-off-by: Chen Jie <chenjie6@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoEDAC, amd64_edac: Prevent OOPS with >16 memory controllers
Daniel J Blueman [Tue, 17 Feb 2015 03:34:38 +0000 (11:34 +0800)]
EDAC, amd64_edac: Prevent OOPS with >16 memory controllers

commit 0c510cc83bdbaac8406f4f7caef34f4da0ba35ea upstream.

When DRAM errors occur on memory controllers after EDAC_MAX_MCS (16),
the kernel fatally dereferences unallocated structures, see splat below;
this occurs on at least NumaConnect systems.

Fix by checking if a memory controller info structure was found.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000320
IP: [<ffffffff819f714f>] decode_bus_error+0x2f/0x2b0
PGD 2f8b5a3067 PUD 2f8b5a2067 PMD 0
Oops: 0000 [#2] SMP
Modules linked in:
CPU: 224 PID: 11930 Comm: stream_c.exe.gn Tainted: G   D    3.19.0 #1
Hardware name: Supermicro H8QGL/H8QGL, BIOS 3.5b    01/28/2015
task: ffff8807dbfb8c00 ti: ffff8807dd16c000 task.ti: ffff8807dd16c000
RIP: 0010:[<ffffffff819f714f>] [<ffffffff819f714f>] decode_bus_error+0x2f/0x2b0
RSP: 0000:ffff8907dfc03c48 EFLAGS: 00010297
RAX: 0000000000000001 RBX: 9c67400010080a13 RCX: 0000000000001dc6
RDX: 000000001dc61dc6 RSI: ffff8907dfc03df0 RDI: 000000000000001c
RBP: ffff8907dfc03ce8 R08: 0000000000000000 R09: 0000000000000022
R10: ffff891fffa30380 R11: 00000000001cfc90 R12: 0000000000000008
R13: 0000000000000000 R14: 000000000000001c R15: 00009c6740001000
FS: 00007fa97ee18700(0000) GS:ffff8907dfc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000320 CR3: 0000003f889b8000 CR4: 00000000000407e0
Stack:
 0000000000000000 ffff8907dfc03df0 0000000000000008 9c67400010080a13
 000000000000001c 00009c6740001000 ffff8907dfc03c88 ffffffff810e4f9a
 ffff8907dfc03ce8 ffffffff81b375b9 0000000000000000 0000000000000010
Call Trace:
 <IRQ>
 ? vprintk_default
 ? printk
 amd_decode_mce
 notifier_call_chain
 atomic_notifier_call_chain
 mce_log
 machine_check_poll
 mce_timer_fn
 ? mce_cpu_restart
 call_timer_fn.isra.29
 run_timer_softirq
 __do_softirq
 irq_exit
 smp_apic_timer_interrupt
 apic_timer_interrupt
 <EOI>
 ? down_read_trylock
 __do_page_fault
 ? __schedule
 do_page_fault
 page_fault

Signed-off-by: Daniel J Blueman <daniel@numascale.com>
Link: http://lkml.kernel.org/r/1424144078-24589-1-git-send-email-daniel@numascale.com
[ Boris: massage commit message ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agomd/raid1: fix read balance when a drive is write-mostly.
Tomáš Hodek [Mon, 23 Feb 2015 00:00:38 +0000 (11:00 +1100)]
md/raid1: fix read balance when a drive is write-mostly.

commit d1901ef099c38afd11add4cfb3312c02ef21ec4a upstream.

When a drive is marked write-mostly it should only be the
target of reads if there is no other option.

This behaviour was broken by

commit 9dedf60313fa4dddfd5b9b226a0ef12a512bf9dc
    md/raid1: read balance chooses idlest disk for SSD

which causes a write-mostly device to be *preferred* is some cases.

Restore correct behaviour by checking and setting
best_dist_disk and best_pending_disk rather than best_disk.

We only need to test one of these as they are both changed
from -1 or >=0 at the same time.

As we leave min_pending and best_dist unchanged, any non-write-mostly
device will appear better than the write-mostly device.

Reported-by: Tomáš Hodek <tomas.hodek@volny.cz>
Reported-by: Dark Penguin <darkpenguin@yandex.ru>
Signed-off-by: NeilBrown <neilb@suse.de>
Link: http://marc.info/?l=linux-raid&m=135982797322422
Fixes: 9dedf60313fa4dddfd5b9b226a0ef12a512bf9dc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agomd/raid5: Fix livelock when array is both resyncing and degraded.
NeilBrown [Wed, 18 Feb 2015 00:35:14 +0000 (11:35 +1100)]
md/raid5: Fix livelock when array is both resyncing and degraded.

commit 26ac107378c4742978216be1005b7291b799c7b2 upstream.

Commit a7854487cd7128a30a7f4f5259de9f67d5efb95f:
  md: When RAID5 is dirty, force reconstruct-write instead of read-modify-write.

Causes an RCW cycle to be forced even when the array is degraded.
A degraded array cannot support RCW as that requires reading all data
blocks, and one may be missing.

Forcing an RCW when it is not possible causes a live-lock and the code
spins, repeatedly deciding to do something that cannot succeed.

So change the condition to only force RCW on non-degraded arrays.

Reported-by: Manibalan P <pmanibalan@amiindia.co.in>
Bisected-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Tested-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: a7854487cd7128a30a7f4f5259de9f67d5efb95f
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agometag: Fix KSTK_EIP() and KSTK_ESP() macros
James Hogan [Tue, 24 Feb 2015 12:25:25 +0000 (12:25 +0000)]
metag: Fix KSTK_EIP() and KSTK_ESP() macros

commit c2996cb29bfb73927a79dc96e598a718e843f01a upstream.

The KSTK_EIP() and KSTK_ESP() macros should return the user program
counter (PC) and stack pointer (A0StP) of the given task. These are used
to determine which VMA corresponds to the user stack in
/proc/<pid>/maps, and for the user PC & A0StP in /proc/<pid>/stat.

However for Meta the PC & A0StP from the task's kernel context are used,
resulting in broken output. For example in following /proc/<pid>/maps
output, the 3afff000-3b021000 VMA should be described as the stack:

  # cat /proc/self/maps
  ...
  100b0000-100b1000 rwxp 00000000 00:00 0          [heap]
  3afff000-3b021000 rwxp 00000000 00:00 0

And in the following /proc/<pid>/stat output, the PC is in kernel code
(1074234964 = 0x40078654) and the A0StP is in the kernel heap
(1335981392 = 0x4fa17550):

  # cat /proc/self/stat
  51 (cat) R ... 1335981392 1074234964 ...

Fix the definitions of KSTK_EIP() and KSTK_ESP() to use
task_pt_regs(tsk)->ctx rather than (tsk)->thread.kernel_context. This
gets the registers from the user context stored after the thread info at
the base of the kernel stack, which is from the last entry into the
kernel from userland, regardless of where in the kernel the task may
have been interrupted, which results in the following more correct
/proc/<pid>/maps output:

  # cat /proc/self/maps
  ...
  0800b000-08070000 r-xp 00000000 00:02 207        /lib/libuClibc-0.9.34-git.so
  ...
  100b0000-100b1000 rwxp 00000000 00:00 0          [heap]
  3afff000-3b021000 rwxp 00000000 00:00 0          [stack]

And /proc/<pid>/stat now correctly reports the PC in libuClibc
(134320308 = 0x80190b4) and the A0StP in the [stack] region (989864576 =
0x3b002280):

  # cat /proc/self/stat
  51 (cat) R ... 989864576 134320308 ...

Reported-by: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
Reported-by: Vineet Gupta <Vineet.Gupta1@synopsys.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoxfs: Fix quota type in quota structures when reusing quota file
Jan Kara [Mon, 23 Feb 2015 11:34:17 +0000 (22:34 +1100)]
xfs: Fix quota type in quota structures when reusing quota file

commit dfcc70a8c868fe03276fa59864149708fb41930b upstream.

For filesystems without separate project quota inode field in the
superblock we just reuse project quota file for group quotas (and vice
versa) if project quota file is allocated and we need group quota file.
When we reuse the file, quota structures on disk suddenly have wrong
type stored in d_flags though. Nobody really cares about this (although
structure type reported to userspace was wrong as well) except
that after commit 14bf61ffe6ac (quota: Switch ->get_dqblk() and
->set_dqblk() to use bytes as space units) assertion in
xfs_qm_scall_getquota() started to trigger on xfs/106 test (apparently I
was testing without XFS_DEBUG so I didn't notice when submitting the
above commit).

Fix the problem by properly resetting ddq->d_flags when running quotacheck
for a quota file.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agogpio: tps65912: fix wrong container_of arguments
Nicolas Saenz Julienne [Thu, 19 Feb 2015 01:52:25 +0000 (01:52 +0000)]
gpio: tps65912: fix wrong container_of arguments

commit 2f97c20e5f7c3582c7310f65a04465bfb0fd0e85 upstream.

The gpio_chip operations receive a pointer the gpio_chip struct which is
contained in the driver's private struct, yet the container_of call in those
functions point to the mfd struct defined in include/linux/mfd/tps65912.h.

Signed-off-by: Nicolas Saenz Julienne <nicolassaenzj@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agogpiolib: of: allow of_gpiochip_find_and_xlate to find more than one chip per node
Hans Holmberg [Tue, 10 Feb 2015 08:48:27 +0000 (09:48 +0100)]
gpiolib: of: allow of_gpiochip_find_and_xlate to find more than one chip per node

commit 9cf75e9e4ddd587ac12e88e8751c358b7b27e95f upstream.

The change:

7b8792bbdffdff3abda704f89c6a45ea97afdc62
gpiolib: of: Correct error handling in of_get_named_gpiod_flags

assumed that only one gpio-chip is registred per of-node.
Some drivers register more than one chip per of-node, so
adjust the matching function of_gpiochip_find_and_xlate to
not stop looking for chips if a node-match is found and
the translation fails.

Fixes: 7b8792bbdffd ("gpiolib: of: Correct error handling in of_get_named_gpiod_flags")
Signed-off-by: Hans Holmberg <hans.holmberg@intel.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
Tested-by: Tyler Hall <tylerwhall@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoarm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian
Catalin Marinas [Mon, 23 Feb 2015 15:13:40 +0000 (15:13 +0000)]
arm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian

commit 9d42d48a342aee208c1154696196497fdc556bbf upstream.

The native (64-bit) sigval_t union contains sival_int (32-bit) and
sival_ptr (64-bit). When a compat application invokes a syscall that
takes a sigval_t value (as part of a larger structure, e.g.
compat_sys_mq_notify, compat_sys_timer_create), the compat_sigval_t
union is converted to the native sigval_t with sival_int overlapping
with either the least or the most significant half of sival_ptr,
depending on endianness. When the corresponding signal is delivered to a
compat application, on big endian the current (compat_uptr_t)sival_ptr
cast always returns 0 since sival_int corresponds to the top part of
sival_ptr. This patch fixes copy_siginfo_to_user32() so that sival_int
is copied to the compat_siginfo_t structure.

Reported-by: Bamvor Jian Zhang <bamvor.zhangjian@huawei.com>
Tested-by: Bamvor Jian Zhang <bamvor.zhangjian@huawei.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agohx4700: regulator: declare full constraints
Martin Vajnar [Tue, 23 Dec 2014 23:27:57 +0000 (00:27 +0100)]
hx4700: regulator: declare full constraints

commit a52d209336f8fc7483a8c7f4a8a7d2a8e1692a6c upstream.

Since the removal of CONFIG_REGULATOR_DUMMY option, the touchscreen stopped
working. This patch enables the "replacement" for REGULATOR_DUMMY and
allows the touchscreen to work even though there is no regulator for "vcc".

Signed-off-by: Martin Vajnar <martin.vajnar@gmail.com>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: x86: update masterclock values on TSC writes
Marcelo Tosatti [Tue, 4 Nov 2014 23:30:44 +0000 (21:30 -0200)]
KVM: x86: update masterclock values on TSC writes

commit 7f187922ddf6b67f2999a76dcb71663097b75497 upstream.

When the guest writes to the TSC, the masterclock TSC copy must be
updated as well along with the TSC_OFFSET update, otherwise a negative
tsc_timestamp is calculated at kvm_guest_time_update.

Once "if (!vcpus_matched && ka->use_master_clock)" is simplified to
"if (ka->use_master_clock)", the corresponding "if (!ka->use_master_clock)"
becomes redundant, so remove the do_request boolean and collapse
everything into a single condition.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoKVM: MIPS: Don't leak FPU/DSP to guest
James Hogan [Wed, 4 Feb 2015 17:06:37 +0000 (17:06 +0000)]
KVM: MIPS: Don't leak FPU/DSP to guest

commit f798217dfd038af981a18bbe4bc57027a08bb182 upstream.

The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
kvm_mips_set_c0_status() on a guest exit, presumably in case there is
active state that needs saving if pre-emption occurs. However neither of
these bits are cleared again when returning to the guest.

This effectively gives the guest access to the FPU/DSP hardware after
the first guest exit even though it is not aware of its presence,
allowing FP instructions in guest user code to intermittently actually
execute instead of trapping into the guest OS for emulation. It will
then read & manipulate the hardware FP registers which technically
belong to the user process (e.g. QEMU), or are stale from another user
process. It can also crash the guest OS by causing an FP exception, for
which a guest exception handler won't have been registered.

First lets save and disable the FPU (and MSA) state with lose_fpu(1)
before entering the guest. This simplifies the problem, especially for
when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
state being live when the FR bit gets cleared for the guest, which
according to the architecture causes the contents of the FPU and vector
registers to become UNPREDICTABLE.

We can then safely remove the enabling of the FPU in
kvm_mips_set_c0_status(), since there should never be any active FPU or
MSA state to save at pre-emption, which should plug the FPU leak.

DSP state is always live rather than being lazily restored, so for that
it is simpler to just clear the MX bit again when re-entering the guest.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Sanjay Lal <sanjayl@kymasys.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: kvm@vger.kernel.org
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # v3.10+: 044f0f03eca0: MIPS: KVM: Deliver guest interrupts
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE
Alexey Brodkin [Thu, 12 Feb 2015 18:10:11 +0000 (21:10 +0300)]
ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE

commit 06f34e1c28f3608b0ce5b310e41102d3fe7b65a1 upstream.

We used to calculate page address differently in 2 cases:

1. In virt_to_page(x) we do
 --->8---
 mem_map + (x - CONFIG_LINUX_LINK_BASE) >> PAGE_SHIFT
 --->8---

2. In in pte_page(x) we do
 --->8---
 mem_map + (pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT
 --->8---

That leads to problems in case PAGE_OFFSET != CONFIG_LINUX_LINK_BASE -
different pages will be selected depending on where and how we calculate
page address.

In particular in the STAR 9000853582 when gdb attempted to read memory
of another process it got improper page in get_user_pages() because this
is exactly one of the places where we search for a page by pte_page().

The fix is trivial - we need to calculate page address similarly in both
cases.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agontp: Fixup adjtimex freq validation on 32-bit systems
John Stultz [Tue, 10 Feb 2015 07:30:36 +0000 (23:30 -0800)]
ntp: Fixup adjtimex freq validation on 32-bit systems

commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream.

Additional validation of adjtimex freq values to avoid
potential multiplication overflows were added in commit
5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)

Unfortunately the patch used LONG_MAX/MIN instead of
LLONG_MAX/MIN, which was fine on 64-bit systems, but being
much smaller on 32-bit systems caused false positives
resulting in most direct frequency adjustments to fail w/
EINVAL.

ntpd only does direct frequency adjustments at startup, so
the issue was not as easily observed there, but other time
sync applications like ptpd and chrony were more effected by
the bug.

See bugs:

  https://bugzilla.kernel.org/show_bug.cgi?id=92481
  https://bugzilla.redhat.com/show_bug.cgi?id=1188074

This patch changes the checks to use LLONG_MAX for
clarity, and additionally the checks are disabled
on 32-bit systems since LLONG_MAX/PPM_SCALE is always
larger then the 32-bit long freq value, so multiplication
overflows aren't possible there.

Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
Reported-by: George Joseph <george.joseph@fairview5.com>
Tested-by: George Joseph <george.joseph@fairview5.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org
[ Prettified the changelog and the comments a bit. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agokdb: fix incorrect counts in KDB summary command output
Jay Lan [Mon, 29 Sep 2014 22:36:57 +0000 (15:36 -0700)]
kdb: fix incorrect counts in KDB summary command output

commit 146755923262037fc4c54abc28c04b1103f3cc51 upstream.

The output of KDB 'summary' command should report MemTotal, MemFree
and Buffers output in kB. Current codes report in unit of pages.

A define of K(x) as
is defined in the code, but not used.

This patch would apply the define to convert the values to kB.
Please include me on Cc on replies. I do not subscribe to linux-kernel.

Signed-off-by: Jay Lan <jlan@sgi.com>
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: pxa: add regulator_has_full_constraints to poodle board file
Dmitry Eremin-Solenikov [Thu, 4 Dec 2014 11:10:01 +0000 (14:10 +0300)]
ARM: pxa: add regulator_has_full_constraints to poodle board file

commit 9bc78f32c2e430aebf6def965b316aa95e37a20c upstream.

Add regulator_has_full_constraints() call to poodle board file to let
regulator core know that we do not have any additional regulators left.
This lets it substitute unprovided regulators with dummy ones.

This fixes the following warnings that can be seen on poodle if
regulators are enabled:

ads7846 spi1.0: unable to get regulator: -517
spi spi1.0: Driver ads7846 requests probe deferral
wm8731 0-001b: Failed to get supply 'AVDD': -517
wm8731 0-001b: Failed to request supplies: -517
wm8731 0-001b: ASoC: failed to probe component -517

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: pxa: add regulator_has_full_constraints to corgi board file
Dmitry Eremin-Solenikov [Thu, 4 Dec 2014 11:10:00 +0000 (14:10 +0300)]
ARM: pxa: add regulator_has_full_constraints to corgi board file

commit 271e80176aae4e5b481f4bb92df9768c6075bbca upstream.

Add regulator_has_full_constraints() call to corgi board file to let
regulator core know that we do not have any additional regulators left.
This lets it substitute unprovided regulators with dummy ones.

This fixes the following warnings that can be seen on corgi if
regulators are enabled:

ads7846 spi1.0: unable to get regulator: -517
spi spi1.0: Driver ads7846 requests probe deferral
wm8731 0-001b: Failed to get supply 'AVDD': -517
wm8731 0-001b: Failed to request supplies: -517
wm8731 0-001b: ASoC: failed to probe component -517
corgi-audio corgi-audio: ASoC: failed to instantiate card -517

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agovt: provide notifications on selection changes
Nicolas Pitre [Fri, 23 Jan 2015 22:07:21 +0000 (17:07 -0500)]
vt: provide notifications on selection changes

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre <nico@linaro.org>
Cc: Dave Mielke <dave@mielke.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agousb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN
Sebastian Andrzej Siewior [Fri, 5 Dec 2014 14:13:54 +0000 (15:13 +0100)]
usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN

commit 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 upstream.

the following error pops up during "testusb -a -t 10"
| musb-hdrc musb-hdrc.1.auto: dma_pool_free buffer-128, f134e000/be842000 (bad dma)
hcd_buffer_create() creates a few buffers, the smallest has 32 bytes of
size. ARCH_KMALLOC_MINALIGN is set to 64 bytes. This combo results in
hcd_buffer_alloc() returning memory which is 32 bytes aligned and it
might by identified by buffer_offset() as another buffer. This means the
buffer which is on a 32 byte boundary will not get freed, instead it
tries to free another buffer with the error message.

This patch fixes the issue by creating the smallest DMA buffer with the
size of ARCH_KMALLOC_MINALIGN (or 32 in case ARCH_KMALLOC_MINALIGN is
smaller). This might be 32, 64 or even 128 bytes. The next three pools
will have the size 128, 512 and 2048.
In case the smallest pool is 128 bytes then we have only three pools
instead of four (and zero the first entry in the array).
The last pool size is always 2048 bytes which is the assumed PAGE_SIZE /
2 of 4096. I doubt it makes sense to continue using PAGE_SIZE / 2 where
we would end up with 8KiB buffer in case we have 16KiB pages.
Instead I think it makes sense to have a common size(s) and extend them
if there is need to.
There is a BUILD_BUG_ON() now in case someone has a minalign of more than
128 bytes.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoUSB: fix use-after-free bug in usb_hcd_unlink_urb()
Alan Stern [Fri, 30 Jan 2015 17:58:26 +0000 (12:58 -0500)]
USB: fix use-after-free bug in usb_hcd_unlink_urb()

commit c99197902da284b4b723451c1471c45b18537cde upstream.

The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoUSB: cp210x: add ID for RUGGEDCOM USB Serial Console
Lennart Sorensen [Wed, 21 Jan 2015 20:24:27 +0000 (15:24 -0500)]
USB: cp210x: add ID for RUGGEDCOM USB Serial Console

commit a6f0331236fa75afba14bbcf6668d42cebb55c43 upstream.

Added the USB serial console device ID for Siemens Ruggedcom devices
which have a USB port for their serial console.

Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotty/serial: at91: fix error handling in atmel_serial_probe()
Cyrille Pitchen [Tue, 9 Dec 2014 13:31:34 +0000 (14:31 +0100)]
tty/serial: at91: fix error handling in atmel_serial_probe()

commit 6fbb9bdf0f3fbe23aeff806489791aa876adaffb upstream.

-EDEFER error wasn't handle properly by atmel_serial_probe().
As an example, when atmel_serial_probe() is called for the first time, we pass
the test_and_set_bit() test to check whether the port has already been
initalized. Then we call atmel_init_port(), which may return -EDEFER, possibly
returned before by clk_get(). Consequently atmel_serial_probe() used to return
this error code WITHOUT clearing the port bit in the "atmel_ports_in_use" mask.
When atmel_serial_probe() was called for the second time, it used to fail on
the test_and_set_bit() function then returning -EBUSY.

When atmel_serial_probe() fails, this patch make it clear the port bit in the
"atmel_ports_in_use" mask, if needed, before returning the error code.

Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotty: Prevent untrappable signals from malicious program
Peter Hurley [Mon, 19 Jan 2015 18:05:03 +0000 (13:05 -0500)]
tty: Prevent untrappable signals from malicious program

commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream.

Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE")
allows a process which has opened a pty master to send _any_ signal
to the process group of the pty slave. Although potentially
exploitable by a malicious program running a setuid program on
a pty slave, it's unknown if this exploit currently exists.

Limit to signals actually used.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Howard Chu <hyc@symas.com>
Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoaxonram: Fix bug in direct_access
Matthew Wilcox [Wed, 7 Jan 2015 16:04:18 +0000 (18:04 +0200)]
axonram: Fix bug in direct_access

commit 91117a20245b59f70b563523edbf998a62fc6383 upstream.

The 'pfn' returned by axonram was completely bogus, and has been since
2008.

Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agocfq-iosched: fix incorrect filing of rt async cfqq
Jeff Moyer [Mon, 12 Jan 2015 20:21:01 +0000 (15:21 -0500)]
cfq-iosched: fix incorrect filing of rt async cfqq

commit c6ce194325cef342313e3d27620411ce90a89c50 upstream.

Hi,

If you can manage to submit an async write as the first async I/O from
the context of a process with realtime scheduling priority, then a
cfq_queue is allocated, but filed into the wrong async_cfqq bucket.  It
ends up in the best effort array, but actually has realtime I/O
scheduling priority set in cfqq->ioprio.

The reason is that cfq_get_queue assumes the default scheduling class and
priority when there is no information present (i.e. when the async cfqq
is created):

static struct cfq_queue *
cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
      struct bio *bio, gfp_t gfp_mask)
{
const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);

cic->ioprio starts out as 0, which is "invalid".  So, class of 0
(IOPRIO_CLASS_NONE) is passed to cfq_async_queue_prio like so:

async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);

static struct cfq_queue **
cfq_async_queue_prio(struct cfq_data *cfqd, int ioprio_class, int ioprio)
{
        switch (ioprio_class) {
        case IOPRIO_CLASS_RT:
                return &cfqd->async_cfqq[0][ioprio];
        case IOPRIO_CLASS_NONE:
                ioprio = IOPRIO_NORM;
                /* fall through */
        case IOPRIO_CLASS_BE:
                return &cfqd->async_cfqq[1][ioprio];
        case IOPRIO_CLASS_IDLE:
                return &cfqd->async_idle_cfqq;
        default:
                BUG();
        }
}

Here, instead of returning a class mapped from the process' scheduling
priority, we get back the bucket associated with IOPRIO_CLASS_BE.

Now, there is no queue allocated there yet, so we create it:

cfqq = cfq_find_alloc_queue(cfqd, is_sync, cic, bio, gfp_mask);

That function ends up doing this:

cfq_init_cfqq(cfqd, cfqq, current->pid, is_sync);
cfq_init_prio_data(cfqq, cic);

cfq_init_cfqq marks the priority as having changed.  Then, cfq_init_prio
data does this:

ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
switch (ioprio_class) {
default:
printk(KERN_ERR "cfq: bad prio %x\n", ioprio_class);
case IOPRIO_CLASS_NONE:
/*
 * no prio set, inherit CPU scheduling settings
 */
cfqq->ioprio = task_nice_ioprio(tsk);
cfqq->ioprio_class = task_nice_ioclass(tsk);
break;

So we basically have two code paths that treat IOPRIO_CLASS_NONE
differently, which results in an RT async cfqq filed into a best effort
bucket.

Attached is a patch which fixes the problem.  I'm not sure how to make
it cleaner.  Suggestions would be welcome.

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Tested-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agocfq-iosched: handle failure of cfq group allocation
Konstantin Khlebnikov [Mon, 9 Feb 2015 13:42:49 +0000 (16:42 +0300)]
cfq-iosched: handle failure of cfq group allocation

commit 69abaffec7d47a083739b79e3066cb3730eba72e upstream.

Cfq_lookup_create_cfqg() allocates struct blkcg_gq using GFP_ATOMIC.
In cfq_find_alloc_queue() possible allocation failure is not handled.
As a result kernel oopses on NULL pointer dereference when
cfq_link_cfqq_cfqg() calls cfqg_get() for NULL pointer.

Bug was introduced in v3.5 in commit cd1604fab4f9 ("blkcg: factor
out blkio_group creation"). Prior to that commit cfq group lookup
had returned pointer to root group as fallback.

This patch handles this error using existing fallback oom_cfqq.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Fixes: cd1604fab4f9 ("blkcg: factor out blkio_group creation")
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoiscsi-target: Drop problematic active_ts_list usage
Nicholas Bellinger [Thu, 22 Jan 2015 08:56:53 +0000 (00:56 -0800)]
iscsi-target: Drop problematic active_ts_list usage

commit 3fd7b60f2c7418239d586e359e0c6d8503e10646 upstream.

This patch drops legacy active_ts_list usage within iscsi_target_tq.c
code.  It was originally used to track the active thread sets during
iscsi-target shutdown, and is no longer used by modern upstream code.

Two people have reported list corruption using traditional iscsi-target
and iser-target with the following backtrace, that appears to be related
to iscsi_thread_set->ts_list being used across both active_ts_list and
inactive_ts_list.

[   60.782534] ------------[ cut here ]------------
[   60.782543] WARNING: CPU: 0 PID: 9430 at lib/list_debug.c:53 __list_del_entry+0x63/0xd0()
[   60.782545] list_del corruption, ffff88045b00d180->next is LIST_POISON1 (dead000000100100)
[   60.782546] Modules linked in: ib_srpt tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc scsi_tgt ib_isert rdma_cm iw_cm ib_addr iscsi_target_mod target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge stp llc autofs4 sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ib_ipoib ib_cm ib_uverbs ib_umad mlx4_en mlx4_ib ib_sa ib_mad ib_core mlx4_core dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support microcode serio_raw pcspkr sb_edac edac_core sg i2c_i801 lpc_ich mfd_core mtip32xx igb i2c_algo_bit i2c_core ptp pps_core ioatdma dca wmi ext3(F) jbd(F) mbcache(F) sd_mod(F) crc_t10dif(F) crct10dif_common(F) ahci(F) libahci(F) isci(F) libsas(F) scsi_transport_sas(F) [last unloaded: speedstep_lib]
[   60.782597] CPU: 0 PID: 9430 Comm: iscsi_ttx Tainted: GF 3.12.19+ #2
[   60.782598] Hardware name: Supermicro X9DRX+-F/X9DRX+-F, BIOS 3.00 07/09/2013
[   60.782599]  0000000000000035 ffff88044de31d08 ffffffff81553ae7 0000000000000035
[   60.782602]  ffff88044de31d58 ffff88044de31d48 ffffffff8104d1cc 0000000000000002
[   60.782605]  ffff88045b00d180 ffff88045b00d0c0 ffff88045b00d0c0 ffff88044de31e58
[   60.782607] Call Trace:
[   60.782611]  [<ffffffff81553ae7>] dump_stack+0x49/0x62
[   60.782615]  [<ffffffff8104d1cc>] warn_slowpath_common+0x8c/0xc0
[   60.782618]  [<ffffffff8104d2b6>] warn_slowpath_fmt+0x46/0x50
[   60.782620]  [<ffffffff81280933>] __list_del_entry+0x63/0xd0
[   60.782622]  [<ffffffff812809b1>] list_del+0x11/0x40
[   60.782630]  [<ffffffffa06e7cf9>] iscsi_del_ts_from_active_list+0x29/0x50 [iscsi_target_mod]
[   60.782635]  [<ffffffffa06e87b1>] iscsi_tx_thread_pre_handler+0xa1/0x180 [iscsi_target_mod]
[   60.782642]  [<ffffffffa06fb9ae>] iscsi_target_tx_thread+0x4e/0x220 [iscsi_target_mod]
[   60.782647]  [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod]
[   60.782652]  [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod]
[   60.782655]  [<ffffffff8106f99e>] kthread+0xce/0xe0
[   60.782657]  [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70
[   60.782660]  [<ffffffff8156026c>] ret_from_fork+0x7c/0xb0
[   60.782662]  [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70
[   60.782663] ---[ end trace 9662f4a661d33965 ]---

Since this code is no longer used, go ahead and drop the problematic usage
all-together.

Reported-by: Gavin Guo <gavin.guo@canonical.com>
Reported-by: Moussa Ba <moussaba@micron.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoNFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
Trond Myklebust [Wed, 11 Feb 2015 22:27:55 +0000 (17:27 -0500)]
NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args

commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.

If the call to decode_rc_list() fails due to a memory allocation error,
then we need to truncate the array size to ensure that we only call
kfree() on those pointer that were allocated.

Reported-by: David Ramos <daramos@stanford.edu>
Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoAdded Little Endian support to vtpm module
honclo [Fri, 13 Feb 2015 02:02:24 +0000 (21:02 -0500)]
Added Little Endian support to vtpm module

commit eb71f8a5e33fa1066fb92f0111ab366a341e1f6c upstream.

The tpm_ibmvtpm module is affected by an unaligned access problem.
ibmvtpm_crq_get_version failed with rc=-4 during boot when vTPM is
enabled in Power partition, which supports both little endian and
big endian modes.

We added little endian support to fix this problem:
1) added cpu_to_be64 calls to ensure BE data is sent from an LE OS.
2) added be16_to_cpu and be32_to_cpu calls to make sure data received
   is in LE format on a LE OS.

Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[phuewe: manually applied the patch :( ]
Reviewed-by: Ashley Lai <ashley@ahsleylai.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send
Christophe Ricard [Mon, 1 Dec 2014 18:32:46 +0000 (19:32 +0100)]
tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send

commit 1ba3b0b6f218072afe8372d12f1b6bf26a26008e upstream.

When sending data in tpm_stm_i2c_send, each loop iteration send buf.
Send buf + i instead as the goal of this for loop is to send a number
of byte from buf that fit in burstcnt. Once those byte are sent, we are
supposed to send the next ones.

The driver was working because the burstcount value returns always the maximum size for a TPM
command or response. (0x800 for a command and 0x400 for a response).

Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma
Hon Ching (Vicky) Lo [Sun, 30 Nov 2014 14:01:28 +0000 (15:01 +0100)]
tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma

commit 84eb186bc37c0900b53077ca21cf6dd15823a232 upstream.

There was an oops in tpm_ibmvtpm_get_desired_dma, which caused
kernel panic during boot when vTPM is enabled in Power partition
configured in AMS mode.

vio_bus_probe calls vio_cmo_bus_probe which calls
tpm_ibmvtpm_get_desired_dma to get the size needed for DMA allocation.
The problem is, vio_cmo_bus_probe is called before calling probe, which
for vtpm is tpm_ibmvtpm_probe and it's this function that initializes
and sets up vtpm's CRQ and gets required data values.  Therefore,
since this has not yet been done, NULL is returned in attempt to get
the size for DMA allocation.

We added a NULL check.  In addition, a default buffer size will
be set when NULL is returned.

Signed-off-by: Hon Ching (Vicky) Lo <honclo@linux.vnet.ibm.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agochar: tpm: Add missing error check for devm_kzalloc
Kiran Padwal [Fri, 19 Sep 2014 07:14:39 +0000 (12:44 +0530)]
char: tpm: Add missing error check for devm_kzalloc

commit bb95cd34ba4c9467114acc78eeddd53ab1c10085 upstream.

Currently these driver are missing a check on the return value of devm_kzalloc,
which would cause a NULL pointer dereference in a OOM situation.

This patch adds a missing check for tpm_i2c_atmel.c and tpm_i2c_nuvoton.c

Signed-off-by: Kiran Padwal <kiran.padwal@smartplayin.com>
Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoTPM: Add new TPMs to the tail of the list to prevent inadvertent change of dev
David Howells [Fri, 29 Aug 2014 09:33:02 +0000 (10:33 +0100)]
TPM: Add new TPMs to the tail of the list to prevent inadvertent change of dev

commit 398a1e71dc827b994b7f2f56c7c2186fea7f8d75 upstream.

Add newly registered TPMs to the tail of the list, not the beginning, so that
things that are specifying TPM_ANY_NUM don't find that the device they're
using has inadvertently changed.  Adding a second device would break IMA, for
instance.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotpm_tis: verify interrupt during init
Scot Doyle [Wed, 24 Sep 2014 22:41:10 +0000 (22:41 +0000)]
tpm_tis: verify interrupt during init

commit 448e9c55c12d6bd4fa90a7e31d802e045666d7c8 upstream.

Some machines, such as the Acer C720 and Toshiba CB35, have TPMs that do
not send IRQs while also having an ACPI TPM entry indicating that they
will be sent. These machines freeze on resume while the tpm_tis module
waits for an IRQ, eventually timing out.

When in interrupt mode, the tpm_tis module should receive an IRQ during
module init. Fall back to polling mode if none is received when expected.

Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
Tested-by: Michael Mullin <masmullin@gmail.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
[phuewe: minor checkpatch fixed]
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: dts: am335x-bone*: usb0 is hardwired for peripheral
Robert Nelson [Tue, 24 Feb 2015 16:10:43 +0000 (10:10 -0600)]
ARM: dts: am335x-bone*: usb0 is hardwired for peripheral

commit 67fd14b3eca63b14429350e9eadc5fab709a8821 upstream.

Fixes: http://bugs.elinux.org/issues/127

the bb.org community was seeing random reboots before this change.

Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: dts: tegra20: fix GR3D, DSI unit and reg base addresses
Dmitry Osipenko [Fri, 12 Dec 2014 15:19:19 +0000 (18:19 +0300)]
ARM: dts: tegra20: fix GR3D, DSI unit and reg base addresses

commit de47699d005996b41cea590c6098078ac12058be upstream.

Commit 58ecb23f64ee ("ARM: tegra: add missing unit addresses to DT") added
unit address and changed reg base for GR3D and DSI host1x modules, but these
addresses belongs to GR2D and TVO modules respectively. Fix it by changing
modules unit and reg base addresses to proper ones.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Fixes: 58ecb23f64ee (ARM: tegra: add missing unit addresses to DT)
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: DRA7: hwmod: Fix boot crash with DEBUG_LL enabled on UART3
Lokesh Vutla [Thu, 8 Jan 2015 11:52:04 +0000 (17:22 +0530)]
ARM: DRA7: hwmod: Fix boot crash with DEBUG_LL enabled on UART3

commit 1c7e36bfc3e2fb2df5e2d1989a4b6fb9055a0f9b upstream.

With commit '7dedd34: ARM: OMAP2+: hwmod: Fix a crash in _setup_reset()
with DEBUG_LL' we moved from parsing cmdline to identify uart used
for earlycon to using the requsite hwmod CONFIG_DEBUG_OMAPxUARTy FLAGS.

On DRA7 UART3 hwmod doesn't have this flag enabled, and atleast on
BeagleBoard-X15, where we use UART3 for console, boot fails with
DEBUG_LL enabled. Enable DEBUG_OMAP4UART3_FLAGS for UART3 hwmod.

For using DEBUG_LL, enable CONFIG_DEBUG_OMAP4UART3 in menuconfig.

Fixes: 90020c7b2c5e ("ARM: OMAP: DRA7: hwmod: Create initial DRA7XX SoC data")
Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoARM: 8284/1: sa1100: clear RCSR_SMR on resume
Dmitry Eremin-Solenikov [Thu, 15 Jan 2015 02:06:22 +0000 (03:06 +0100)]
ARM: 8284/1: sa1100: clear RCSR_SMR on resume

commit e461894dc2ce7778ccde1c3483c9b15a85a7fc5f upstream.

StrongARM core uses RCSR SMR bit to tell to bootloader that it was reset
by entering the sleep mode. After we have resumed, there is little point
in having that bit enabled. Moreover, if this bit is set before reboot,
the bootloader can become confused. Thus clear the SMR bit on resume
just before clearing the scratchpad (resume address) register.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agotracing: Fix unmapping loop in tracing_mark_write
Vikram Mulukutla [Thu, 18 Dec 2014 02:50:56 +0000 (18:50 -0800)]
tracing: Fix unmapping loop in tracing_mark_write

commit 7215853e985a4bef1a6c14e00e89dfec84f1e457 upstream.

Commit 6edb2a8a385f0cdef51dae37ff23e74d76d8a6ce introduced
an array map_pages that contains the addresses returned by
kmap_atomic. However, when unmapping those pages, map_pages[0]
is unmapped before map_pages[1], breaking the nesting requirement
as specified in the documentation for kmap_atomic/kunmap_atomic.

This was caught by the highmem debug code present in kunmap_atomic.
Fix the loop to do the unmapping properly.

Link: http://lkml.kernel.org/r/1418871056-6614-1-git-send-email-markivx@codeaurora.org
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Reported-by: Lime Yang <limey@codeaurora.org>
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agomm/hugetlb: pmd_huge() returns true for non-present hugepage
Naoya Horiguchi [Wed, 11 Feb 2015 23:25:19 +0000 (15:25 -0800)]
mm/hugetlb: pmd_huge() returns true for non-present hugepage

commit cbef8478bee55775ac312a574aad48af7bb9cf9f upstream.

Migrating hugepages and hwpoisoned hugepages are considered as non-present
hugepages, and they are referenced via migration entries and hwpoison
entries in their page table slots.

This behavior causes race condition because pmd_huge() doesn't tell
non-huge pages from migrating/hwpoisoned hugepages.  follow_page_mask() is
one example where the kernel would call follow_page_pte() for such
hugepage while this function is supposed to handle only normal pages.

To avoid this, this patch makes pmd_huge() return true when pmd_none() is
true *and* pmd_present() is false.  We don't have to worry about mixing up
non-present pmd entry with normal pmd (pointing to leaf level pte entry)
because pmd_present() is true in normal pmd.

The same race condition could happen in (x86-specific) gup_pmd_range(),
where this patch simply adds pmd_present() check instead of pmd_huge().
This is because gup_pmd_range() is fast path.  If we have non-present
hugepage in this function, we will go into gup_huge_pmd(), then return 0
at flag mask check, and finally fall back to the slow path.

Fixes: 290408d4a2 ("hugetlb: hugepage migration core")
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Steve Capper <steve.capper@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoMIPS: KVM: Deliver guest interrupts after local_irq_disable()
James Hogan [Thu, 29 May 2014 09:16:32 +0000 (10:16 +0100)]
MIPS: KVM: Deliver guest interrupts after local_irq_disable()

commit 044f0f03eca0110e1835b2ea038a484b93950328 upstream.

When about to run the guest, deliver guest interrupts after disabling
host interrupts. This should prevent an hrtimer interrupt from being
handled after delivering guest interrupts, and therefore not delivering
the guest timer interrupt until after the next guest exit.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: kvm@vger.kernel.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: Sanjay Lal <sanjayl@kymasys.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agonfs: don't call blocking operations while !TASK_RUNNING
Jeff Layton [Wed, 14 Jan 2015 18:08:57 +0000 (13:08 -0500)]
nfs: don't call blocking operations while !TASK_RUNNING

commit 6ffa30d3f734d4f6b478081dfc09592021028f90 upstream.

Bruce reported seeing this warning pop when mounting using v4.1:

     ------------[ cut here ]------------
     WARNING: CPU: 1 PID: 1121 at kernel/sched/core.c:7300 __might_sleep+0xbd/0xd0()
    do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff810ff58f>] prepare_to_wait+0x2f/0x90
    Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer ppdev joydev snd virtio_console virtio_balloon pcspkr serio_raw parport_pc parport pvpanic floppy soundcore i2c_piix4 virtio_blk virtio_net qxl drm_kms_helper ttm drm virtio_pci virtio_ring ata_generic virtio pata_acpi
    CPU: 1 PID: 1121 Comm: nfsv4.1-svc Not tainted 3.19.0-rc4+ #25
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
     0000000000000000 000000004e5e3f73 ffff8800b998fb48 ffffffff8186ac78
     0000000000000000 ffff8800b998fba0 ffff8800b998fb88 ffffffff810ac9da
     ffff8800b998fb68 ffffffff81c923e7 00000000000004d9 0000000000000000
    Call Trace:
     [<ffffffff8186ac78>] dump_stack+0x4c/0x65
     [<ffffffff810ac9da>] warn_slowpath_common+0x8a/0xc0
     [<ffffffff810aca65>] warn_slowpath_fmt+0x55/0x70
     [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90
     [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90
     [<ffffffff810dd2ad>] __might_sleep+0xbd/0xd0
     [<ffffffff8124c973>] kmem_cache_alloc_trace+0x243/0x430
     [<ffffffff810d941e>] ? groups_alloc+0x3e/0x130
     [<ffffffff810d941e>] groups_alloc+0x3e/0x130
     [<ffffffffa0301b1e>] svcauth_unix_accept+0x16e/0x290 [sunrpc]
     [<ffffffffa0300571>] svc_authenticate+0xe1/0xf0 [sunrpc]
     [<ffffffffa02fc564>] svc_process_common+0x244/0x6a0 [sunrpc]
     [<ffffffffa02fd044>] bc_svc_process+0x1c4/0x260 [sunrpc]
     [<ffffffffa03d5478>] nfs41_callback_svc+0x128/0x1f0 [nfsv4]
     [<ffffffff810ff970>] ? wait_woken+0xc0/0xc0
     [<ffffffffa03d5350>] ? nfs4_callback_svc+0x60/0x60 [nfsv4]
     [<ffffffff810d45bf>] kthread+0x11f/0x140
     [<ffffffff810ea815>] ? local_clock+0x15/0x30
     [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250
     [<ffffffff81874bfc>] ret_from_fork+0x7c/0xb0
     [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250
    ---[ end trace 675220a11e30f4f2 ]---

nfs41_callback_svc does most of its work while in TASK_INTERRUPTIBLE,
which is just wrong. Fix that by finishing the wait immediately if we've
found that the list has something on it.

Also, we don't expect this kthread to accept signals, so we should be
using a TASK_UNINTERRUPTIBLE sleep instead. That however, opens us up
hung task warnings from the watchdog, so have the schedule_timeout
wake up every 60s if there's no callback activity.

Reported-by: "J. Bruce Fields" <bfields@fieldses.org>
Signed-off-by: Jeff Layton <jlayton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agommc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles
Jisheng Zhang [Wed, 28 Jan 2015 11:54:12 +0000 (19:54 +0800)]
mmc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles

commit 14460dbaf7a5a0488963fdb8232ad5c8a8cca7b7 upstream.

Current code checks "clk_delay_cycles > 0" to know whether the optional
"mrvl,clk_delay_cycles" is set or not. But of_property_read_u32() doesn't
touch clk_delay_cycles if the property is not set. And type of
clk_delay_cycles is u32, so we may always set pdata->clk_delay_cycles as a
random value.

This patch fix this problem by check the return value of of_property_read_u32()
to know whether the optional clk-delay-cycles is set or not.

Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6 years agoem28xx-audio: fix missing newlines
Russell King [Sat, 20 Dec 2014 12:45:36 +0000 (09:45 -0300)]
em28xx-audio: fix missing newlines

commit 7818b0aab87b680fb10f68eccebeeb6cd8283c73 upstream.

Inspection shows that newlines are missing from several kernel messages
in em28xx-audio.  Fix these.

Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>