5 years agoarm: dts: dra72: Use gpio hog only for baseboard ethernet glsdk-
Nikhil Devshatwar [Mon, 24 Aug 2015 10:08:35 +0000 (15:38 +0530)]
arm: dts: dra72: Use gpio hog only for baseboard ethernet

On J6eco EVM, the ethernet is muxed with the vin2a interface.
For using vin2a, ethernet slave0 is rerouted to use the PHY1.
This is done by hogging a GPIO to output-low.

For vision use cases, we need to set the GPIO from driver.
Therefore, hogging is not correct solution. Also, gpio-hog does not
respect the status="disabled" property.

So keep the gpio hog node in baseboard dts but delete from the vision dts.
This will enable ethernet on baseboard and would allow setting thr GPIO
for vision use cases.

Fixes: 1eedfa4af ("arm: dts: dra72-evm: New device tree for dra72-evm")
Change-Id: I94d6aba3f5582da5664d4a91734b638dd90c572e
Signed-off-by: Nikhil Devshatwar <>
5 years agoARM: dts: DRA7: fix a typo in ethernet
Vishal Mahaveer [Tue, 11 Aug 2015 19:29:42 +0000 (19:29 +0000)]
ARM: dts: DRA7: fix a typo in ethernet

Register address in name of the node is wrong

Change-Id: Ibb9be2fafaeb0aca2920c5ef9d3ff469cab2c82d
Signed-off-by: Vishal Mahaveer <>
Acked-by: Mugunthan V N <>
5 years agoMerge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git://
Praneeth Bajjuri [Fri, 21 Aug 2015 03:12:19 +0000 (22:12 -0500)]
Merge branch 'p-ti-linux-3.14.y-common/audio-for-next' of git:// into p-ti-linux-3.14.y-common

* 'p-ti-linux-3.14.y-common/audio-for-next' of git://
  ASoC: davinci-mcasp: dai format runtime reconfiguration

Change-Id: I2c9efe9f442e8ac18f5e3063ebde4ae31362b265
Signed-off-by: Praneeth Bajjuri <>
5 years agoASoC: davinci-mcasp: dai format runtime reconfiguration
Peter Ujfalusi [Wed, 19 Aug 2015 07:02:04 +0000 (10:02 +0300)]
ASoC: davinci-mcasp: dai format runtime reconfiguration

In case when the dai format is set via the dai_link the format
configuration happens once when the links are probed. If the McASP lose
context after this, the information will be lost and McASP will not going
to work correctly.
To overcome this issue, we save the fmt and set it within hw_params as

Reported-by: Misael Lopez Cruz <>
Signed-off-by: Peter Ujfalusi <>
Signed-off-by: Jyri Sarha <>
5 years agoARM: dts: dra72-evm: Fix spurious card insert/removal interrupt
Kishon Vijay Abraham I [Tue, 18 Aug 2015 22:58:22 +0000 (17:58 -0500)]
ARM: dts: dra72-evm: Fix spurious card insert/removal interrupt

ldo1_reg in addition to being connected to the io lines is also
connected to the card detect line. On card removal, omap_hsmmc
driver does a regulator_disable causing card detect line to be
pulled down. This raises a card insertion interrupt and once the
MMC core detects there is no card inserted, it does a
regulator disable which again raises a card insertion interrupt.

This happens in a loop causing infinite MMC interrupts.
Fix it by making ldo1_reg as always_on.

Signed-off-by: Kishon Vijay Abraham I <>
Signed-off-by: Sekhar Nori <>
[cherrypick to p-ti-linux-3.14.y]
Signed-off-by: Praneeth Bajjuri <>
Change-Id: I58acd0da5a744cf2554eeff05b5acfa0dfd97dfd

5 years agomedia: ti-vpe: vip: Create VIP streams based on DTS channel info
Nikhil Devshatwar [Fri, 14 Aug 2015 03:50:08 +0000 (09:20 +0530)]
media: ti-vpe: vip: Create VIP streams based on DTS channel info

With support for multi channel capture and multiple subdevices, sometimes,
driver has to choose between available subdevices. e.g. muxed cameras.
This means, the driver cannot preallocate the capture streams before knowing
the subdevice. This won't work great with multichannel capture subdevices.

Create the capture streams after a subdevice of higher priority is matched.
Of couse, cleanup all the streams associated with the old subdev.
Negotiate with the subdevice to find out the supported formats.
Set the port specific endpoint and subdev info accordingly.

With this, sometimes the video devices would get created, deleted and
re-created again. This may be a problem with video_device. Therefore,
as recommended, allocate the video_device instead of using embedded one.

Change-Id: Ia8f27a2f3ac3880dda9f6801081399cd52630d74
Signed-off-by: Nikhil Devshatwar <>
5 years agomedia: ti-vpe: vpdma: Use bidirectional cached buffers
Nikhil Devshatwar [Wed, 29 Jul 2015 11:08:10 +0000 (16:38 +0530)]
media: ti-vpe: vpdma: Use bidirectional cached buffers

VPDMA buffer will be used by CPU as well as by the VPDMA.
CPU will write/update the VPDMA descriptors containing data
about the video buffer DMA addresses.
VPDMA will write the "write descriptor" containing the
data about the DMA operation.

When mapping/unmapping the buffer, driver has to take care of
WriteBack and invalidation of the cache so that all the
coherency is maintained from both directions.

Use DMA_BIDIRECTIONAL to maintain coherency between CPU and VPDMA.

Change-Id: I44c166391676f457c1b3c983d178e65592a4523d
Signed-off-by: Nikhil Devshatwar <>
5 years agomedia: ti-vpe: vip: Fix crash when streaming without buffers
Nikhil Devshatwar [Wed, 10 Jun 2015 08:07:40 +0000 (13:37 +0530)]
media: ti-vpe: vip: Fix crash when streaming without buffers

When starting a video streaming, to ensure capture without frame drops,
VIP driver tries to post VPDMA descriptors untill the VPDMA FIFO is full.
This adds a constraint that the application should have queued at least
three buffers into the CAPTURE stream before calling STREAMON ioctl.

If for some reason, application calls the STREAMON with zero or less than
three buffers, driver would still try to get the DMA address of the
vb2 buffers and eventually result into NULL pointer crash in vb2 framework

Check the queued buffer count and fail the ioctl gracefully if the required
number of buffers are not queued already.

Change-Id: Ib961500502937de74e6fcf0ae7569f02e98dace3
Signed-off-by: Nikhil Devshatwar <>
5 years agoi2c: ov1063x: Cleanup and optimize sensor configuration
Nikhil Devshatwar [Mon, 3 Aug 2015 07:48:56 +0000 (13:18 +0530)]
i2c: ov1063x: Cleanup and optimize sensor configuration

Remove unnecessary delay for sensor internal writes.
Also remove the LVDS specific sensor configuration parameters.
No need to configure the sensor registers differently for LVDS cameras.

Exception for this being the PLL values. Configure the LVDS specific
PLL values (which work for the normal cameras also)

Change-Id: I9c0f0b06869f2cff37fb9f38a8f8dc8ca4f37fbb
Signed-off-by: Nikhil Devshatwar <>
5 years agoarm: dts: dra7: jamr3: Add channel info for tvp5158
Nikhil Devshatwar [Fri, 14 Aug 2015 03:49:01 +0000 (09:19 +0530)]
arm: dts: dra7: jamr3: Add channel info for tvp5158

Describe the channel numbers used by TVP5158 to multiplex the
4 analog video inputs.
Specify the list of channel numbers correctly, so that the video
devices for each of them are created.

Change-Id: Iec99fe010c9721390d77fdd2ca4fcd22b8c50ba7
Signed-off-by: Nikhil Devshatwar <>
5 years agomedia: ti-vpe: vip: cleanup parser configuration code
Nikhil Devshatwar [Fri, 31 Jul 2015 15:15:40 +0000 (20:45 +0530)]
media: ti-vpe: vip: cleanup parser configuration code

Remove redundant checks with simple inline function.
Optimize the parser configuration with minimal register writes.
Remove the independent functions to configure the hsync, vsync, pclk,
actvid, etc  and replace that with simple config0.

Split the vip_set_polarity into the vip_set_pclk_invert to take care of
the pixel clock inversion via SMA_SW1 regmap.

Also add the missing single channel embedded sync type.

Change-Id: I749da57c305e12111413608895f594f4cdb83661
Signed-off-by: Nikhil Devshatwar <>
5 years agov4l: of: Parse endpoint channel information for BT656 bus
Nikhil Devshatwar [Fri, 14 Aug 2015 03:48:02 +0000 (09:18 +0530)]
v4l: of: Parse endpoint channel information for BT656 bus

For BT656 bus, there can be more than one video time multiplexed.
These are called as channels. There can be multiple methods of
multiplexing, commonly used are, single channel, 2chan, 4chan
pixel multiplexed and line multiplexed(variable chan num).

Alos, the channel numbers for the multiplexed videos can vary.
Add support for describing the channel numbers and multiplexing method
in the device tree endpoint node for the BT656 video interface.

Change-Id: Idcf606854cb9af5af05280136b605c9332d815f0
Signed-off-by: Nikhil Devshatwar <>
5 years agomedia: ti-vpe: vip: Add support for port B capture
Nikhil Devshatwar [Thu, 14 May 2015 13:22:46 +0000 (18:52 +0530)]
media: ti-vpe: vip: Add support for port B capture

Current VIP driver only supports port A video capture.
Parse the endpoint nodes to figure out the port information from DT.
For each of the found device, register a separate notifier for it.
Move all the port specific fields from vip_dev to vip_port structure.
Keep a port specific copy for notifier, subdev and active_fmt.

Change-Id: I864ecf8f17b00bfb29ee69a8959725af38ce53bd
Signed-off-by: Nikhil Devshatwar <>
5 years agoarm: dts: dra72-evm: New device tree for dra72-evm with vision card
Nikhil Devshatwar [Thu, 30 Jul 2015 10:05:09 +0000 (15:35 +0530)]
arm: dts: dra72-evm: New device tree for dra72-evm with vision card

Override the ovcam nodes for cam1, cam2, cam3, cam4 nodes.
Add endpoint nodes for vin1a, 1b, 2a, 2b interfaces.
Also, add the GPIO properties to drive the board muxes.
Add a comment table to map the cameras with the video interfaces.

Change-Id: I494778f1461784183473658302efb218a89d0d49
Signed-off-by: Nikhil Devshatwar <>
5 years agoarm: dtsi: dra72: Add VIP mux pinctrl node and bindings
Nikhil Devshatwar [Wed, 5 Aug 2015 15:34:17 +0000 (21:04 +0530)]
arm: dtsi: dra72: Add VIP mux pinctrl node and bindings

DRA72 device has only one instance of VIP (VIP1)
But the SoC has more video pads(total 8) than available ports (1a,2a,1b,2b)
Each video port can be connected to one of the pad group.
This is selected via a control module register CTRL_CORE_VIP_MUX_SELECT.

Depending on the board design, some of the interfaces would be used and
this register needs to be programmed.
As this can be best fit as a pinctrl device, Add a pinctrl node in dra72x.dtsi
and also add the bindings for the bitfields to be used when configuring
this mux.

Change-Id: I7498ee9c270ac399ac112748c8c19ee93eb8c51e
Signed-off-by: Nikhil Devshatwar <>
5 years agoarm: dts: dra7: vision: Remove gpio from generic vision DTB
Nikhil Devshatwar [Thu, 30 Jul 2015 10:02:58 +0000 (15:32 +0530)]
arm: dts: dra7: vision: Remove gpio from generic vision DTB

dra7xx-vision.dtsi is a generic device tree file while describes the
devices on the vision application board (daughter card)

But the gpios to drive the board muxes for routing the camera signals
vary depending on board muxes.
Remove this information from the generic device tree and add it in the
board specific (dra7-evm-vision) device tree.

Also add a comment table to map camera and video interfaces.

Change-Id: I43fb1f1989ecb2b3f87fae874e395a3424d747d7
Signed-off-by: Nikhil Devshatwar <>
5 years agoarm: dtsi: dra7: Add port B endpoints in VIP nodes
Nikhil Devshatwar [Wed, 18 Feb 2015 09:11:51 +0000 (14:41 +0530)]
arm: dtsi: dra7: Add port B endpoints in VIP nodes

Each VIP slice has a 24bit port A and an 8bit port B for video capture.
For each of this port, there has to be an endpoint device node which
should connect to the camera endpoint node.

Add the endpoint device nodes for port B. The reg property of the endpoint
node describes the slice and port it belongs to.

Change-Id: I9ead7caa8fc09b898b8f396765a39a75afd3acaf
Signed-off-by: Nikhil Devshatwar <>
5 years agodrivers: of: export of_remove_property()
Ravikumar Kattekola [Thu, 6 Aug 2015 08:45:40 +0000 (14:15 +0530)]
drivers: of: export of_remove_property()

Export of_remove_property() function.
This fixes remoteproc driver modular build.

Remoteproc late attach code added usage of this API.
So if we need to have rproc driver modular then this
patch is needed.

Change-Id: I1c544b5b12941bc0fab15f1060b34c514baf9fa7
Signed-off-by: Ravikumar Kattekola <>
Signed-off-by: Angela Stegmaier <>
5 years agodra7: dt: Update coproc opp voltages for dsp and iva
Ravikumar Kattekola [Thu, 13 Aug 2015 15:29:34 +0000 (20:59 +0530)]
dra7: dt: Update coproc opp voltages for dsp and iva

voltdm framework uses the voltages passed through DT
to index into efused voltage table.

Update voltages as per RTP version of DM.
SPRS857M - Revised OCT 2014.

Change-Id: I87ed1376a02014cce823458e272bd94bc8aa7204
Signed-off-by: Ravikumar Kattekola <>
5 years agodra7: dt: update vdd voltages as per DM
Ravikumar Kattekola [Thu, 13 Aug 2015 15:27:10 +0000 (20:57 +0530)]
dra7: dt: update vdd voltages as per DM

Existing voltages in DT are per an old DM version.

Update them to match with RTP version of the DM

Doc ID: SPRS857M - Revised OCT 2014

Change-Id: If15b5affed381424ad7a7e4a4cecaf47f52f7fc1
Signed-off-by: Ravikumar Kattekola <>
5 years agoDRA7x: dt: Remove duplicate OPPs for DSP coproc
Ravikumar Kattekola [Thu, 13 Aug 2015 15:02:18 +0000 (20:32 +0530)]
DRA7x: dt: Remove duplicate OPPs for DSP coproc

As per datamanual there are three OPPs for DSP0/1
but the OPP_OD and OPP_HIGH are at the same frequency but
different voltage levels which leads to following warnings while
initializing the opp table.

oproc dsp_coproc: dev_pm_opp_add: duplicate OPPs detected.
Existing: freq: 700000000, volt: 1150000, enabled: 1.
New: freq: 700000000, volt: 1250000, enabled: 1

Anyway the opp logic works based on first match frequency
hence we will never reach the third opp so remove it.

Change-Id: I0442ba58171053ba3cddb1385c5902939b648c66
Signed-off-by: Ravikumar Kattekola <>
5 years agodrivers: coproc: clean up driver code
Ravikumar Kattekola [Thu, 13 Aug 2015 14:47:42 +0000 (20:17 +0530)]
drivers: coproc: clean up driver code

Fixes : 72923c8a drivers: power: Introduce TI coprocessor driver

Free opp table and voltdm notifier block when probe deferred
or failed.
Clean up opp table when removing the driver module

Change-Id: Ia5163302ea4b7e79a9990dba2d9e0c5ee386b9d8
Signed-off-by: Ravikumar Kattekola <>
5 years agoPM / OPP / clk: Remove unnecessary OOM message
Quentin Lambert [Mon, 9 Feb 2015 09:45:32 +0000 (10:45 +0100)]
PM / OPP / clk: Remove unnecessary OOM message

This patch reduces the kernel size by removing error messages that duplicate
the normal OOM message.

A simplified version of the semantic patch that finds this problem is as
follows: (

identifier f,print,l;
expression e;
constant char[] c;

e = \(kzalloc\|kmalloc\|devm_kzalloc\|devm_kmalloc\)(...);
if (e == NULL) {
-  print(...,c,...);
  ... when any
  goto l;
  return ...;
  ...+> }

Change-Id: Ib3f3065763f9d0b43a647a1c30e28c13564d855c
Signed-off-by: Quentin Lambert <>
Acked-by: Nishanth Menon <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: Assert RCU lock in exported functions
Krzysztof Kozlowski [Fri, 9 Jan 2015 08:27:57 +0000 (09:27 +0100)]
PM / OPP: Assert RCU lock in exported functions

Add lockdep asserts for holding the RCU lock when calling
dev_pm_opp_get_freq() and dev_pm_opp_get_voltage() to aid in detecting
RCU misuses.

These are called often after dev_pm_opp_find_freq_ceil/exact() which
already asserts for RCU lock. However one could make an error by
releasing lock too early - just after dev_pm_opp_find_freq_ceil().

Change-Id: I981c36fe9d3e39ac0ed1ee4b46dfe1cff1577314
Signed-off-by: Krzysztof Kozlowski <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: Update kernel documentation
Nishanth Menon [Wed, 24 Dec 2014 17:22:57 +0000 (11:22 -0600)]
PM / OPP: Update kernel documentation

kernel doc has gotten bit-rotted over time. Re-sync with Locking and
Return information. document all functions properly and ensure that
./scripts/kernel-doc -v  ./drivers/base/power/opp.c >/dev/null returns
no errors

Change-Id: Ib2484b1cdec48a096ecfaec2b2a55c8175554cbd
Signed-off-by: Nishanth Menon <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: Ensure consistent naming of static functions
Nishanth Menon [Wed, 24 Dec 2014 17:22:56 +0000 (11:22 -0600)]
PM / OPP: Ensure consistent naming of static functions

All exported functions use dev_pm_* prefix and all static functions
are now standardized with _ prefix. This is better than having to deal
with multiple function naming styles within the same file.

Change-Id: Ib4e4e54e635faf9175901e2c9e92fe01476ab506
Signed-off-by: Nishanth Menon <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: export dev_pm_opp_get_notifier
Nishanth Menon [Wed, 24 Dec 2014 17:22:55 +0000 (11:22 -0600)]
PM / OPP: export dev_pm_opp_get_notifier

Allows user drivers such as devfreq to be modules.

Change-Id: Ia6ffc5e7f8f75f6e9596652df4b8fe59da93d054
Signed-off-by: Nishanth Menon <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: take RCU lock in dev_pm_opp_get_opp_count
Dmitry Torokhov [Tue, 16 Dec 2014 23:09:38 +0000 (15:09 -0800)]
PM / OPP: take RCU lock in dev_pm_opp_get_opp_count

A lot of callers are missing the fact that dev_pm_opp_get_opp_count
needs to be called under RCU lock. Given that RCU locks can safely be
nested, instead of providing *_locked() API, let's take RCU lock inside
dev_pm_opp_get_opp_count() and leave callers as is.

Change-Id: I7eb454c853e599d7b8c4c2dce389a57ac413721b
Signed-off-by: Dmitry Torokhov <>
Acked-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: fix warning in of_free_opp_table()
Dmitry Torokhov [Tue, 16 Dec 2014 23:09:37 +0000 (15:09 -0800)]
PM / OPP: fix warning in of_free_opp_table()

Not having OPP defined for a device is not a crime, we should not splat
warning in this case. Also, it seems that we are ready to accept invalid
dev (find_device_opp will return ERR_PTR(-EINVAL) then) so let's not
crash in dev_name() in such case.

Change-Id: Ic04ecffaf644da64ad0995b7624a0a72725d6b3a
Signed-off-by: Dmitry Torokhov <>
Acked-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: add some lockdep annotations
Dmitry Torokhov [Tue, 16 Dec 2014 23:09:36 +0000 (15:09 -0800)]
PM / OPP: add some lockdep annotations

Certain OPP APIs need to be called under RCU lock; let's add a few
rcu_lockdep_assert() calls to warn about potential misuse.

Change-Id: I53f27837ba7a0533dacc3ee155e04f90d10c3b7e
Signed-off-by: Dmitry Torokhov <>
Acked-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
Signed-off-by: Ravikumar Kattekola <>
5 years agoPM / OPP: do error handling at the bottom of dev_pm_opp_add_dynamic()
Viresh Kumar [Wed, 10 Dec 2014 04:15:35 +0000 (09:45 +0530)]
PM / OPP: do error handling at the bottom of dev_pm_opp_add_dynamic()

This makes it less error prone and moves common resource deallocation at a
single place.

Change-Id: Ie8e81e210738145d78aebc034edb962daef05182
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: handle allocation of device_opp in a separate routine
Viresh Kumar [Wed, 10 Dec 2014 04:15:34 +0000 (09:45 +0530)]
PM / OPP: handle allocation of device_opp in a separate routine

Get the 'device_opp' allocation code into a separate routine to keep only the
necessary part in dev_pm_opp_add_dynamic().

Also do s/sizeof(struct device_opp)/sizeof(*dev_opp) and remove the print
message on kzalloc() failure as checkpatch warns for that.

Change-Id: Ie7a364d0a217f109e942a9cd134ba4ec07fc7848
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: reuse find_device_opp() instead of duplicating code
Viresh Kumar [Wed, 10 Dec 2014 04:15:33 +0000 (09:45 +0530)]
PM / OPP: reuse find_device_opp() instead of duplicating code

Reuse find_device_opp() in opp_set_availability() instead of duplicating code.

Change-Id: I5c4b16f99fd2e77f330102ff0ee50e98d1c496f8
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: Staticize __dev_pm_opp_remove()
Viresh Kumar [Wed, 10 Dec 2014 04:15:32 +0000 (09:45 +0530)]
PM / OPP: Staticize __dev_pm_opp_remove()

Its a local routine and need not be accessible outside of opp.c.

Change-Id: I72450b33db460b88a6cc760d55adc0961f5bc817
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: replace kfree with kfree_rcu while freeing 'struct device_opp'
Viresh Kumar [Wed, 10 Dec 2014 04:15:31 +0000 (09:45 +0530)]
PM / OPP: replace kfree with kfree_rcu while freeing 'struct device_opp'

Somehow one of the instance of freeing resources failed to use kfree_rcu() and
used kfree() instead. This might cause problems as the node might be referenced
by readers under rcu locks and we must wait for the rcu grace period as well.

While we are at it, also update comment over 'struct device_opp' to mention why
we are waiting for both rcu and srcu grace periods.

Change-Id: I1df1a5fb833648c4848a55cf38be2198abbd9ef8
Fixes: 129eec55df6a (PM / OPP Introduce APIs to remove OPPs)
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: remove double calls to find_device_opp()
Viresh Kumar [Mon, 8 Dec 2014 08:16:18 +0000 (13:46 +0530)]
PM / OPP: remove double calls to find_device_opp()

By mistake we called find_device_opp() twice in of_free_opp_table(), fix it.

Generated diff doesn't show the problem well and so here is the code snippet:

void of_free_opp_table(struct device *dev)
struct device_opp *dev_opp = find_device_opp(dev);
struct dev_pm_opp *opp, *tmp;

/* Check for existing list for 'dev' */
dev_opp = find_device_opp(dev);


Change-Id: I05b7e91d4c38147a9eea254ad88393a5d2147762
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP: set new_opp->dev_opp to a valid dev_opp
Viresh Kumar [Tue, 9 Dec 2014 05:48:51 +0000 (11:18 +0530)]
PM / OPP: set new_opp->dev_opp to a valid dev_opp

We find/allocate dev_opp after using its value to fill new_opp->dev_opp right
now. Move this to a later point where dev_opp is valid.

Change-Id: I781e5d6ccf0a24c19b1f05ffae97074007902af8
Fixes: a7470db6fec4 (PM / OPP don't match for existing OPPs when list is empty)
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP replace kfree_rcu() with call_srcu() in opp_set_availability()
Viresh Kumar [Thu, 27 Nov 2014 03:24:07 +0000 (08:54 +0530)]
PM / OPP replace kfree_rcu() with call_srcu() in opp_set_availability()

This existed before we introduced call_srcu() in opp layer to synchronize with
srcu_notifier_call_chain() while removing OPPs. And is a potential bug which
wasn't noticed earlier.

Let fix it as well by using the right API to free OPP.

Change-Id: Ie81ca2cfe92654bff199c9c828e1c823bae86abc
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP Introduce APIs to remove OPPs
Viresh Kumar [Thu, 27 Nov 2014 03:24:06 +0000 (08:54 +0530)]
PM / OPP Introduce APIs to remove OPPs

OPPs are created statically (from DT) or dynamically. Currently we don't free
OPPs that are created statically, when the module unloads. And so if the module
is inserted back again, we get warning for duplicate OPPs as the same were
already present.

Also, there might be a need to remove dynamic OPPs in future and so API for that
is also added.

This patch adds helper APIs to remove/free existing static and dynamic OPPs.

Because the OPPs are used both under RCU and SRCU, we have to wait for grace
period of both. And so are using kfree_rcu() from within call_srcu().

Change-Id: I59d62d96ded863f6268401f27a6d87c79e455cb4
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
Signed-off-by: Ravikumar Kattekola <>
5 years agoPM / OPP mark OPPs as 'static' or 'dynamic'
Viresh Kumar [Tue, 25 Nov 2014 10:34:18 +0000 (16:04 +0530)]
PM / OPP mark OPPs as 'static' or 'dynamic'

Static OPPs are the ones created from Device Tree entries and dynamic are the
ones created at runtime by calling dev_pm_opp_add().

There is a need to distinguish them as we need to free static OPPs from cpufreq
drivers when they are removed.

So, add another field 'dynamic' in 'struct dev_pm_opp' to keep this information.

Change-Id: I9c3eda1f16a475efe5df5542ec85c0e1ffd95c4a
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP don't match for existing OPPs when list is empty
Viresh Kumar [Tue, 25 Nov 2014 10:34:17 +0000 (16:04 +0530)]
PM / OPP don't match for existing OPPs when list is empty

OPP list is guaranteed to be empty when 'dev_opp' is created. And so we don't
need to run the comparison loop with existing OPPs.

Change-Id: I0d60bb0ef1ab54044b4c483f32f395e3ea07902c
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoPM / OPP rename 'head' as 'rcu_head' or 'srcu_head' based on its type
Viresh Kumar [Tue, 25 Nov 2014 10:34:16 +0000 (16:04 +0530)]
PM / OPP rename 'head' as 'rcu_head' or 'srcu_head' based on its type

Both 'struct dev_pm_opp' and 'struct device_opp' have member with name 'head'
but with different types. This leads to confusion while reading the code.

Name them 'rcu_head' and 'srcu_head'.

Change-Id: I2ac19b8411ba876cb87296a0b9baacc0dbd56f41
Signed-off-by: Viresh Kumar <>
Signed-off-by: Rafael J. Wysocki <>
5 years agoARM: OMAP5 / DRA7: Introduce workaround for 801819
Nishanth Menon [Tue, 11 Aug 2015 19:11:33 +0000 (14:11 -0500)]
ARM: OMAP5 / DRA7: Introduce workaround for 801819

Add workaround for Cortex-A15 ARM erratum 801819 which says in summary
that "A livelock can occur in the L2 cache arbitration that might
prevent a snoop from completing. Under certain conditions this can
cause the system to deadlock. "

Recommended workaround is as follows:
Do both of the following:

1) Do not use the write-back no-allocate memory type.
2) Do not issue write-back cacheable stores at any time when the cache
is disabled (SCTLR.C=0) and the MMU is enabled (SCTLR.M=1). Because it
is implementation defined whether cacheable stores update the cache when
the cache is disabled it is not expected that any portable code will
execute cacheable stores when the cache is disabled.

For implementations of Cortex-A15 configured without the “L2 arbitration
register slice” option (typically one or two core systems), you must
also do the following:

3) Disable write-streaming in each CPU by setting ACTLR[28:25] = 0b1111

So, we provide an option to disable write streaming on OMAP5 and DRA7.
It is a rare condition to occur and may be enabled selectively based
on platform acceptance of risk.

Applies to: A15 revisions r2p0, r2p1, r2p2, r2p3 or r2p4 and REVIDR[3]
is set to 0.

Based on ARM errata Document revision 18.0 (22 Nov 2013)

Note: the configuration for the workaround needs to be done with
each CPU bringup, since CPU0 bringup is done by bootloader, it is
recommended to have the workaround in the bootloader, kernel also does
ensure that CPU0 has the workaround and makes the workaround active
when CPU1 gets active.

With CONFIG_SMP disabled, it is expected to be done by the bootloader.

This does show significant degradation in synthetic tests such as
mbw (
mbw -n 100 100|grep AVG (on a test platform)
Without enabling the erratum:
AVG Method: MEMCPY  Elapsed: 0.13406  MiB: 100.00000  Copy: 745.913 MiB/s
AVG Method: DUMB    Elapsed: 0.06746  MiB: 100.00000  Copy: 1482.357 MiB/s
AVG Method: MCBLOCK Elapsed: 0.03058  MiB: 100.00000  Copy: 3270.569 MiB/s
After enabling the erratum:
AVG Method: MEMCPY  Elapsed: 0.13757  MiB: 100.00000  Copy: 726.913 MiB/s
AVG Method: DUMB    Elapsed: 0.12024  MiB: 100.00000  Copy: 831.668 MiB/s
AVG Method: MCBLOCK Elapsed: 0.09243  MiB: 100.00000  Copy: 1081.942 MiB/s

Most benchmarks are designed for specific performance analysis, so
overall usecase must be considered before making a decision to
enable/disable the erratum workaround.

Pending internal investigation, the erratum is kept disabled by default.

Suggested-by: Richard Woodruff <>
Suggested-by: Brad Griffis <>
Signed-off-by: Nishanth Menon <>
[Rebase and apply to 3.14 product baseline]
Signed-off-by: Praneeth Bajjuri <>
Change-Id: I1670c797fcd41126fb6357baeb7264527918df1a

5 years agoi2c: tvp5158: parse/configure the gpios needed for tvp5158 chip
Rakesh Movva [Fri, 7 Aug 2015 06:39:09 +0000 (01:39 -0500)]
i2c: tvp5158: parse/configure the gpios needed for tvp5158 chip

added support to parse/configure/control the tvp5158 chip

after parsing the TVP5158 dt node for the gpios the driver
would set all the gpios as per the active high/low flags
specified by the dt node.

Change-Id: I6eff4f62d98642fbaf17c877bd978a33d96f2c8f
Signed-off-by: Rakesh Movva <>
5 years agoarm: dts: dra7-evm/dra72-evm: added vin/gpio support for TVP5158
Rakesh Movva [Fri, 7 Aug 2015 06:22:03 +0000 (01:22 -0500)]
arm: dts: dra7-evm/dra72-evm: added vin/gpio support for TVP5158

added vin instances and gpio support for dra7-evm and dra72-evm
device tree files. also added a new pcf8575(on jamr3 board) device
node under i2c4 which is needed to control the tvp5158 chip.

Change-Id: I2f4d731c024697d00edf6cb508b79550a5c97888
Signed-off-by: Rakesh Movva <>
5 years agoi2c: tvp5158: add a new property to the TVP5158 device tree binding
Rakesh Movva [Fri, 7 Aug 2015 05:45:01 +0000 (00:45 -0500)]
i2c: tvp5158: add a new property to the TVP5158 device tree binding

added a new property "mux-gpios" to the TVP5158 device tree binding
which lists the gpios needed for power, board muxes etc.

Change-Id: Iedbf364580111928eaa1316aa5316ecd7442fb5a
Signed-off-by: Rakesh Movva <>
5 years agoARM: OMAP: DRA7: powerdomain data: Erratum i892 workaround: Disable core INA
Nishanth Menon [Fri, 7 Aug 2015 21:55:53 +0000 (16:55 -0500)]
ARM: OMAP: DRA7: powerdomain data: Erratum i892 workaround: Disable core INA

Erratum i892 as will be documented in the upcoming G or later revision
of DRA7xx/ AM57xx errata documentation (SPRZ398F) states that L3 clock
needs to be kept active all the time to ensure that asymmetric aging
degradation is minimal and within the design allowed margin.

by allowing core domain to transition to INA and allowing L3 clock to be
turned off for extended periods of time, there is a risk of functional

Due to this change, there is a minimal impact on power numbers in low
power state.

Signed-off-by: Nishanth Menon <>
[cherrypick to 3.14 baseline]
Signed-off-by: Praneeth Bajjuri <>
Change-Id: I8140ea33686758fc2c03b09a3009e656b4a94294

5 years agoARM: DRA752: OPP: reuse OPP information for ES2.0
Vishal Mahaveer [Tue, 4 Aug 2015 21:17:40 +0000 (16:17 -0500)]
ARM: DRA752: OPP: reuse OPP information for ES2.0

ES2.0 variant of DRA752 reuses the same OPP information as ES1.1

Change-Id: I6b1482a5fe54e60f9e04baa84b6e5d2adc3e3c6f
Signed-off-by: Vishal Mahaveer <>
Signed-off-by: Nishanth Menon <>
[rebase and pick for 3.14]
Signed-off-by: Praneeth Bajjuri <>
5 years agoARM: DRA752: Add ID detect for ES2.0
Vishal Mahaveer [Tue, 4 Aug 2015 21:11:38 +0000 (16:11 -0500)]
ARM: DRA752: Add ID detect for ES2.0

ES2.0 is a minor variant of ES1.1. ES2.0 is an incremental revision
with various fixes including the following:
- reset logic fixes
- few assymetric aging logic fixes
- MMC clock rate fixes
- Ethernet speed fixes
- edma fixes for mcasp

Signed-off-by: Vishal Mahaveer <>
Signed-off-by: Nishanth Menon <>
[rebase and pick to 3.14]
Signed-off-by: Praneeth Bajjuri <>
Change-Id: Ib80ed2639797b5dce07a370f27b0fd529c550f37

5 years agoMerge branch 'ti-linux-3.14.y' of git://
Praneeth Bajjuri [Tue, 4 Aug 2015 21:06:48 +0000 (16:06 -0500)]
Merge branch 'ti-linux-3.14.y' of git:// into p-ti-linux-3.14.y-common

* 'ti-linux-3.14.y' of git:// (126 commits)
  Linux 3.14.49
  MIPS: KVM: Do not sign extend on unsigned MMIO load
  qla2xxx: Mark port lost when we receive an RSCN for it.
  Fix firmware loader uevent buffer NULL pointer dereference
  hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
  arm64: Don't report clear pmds and puds as huge
  agp/intel: Fix typo in needs_ilk_vtd_wa()
  rbd: use GFP_NOIO in rbd_obj_request_create()
  9p: don't leave a half-initialized inode sitting around
  9p: forgetting to cancel request on interrupted zero-copy RPC
  SUNRPC: Fix a memory leak in the backchannel code
  nfs: increase size of EXCHANGE_ID name string buffer
  fixing infinite OPEN loop in 4.0 stateid recovery
  NFS: Fix size of NFSACL SETACL operations
  watchdog: omap: assert the counter being stopped before reprogramming
  of: return NUMA_NO_NODE from fallback of_node_to_nid()
  block: Do a full clone when splitting discard bios
  USB: usbfs: allow URBs to be reaped after disconnection
  dell-laptop: Fix allocating & freeing SMI buffer page
  ideapad: fix software rfkill setting

Change-Id: I0a99f18d4e53a6a16c48f865b39350d2665dd4ad
Signed-off-by: Praneeth Bajjuri <>
5 years agomedia: ti-vpe: vip: fix try_format for interlaced frames usecase
Rakesh Movva [Mon, 27 Jul 2015 23:38:51 +0000 (18:38 -0500)]
media: ti-vpe: vip: fix try_format for interlaced frames usecase

The try_format call is not comapring the enum_framesizes received
from subdev for interlaced frames.  Added a check for
field == V4L2_FIELD_ALTERNATE as the height defers for interlaced

Change-Id: If16e4d09ff48b4cb36bf9259af77116e3b65e2ff
Signed-off-by: Rakesh Movva <>
5 years agoMerge tag 'v3.14.49' of
Texas Instruments Auto Merger [Mon, 3 Aug 2015 18:44:36 +0000 (13:44 -0500)]
Merge tag 'v3.14.49' of git./linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.49 stable release

* tag 'v3.14.49' of (126 commits)
  Linux 3.14.49
  MIPS: KVM: Do not sign extend on unsigned MMIO load
  qla2xxx: Mark port lost when we receive an RSCN for it.
  Fix firmware loader uevent buffer NULL pointer dereference
  hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
  arm64: Don't report clear pmds and puds as huge
  agp/intel: Fix typo in needs_ilk_vtd_wa()
  rbd: use GFP_NOIO in rbd_obj_request_create()
  9p: don't leave a half-initialized inode sitting around
  9p: forgetting to cancel request on interrupted zero-copy RPC
  SUNRPC: Fix a memory leak in the backchannel code
  nfs: increase size of EXCHANGE_ID name string buffer
  fixing infinite OPEN loop in 4.0 stateid recovery
  NFS: Fix size of NFSACL SETACL operations
  watchdog: omap: assert the counter being stopped before reprogramming
  of: return NUMA_NO_NODE from fallback of_node_to_nid()
  block: Do a full clone when splitting discard bios
  USB: usbfs: allow URBs to be reaped after disconnection
  dell-laptop: Fix allocating & freeing SMI buffer page
  ideapad: fix software rfkill setting

Signed-off-by: Texas Instruments Auto Merger <>
5 years agoLinux 3.14.49
Greg Kroah-Hartman [Mon, 3 Aug 2015 16:32:59 +0000 (09:32 -0700)]
Linux 3.14.49

5 years agoMIPS: KVM: Do not sign extend on unsigned MMIO load
Nicholas Mc Guire [Thu, 7 May 2015 12:47:50 +0000 (14:47 +0200)]
MIPS: KVM: Do not sign extend on unsigned MMIO load

commit ed9244e6c534612d2b5ae47feab2f55a0d4b4ced upstream.

Fix possible unintended sign extension in unsigned MMIO loads by casting
to uint16_t in the case of mmio_needed != 2.

Signed-off-by: Nicholas Mc Guire <>
Reviewed-by: James Hogan <>
Tested-by: James Hogan <>
Cc: Gleb Natapov <>
Cc: Paolo Bonzini <>
Signed-off-by: Ralf Baechle <>
Signed-off-by: James Hogan <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoqla2xxx: Mark port lost when we receive an RSCN for it.
Chad Dupuis [Thu, 25 Sep 2014 09:17:01 +0000 (05:17 -0400)]
qla2xxx: Mark port lost when we receive an RSCN for it.

commit ef86cb2059a14b4024c7320999ee58e938873032 upstream.

Signed-off-by: Chad Dupuis <>
Signed-off-by: Saurav Kashyap <>
Signed-off-by: Christoph Hellwig <>
Cc: Himanshu Madhani <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoFix firmware loader uevent buffer NULL pointer dereference
Linus Torvalds [Thu, 9 Jul 2015 18:20:01 +0000 (11:20 -0700)]
Fix firmware loader uevent buffer NULL pointer dereference

commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c upstream.

The firmware class uevent function accessed the "fw_priv->buf" buffer
without the proper locking and testing for NULL.  This is an old bug
(looks like it goes back to 2012 and commit 1244691c73b2: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering
only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger
more easily, but in the meantime let's just fix the bug since others are
hitting it too (at least Ingo reports having seen it as well).

Reported-and-tested-by: Shuah Khan <>
Acked-by: Ming Lei <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agohpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
Joe Perches [Fri, 27 Mar 2015 03:47:10 +0000 (20:47 -0700)]
hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead

commit a28e4b2b18ccb90df402da3f21e1a83c9d4f8ec1 upstream.

Removing unnecessary static buffers is good.
Use the vsprintf %pV extension instead.

Signed-off-by: Joe Perches <>
Signed-off-by: Mikulas Patocka <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoarm64: Don't report clear pmds and puds as huge
Christoffer Dall [Wed, 1 Jul 2015 12:08:31 +0000 (14:08 +0200)]
arm64: Don't report clear pmds and puds as huge

commit fd28f5d439fca77348c129d5b73043a56f8a0296 upstream.

The current pmd_huge() and pud_huge() functions simply check if the table
bit is not set and reports the entries as huge in that case.  This is
counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
it is inconsistent with at least arm and x86.

To prevent others from making the same mistake as me in looking at code
that calls these functions and to fix an issue with KVM on arm64 that
causes memory corruption due to incorrect page reference counting
resulting from this mistake, let's change the behavior.

Signed-off-by: Christoffer Dall <>
Reviewed-by: Steve Capper <>
Acked-by: Marc Zyngier <>
Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.")
Signed-off-by: Catalin Marinas <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoagp/intel: Fix typo in needs_ilk_vtd_wa()
Chris Wilson [Sun, 28 Jun 2015 13:18:16 +0000 (14:18 +0100)]
agp/intel: Fix typo in needs_ilk_vtd_wa()

commit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.

In needs_ilk_vtd_wa(), we pass in the GPU device but compared it against
the ids for the mobile GPU and the mobile host bridge. That latter is
impossible and so likely was just a typo for the desktop GPU device id
(which is also buggy).

Fixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662
Author: Chris Wilson <>
Date:   Wed Feb 13 09:31:53 2013 +0000

    drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK

Reported-by: Ting-Wei Lan <>
Signed-off-by: Chris Wilson <>
Cc: Daniel Vetter <>
Reviewed-by: Daniel Vetter <>
Signed-off-by: Jani Nikula <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agorbd: use GFP_NOIO in rbd_obj_request_create()
Ilya Dryomov [Wed, 24 Jun 2015 14:24:33 +0000 (17:24 +0300)]
rbd: use GFP_NOIO in rbd_obj_request_create()

commit 5a60e87603c4c533492c515b7f62578189b03c9c upstream.

rbd_obj_request_create() is called on the main I/O path, so we need to
use GFP_NOIO to make sure allocation doesn't blow back on us.  Not all
callers need this, but I'm still hardcoding the flag inside rather than
making it a parameter because a) this is going to stable, and b) those
callers shouldn't really use rbd_obj_request_create() and will be fixed
in the future.

More memory allocation fixes will follow.

Signed-off-by: Ilya Dryomov <>
Reviewed-by: Alex Elder <>
Signed-off-by: Greg Kroah-Hartman <>
5 years ago9p: don't leave a half-initialized inode sitting around
Al Viro [Sun, 12 Jul 2015 14:34:29 +0000 (10:34 -0400)]
9p: don't leave a half-initialized inode sitting around

commit 0a73d0a204a4a04a1e110539c5a524ae51f91d6d upstream.

Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>
5 years ago9p: forgetting to cancel request on interrupted zero-copy RPC
Al Viro [Sat, 4 Jul 2015 20:04:19 +0000 (16:04 -0400)]
9p: forgetting to cancel request on interrupted zero-copy RPC

commit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.

If we'd already sent a request and decide to abort it, we *must*
issue TFLUSH properly and not just blindly reuse the tag, or
we'll get seriously screwed when response eventually arrives
and we confuse it for response to later request that had reused
the same tag.

Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoSUNRPC: Fix a memory leak in the backchannel code
Trond Myklebust [Mon, 1 Jun 2015 19:10:25 +0000 (15:10 -0400)]
SUNRPC: Fix a memory leak in the backchannel code

commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.

req->rq_private_buf isn't initialised when xprt_setup_backchannel calls

Fixes: fb7a0b9addbdb ("nfs41: New backchannel helper routines")
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agonfs: increase size of EXCHANGE_ID name string buffer
Jeff Layton [Tue, 9 Jun 2015 23:43:56 +0000 (19:43 -0400)]
nfs: increase size of EXCHANGE_ID name string buffer

commit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.

The current buffer is much too small if you have a relatively long
hostname. Bring it up to the size of the one that SETCLIENTID has.

Reported-by: Michael Skralivetsky <>
Signed-off-by: Jeff Layton <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agofixing infinite OPEN loop in 4.0 stateid recovery
Olga Kornievskaia [Fri, 15 May 2015 15:45:31 +0000 (11:45 -0400)]
fixing infinite OPEN loop in 4.0 stateid recovery

commit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.

Problem: When an operation like WRITE receives a BAD_STATEID, even though
recovery code clears the RECLAIM_NOGRACE recovery flag before recovering
the open state, because of clearing delegation state for the associated
inode, nfs_inode_find_state_and_recover() gets called and it makes the
same state with RECLAIM_NOGRACE flag again. As a results, when we restart
looking over the open states, we end up in the infinite loop instead of
breaking out in the next test of state flags.

Solution: unset the RECLAIM_NOGRACE set because of
calling of nfs_inode_find_state_and_recover() after returning from calling
recover_open() function.

Signed-off-by: Olga Kornievskaia <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoNFS: Fix size of NFSACL SETACL operations
Chuck Lever [Tue, 26 May 2015 15:53:52 +0000 (11:53 -0400)]
NFS: Fix size of NFSACL SETACL operations

commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.

When encoding the NFSACL SETACL operation, reserve just the estimated
size of the ACL rather than a fixed maximum. This eliminates needless
zero padding on the wire that the server ignores.

Fixes: ee5dc7732bd5 ('NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"')
Signed-off-by: Chuck Lever <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agowatchdog: omap: assert the counter being stopped before reprogramming
Uwe Kleine-König [Wed, 29 Apr 2015 18:38:46 +0000 (20:38 +0200)]
watchdog: omap: assert the counter being stopped before reprogramming

commit 530c11d432727c697629ad5f9d00ee8e2864d453 upstream.

The omap watchdog has the annoying behaviour that writes to most
registers don't have any effect when the watchdog is already running.
Quoting the AM335x reference manual:

To modify the timer counter value (the WDT_WCRR register),
prescaler ratio (the WDT_WCLR[4:2] PTV bit field), delay
configuration value (the WDT_WDLY[31:0] DLY_VALUE bit field), or
the load value (the WDT_WLDR[31:0] TIMER_LOAD bit field), the
watchdog timer must be disabled by using the start/stop sequence
(the WDT_WSPR register).

Currently the timer is stopped in the .probe callback but still there
are possibilities that yield to a situation where omap_wdt_start is
entered with the timer running (e.g. when /dev/watchdog is closed
without stopping and then reopened). In such a case programming the
timeout silently fails!

To circumvent this stop the timer before reprogramming.

Assuming one of the first things the watchdog user does is setting the
timeout explicitly nothing too bad should happen because this explicit
setting works fine.

Fixes: 7768a13c252a ("[PATCH] OMAP: Add Watchdog driver support")
Signed-off-by: Uwe Kleine-König <>
Reviewed-by: Guenter Roeck <>
Signed-off-by: Wim Van Sebroeck <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoof: return NUMA_NO_NODE from fallback of_node_to_nid()
Konstantin Khlebnikov [Wed, 8 Apr 2015 16:59:20 +0000 (19:59 +0300)]
of: return NUMA_NO_NODE from fallback of_node_to_nid()

commit c8fff7bc5bba6bd59cad40441c189c4efe7190f6 upstream.

Node 0 might be offline as well as any other numa node,
in this case kernel cannot handle memory allocation and crashes.

Signed-off-by: Konstantin Khlebnikov <>
Fixes: 0c3f061c195c ("of: implement of_node_to_nid as a weak function")
Signed-off-by: Grant Likely <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoblock: Do a full clone when splitting discard bios
Martin K. Petersen [Wed, 22 Jul 2015 11:57:12 +0000 (07:57 -0400)]
block: Do a full clone when splitting discard bios

commit f3f5da624e0a891c34d8cd513c57f1d9b0c7dadc upstream.

This fixes a data corruption bug when using discard on top of MD linear,
raid0 and raid10 personalities.

Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing
the bio_vec between the two resulting bios. That is fine for read/write
requests where the bio_vec is immutable. For discards, however, we need
to be able to attach a payload and update the bio_vec so the page can
get mapped to a scatterlist entry. Therefore the bio_vec can not be
shared when splitting discards and we must do a full clone.

Signed-off-by: Martin K. Petersen <>
Reported-by: Seunguk Shin <>
Tested-by: Seunguk Shin <>
Cc: Seunguk Shin <>
Cc: Jens Axboe <>
Cc: Kent Overstreet <>
Reviewed-by: Christoph Hellwig <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoUSB: usbfs: allow URBs to be reaped after disconnection
Alan Stern [Thu, 29 Jan 2015 16:29:13 +0000 (11:29 -0500)]
USB: usbfs: allow URBs to be reaped after disconnection

commit 3f2cee73b650921b2e214bf487b2061a1c266504 upstream.

The usbfs API has a peculiar hole: Users are not allowed to reap their
URBs after the device has been disconnected.  There doesn't seem to be
any good reason for this; it is an ad-hoc inconsistency.

The patch allows users to issue the USBDEVFS_REAPURB and
USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts
on 64-bit systems) even after the device is gone.  If no URBs are
pending for a disconnected device then the ioctls will return -ENODEV
rather than -EAGAIN, because obviously no new URBs will ever be able
to complete.

The patch also adds a new capability flag for
USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect
feature is supported.

Signed-off-by: Alan Stern <>
Tested-by: Chris Dickens <>
Acked-by: Hans de Goede <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agodell-laptop: Fix allocating & freeing SMI buffer page
Pali Rohár [Tue, 23 Jun 2015 08:11:19 +0000 (10:11 +0200)]
dell-laptop: Fix allocating & freeing SMI buffer page

commit b8830a4e71b15d0364ac8e6c55301eea73f211da upstream.

This commit fix kernel crash when probing for rfkill devices in dell-laptop
driver failed. Function free_page() was incorrectly used on struct page *
instead of virtual address of SMI buffer.

This commit also simplify allocating page for SMI buffer by using
__get_free_page() function instead of sequential call of functions
alloc_page() and page_address().

Signed-off-by: Pali Rohár <>
Acked-by: Michal Hocko <>
Signed-off-by: Darren Hart <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoideapad: fix software rfkill setting
Arnd Bergmann [Sat, 13 Jun 2015 13:23:33 +0000 (15:23 +0200)]
ideapad: fix software rfkill setting

commit 4b200b4604bec3388426159f1656109d19fadf6e upstream.

This fixes a several year old regression that I found while trying
to get the Yoga 3 11 to work. The ideapad_rfk_set function is meant
to send a command to the embedded controller through ACPI, but
as of c1f73658ed, it sends the index of the rfkill device instead
of the command, and ignores the opcode field.

This changes it back to the original behavior, which indeed
flips the rfkill state as seen in the debugfs interface.

Signed-off-by: Arnd Bergmann <>
Fixes: c1f73658ed ("ideapad: pass ideapad_priv as argument (part 2)")
Signed-off-by: Darren Hart <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoclocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
Damian Eppel [Fri, 26 Jun 2015 13:23:04 +0000 (15:23 +0200)]
clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier

commit 56a94f13919c0db5958611b388e1581b4852f3c9 upstream.

Whilst testing cpu hotplug events on kernel configured with
DEBUG_PREEMPT and DEBUG_ATOMIC_SLEEP we get following BUG message,
caused by calling request_irq() and free_irq() in the context of
hotplug notification (which is in this case atomic context).

[   40.785859] CPU1: Software reset
[   40.786660] BUG: sleeping function called from invalid context at mm/slub.c:1241
[   40.786668] in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/1
[   40.786678] Preemption disabled at:[<  (null)>]   (null)
[   40.786681]
[   40.786692] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.19.0-rc4-00024-g7dca860 #36
[   40.786698] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   40.786728] [<c0014a00>] (unwind_backtrace) from [<c0011980>] (show_stack+0x10/0x14)
[   40.786747] [<c0011980>] (show_stack) from [<c0449ba0>] (dump_stack+0x70/0xbc)
[   40.786767] [<c0449ba0>] (dump_stack) from [<c00c6124>] (kmem_cache_alloc+0xd8/0x170)
[   40.786785] [<c00c6124>] (kmem_cache_alloc) from [<c005d6f8>] (request_threaded_irq+0x64/0x128)
[   40.786804] [<c005d6f8>] (request_threaded_irq) from [<c0350b8c>] (exynos4_local_timer_setup+0xc0/0x13c)
[   40.786820] [<c0350b8c>] (exynos4_local_timer_setup) from [<c0350ca8>] (exynos4_mct_cpu_notify+0x30/0xa8)
[   40.786838] [<c0350ca8>] (exynos4_mct_cpu_notify) from [<c003b330>] (notifier_call_chain+0x44/0x84)
[   40.786857] [<c003b330>] (notifier_call_chain) from [<c0022fd4>] (__cpu_notify+0x28/0x44)
[   40.786873] [<c0022fd4>] (__cpu_notify) from [<c0013714>] (secondary_start_kernel+0xec/0x150)
[   40.786886] [<c0013714>] (secondary_start_kernel) from [<40008764>] (0x40008764)

Interrupts cannot be requested/freed in the CPU_STARTING/CPU_DYING
notifications which run on the hotplugged cpu with interrupts and
preemption disabled.

To avoid the issue, request the interrupts for all possible cpus in
the boot code. The interrupts are marked NO_AUTOENABLE to avoid a racy
request_irq/disable_irq() sequence. The flag prevents the
request_irq() code from enabling the interrupt immediately.

The interrupt is then enabled in the CPU_STARTING notifier of the
hotplugged cpu and again disabled with disable_irq_nosync() in the
CPU_DYING notifier.

[ tglx: Massaged changelog to match the patch ]

Fixes: 7114cd749a12 ("clocksource: exynos_mct: use (request/free)_irq calls for local timer registration")
Reported-by: Krzysztof Kozlowski <>
Reviewed-by: Krzysztof Kozlowski <>
Tested-by: Krzysztof Kozlowski <>
Tested-by: Marcin Jabrzyk <>
Signed-off-by: Damian Eppel <>
Signed-off-by: Thomas Gleixner <>
Cc: <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agomac80211: prevent possible crypto tx tailroom corruption
Michal Kazior [Fri, 22 May 2015 08:22:40 +0000 (10:22 +0200)]
mac80211: prevent possible crypto tx tailroom corruption

commit ab499db80fcf07c18e4053f91a619500f663e90e upstream.

There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior <>
Signed-off-by: Johannes Berg <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agosecurity_syslog() should be called once only
Vasily Averin [Thu, 25 Jun 2015 22:01:44 +0000 (15:01 -0700)]
security_syslog() should be called once only

commit d194e5d666225b04c7754471df0948f645b6ab3a upstream.

The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict
sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are
processed incorrectly:

- open of /dev/kmsg checks syslog access permissions by using
  check_syslog_permissions() where security_syslog() is not called if
  dmesg_restrict is set.

- syslog syscall and /proc/kmsg calls do_syslog() where security_syslog
  can be executed twice (inside check_syslog_permissions() and then
  directly in do_syslog())

With this patch security_syslog() is called once only in all
syslog-related operations regardless of dmesg_restrict value.

Fixes: 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg")
Signed-off-by: Vasily Averin <>
Cc: Kees Cook <>
Cc: Josh Boyer <>
Cc: Eric Paris <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
5 years ago__bitmap_parselist: fix bug in empty string handling
Chris Metcalf [Thu, 25 Jun 2015 22:02:08 +0000 (15:02 -0700)]
__bitmap_parselist: fix bug in empty string handling

commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.

bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in
the mask.  The same bug is visible in cpumask_parselist() since it is
layered on top of the bitmask code, e.g.  if you boot with "isolcpus=",
you will actually end up with cpu zero isolated.

The bug was introduced in commit 4b060420a596 ("bitmap, irq: add
smp_affinity_list interface to /proc/irq") when bitmap_parselist() was
generalized to support userspace as well as kernelspace.

Fixes: 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq")
Signed-off-by: Chris Metcalf <>
Cc: Rasmus Villemoes <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoPM / sleep: Increase default DPM watchdog timeout to 60
Takashi Iwai [Wed, 24 Jun 2015 22:35:16 +0000 (00:35 +0200)]
PM / sleep: Increase default DPM watchdog timeout to 60

commit fff3b16d2754a061a3549c4307a186423a0128fd upstream.

Many harddisks (mostly WD ones) have firmware problems and take too
long, more than 10 seconds, to resume from suspend.  And this often
exceeds the default DPM watchdog timeout (12 seconds), resulting in a
kernel panic out of sudden.

Since most distros just take the default as is, we should give a bit
more safer value.  This patch increases the default value from 12
seconds to one minute, which has been confirmed to be long enough for
such problematic disks.

Fixes: 70fea60d888d (PM / Sleep: Detect device suspend/resume lockup and log event)
Signed-off-by: Takashi Iwai <>
Signed-off-by: Rafael J. Wysocki <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agommc: card: Fixup request missing in mmc_blk_issue_rw_rq
Ding Wang [Mon, 18 May 2015 12:14:15 +0000 (20:14 +0800)]
mmc: card: Fixup request missing in mmc_blk_issue_rw_rq

commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 upstream.

The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function
may cause new coming request permanent missing when the ongoing
request (previoulsy started) complete end.

The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err()
    end request A completed and return zero. Continue the error handling,
    suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
    is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.

The process related to the missing request may wait that IO request
complete forever, possibly crashing the application or hanging the system.

Fix this issue by starting new request when reset success.

Signed-off-by: Ding Wang <>
Fixes: 67716327eec7 ("mmc: block: add eMMC hardware reset support")
Signed-off-by: Ulf Hansson <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoiser-target: release stale iser connections
Sagi Grimberg [Thu, 4 Jun 2015 16:49:20 +0000 (19:49 +0300)]
iser-target: release stale iser connections

commit 2f1b6b7d9a815f341b18dfd26a363f37d4d3c96a upstream.

When receiving a new iser connect request we serialize
the pending requests by adding the newly created iser connection
to the np accept list and let the login thread process the connect
request one by one (np_accept_wait).

In case we received a disconnect request before the iser_conn
has begun processing (still linked in np_accept_list) we should
detach it from the list and clean it up and not have the login
thread process a stale connection. We do it only when the connection
state is not already terminating (initiator driven disconnect) as
this might lead us to access np_accept_mutex after the np was released
in live shutdown scenarios.

Signed-off-by: Sagi Grimberg <>
Signed-off-by: Jenny Falkovich <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoiser-target: Fix possible deadlock in RDMA_CM connection error
Sagi Grimberg [Sun, 29 Mar 2015 12:52:04 +0000 (15:52 +0300)]
iser-target: Fix possible deadlock in RDMA_CM connection error

commit 4a579da2586bd3b79b025947ea24ede2bbfede62 upstream.

Before we reach to connection established we may get an
error event. In this case the core won't teardown this
connection (never established it), so we take care of freeing
it ourselves.

Signed-off-by: Sagi Grimberg <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoiscsi-target: Convert iscsi_thread_set usage to kthread.h
Nicholas Bellinger [Fri, 27 Feb 2015 06:19:15 +0000 (22:19 -0800)]
iscsi-target: Convert iscsi_thread_set usage to kthread.h

commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca upstream.

This patch converts iscsi-target code to use modern kthread.h API
callers for creating RX/TX threads for each new iscsi_conn descriptor,
and releasing associated RX/TX threads during connection shutdown.

This is done using iscsit_start_kthreads() -> kthread_run() to start
new kthreads from within iscsi_post_login_handler(), and invoking
kthread_stop() from existing iscsit_close_connection() code.

Also, convert iscsit_logout_post_handler_closesession() code to use
cmpxchg when determing when iscsit_cause_connection_reinstatement()
needs to sleep waiting for completion.

Reported-by: Sagi Grimberg <>
Tested-by: Sagi Grimberg <>
Cc: Slava Shwartsman <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoACPICA: Tables: Fix an issue that FACS initialization is performed twice
Lv Zheng [Wed, 1 Jul 2015 06:43:26 +0000 (14:43 +0800)]
ACPICA: Tables: Fix an issue that FACS initialization is performed twice

commit c04be18448355441a0c424362df65b6422e27bda upstream.

ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658

This patch adds a new FACS initialization flag for acpi_tb_initialize().
acpi_enable_subsystem() might be invoked several times in OS bootup process,
and we don't want FACS initialization to be invoked twice. Lv Zheng.

Signed-off-by: Lv Zheng <>
Signed-off-by: Bob Moore <>
Signed-off-by: Rafael J. Wysocki <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agocrush: fix a bug in tree bucket decode
Ilya Dryomov [Mon, 29 Jun 2015 16:30:23 +0000 (19:30 +0300)]
crush: fix a bug in tree bucket decode

commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.

struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()
should be used.  -Wconversion catches this, but I guess it went
unnoticed in all the noise it spews.  The actual problem (at least for
common crushmaps) isn't the u32 -> u8 truncation though - it's the
advancement by 4 bytes instead of 1 in the crushmap buffer.


Signed-off-by: Ilya Dryomov <>
Reviewed-by: Josh Durgin <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agofuse: initialize fc->release before calling it
Miklos Szeredi [Wed, 1 Jul 2015 14:25:55 +0000 (16:25 +0200)]
fuse: initialize fc->release before calling it

commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.

fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.

[Jeremiah Mahler <>: assign fc->release after calling
fuse_conn_init(fc) instead of before.]

Signed-off-by: Miklos Szeredi <>
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Signed-off-by: Greg Kroah-Hartman <>
5 years agoBtrfs: fix memory leak in the extent_same ioctl
Filipe Manana [Fri, 3 Jul 2015 07:36:11 +0000 (08:36 +0100)]
Btrfs: fix memory leak in the extent_same ioctl

commit 497b4050e0eacd4c746dd396d14916b1e669849d upstream.

We were allocating memory with memdup_user() but we were never releasing
that memory. This affected pretty much every call to the ioctl, whether
it deduplicated extents or not.

This issue was reported on IRC by Julian Taylor and on the mailing list
by Marcel Ritter, credit goes to them for finding the issue.

Reported-by: Julian Taylor <>
Reported-by: Marcel Ritter <>
Signed-off-by: Filipe Manana <>
Reviewed-by: Mark Fasheh <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoBtrfs: use kmem_cache_free when freeing entry in inode cache
Filipe Manana [Sat, 13 Jun 2015 05:52:56 +0000 (06:52 +0100)]
Btrfs: use kmem_cache_free when freeing entry in inode cache

commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream.

The free space entries are allocated using kmem_cache_zalloc(),
through __btrfs_add_free_space(), therefore we should use
kmem_cache_free() and not kfree() to avoid any confusion and
any potential problem. Looking at the kfree() definition at
mm/slab.c it has the following comment:

   * (...)
   * Don't free memory not originally allocated by kmalloc()
   * or you will run into trouble.

So better be safe and use kmem_cache_free().

Signed-off-by: Filipe Manana <>
Reviewed-by: David Sterba <>
Signed-off-by: Chris Mason <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agomd: fix a build warning
Firo Yang [Thu, 11 Jun 2015 01:41:10 +0000 (09:41 +0800)]
md: fix a build warning

commit 4e023612325a9034a542bfab79f78b1fe5ebb841 upstream.

Warning like this:

drivers/md/md.c: In function "update_array_info":
drivers/md/md.c:6394:26: warning: logical not is only applied
to the left hand side of comparison [-Wlogical-not-parentheses]
      !mddev->persistent  != info->not_persistent||

Fix it as Neil Brown said:
mddev->persistent != !info->not_persistent ||

Signed-off-by: Firo Yang <>
Signed-off-by: NeilBrown <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agohwmon: (mcp3021) Fix broken output scaling
Stevens, Nick [Wed, 1 Jul 2015 16:07:41 +0000 (16:07 +0000)]
hwmon: (mcp3021) Fix broken output scaling

commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream.

The mcp3021 scaling code is dividing the VDD (full-scale) value in
millivolts by the A2D resolution to obtain the scaling factor. When VDD
is 3300mV (the standard value) and the resolution is 12-bit (4096
divisions), the result is a scale factor of 3300/4096, which is always
one.  Effectively, the raw A2D reading is always being returned because
no scaling is applied.

This patch fixes the issue and simplifies the register-to-volts
calculation, removing the unneeded "output_scale" struct member.

Signed-off-by: Nick Stevens <>
[Guenter Roeck: Dropped unnecessary value check]
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agodmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
Lior Amsalem [Tue, 26 May 2015 13:07:32 +0000 (15:07 +0200)]
dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup

commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.

This patch fixes a bug in the XOR driver where the cleanup function can be
called and free descriptors that never been processed by the engine (which
result in data errors).

The cleanup function will free descriptors based on the ownership bit in
the descriptors.

Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Lior Amsalem <>
Signed-off-by: Maxime Ripard <>
Reviewed-by: Ofer Heifetz <>
Signed-off-by: Vinod Koul <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agotracing: Have branch tracer use recursive field of task struct
Steven Rostedt (Red Hat) [Tue, 7 Jul 2015 19:05:03 +0000 (15:05 -0400)]
tracing: Have branch tracer use recursive field of task struct

commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 upstream.

Fengguang Wu's tests triggered a bug in the branch tracer's start up
test when CONFIG_DEBUG_PREEMPT set. This was because that config
adds some debug logic in the per cpu field, which calls back into
the branch tracer.

The branch tracer has its own recursive checks, but uses a per cpu
variable to implement it. If retrieving the per cpu variable calls
back into the branch tracer, you can see how things will break.

Instead of using a per cpu variable, use the trace_recursion field
of the current task struct. Simply set a bit when entering the
branch tracing and clear it when leaving. If the bit is set on
entry, just don't do the tracing.

There's also the case with lockdep, as the local_irq_save() called
before the recursion can also trigger code that can call back into
the function. Changing that to a raw_local_irq_save() will protect
that as well.

This prevents the recursion and the inevitable crash that follows.

Reported-by: Fengguang Wu <>
Tested-by: Fengguang Wu <>
Signed-off-by: Steven Rostedt <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agotracing/filter: Do not allow infix to exceed end of string
Steven Rostedt (Red Hat) [Thu, 25 Jun 2015 22:10:09 +0000 (18:10 -0400)]
tracing/filter: Do not allow infix to exceed end of string

commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.

While debugging a WARN_ON() for filtering, I found that it is possible
for the filter string to be referenced after its end. With the filter:

 # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter

The filter_parse() function can call infix_get_op() which calls
infix_advance() that updates the infix filter pointers for the cnt
and tail without checking if the filter is already at the end, which
will put the cnt to zero and the tail beyond the end. The loop then calls
infix_next() that has

return ps->infix.string[ps->infix.tail++];

The cnt will now be below zero, and the tail that is returned is
already passed the end of the filter string. So far the allocation
of the filter string usually has some buffer that is zeroed out, but
if the filter string is of the exact size of the allocated buffer
there's no guarantee that the charater after the nul terminating
character will be zero.

Luckily, only root can write to the filter.

Signed-off-by: Steven Rostedt <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agotracing/filter: Do not WARN on operand count going below zero
Steven Rostedt (Red Hat) [Thu, 25 Jun 2015 22:02:29 +0000 (18:02 -0400)]
tracing/filter: Do not WARN on operand count going below zero

commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.

When testing the fix for the trace filter, I could not come up with
a scenario where the operand count goes below zero, so I added a
WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case
that it can happen (although the filter would be wrong).

 # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter

That is, a single operation without any operands will hit the path
where the WARN_ON_ONCE() can trigger. Although this is harmless,
and the filter is reported as a error. But instead of spitting out
a warning to the kernel dmesg, just fail nicely and report it via
the proper channels.

Reported-by: Vince Weaver <>
Reported-by: Sasha Levin <>
Signed-off-by: Steven Rostedt <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agolibata: force disable trim for SuperSSpeed S238
Arne Fitzenreiter [Wed, 15 Jul 2015 11:54:37 +0000 (13:54 +0200)]
libata: force disable trim for SuperSSpeed S238

commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.

This device loses blocks, often the partition table area, on trim.
Disable TRIM.

Signed-off-by: Arne Fitzenreiter <>
Signed-off-by: Tejun Heo <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agolibata: add ATA_HORKAGE_NOTRIM
Arne Fitzenreiter [Wed, 15 Jul 2015 11:54:36 +0000 (13:54 +0200)]

commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.

Some devices lose data on TRIM whether queued or not.  This patch adds
a horkage to disable TRIM.

tj: Collapsed unnecessary if() nesting.

Signed-off-by: Arne Fitzenreiter <>
Signed-off-by: Tejun Heo <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoevm: labeling pseudo filesystems exception
Mimi Zohar [Tue, 21 Apr 2015 17:59:31 +0000 (13:59 -0400)]
evm: labeling pseudo filesystems exception

commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream.

To prevent offline stripping of existing file xattrs and relabeling of
them at runtime, EVM allows only newly created files to be labeled.  As
pseudo filesystems are not persistent, stripping of xattrs is not a

Some LSMs defer file labeling on pseudo filesystems.  This patch
permits the labeling of existing files on pseudo files systems.

Signed-off-by: Mimi Zohar <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoima: fix ima_show_template_data_ascii()
Mimi Zohar [Thu, 11 Jun 2015 15:54:42 +0000 (11:54 -0400)]
ima: fix ima_show_template_data_ascii()

commit 45b26133b97871896b8c5241d59f4ff7839db7b2 upstream.

This patch fixes a bug introduced in "4d7aeee ima: define new template
ima-ng and template fields d-ng and n-ng".

- change int to uint32 (Roberto Sassu's suggestion)

Signed-off-by: Mimi Zohar <>
Signed-off-by: Roberto Sassu <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoKEYS: ensure we free the assoc array edit if edit is valid
Colin Ian King [Mon, 27 Jul 2015 14:23:43 +0000 (15:23 +0100)]
KEYS: ensure we free the assoc array edit if edit is valid

commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream.

__key_link_end is not freeing the associated array edit structure
and this leads to a 512 byte memory leak each time an identical
existing key is added with add_key().

The reason the add_key() system call returns okay is that
key_create_or_update() calls __key_link_begin() before checking to see
whether it can update a key directly rather than adding/replacing - which
it turns out it can.  Thus __key_link() is not called through
__key_instantiate_and_link() and __key_link_end() must cancel the edit.


Signed-off-by: Colin Ian King <>
Signed-off-by: David Howells <>
Signed-off-by: James Morris <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agovTPM: set virtual device before passing to ibmvtpm_reset_crq
Hon Ching \\(Vicky\\) Lo [Fri, 22 May 2015 17:23:02 +0000 (13:23 -0400)]
vTPM: set virtual device before passing to ibmvtpm_reset_crq

commit 9d75f08946e8485109458ccf16f714697c207f41 upstream.

tpm_ibmvtpm_probe() calls ibmvtpm_reset_crq(ibmvtpm) without having yet
set the virtual device in the ibmvtpm structure. So in ibmvtpm_reset_crq,
the phype call contains empty unit addresses, ibmvtpm->vdev->unit_address.

Signed-off-by: Hon Ching(Vicky) Lo <>
Signed-off-by: Joy Latten <>
Reviewed-by: Ashley Lai <>
Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Signed-off-by: Peter Huewe <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoxfs: fix remote symlinks on V5/CRC filesystems
Eric Sandeen [Sun, 21 Jun 2015 23:42:48 +0000 (09:42 +1000)]
xfs: fix remote symlinks on V5/CRC filesystems

commit 2ac56d3d4bd625450a54d4c3f9292d58f6b88232 upstream.

If we create a CRC filesystem, mount it, and create a symlink with
a path long enough that it can't live in the inode, we get a very
strange result upon remount:

# ls -l mnt
total 4
lrwxrwxrwx. 1 root root 929 Jun 15 16:58 link -> XSLM

XSLM is the V5 symlink block header magic (which happens to be
followed by a NUL, so the string looks terminated).

xfs_readlink_bmap() advanced cur_chunk by the size of the header
for CRC filesystems, but never actually used that pointer; it
kept reading from bp->b_addr, which is the start of the block,
rather than the start of the symlink data after the header.

Looks like this problem goes back to v3.10.

Fixing this gets us reading the proper link target, again.

Signed-off-by: Eric Sandeen <>
Reviewed-by: Dave Chinner <>
Signed-off-by: Dave Chinner <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agodrm: add a check for x/y in drm_mode_setcrtc
Zhao Junwang [Tue, 7 Jul 2015 09:08:35 +0000 (17:08 +0800)]
drm: add a check for x/y in drm_mode_setcrtc

commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.

legacy setcrtc ioctl does take a 32 bit value which might indeed

the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't
needed any more with this

v2: -polish the annotation according to Daniel's comment

Cc: Daniel Vetter <>
Signed-off-by: Zhao Junwang <>
Signed-off-by: Daniel Vetter <>
Signed-off-by: Greg Kroah-Hartman <>