]> Gitweb @ Texas Instruments - Open Source Git Repositories - git.TI.com/gitweb - android-sdk/kernel-video.git/log
android-sdk/kernel-video.git
9 years agoiwlwifi: mvm: always use mac color zero
Luciano Coelho [Thu, 29 Jan 2015 10:48:20 +0000 (12:48 +0200)]
iwlwifi: mvm: always use mac color zero

commit 5523d11cc46393a1e61b7ef4a0b2d4e7ed9521e4 upstream.

We don't really need to use different mac colors when adding mac
contexts, because they're not used anywhere.  In fact, the firmware
doesn't accept 255 as a valid color, so we get into a SYSASSERT 0x3401
when we reach that.

Remove the color increment to use always zero and avoid reaching 255.

Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoiwlwifi: mvm: fix failure path when power_update fails in add_interface
Luciano Coelho [Tue, 27 Jan 2015 13:06:57 +0000 (15:06 +0200)]
iwlwifi: mvm: fix failure path when power_update fails in add_interface

commit fd66fc1cafd72ddf27dbec3a5e29e99839d1bc84 upstream.

When iwl_mvm_power_update_mac() is called, we have already added the
mac context, so if this call fails we should remove the mac.

Fixes: commit e5e7aa8e2561 ('iwlwifi: mvm: refactor power code')
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoiwlwifi: mvm: validate tid and sta_id in ba_notif
Eyal Shapira [Fri, 16 Jan 2015 09:09:30 +0000 (11:09 +0200)]
iwlwifi: mvm: validate tid and sta_id in ba_notif

commit 2cee4762c528a9bd2cdff793197bf591a2196c11 upstream.

These are coming from the FW and are used to access arrays.
Bad values can cause an out of bounds access so discard
such ba_notifs and warn.

Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoiwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN
Emmanuel Grumbach [Thu, 29 Jan 2015 19:34:00 +0000 (21:34 +0200)]
iwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN

commit cd8f438405032ac8ff88bd8f2eca5e0c0063b14b upstream.

The base address of the scheduler in the device's memory
(SRAM) comes from two different sources. The periphery
register and the alive notification from the firmware.
We have a check in iwl_pcie_tx_start that ensures that
they are the same.
When we resume from WoWLAN, the firmware may have crashed
for whatever reason. In that case, the whole device may be
reset which means that the periphery register will hold a
meaningless value. When we come to compare
trans_pcie->scd_base_addr (which really holds the value we
had when we loaded the WoWLAN firmware upon suspend) and
the current value of the register, we don't see a match
unsurprisingly.
Trick the check to avoid a loud yet harmless WARN.
Note that when the WoWLAN has crashed, we will see that
in iwl_trans_pcie_d3_resume which will let the op_mode
know. Once the op_mode is informed that the WowLAN firmware
has crashed, it can't do much besides resetting the whole
device.

Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agofsnotify: fix handling of renames in audit
Jan Kara [Tue, 10 Feb 2015 22:08:32 +0000 (14:08 -0800)]
fsnotify: fix handling of renames in audit

commit 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab upstream.

Commit e9fd702a58c4 ("audit: convert audit watches to use fsnotify
instead of inotify") broke handling of renames in audit.  Audit code
wants to update inode number of an inode corresponding to watched name
in a directory.  When something gets renamed into a directory to a
watched name, inotify previously passed moved inode to audit code
however new fsnotify code passes directory inode where the change
happened.  That confuses audit and it starts watching parent directory
instead of a file in a directory.

This can be observed for example by doing:

  cd /tmp
  touch foo bar
  auditctl -w /tmp/foo
  touch foo
  mv bar foo
  touch foo

In audit log we see events like:

  type=CONFIG_CHANGE msg=audit(1423563584.155:90): auid=1000 ses=2 op="updated rules" path="/tmp/foo" key=(null) list=4 res=1
  ...
  type=PATH msg=audit(1423563584.155:91): item=2 name="bar" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  type=PATH msg=audit(1423563584.155:91): item=3 name="foo" inode=1046842 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  type=PATH msg=audit(1423563584.155:91): item=4 name="foo" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
  ...

and that's it - we see event for the first touch after creating the
audit rule, we see events for rename but we don't see any event for the
last touch.  However we start seeing events for unrelated stuff
happening in /tmp.

Fix the problem by passing moved inode as data in the FS_MOVED_FROM and
FS_MOVED_TO events instead of the directory where the change happens.
This doesn't introduce any new problems because noone besides
audit_watch.c cares about the passed value:

  fs/notify/fanotify/fanotify.c cares only about FSNOTIFY_EVENT_PATH events.
  fs/notify/dnotify/dnotify.c doesn't care about passed 'data' value at all.
  fs/notify/inotify/inotify_fsnotify.c uses 'data' only for FSNOTIFY_EVENT_PATH.
  kernel/audit_tree.c doesn't care about passed 'data' at all.
  kernel/audit_watch.c expects moved inode as 'data'.

Fixes: e9fd702a58c49db ("audit: convert audit watches to use fsnotify instead of inotify")
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoxfs: set superblock buffer type correctly
Dave Chinner [Wed, 21 Jan 2015 22:30:23 +0000 (09:30 +1100)]
xfs: set superblock buffer type correctly

commit 3443a3bca54588f43286b725d8648d33a38c86f1 upstream.

When the superblock is modified in a transaction, the commonly
modified fields are not actually copied to the superblock buffer to
avoid the buffer lock becoming a serialisation point. However, there
are some other operations that modify the superblock fields within
the transaction that don't directly log to the superblock but rely
on the changes to be applied during the transaction commit (to
minimise the buffer lock hold time).

When we do this, we fail to mark the buffer log item as being a
superblock buffer and that can lead to the buffer not being marked
with the corect type in the log and hence causing recovery issues.
Fix it by setting the type correctly, similar to xfs_mod_sb()...

Tested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoxfs: inode unlink does not set AGI buffer type
Dave Chinner [Wed, 21 Jan 2015 22:29:40 +0000 (09:29 +1100)]
xfs: inode unlink does not set AGI buffer type

commit f19b872b086711bb4b22c3a0f52f16aa920bcc61 upstream.

This leads to log recovery throwing errors like:

XFS (md0): Mounting V5 Filesystem
XFS (md0): Starting recovery (logdev: internal)
XFS (md0): Unknown buffer type 0!
XFS (md0): _xfs_buf_ioapply: no ops on block 0xaea8802/0x1
ffff8800ffc53800: 58 41 47 49 .....

Which is the AGI buffer magic number.

Ensure that we set the type appropriately in both unlink list
addition and removal.

Tested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoxfs: ensure buffer types are set correctly
Dave Chinner [Wed, 21 Jan 2015 22:29:05 +0000 (09:29 +1100)]
xfs: ensure buffer types are set correctly

commit 0d612fb570b71ea2e49554a770cff4c489018b2c upstream.

Jan Kara reported that log recovery was finding buffers with invalid
types in them. This should not happen, and indicates a bug in the
logging of buffers. To catch this, add asserts to the buffer
formatting code to ensure that the buffer type is in range when the
transaction is committed.

We don't set a type on buffers being marked stale - they are not
going to get replayed, the format item exists only for recovery to
be able to prevent replay of the buffer, so the type does not
matter. Hence that needs special casing here.

Reported-by: Jan Kara <jack@suse.cz>
Tested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoBluetooth: ath3k: workaround the compatibility issue with xHCI controller
Adam Lee [Wed, 28 Jan 2015 20:30:27 +0000 (15:30 -0500)]
Bluetooth: ath3k: workaround the compatibility issue with xHCI controller

commit c561a5753dd631920c4459a067d22679b3d110d6 upstream.

BugLink: https://bugs.launchpad.net/bugs/1400215
ath3k devices fail to load firmwares on xHCI buses, but work well on
EHCI, this might be a compatibility issue between xHCI and ath3k chips.
As my testing result, those chips will work on xHCI buses again with
this patch.

This workaround is from Qualcomm, they also did some workarounds in
Windows driver.

Signed-off-by: Adam Lee <adam.lee@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Fri, 6 Mar 2015 09:20:34 +0000 (03:20 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: am57xx-evm/beagle-x15: remove cpsw, mdio, usb and mmc sleep pinmux

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: dts: am57xx-evm/beagle-x15: remove cpsw, mdio, usb and mmc sleep pinmux
Sekhar Nori [Wed, 4 Mar 2015 16:00:44 +0000 (21:30 +0530)]
ARM: dts: am57xx-evm/beagle-x15: remove cpsw, mdio, usb and mmc sleep pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for cpsw, mdio, usb and mmc
IO power-optimized sleep state.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Dan Murphy [Thu, 5 Mar 2015 19:41:50 +0000 (13:41 -0600)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  drm/omap: fix stride vs pixel size check
  OMAPDSS: DISPC: fix predecimation for YUV modes
  ARM: dts: dra7-evm: remove HDMI HPD pinmux
  ARM: dts: dra7-evm: remove vout1 pinmux
  drm/omap: add manager properties

Conflicts:
arch/arm/boot/dts/dra7-evm.dts

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Dan Murphy [Thu, 5 Mar 2015 18:41:20 +0000 (12:41 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: dts: am57xx-evm: Remove gpio keys pinmux
  ARM: dts: BeagleBoard-x15: Remove pinmux
  ARM: dts: BeagleBoard-x15: Add missing regulators

Conflicts:
arch/arm/boot/dts/am57xx-beagle-x15.dts
arch/arm/boot/dts/am57xx-evm.dts

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agodrm/omap: fix stride vs pixel size check
Tomi Valkeinen [Mon, 2 Mar 2015 10:37:16 +0000 (12:37 +0200)]
drm/omap: fix stride vs pixel size check

Commit 9ac71bece8679d62734600d9012550b01d2ced46 ("drm/omap: handle
mismatching color format and buffer width") added a check for
incompatible buffer stride and pixel size, but that check is not
correct.

Instead of checking if the buffer byte stride is an integer number of
bytes-per-pixel, it checks if the buffer pixel width is an integer
number of bytes-per-pixel. Which doesn't make any sense, but
accidentally happened to fix the issue we were seeing.

So fix the check.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoOMAPDSS: DISPC: fix predecimation for YUV modes
Tomi Valkeinen [Fri, 27 Feb 2015 11:07:58 +0000 (13:07 +0200)]
OMAPDSS: DISPC: fix predecimation for YUV modes

DISPC needs even input buffer width for YUV modes. The DISPC driver
doesn't check this at the moment (although omapdrm does), but worse,
when DISPC driver does x predecimation the result may be uneven. This
causes sometimes sync losts, underflows, or just visual errors.

This patch makes DISPC driver return an error if the user gives uneven
input width for a YUV buffer. It also makes the input width even in case
of predecimation.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoARM: dts: dra7-evm: remove HDMI HPD pinmux
Tomi Valkeinen [Tue, 3 Mar 2015 15:20:05 +0000 (17:20 +0200)]
ARM: dts: dra7-evm: remove HDMI HPD pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for HDMI HPD pin.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoARM: dts: dra7-evm: remove vout1 pinmux
Tomi Valkeinen [Tue, 3 Mar 2015 15:20:04 +0000 (17:20 +0200)]
ARM: dts: dra7-evm: remove vout1 pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for vout1.

DRA7 EVM and DRA72 EVM share some LCD .dts files, and pinmuxing was
defined in a shared file, so we need to add pinmuxing to DRA72 specific
.dts files.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agodrm/omap: add manager properties
Tomi Valkeinen [Tue, 3 Mar 2015 10:45:08 +0000 (12:45 +0200)]
drm/omap: add manager properties

Add DRM properties for overlay manager features:
* transparency key
* background color
* partial alpha

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Dan Murphy [Thu, 5 Mar 2015 16:18:30 +0000 (10:18 -0600)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  OMAPDSS ASoC: omap-hdmi-audio: Forbid audio playback if display is off

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Dan Murphy [Thu, 5 Mar 2015 15:24:53 +0000 (09:24 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  pinctrl: am43xx: dt-bindings: fix SLEWCTRL_FAST binding
  pinctrl: am33xx: dt-bindings: fix SLEWCTRL_FAST binding

Conflicts:
include/dt-bindings/pinctrl/am43xx.h

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoARM: dts: am57xx-evm: Remove gpio keys pinmux
Lokesh Vutla [Thu, 5 Mar 2015 09:43:28 +0000 (15:13 +0530)]
ARM: dts: am57xx-evm: Remove gpio keys pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes gpio keys pinmux nodes for
am57xx-evm.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoARM: dts: BeagleBoard-x15: Remove pinmux
Lokesh Vutla [Thu, 5 Mar 2015 09:39:52 +0000 (15:09 +0530)]
ARM: dts: BeagleBoard-x15: Remove pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes all the pinmux nodes from
am57xx-beagle-x15.dts

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoARM: dts: BeagleBoard-x15: Add missing regulators
Lokesh Vutla [Mon, 2 Mar 2015 05:30:45 +0000 (11:00 +0530)]
ARM: dts: BeagleBoard-x15: Add missing regulators

regen2 is used for PMIC internal resource.
Adding DT node for regen2 regulator.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Thu, 5 Mar 2015 14:21:25 +0000 (08:21 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoOMAPDSS ASoC: omap-hdmi-audio: Forbid audio playback if display is off
Jyri Sarha [Wed, 4 Mar 2015 10:06:26 +0000 (12:06 +0200)]
OMAPDSS ASoC: omap-hdmi-audio: Forbid audio playback if display is off

Abort any ongoing audio playback if display is turned off and do not
allow new audio streams until the display is turned on again. This is
the way the mainline implementation works.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux
Sekhar Nori [Wed, 4 Mar 2015 16:00:44 +0000 (21:30 +0530)]
ARM: dts: dra7-evm: remove cpsw, mdio, nand and tsc pinmux

MLO now does the pinmuxing, and we need to remove pinmuxing from the
.dts files. This patch removes pinmuxing for cpsw, mdio, nand and tsc.

Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Texas Instruments Auto Merger [Thu, 5 Mar 2015 10:21:19 +0000 (04:21 -0600)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  ti_fragments: audio_display: Enabled MT9T11x sensor driver

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoti_fragments: audio_display: Enabled MT9T11x sensor driver
Benoit Parrot [Wed, 4 Mar 2015 16:28:10 +0000 (10:28 -0600)]
ti_fragments: audio_display: Enabled MT9T11x sensor driver

Enable MT9T11x sensor driver.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agopinctrl: am43xx: dt-bindings: fix SLEWCTRL_FAST binding
Dave Gerlach [Thu, 5 Mar 2015 06:00:44 +0000 (11:30 +0530)]
pinctrl: am43xx: dt-bindings: fix SLEWCTRL_FAST binding

According to AM437x TRM, Document SPRUHL7B, Revised December 2014,
Section 7.2.1 Pad Control Registers, setting bit 19 of the pad control
registers actually sets the SLEWCTRL value to slow rather than fast as
the current macro indicates. Introduce a new macro, SLEWCTRL_SLOW, that
sets the bit, and modify SLEWCTRL_FAST to 0 but keep it for
completeness.

Current users of the macro (i2c, mdio, and uart) are left unmodified as
SLEWCTRL_FAST was the macro used and actual desired state. Tested on
am437x-gp-evm with no difference in software performance seen.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
9 years agopinctrl: am33xx: dt-bindings: fix SLEWCTRL_FAST binding
Dave Gerlach [Thu, 26 Feb 2015 17:47:53 +0000 (11:47 -0600)]
pinctrl: am33xx: dt-bindings: fix SLEWCTRL_FAST binding

According to AM335x TRM, Document spruh73l, Revised February 2015,
Section 9.2.2 Pad Control Registers, setting bit 6 of the pad control
registers actually sets the SLEWCTRL value to slow rather than fast as
the current macro indicates. Introduce a new macro, SLEWCTRL_SLOW, that
sets the bit, and modify SLEWCTRL_FAST to 0 but keep it for
completeness.

Current users of the macro (i2c and mdio) are left unmodified as
SLEWCTRL_FAST was the macro used and actual desired state. Tested on
am335x-gp-evm with no difference in software performance seen.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
9 years agoMerge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux...
Dan Murphy [Wed, 4 Mar 2015 14:57:28 +0000 (08:57 -0600)]
Merge branch 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree into ti-linux-3.14.y

TI-Feature: audio-display
TI-Tree: git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree.git
TI-Branch: audio-display-ti-linux-3.14.y

* 'audio-display-ti-linux-3.14.y' of git://git.ti.com/~darrene/ti-linux-kernel/audio-display-linux-feature-tree:
  media: ti-vpe: vip: Don't fail if pinctrl resource is not found
  media: ti-vpe: vip: Wrong line stride generated wrongly reported bytesperline
  media: ti-vpe: vip: Fix s_fmt behavior
  media: ti-vpe: vip: Fix g_fmt behavior
  media: ti-vpe: vip: Make sure v4l2_ctrl are passed on to subdev
  media: ti-vpe: vip: Fix a kernel WARN when aborting a stream
  media: ti-vpe: vip: propagate s_stream signal to sub-device
  media: ti-vpe: vip: Fix bug in format handling
  ARM: dts: am57xx-evm: Add VIP and MT9T111 required nodes
  media: v4l: add mt9t11x to Kconfig and Makefile
  media: i2c: Document mt9t11x sensor driver bindings
  media: sensor: Create an i2c mt9t11x driver

Conflicts:
arch/arm/boot/dts/am57xx-evm.dts

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Dan Murphy [Wed, 4 Mar 2015 14:14:37 +0000 (08:14 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: DRA7-evm: Remove pin mux

Conflicts:
arch/arm/boot/dts/dra7-evm.dts

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agomedia: ti-vpe: vip: Don't fail if pinctrl resource is not found
Benoit Parrot [Wed, 4 Mar 2015 00:43:35 +0000 (18:43 -0600)]
media: ti-vpe: vip: Don't fail if pinctrl resource is not found

When pinctrl resources are not found just warn and continue
instead of exiting.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Wrong line stride generated wrongly reported bytesperline
Benoit Parrot [Mon, 2 Mar 2015 23:52:08 +0000 (17:52 -0600)]
media: ti-vpe: vip: Wrong line stride generated wrongly reported bytesperline

The bytesperline property gets wrongly reported due to
an incorrect stride alignment being used.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Fix s_fmt behavior
Benoit Parrot [Mon, 2 Mar 2015 23:52:07 +0000 (17:52 -0600)]
media: ti-vpe: vip: Fix s_fmt behavior

Currently s_fmt is setup to configure the H/W params and the VIP parser
when invoked. This assumes that s_fmt is always called before s_stream.
Although most user application do always call s_fmt before s_stream,
it is not always the case, g-streamer is an example, where if it
finds that reported format g_fmt is acceptable it will happily start
a capture stream.

So here we make sure that the H/W params and the VIP parser are configured
when streaming starts instead.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Fix g_fmt behavior
Benoit Parrot [Mon, 2 Mar 2015 23:52:06 +0000 (17:52 -0600)]
media: ti-vpe: vip: Fix g_fmt behavior

When g_fmt is invoked the first time the current format may not match
the subdevice reported format. Here we make sure that the reported
format is consistent.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Make sure v4l2_ctrl are passed on to subdev
Benoit Parrot [Mon, 2 Mar 2015 23:52:05 +0000 (17:52 -0600)]
media: ti-vpe: vip: Make sure v4l2_ctrl are passed on to subdev

Make sure subdevice v4l2 controls are properly handled.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Fix a kernel WARN when aborting a stream
Benoit Parrot [Mon, 2 Mar 2015 23:52:04 +0000 (17:52 -0600)]
media: ti-vpe: vip: Fix a kernel WARN when aborting a stream

On occasion a kernel WARN was seen when aborting a streaming session.
Fix make sure pending buffer is unmapped before operating on it.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: propagate s_stream signal to sub-device
Benoit Parrot [Mon, 2 Mar 2015 23:52:03 +0000 (17:52 -0600)]
media: ti-vpe: vip: propagate s_stream signal to sub-device

Make sure the s_stream signal is propagated to the sub-device
in the stop/start_streaming call.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: ti-vpe: vip: Fix bug in format handling
Benoit Parrot [Mon, 2 Mar 2015 23:52:02 +0000 (17:52 -0600)]
media: ti-vpe: vip: Fix bug in format handling

Internal vip_format table entries were getting overwritten
when vip_g_fmt_vid_cap and vip_video_pix_to_mbus.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoARM: dts: am57xx-evm: Add VIP and MT9T111 required nodes
Benoit Parrot [Wed, 25 Feb 2015 20:46:34 +0000 (14:46 -0600)]
ARM: dts: am57xx-evm: Add VIP and MT9T111 required nodes

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: v4l: add mt9t11x to Kconfig and Makefile
Benoit Parrot [Wed, 25 Feb 2015 20:46:33 +0000 (14:46 -0600)]
media: v4l: add mt9t11x to Kconfig and Makefile

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: i2c: Document mt9t11x sensor driver bindings
Benoit Parrot [Wed, 25 Feb 2015 20:46:32 +0000 (14:46 -0600)]
media: i2c: Document mt9t11x sensor driver bindings

Add mt9t11x sensor driver idocumentation to DT bindings.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agomedia: sensor: Create an i2c mt9t11x driver
Benoit Parrot [Wed, 25 Feb 2015 20:46:31 +0000 (14:46 -0600)]
media: sensor: Create an i2c mt9t11x driver

Create a Video4Linux2 i2c sub device sensor driver for Aptina/Micron MT9T11x
sensor by using the existing soc_camera/mt9t112.c as a starting point.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Wed, 4 Mar 2015 07:21:33 +0000 (01:21 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: dra7x-evm: avoid possible contention while muxing on CAN lines

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: dts: dra7x-evm: avoid possible contention while muxing on CAN lines
Roger Quadros [Mon, 2 Mar 2015 15:45:57 +0000 (17:45 +0200)]
ARM: dts: dra7x-evm: avoid possible contention while muxing on CAN lines

DCAN1_RX line is internally pulled high and idle state
of DCAN1_TX is high. While muxing between DCAN mode
and SAFE mode we make sure the same pull direction is
set to minimize opposite pull contention during the
switching window.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Tue, 3 Mar 2015 13:21:35 +0000 (07:21 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  arm: dts: TI bluetooth: switch to 8250_omap serial device
  ti_config_fragments/connectivity.cfg: switch to 8250_omap driver
  tty: serial: 8250: omap: fix kernel crash in suspend-to-ram

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoarm: dts: TI bluetooth: switch to 8250_omap serial device
Sekhar Nori [Wed, 25 Feb 2015 12:33:47 +0000 (18:03 +0530)]
arm: dts: TI bluetooth: switch to 8250_omap serial device

Switch to 8250_omap driver as underlying serial transport for
TI bluetooth interfaced on TI EVMs.

Tested with Bluetooth on DRA74x EVM. Compile tested on others.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoti_config_fragments/connectivity.cfg: switch to 8250_omap driver
Sekhar Nori [Wed, 25 Feb 2015 12:33:46 +0000 (18:03 +0530)]
ti_config_fragments/connectivity.cfg: switch to 8250_omap driver

Switch to newer 8250_omap driver supporting DMA.

Boot tested on AM335x, AM437x, DRA74x, DRA72x, AM57x EVMs.

Tested wake from DeepSleep on AM437x EVM.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agotty: serial: 8250: omap: fix kernel crash in suspend-to-ram
Sekhar Nori [Thu, 26 Feb 2015 15:48:17 +0000 (21:18 +0530)]
tty: serial: 8250: omap: fix kernel crash in suspend-to-ram

omap_device infrastructure has a suspend_noirq hook which
runtime suspends all devices late in the suspend cycle.

This leads to a NULL pointer exception in 8250_omap driver
since by that time 8250_dma has already suspended and rxchan
is set to NULL.

Make an explicit check to see if rxchan is NULL in
runtime_{suspend|resume} hooks to fix this.

Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoARM: DRA7-evm: Remove pin mux
Lokesh Vutla [Wed, 25 Feb 2015 12:37:25 +0000 (18:07 +0530)]
ARM: DRA7-evm: Remove pin mux

As part of IODELAY recalibration sequence all the pin mux
configuration needs to be done as part of MLO. So remove pinmux
definitions in DT.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Dan Murphy [Mon, 2 Mar 2015 14:45:28 +0000 (08:45 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: am57xx-beagle-x15: Add regulator information to USB2 PHYs
  ARM: dts: dra72-evm: Add regulator information to USB2 PHYs
  ARM: dts: dra7-evm: Add regulator information to USB2 PHYs
  phy: core: Support regulator supply for PHY power
  ARM: dts: am57xx-beagle-x15: Add pinmux configuration for MMC1 and MMC2
  ARM: dts: dra7-evm: Add pinmux configuration for MMC1 and MMC2
  ARM: dts: DRA7: use the new compatible string added for dra7 and dra72
  mmc: host: omap_hsmmc: Set appropriate IODELAY values for various MMC modes
  input: ti_am335x_tsc: Ignore previous pen down event when pen up event occurs
  ARM: dts: DRA7: add DT entries for PWMSS
  PWM: Kconfig: Enable PWM on DRA7

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoARM: dts: am57xx-beagle-x15: Add regulator information to USB2 PHYs
Roger Quadros [Mon, 2 Mar 2015 12:53:12 +0000 (14:53 +0200)]
ARM: dts: am57xx-beagle-x15: Add regulator information to USB2 PHYs

The ldousb_reg regulator provides power to the USB1 and USB2
High Speed PHYs.

Signed-off-by: Roger Quadros <rogerq@ti.com>
9 years agoARM: dts: dra72-evm: Add regulator information to USB2 PHYs
Roger Quadros [Mon, 2 Mar 2015 12:53:11 +0000 (14:53 +0200)]
ARM: dts: dra72-evm: Add regulator information to USB2 PHYs

[ upstream commit 7a15c8e74737283e9c195742074812aeaea08eaa ]

The ldo4_reg regulator provides power to the USB1 and USB2
High Speed PHYs.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Conflicts:
arch/arm/boot/dts/dra72-evm.dts

9 years agoARM: dts: dra7-evm: Add regulator information to USB2 PHYs
Roger Quadros [Mon, 2 Mar 2015 12:53:10 +0000 (14:53 +0200)]
ARM: dts: dra7-evm: Add regulator information to USB2 PHYs

[ upstream commit ae28ea88a38decac2a0dc1abc23936e59a08b6f3 ]

The ldousb_reg regulator provides power to the USB1 and USB2
High Speed PHYs.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Conflicts:
arch/arm/boot/dts/dra7-evm.dts

9 years agophy: core: Support regulator supply for PHY power
Roger Quadros [Mon, 2 Mar 2015 12:53:09 +0000 (14:53 +0200)]
phy: core: Support regulator supply for PHY power

[ upstream commit 3be88125d85df587085b0be0a5c0e9953eb5ed6b ]

Some PHYs can be powered by an external power regulator.
e.g. USB_HS PHY on DRA7 SoC. Make the PHY core support a
power regulator.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
9 years agoARM: dts: am57xx-beagle-x15: Add pinmux configuration for MMC1 and MMC2
Kishon Vijay Abraham I [Mon, 2 Feb 2015 08:43:16 +0000 (14:13 +0530)]
ARM: dts: am57xx-beagle-x15: Add pinmux configuration for MMC1 and MMC2

Added pinmux configuration for MMC1 and MMC2 including the IODELAY values
suggested in the data manual for the various modes. (Current revision
of DRA7 supports only HS mode for both MMC1 and MMC2).

Reference: DRA75x TRM revision W (18.6.2 IODELAYCONFIG Registers)
DRA75x Data Manual Revision M (Table 7-116. Virtual Functions Mapping
for MMC1 - Column MMC1_VIRTUAL1; Table 7-127. Manual Functions Mapping for
MMC2 HS - Column MMC_HS_DS_LB_MANUAL1).

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
9 years agoARM: dts: dra7-evm: Add pinmux configuration for MMC1 and MMC2
Kishon Vijay Abraham I [Sat, 31 Jan 2015 15:06:56 +0000 (20:36 +0530)]
ARM: dts: dra7-evm: Add pinmux configuration for MMC1 and MMC2

Added pinmux configuration for MMC1 and MMC2 including the IODELAY values
suggested in the data manual for the various modes. (Current revision
of DRA7 supports only HS mode for both MMC1 and MMC2).

Reference: DRA75x TRM revision W (18.6.2 IODELAYCONFIG Registers)
DRA75x Data Manual Revision M (Table 7-116. Virtual Functions Mapping
for MMC1 - Column MMC1_VIRTUAL1; Table 7-127. Manual Functions Mapping for
MMC2 HS - Column MMC_HS_DS_LB_MANUAL1).

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
9 years agoARM: dts: DRA7: use the new compatible string added for dra7 and dra72
Kishon Vijay Abraham I [Thu, 26 Feb 2015 11:13:16 +0000 (16:43 +0530)]
ARM: dts: DRA7: use the new compatible string added for dra7 and dra72

Used the new compatible string "ti,dra7-hsmmc" that was specifically
added for dra7 and dra72. This is required since for dra7 and dra72
processors iodelay values has to be set unlike other processors.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Texas Instruments Auto Merger [Mon, 2 Mar 2015 05:20:22 +0000 (23:20 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: dts: dra7-evm: Keep all VDD rails always-on
  ARM: DRA7-evm: Add missing regulators

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: dts: dra7-evm: Keep all VDD rails always-on
Nishanth Menon [Fri, 27 Feb 2015 05:32:56 +0000 (11:02 +0530)]
ARM: dts: dra7-evm: Keep all VDD rails always-on

[ upstream commit 395b23ca57b46e79d7956ce1d5a9381dc6fe0e3a ]

DRA7 Data Manual (SPRS857L - August 2014) section 4.1.1 states: "All
unused power supply balls must be supplied with the voltages specified
in the Section 5.2, Recommended Operating Conditions".

This implies that all unused voltage rails for Vayu can never be
switched off even if the hardware blocks inside that voltage domain is
unused. Switching off these unused rails may result in stability issues
on other domains and increased leakage and power-on-hour impacts.

J6eco-evm dts file already considers this, however j6evm-dts file needs
to be fixed to consider this constraint of the SoC.

Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoARM: DRA7-evm: Add missing regulators
Nishanth Menon [Mon, 2 Mar 2015 04:46:15 +0000 (10:16 +0530)]
ARM: DRA7-evm: Add missing regulators

Few regulators information were missing from DT. Add those
missing regulators.

Note that this might cause probe order to change and potentially
root device such as mmcblk0 might change it's order.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Texas Instruments Auto Merger [Fri, 27 Feb 2015 15:20:35 +0000 (09:20 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: dts: am43xx-clocks: Fix ehrpwm tbclk data on am43xx
  ARM: dts: am33xx-clocks: Fix ehrpwm tbclk data on am33xx

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: dts: am43xx-clocks: Fix ehrpwm tbclk data on am43xx
Vignesh R [Tue, 10 Feb 2015 05:35:42 +0000 (11:05 +0530)]
ARM: dts: am43xx-clocks: Fix ehrpwm tbclk data on am43xx

ehrpwm tbclk is wrongly modelled as deriving from dpll_per_m2_ck.
The TRM says tbclk is derived from SYSCLKOUT. SYSCLKOUT nothing but the
functional clock of pwmss (l4ls_gclk).
Fix this by changing source of ehrpwmx_tbclk to l4ls_gclk.

Fixes: 4da1c67719f61 ("add tbclk data for ehrpwm")
Signed-off-by: Vignesh R <vigneshr@ti.com>
9 years agoARM: dts: am33xx-clocks: Fix ehrpwm tbclk data on am33xx
Vignesh R [Tue, 10 Feb 2015 05:35:41 +0000 (11:05 +0530)]
ARM: dts: am33xx-clocks: Fix ehrpwm tbclk data on am33xx

ehrpwm tbclk is wrongly modelled as deriving from dpll_per_m2_ck.
The TRM says tbclk is derived from SYSCLKOUT. SYSCLKOUT nothing but the
functional clock of pwmss (l4ls_gclk).
Fix this by changing source of ehrpwmx_tbclk to l4ls_gclk.

Fixes: 9e100ebafb91: ("Fix ehrpwm tbclk data")
Signed-off-by: Vignesh R <vigneshr@ti.com>
9 years agoMerge branch 'pm-ti-linux-3.14.y' of git://git.ti.com/~kristo/ti-linux-kernel/pm...
Texas Instruments Auto Merger [Fri, 27 Feb 2015 10:20:44 +0000 (04:20 -0600)]
Merge branch 'pm-ti-linux-3.14.y' of git://git.ti.com/~kristo/ti-linux-kernel/pm-linux-feature-tree into ti-linux-3.14.y

TI-Feature: power_management_base
TI-Tree: git://git.ti.com/~kristo/ti-linux-kernel/pm-linux-feature-tree.git
TI-Branch: pm-ti-linux-3.14.y

* 'pm-ti-linux-3.14.y' of git://git.ti.com/~kristo/ti-linux-kernel/pm-linux-feature-tree:
  hwmon: (tmp102) add hibernation callbacks

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agohwmon: (tmp102) add hibernation callbacks
Grygorii Strashko [Tue, 3 Feb 2015 15:01:58 +0000 (17:01 +0200)]
hwmon: (tmp102) add hibernation callbacks

[ Upstream commit dd378b1bcaa0ef5b14cca1e52b58ef9a3279fd8b ]

Setting a dev_pm_ops suspend/resume pair but not a set of
hibernation functions means those pm functions will not be
called upon hibernation.
Fix this by using SIMPLE_DEV_PM_OPS, which appropriately
assigns the suspend and hibernation handlers and move
mp102_suspend/tmp102_resume under CONFIG_PM_SLEEP to avoid
build warnings.

Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
[groeck: Declare tmp102_dev_pm_ops as static variable]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
9 years agommc: host: omap_hsmmc: Set appropriate IODELAY values for various MMC modes
Kishon Vijay Abraham I [Sat, 31 Jan 2015 14:44:55 +0000 (20:14 +0530)]
mmc: host: omap_hsmmc: Set appropriate IODELAY values for various MMC modes

The data manual of J6/J6 Eco recommends to set different IODELAY values
depending on the mode in which the MMC/SD is enumerated in order to
ensure IO timings are met.

Added support to set the IODELAY values depending on the various MMC
modes using the pinctrl APIs.

The platforms that require IODELAY values to be set should add
"ti,require_iodelay" property in its dt data.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Texas Instruments Auto Merger [Fri, 27 Feb 2015 06:22:14 +0000 (00:22 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: OMAP2+: hwmod: fix deassert hardreset clkdm usecounting

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: OMAP2+: hwmod: fix deassert hardreset clkdm usecounting
Tero Kristo [Thu, 26 Feb 2015 15:22:42 +0000 (17:22 +0200)]
ARM: OMAP2+: hwmod: fix deassert hardreset clkdm usecounting

Deasserting hardreset increases the usecount for the hwmod parent clockdomain
always, however usecount is only decreased at end in certain error cases.
This causes clockdomains to remain always on, preventing idle. Fixed by
always releasing the hwmods clockdomain parent when exiting the function.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Tested-by: Carlos Hernandez <ceh@ti.com>
Cc: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoMerge tag 'v3.14.34' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
Texas Instruments Auto Merger [Fri, 27 Feb 2015 02:12:38 +0000 (20:12 -0600)]
Merge tag 'v3.14.34' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into ti-linux-3.14.y

This is the 3.14.34 stable release

* tag 'v3.14.34' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable:
  Linux 3.14.34
  media/rc: Send sync space information on the lirc device
  net: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param
  ppp: deflate: never return len larger than output buffer
  ipv4: tcp: get rid of ugly unicast_sock
  tcp: ipv4: initialize unicast_sock sk_pacing_rate
  bridge: dont send notification when skb->len == 0 in rtnl_bridge_notify
  net: don't OOPS on socket aio
  bnx2x: fix napi poll return value for repoll
  ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
  ping: Fix race in free in receive path
  udp_diag: Fix socket skipping within chain
  ipv4: try to cache dst_entries which would cause a redirect
  net: sctp: fix slab corruption from use after free on INIT collisions
  netxen: fix netxen_nic_poll() logic
  ipv6: stop sending PTB packets for MTU < 1280
  net: rps: fix cpu unplug
  ip: zero sockaddr returned on error queue

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoLinux 3.14.34
Greg Kroah-Hartman [Fri, 27 Feb 2015 01:50:27 +0000 (17:50 -0800)]
Linux 3.14.34

9 years agomedia/rc: Send sync space information on the lirc device
Austin Lund [Thu, 24 Jul 2014 10:40:20 +0000 (07:40 -0300)]
media/rc: Send sync space information on the lirc device

commit a8f29e89f2b54fbf2c52be341f149bc195b63a8b upstream.

Userspace expects to see a long space before the first pulse is sent on
the lirc device.  Currently, if a long time has passed and a new packet
is started, the lirc codec just returns and doesn't send anything.  This
makes lircd ignore many perfectly valid signals unless they are sent in
quick sucession.  When a reset event is delivered, we cannot know
anything about the duration of the space.  But it should be safe to
assume it has been a long time and we just set the duration to maximum.

Signed-off-by: Austin Lund <austin.lund@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agonet: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param
Saran Maruti Ramanara [Thu, 29 Jan 2015 10:05:58 +0000 (11:05 +0100)]
net: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param

[ Upstream commit cfbf654efc6d78dc9812e030673b86f235bf677d ]

When making use of RFC5061, section 4.2.4. for setting the primary IP
address, we're passing a wrong parameter header to param_type2af(),
resulting always in NULL being returned.

At this point, param.p points to a sctp_addip_param struct, containing
a sctp_paramhdr (type = 0xc004, length = var), and crr_id as a correlation
id. Followed by that, as also presented in RFC5061 section 4.2.4., comes
the actual sctp_addr_param, which also contains a sctp_paramhdr, but
this time with the correct type SCTP_PARAM_IPV{4,6}_ADDRESS that
param_type2af() can make use of. Since we already hold a pointer to
addr_param from previous line, just reuse it for param_type2af().

Fixes: d6de3097592b ("[SCTP]: Add the handling of "Set Primary IP Address" parameter to INIT")
Signed-off-by: Saran Maruti Ramanara <saran.neti@telus.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoppp: deflate: never return len larger than output buffer
Florian Westphal [Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)]
ppp: deflate: never return len larger than output buffer

[ Upstream commit e2a4800e75780ccf4e6c2487f82b688ba736eb18 ]

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoipv4: tcp: get rid of ugly unicast_sock
Eric Dumazet [Fri, 30 Jan 2015 05:35:05 +0000 (21:35 -0800)]
ipv4: tcp: get rid of ugly unicast_sock

[ Upstream commit bdbbb8527b6f6a358dbcb70dac247034d665b8e4 ]

In commit be9f4a44e7d41 ("ipv4: tcp: remove per net tcp_sock")
I tried to address contention on a socket lock, but the solution
I chose was horrible :

commit 3a7c384ffd57e ("ipv4: tcp: unicast_sock should not land outside
of TCP stack") addressed a selinux regression.

commit 0980e56e506b ("ipv4: tcp: set unicast_sock uc_ttl to -1")
took care of another regression.

commit b5ec8eeac46 ("ipv4: fix ip_send_skb()") fixed another regression.

commit 811230cd85 ("tcp: ipv4: initialize unicast_sock sk_pacing_rate")
was another shot in the dark.

Really, just use a proper socket per cpu, and remove the skb_orphan()
call, to re-enable flow control.

This solves a serious problem with FQ packet scheduler when used in
hostile environments, as we do not want to allocate a flow structure
for every RST packet sent in response to a spoofed packet.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agotcp: ipv4: initialize unicast_sock sk_pacing_rate
Eric Dumazet [Wed, 28 Jan 2015 13:47:11 +0000 (05:47 -0800)]
tcp: ipv4: initialize unicast_sock sk_pacing_rate

[ Upstream commit 811230cd853d62f09ed0addd0ce9a1b9b0e13fb5 ]

When I added sk_pacing_rate field, I forgot to initialize its value
in the per cpu unicast_sock used in ip_send_unicast_reply()

This means that for sch_fq users, RST packets, or ACK packets sent
on behalf of TIME_WAIT sockets might be sent to slowly or even dropped
once we reach the per flow limit.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 95bd09eb2750 ("tcp: TSO packets automatic sizing")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agobridge: dont send notification when skb->len == 0 in rtnl_bridge_notify
Roopa Prabhu [Thu, 29 Jan 2015 00:23:11 +0000 (16:23 -0800)]
bridge: dont send notification when skb->len == 0 in rtnl_bridge_notify

[ Upstream commit 59ccaaaa49b5b096cdc1f16706a9f931416b2332 ]

Reported in: https://bugzilla.kernel.org/show_bug.cgi?id=92081

This patch avoids calling rtnl_notify if the device ndo_bridge_getlink
handler does not return any bytes in the skb.

Alternately, the skb->len check can be moved inside rtnl_notify.

For the bridge vlan case described in 92081, there is also a fix needed
in bridge driver to generate a proper notification. Will fix that in
subsequent patch.

v2: rebase patch on net tree

Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agonet: don't OOPS on socket aio
Christoph Hellwig [Tue, 27 Jan 2015 20:25:33 +0000 (12:25 -0800)]
net: don't OOPS on socket aio

[ Upstream commit 06539d3071067ff146a9bffd1c801fa56d290909 ]

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agobnx2x: fix napi poll return value for repoll
Govindarajulu Varadarajan [Sun, 25 Jan 2015 10:39:23 +0000 (16:09 +0530)]
bnx2x: fix napi poll return value for repoll

[ Upstream commit 24e579c8898aa641ede3149234906982290934e5 ]

With the commit d75b1ade567ffab ("net: less interrupt masking in NAPI") napi
repoll is done only when work_done == budget. When in busy_poll is we return 0
in napi_poll. We should return budget.

Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
Hannes Frederic Sowa [Mon, 26 Jan 2015 14:11:17 +0000 (15:11 +0100)]
ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too

[ Upstream commit 6e9e16e6143b725662e47026a1d0f270721cdd24 ]

Lubomir Rintel reported that during replacing a route the interface
reference counter isn't correctly decremented.

To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
| [root@rhel7-5 lkundrak]# sh -x lal
| + ip link add dev0 type dummy
| + ip link set dev0 up
| + ip link add dev1 type dummy
| + ip link set dev1 up
| + ip addr add 2001:db8:8086::2/64 dev dev0
| + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
| + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
| + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
| + ip link del dev0 type dummy
| Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
|  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
|
| Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
|  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2

During replacement of a rt6_info we must walk all parent nodes and check
if the to be replaced rt6_info got propagated. If so, replace it with
an alive one.

Fixes: 4a287eba2de3957 ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag")
Reported-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Tested-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoping: Fix race in free in receive path
subashab@codeaurora.org [Fri, 23 Jan 2015 22:26:02 +0000 (22:26 +0000)]
ping: Fix race in free in receive path

[ Upstream commit fc752f1f43c1c038a2c6ae58cc739ebb5953ccb0 ]

An exception is seen in ICMP ping receive path where the skb
destructor sock_rfree() tries to access a freed socket. This happens
because ping_rcv() releases socket reference with sock_put() and this
internally frees up the socket. Later icmp_rcv() will try to free the
skb and as part of this, skb destructor is called and which leads
to a kernel panic as the socket is freed already in ping_rcv().

-->|exception
-007|sk_mem_uncharge
-007|sock_rfree
-008|skb_release_head_state
-009|skb_release_all
-009|__kfree_skb
-010|kfree_skb
-011|icmp_rcv
-012|ip_local_deliver_finish

Fix this incorrect free by cloning this skb and processing this cloned
skb instead.

This patch was suggested by Eric Dumazet

Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoudp_diag: Fix socket skipping within chain
Herbert Xu [Fri, 23 Jan 2015 21:02:40 +0000 (08:02 +1100)]
udp_diag: Fix socket skipping within chain

[ Upstream commit 86f3cddbc3037882414c7308973530167906b7e9 ]

While working on rhashtable walking I noticed that the UDP diag
dumping code is buggy.  In particular, the socket skipping within
a chain never happens, even though we record the number of sockets
that should be skipped.

As this code was supposedly copied from TCP, this patch does what
TCP does and resets num before we walk a chain.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoipv4: try to cache dst_entries which would cause a redirect
Hannes Frederic Sowa [Fri, 23 Jan 2015 11:01:26 +0000 (12:01 +0100)]
ipv4: try to cache dst_entries which would cause a redirect

[ Upstream commit df4d92549f23e1c037e83323aff58a21b3de7fe0 ]

Not caching dst_entries which cause redirects could be exploited by hosts
on the same subnet, causing a severe DoS attack. This effect aggravated
since commit f88649721268999 ("ipv4: fix dst race in sk_dst_get()").

Lookups causing redirects will be allocated with DST_NOCACHE set which
will force dst_release to free them via RCU.  Unfortunately waiting for
RCU grace period just takes too long, we can end up with >1M dst_entries
waiting to be released and the system will run OOM. rcuos threads cannot
catch up under high softirq load.

Attaching the flag to emit a redirect later on to the specific skb allows
us to cache those dst_entries thus reducing the pressure on allocation
and deallocation.

This issue was discovered by Marcelo Leitner.

Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Marcelo Leitner <mleitner@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agonet: sctp: fix slab corruption from use after free on INIT collisions
Daniel Borkmann [Thu, 22 Jan 2015 17:26:54 +0000 (18:26 +0100)]
net: sctp: fix slab corruption from use after free on INIT collisions

[ Upstream commit 600ddd6825543962fb807884169e57b580dba208 ]

When hitting an INIT collision case during the 4WHS with AUTH enabled, as
already described in detail in commit 1be9a950c646 ("net: sctp: inherit
auth_capable on INIT collisions"), it can happen that we occasionally
still remotely trigger the following panic on server side which seems to
have been uncovered after the fix from commit 1be9a950c646 ...

[  533.876389] BUG: unable to handle kernel paging request at 00000000ffffffff
[  533.913657] IP: [<ffffffff811ac385>] __kmalloc+0x95/0x230
[  533.940559] PGD 5030f2067 PUD 0
[  533.957104] Oops: 0000 [#1] SMP
[  533.974283] Modules linked in: sctp mlx4_en [...]
[  534.939704] Call Trace:
[  534.951833]  [<ffffffff81294e30>] ? crypto_init_shash_ops+0x60/0xf0
[  534.984213]  [<ffffffff81294e30>] crypto_init_shash_ops+0x60/0xf0
[  535.015025]  [<ffffffff8128c8ed>] __crypto_alloc_tfm+0x6d/0x170
[  535.045661]  [<ffffffff8128d12c>] crypto_alloc_base+0x4c/0xb0
[  535.074593]  [<ffffffff8160bd42>] ? _raw_spin_lock_bh+0x12/0x50
[  535.105239]  [<ffffffffa0418c11>] sctp_inet_listen+0x161/0x1e0 [sctp]
[  535.138606]  [<ffffffff814e43bd>] SyS_listen+0x9d/0xb0
[  535.166848]  [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b

... or depending on the the application, for example this one:

[ 1370.026490] BUG: unable to handle kernel paging request at 00000000ffffffff
[ 1370.026506] IP: [<ffffffff811ab455>] kmem_cache_alloc+0x75/0x1d0
[ 1370.054568] PGD 633c94067 PUD 0
[ 1370.070446] Oops: 0000 [#1] SMP
[ 1370.085010] Modules linked in: sctp kvm_amd kvm [...]
[ 1370.963431] Call Trace:
[ 1370.974632]  [<ffffffff8120f7cf>] ? SyS_epoll_ctl+0x53f/0x960
[ 1371.000863]  [<ffffffff8120f7cf>] SyS_epoll_ctl+0x53f/0x960
[ 1371.027154]  [<ffffffff812100d3>] ? anon_inode_getfile+0xd3/0x170
[ 1371.054679]  [<ffffffff811e3d67>] ? __alloc_fd+0xa7/0x130
[ 1371.080183]  [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b

With slab debugging enabled, we can see that the poison has been overwritten:

[  669.826368] BUG kmalloc-128 (Tainted: G        W     ): Poison overwritten
[  669.826385] INFO: 0xffff880228b32e50-0xffff880228b32e50. First byte 0x6a instead of 0x6b
[  669.826414] INFO: Allocated in sctp_auth_create_key+0x23/0x50 [sctp] age=3 cpu=0 pid=18494
[  669.826424]  __slab_alloc+0x4bf/0x566
[  669.826433]  __kmalloc+0x280/0x310
[  669.826453]  sctp_auth_create_key+0x23/0x50 [sctp]
[  669.826471]  sctp_auth_asoc_create_secret+0xcb/0x1e0 [sctp]
[  669.826488]  sctp_auth_asoc_init_active_key+0x68/0xa0 [sctp]
[  669.826505]  sctp_do_sm+0x29d/0x17c0 [sctp] [...]
[  669.826629] INFO: Freed in kzfree+0x31/0x40 age=1 cpu=0 pid=18494
[  669.826635]  __slab_free+0x39/0x2a8
[  669.826643]  kfree+0x1d6/0x230
[  669.826650]  kzfree+0x31/0x40
[  669.826666]  sctp_auth_key_put+0x19/0x20 [sctp]
[  669.826681]  sctp_assoc_update+0x1ee/0x2d0 [sctp]
[  669.826695]  sctp_do_sm+0x674/0x17c0 [sctp]

Since this only triggers in some collision-cases with AUTH, the problem at
heart is that sctp_auth_key_put() on asoc->asoc_shared_key is called twice
when having refcnt 1, once directly in sctp_assoc_update() and yet again
from within sctp_auth_asoc_init_active_key() via sctp_assoc_update() on
the already kzfree'd memory, which is also consistent with the observation
of the poison decrease from 0x6b to 0x6a (note: the overwrite is detected
at a later point in time when poison is checked on new allocation).

Reference counting of auth keys revisited:

Shared keys for AUTH chunks are being stored in endpoints and associations
in endpoint_shared_keys list. On endpoint creation, a null key is being
added; on association creation, all endpoint shared keys are being cached
and thus cloned over to the association. struct sctp_shared_key only holds
a pointer to the actual key bytes, that is, struct sctp_auth_bytes which
keeps track of users internally through refcounting. Naturally, on assoc
or enpoint destruction, sctp_shared_key are being destroyed directly and
the reference on sctp_auth_bytes dropped.

User space can add keys to either list via setsockopt(2) through struct
sctp_authkey and by passing that to sctp_auth_set_key() which replaces or
adds a new auth key. There, sctp_auth_create_key() creates a new sctp_auth_bytes
with refcount 1 and in case of replacement drops the reference on the old
sctp_auth_bytes. A key can be set active from user space through setsockopt()
on the id via sctp_auth_set_active_key(), which iterates through either
endpoint_shared_keys and in case of an assoc, invokes (one of various places)
sctp_auth_asoc_init_active_key().

sctp_auth_asoc_init_active_key() computes the actual secret from local's
and peer's random, hmac and shared key parameters and returns a new key
directly as sctp_auth_bytes, that is asoc->asoc_shared_key, plus drops
the reference if there was a previous one. The secret, which where we
eventually double drop the ref comes from sctp_auth_asoc_set_secret() with
intitial refcount of 1, which also stays unchanged eventually in
sctp_assoc_update(). This key is later being used for crypto layer to
set the key for the hash in crypto_hash_setkey() from sctp_auth_calculate_hmac().

To close the loop: asoc->asoc_shared_key is freshly allocated secret
material and independant of the sctp_shared_key management keeping track
of only shared keys in endpoints and assocs. Hence, also commit 4184b2a79a76
("net: sctp: fix memory leak in auth key management") is independant of
this bug here since it concerns a different layer (though same structures
being used eventually). asoc->asoc_shared_key is reference dropped correctly
on assoc destruction in sctp_association_free() and when active keys are
being replaced in sctp_auth_asoc_init_active_key(), it always has a refcount
of 1. Hence, it's freed prematurely in sctp_assoc_update(). Simple fix is
to remove that sctp_auth_key_put() from there which fixes these panics.

Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agonetxen: fix netxen_nic_poll() logic
Eric Dumazet [Thu, 22 Jan 2015 15:56:18 +0000 (07:56 -0800)]
netxen: fix netxen_nic_poll() logic

[ Upstream commit 6088beef3f7517717bd21d90b379714dd0837079 ]

NAPI poll logic now enforces that a poller returns exactly the budget
when it wants to be called again.

If a driver limits TX completion, it has to return budget as well when
the limit is hit, not the number of received packets.

Reported-and-tested-by: Mike Galbraith <umgwanakikbuti@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: d75b1ade567f ("net: less interrupt masking in NAPI")
Cc: Manish Chopra <manish.chopra@qlogic.com>
Acked-by: Manish Chopra <manish.chopra@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoipv6: stop sending PTB packets for MTU < 1280
Hagen Paul Pfeifer [Thu, 15 Jan 2015 21:34:25 +0000 (22:34 +0100)]
ipv6: stop sending PTB packets for MTU < 1280

[ Upstream commit 9d289715eb5c252ae15bd547cb252ca547a3c4f2 ]

Reduce the attack vector and stop generating IPv6 Fragment Header for
paths with an MTU smaller than the minimum required IPv6 MTU
size (1280 byte) - called atomic fragments.

See IETF I-D "Deprecating the Generation of IPv6 Atomic Fragments" [1]
for more information and how this "feature" can be misused.

[1] https://tools.ietf.org/html/draft-ietf-6man-deprecate-atomfrag-generation-00

Signed-off-by: Fernando Gont <fgont@si6networks.com>
Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agonet: rps: fix cpu unplug
Eric Dumazet [Fri, 16 Jan 2015 01:04:22 +0000 (17:04 -0800)]
net: rps: fix cpu unplug

[ Upstream commit ac64da0b83d82abe62f78b3d0e21cca31aea24fa ]

softnet_data.input_pkt_queue is protected by a spinlock that
we must hold when transferring packets from victim queue to an active
one. This is because other cpus could still be trying to enqueue packets
into victim queue.

A second problem is that when we transfert the NAPI poll_list from
victim to current cpu, we absolutely need to special case the percpu
backlog, because we do not want to add complex locking to protect
process_queue : Only owner cpu is allowed to manipulate it, unless cpu
is offline.

Based on initial patch from Prasad Sodagudi & Subash Abhinov
Kasiviswanathan.

This version is better because we do not slow down packet processing,
only make migration safer.

Reported-by: Prasad Sodagudi <psodagud@codeaurora.org>
Reported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoip: zero sockaddr returned on error queue
Willem de Bruijn [Thu, 15 Jan 2015 18:18:40 +0000 (13:18 -0500)]
ip: zero sockaddr returned on error queue

[ Upstream commit f812116b174e59a350acc8e4856213a166a91222 ]

The sockaddr is returned in IP(V6)_RECVERR as part of errhdr. That
structure is defined and allocated on the stack as

    struct {
            struct sock_extended_err ee;
            struct sockaddr_in(6)    offender;
    } errhdr;

The second part is only initialized for certain SO_EE_ORIGIN values.
Always initialize it completely.

An MTU exceeded error on a SOCK_RAW/IPPROTO_RAW is one example that
would return uninitialized bytes.

Signed-off-by: Willem de Bruijn <willemb@google.com>
----

Also verified that there is no padding between errhdr.ee and
errhdr.offender that could leak additional kernel data.
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoinput: ti_am335x_tsc: Ignore previous pen down event when pen up event occurs
Franklin S Cooper Jr [Thu, 26 Feb 2015 14:53:56 +0000 (08:53 -0600)]
input: ti_am335x_tsc: Ignore previous pen down event when pen up event occurs

Frequently when a pen up event occurs the sampling for the previous pen down
event ends up being incomplete. From a userspace perspective you will see an
abnormal jump when comparing the pen down events to the one right before the
pen up event.

To avoid this issue delay sending a pen down event until the next touch
event has occurred. If the current touch event is not a pen up event then
send the previously detected pen down values. If the current touch event is
a pen up then simply ignore the previous pen down value.

Signed-off-by: Franklin S Cooper Jr. <fcooper@ti.com>
Acked-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel...
Dan Murphy [Thu, 26 Feb 2015 15:25:57 +0000 (09:25 -0600)]
Merge branch 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree into ti-linux-3.14.y

TI-Feature: platform_base
TI-Tree: git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree.git
TI-Branch: platform-ti-linux-3.14.y

* 'platform-ti-linux-3.14.y' of git://git.ti.com/~rrnayak/ti-linux-kernel/platform-linux-feature-tree:
  ARM: OMAP: DRA7xx: Add clocks for PWMSS
  ARM: OMAP2+: DRA7xx: add hwmod entries for PWMSS

Signed-off-by: Dan Murphy <DMurphy@ti.com>
9 years agoARM: dts: DRA7: add DT entries for PWMSS
Vignesh R [Thu, 26 Feb 2015 08:40:42 +0000 (14:10 +0530)]
ARM: dts: DRA7: add DT entries for PWMSS

This patch adds DT entries for PWMSS.
ehrpwm1 is used to control LCD backlight on AM57x EVM.
So enable ehrpwm1 in the board dts file.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Thu, 26 Feb 2015 09:30:12 +0000 (03:30 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: dts: dra7-evm: disable gpmc/nand

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoPWM: Kconfig: Enable PWM on DRA7
Vignesh R [Thu, 26 Feb 2015 08:40:41 +0000 (14:10 +0530)]
PWM: Kconfig: Enable PWM on DRA7

TIPWMSS is present on TI's DRA7x SoC.
Enable its usage.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge remote-tracking branch 'ti-linux/ti-linux-3.14.y' into connectivity-ti-linux...
Sekhar Nori [Thu, 26 Feb 2015 09:19:07 +0000 (14:49 +0530)]
Merge remote-tracking branch 'ti-linux/ti-linux-3.14.y' into connectivity-ti-linux-3.14.y

9 years agoARM: OMAP: DRA7xx: Add clocks for PWMSS
Vignesh R [Thu, 26 Feb 2015 08:40:40 +0000 (14:10 +0530)]
ARM: OMAP: DRA7xx: Add clocks for PWMSS

PWMSS does not seem to support smart idle mode when clockdomain
"l4per2_clkdm" is in HW_AUTO. Hence, configuring l4per2_clkdm to
SW_WKUP.

EHRPWM has a TBCLK which is enabled by writing into CTRL_CORE_IO_2. This
clock is derived from the same clock that drives PWMSS. Hence adding
ehrpwmx_tbclk nodes.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoARM: OMAP2+: DRA7xx: add hwmod entries for PWMSS
Vignesh R [Thu, 26 Feb 2015 08:50:38 +0000 (14:20 +0530)]
ARM: OMAP2+: DRA7xx: add hwmod entries for PWMSS

This patch adds hwmod entries for PWMSS on DRA7.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
9 years agoARM: dts: dra7-evm: disable gpmc/nand
Sekhar Nori [Wed, 25 Feb 2015 15:47:21 +0000 (21:17 +0530)]
ARM: dts: dra7-evm: disable gpmc/nand

On DRA7-evm, GPMC/NAND is muxed with VOUT3. VOUT3 is preferred from
usecase point of view, and the MLO has the pins muxed such that
VOUT3 is used.

Having NAND enabled without pins configured causes an ugly delay
at boot trying to reset the device. Keep NAND disabled by default.

Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
9 years agoMerge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integrat...
Texas Instruments Auto Merger [Wed, 25 Feb 2015 15:21:03 +0000 (09:21 -0600)]
Merge branch 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel into ti-linux-3.14.y

TI-Feature: connectivity
TI-Tree: git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel.git
TI-Branch: connectivity-ti-linux-3.14.y

* 'connectivity-ti-linux-3.14.y' of git://git.ti.com/connectivity-integration-tree/connectivity-ti-linux-kernel:
  ARM: DRA7: hwmod_data: Fix hwmod data for pcie
  ARM: dts: dra7: remove ti,hwmod property from pcie phy
  mtd: nand: Prevent possible kernel lockup in nand_command()

Signed-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>
9 years agoARM: DRA7: hwmod_data: Fix hwmod data for pcie
Kishon Vijay Abraham I [Fri, 20 Feb 2015 08:45:56 +0000 (14:15 +0530)]
ARM: DRA7: hwmod_data: Fix hwmod data for pcie

Fixed hwmod data for pcie by having the correct module mode offset.
Previously this module mode offset was part of pcie PHY which was wrong.
Now this module mode offset was moved to pcie hwmod and removed the hwmod data
for pcie phy. While at that renamed pcie_hwmod to pciess_hwmod in order
to match with the name given in TRM.

This helps to get rid of the following warning
"omap_hwmod: pcie1: _wait_target_disable failed"

[Grygorii.Strashko@linaro.org: Found the issue that actually caused
 "omap_hwmod: pcie1: _wait_target_disable failed"]
Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>