[GIT PULL] ARM: SoC fixes for 4.3-rc

2015-09-26 Thread Olof Johansson
Hi Linus,

Our first batch of fixes this merge window. Nothing really concerning,
and diffstat is a bit inflated due to some DT contents moving around on
STi platforms.

Please merge!


Thanks,

-Olof


The following changes since commit 6ff33f3902c3b1c5d0db6b1e2c70b6d76fba357f:

  Linux 4.3-rc1 (2015-09-12 16:35:56 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git 
tags/armsoc-fixes

for you to fetch changes up to e46fc90ec2612ef7578c6e3e28ad477a116e24da:

  Merge tag 'pxa-fixes-v4.3' of https://github.com/rjarzmik/linux into fixes 
(2015-09-26 22:23:26 -0700)


ARM: SoC fixes for v4.3-rc

Our first real batch of fixes this release cycle. There's a collection of
them here:

- A fixup for a build breakage that hits on arm64 allmodconfig in QCOM SCM
  firmware drivers
- MMC fixes for OMAP that had quite a bit of breakage this merge window.
- Misc build/warning fixes on PXA and OMAP
- A couple of minor fixes for Beagleboard X15 which is now starting to see
  a few more users in the wild


Andy Gross (1):
  firmware: qcom: scm: Add function stubs for ARM64

Axel Lin (1):
  ARM: pxa: balloon3: Fix build error

Benjamin Gaignard (1):
  ARM: sti: dt: adapt DT to fix probe/bind issues in DRM driver

Carl Frederik Werner (1):
  ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again

Dave Gerlach (1):
  ARM: OMAP2+: AM43XX: Enable autoidle for clks in am43xx_init_late

Douglas Anderson (1):
  ARM: dts: Add ddc i2c reference to veyron

Frans Klaver (1):
  ARM: OMAP3: vc: fix 'or' always true warning

Grazvydas Ignotas (2):
  ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
  ARM: omap2plus_defconfig: enable GPIO_PCA953X

Grygorii Strashko (1):
  ARM: OMAP2+: omap-device: fix race deferred probe of omap_hsmmc vs 
omap_device_late_init

Jarkko Nikula (1):
  ARM: pxa: ssp: Fix build error by removing originally incorrect DT binding

Javier Martinez Canillas (1):
  ARM: dts: omap3-igep: Move eth IRQ pinmux to IGEPv2 common dtsi

Kevin Hilman (1):
  Merge tag 'omap-for-v4.3/fixes-rc1' of 
git://git.kernel.org/.../tmlind/linux-omap into fixes

Kishon Vijay Abraham I (4):
  ARM: dts: am57xx-beagle-x15: Fix regulator populated in MMC1 dt node
  ARM: dts: Use ti,pbias compatible string for pbias
  ARM: omap2plus_defconfig: make PCF857x built-in
  ARM: dts: fix omap2+ address translation for pbias

Nicolas Chauvet (1):
  ARM: dts: Fixup model name for HP t410 dts

Nishanth Menon (6):
  ARM: dts: am57xx-beagle-x15: Add wakeup irq for mcp79410
  ARM: OMAP4+: PM: erratum is used by OMAP5 and DRA7 as well
  ARM: OMAP2+: board-generic: Remove stale of_irq macros
  ARM: DRA7: Select missing options for SoC only build
  ARM: OMAP5: Cleanup options for SoC only build
  ARM: dts: am57xx-beagle-x15: Update Phy supplies

Olof Johansson (4):
  Merge tag 'qcom-fixes-for-4.3-rc1' of 
git://codeaurora.org/quic/kernel/agross-msm into fixes
  Merge tag 'v4.3-rockchip32-dtsfixes1' of 
git://git.kernel.org/.../mmind/linux-rockchip into fixes
  Merge tag 'omap-for-v4.3/fixes-rc2' of 
git://git.kernel.org/.../tmlind/linux-omap into fixes
  Merge tag 'pxa-fixes-v4.3' of https://github.com/rjarzmik/linux into fixes

Robert Jarzmik (1):
  ARM: pxa: fix DFI bus lockups on startup

Roger Quadros (1):
  ARM: dts: am57xx-beagle-x15: use palmas-usb for USB2

Teresa Remmet (1):
  ARM: dts: am335x-phycore-som: Fix mpu voltage

Tony Lindgren (5):
  ARM: OMAP2+: Fix booting if no timer parent clock is available
  ARM: omap2plus_defconfig: Enable MUSB DMA support
  ARM: dts: Fix dm814x control base to properly initialize Ethernet PHY
  Merge branch 'fixes-rc1' into omap-for-v4.3/fixes
  Merge commit 'b8c93646fd5c' into omap-for-v4.3/fixes

Vishal Mahaveer (2):
  ARM: DRA752: Add ID detect for ES2.0
  ARM: dts: DRA7: fix a typo in ethernet

 arch/arm/boot/dts/am335x-phycore-som.dtsi|  4 +-
 arch/arm/boot/dts/am57xx-beagle-x15.dts  | 46 ++--
 arch/arm/boot/dts/dm8148-evm.dts |  4 +-
 arch/arm/boot/dts/dm8148-t410.dts|  6 +-
 arch/arm/boot/dts/dm814x.dtsi|  8 +--
 arch/arm/boot/dts/dra7.dtsi  |  5 +-
 arch/arm/boot/dts/omap2430.dtsi  |  3 +-
 arch/arm/boot/dts/omap3-beagle.dts   |  2 +-
 arch/arm/boot/dts/omap3-igep.dtsi|  6 --
 arch/arm/boot/dts/omap3-igep0020-common.dtsi |  6 ++
 arch/arm/boot/dts/omap3.dtsi | 25 +
 arch/arm/boot/dts/omap4.dtsi |  3 +-
 arch/arm/boot/dts/omap5-uevm.dts |  4 +-
 arch/arm/boot/dts/omap5.dtsi |  3 +-
 arch/arm/boot/dts/rk3288-veyron.dtsi |  1 +
 arch/arm/boot/dts/stih407.dtsi   | 82 

Re: [PATCH 16/19] r8169: fix handling rtl_readphy result

2015-09-26 Thread David Miller
From: Andrzej Hajda 
Date: Thu, 24 Sep 2015 16:00:24 +0200

> The function can return negative value.
> 
> The problem has been detected using proposed semantic patch
> scripts/coccinelle/tests/assign_signed_to_unsigned.cocci [1].
> 
> [1]: http://permalink.gmane.org/gmane.linux.kernel/2046107
> 
> Signed-off-by: Andrzej Hajda 

Applied.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 07/19] net: hisilicon: fix handling platform_get_irq result

2015-09-26 Thread David Miller
From: Andrzej Hajda 
Date: Thu, 24 Sep 2015 16:00:15 +0200

> The function can return negative value.
> 
> The problem has been detected using proposed semantic patch
> scripts/coccinelle/tests/assign_signed_to_unsigned.cocci [1].
> 
> [1]: http://permalink.gmane.org/gmane.linux.kernel/2046107
> 
> Signed-off-by: Andrzej Hajda 

Applied.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 1/3] Thermal: initialize thermal zone device correctly

2015-09-26 Thread Chen Yu
From: Zhang Rui 

After thermal zone device registered, as we have not read any
temperature before, thus tz->temperature should not be 0,
which actually means 0C, and thermal trend is not available.
In this case, we need specially handling for the first
thermal_zone_device_update().

Both thermal core framework and step_wise governor is
enhanced to handle this.

CC:  #3.18+
Tested-by: Manuel Krause 
Tested-by: szegad 
Tested-by: prash 
Tested-by: amish 
Tested-by: Matthias 
Signed-off-by: Zhang Rui 
Signed-off-by: Chen Yu 
---
 drivers/thermal/step_wise.c| 18 --
 drivers/thermal/thermal_core.c | 19 +--
 drivers/thermal/thermal_core.h |  1 +
 include/linux/thermal.h|  3 +++
 4 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index 2f9f708..405de04 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -63,6 +63,19 @@ static unsigned long get_target_state(struct 
thermal_instance *instance,
next_target = instance->target;
dev_dbg(>device, "cur_state=%ld\n", cur_state);
 
+   if (!instance->initialized) {
+   if (throttle) {
+   next_target = (cur_state + 1) >= instance->upper ?
+   instance->upper :
+   ((cur_state + 1) < instance->lower ?
+   instance->lower : (cur_state + 1));
+   } else {
+   next_target = THERMAL_NO_TARGET;
+   }
+
+   return next_target;
+   }
+
switch (trend) {
case THERMAL_TREND_RAISING:
if (throttle) {
@@ -149,7 +162,8 @@ static void thermal_zone_trip_update(struct 
thermal_zone_device *tz, int trip)
dev_dbg(>cdev->device, "old_target=%d, target=%d\n",
old_target, (int)instance->target);
 
-   if (old_target == instance->target)
+   if (instance->initialized &&
+   old_target == instance->target)
continue;
 
/* Activate a passive thermal instance */
@@ -161,7 +175,7 @@ static void thermal_zone_trip_update(struct 
thermal_zone_device *tz, int trip)
instance->target == THERMAL_NO_TARGET)
update_passive_instance(tz, trip_type, -1);
 
-
+   instance->initialized = true;
instance->cdev->updated = false; /* cdev needs update */
}
 
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index d9e525c..682bc1e 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -532,8 +532,22 @@ static void update_temperature(struct thermal_zone_device 
*tz)
mutex_unlock(>lock);
 
trace_thermal_temperature(tz);
-   dev_dbg(>device, "last_temperature=%d, current_temperature=%d\n",
-   tz->last_temperature, tz->temperature);
+   if (tz->last_temperature == THERMAL_TEMP_INVALID)
+   dev_dbg(>device, "last_temperature N/A, 
current_temperature=%d\n",
+   tz->temperature);
+   else
+   dev_dbg(>device, "last_temperature=%d, 
current_temperature=%d\n",
+   tz->last_temperature, tz->temperature);
+}
+
+static void thermal_zone_device_reset(struct thermal_zone_device *tz)
+{
+   struct thermal_instance *pos;
+
+   tz->temperature = THERMAL_TEMP_INVALID;
+   tz->passive = 0;
+   list_for_each_entry(pos, >thermal_instances, tz_node)
+   pos->initialized = false;
 }
 
 void thermal_zone_device_update(struct thermal_zone_device *tz)
@@ -1900,6 +1914,7 @@ struct thermal_zone_device 
*thermal_zone_device_register(const char *type,
 
INIT_DELAYED_WORK(&(tz->poll_queue), thermal_zone_device_check);
 
+   thermal_zone_device_reset(tz);
thermal_zone_device_update(tz);
 
return tz;
diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h
index d7ac1fc..749d41a 100644
--- a/drivers/thermal/thermal_core.h
+++ b/drivers/thermal/thermal_core.h
@@ -41,6 +41,7 @@ struct thermal_instance {
struct thermal_zone_device *tz;
struct thermal_cooling_device *cdev;
int trip;
+   bool initialized;
unsigned long upper;/* Highest cooling state for this trip point */
unsigned long lower;/* Lowest cooling state for this trip point */
unsigned long target;   /* expected cooling state */
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index 157d366..5bcabc7 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -43,6 +43,9 @@
 /* Default weight of a bound cooling device */
 #define THERMAL_WEIGHT_DEFAULT 0
 
+/* use value, which < 0K, to indicate an invalid/uninitialized temperature */
+#define THERMAL_TEMP_INVALID  

[PATCH] Staging: lustre: Fix warning detected by coccicheck

2015-09-26 Thread Jayavant Kenjalkar
From: Jayavant Kenjalkar 

Removing redundant semicolon as detected by coccicheck.

Signed-off-by: Jayavant Kenjalkar 
---
 drivers/staging/lustre/lustre/ptlrpc/niobuf.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c 
b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
index 92c746b..cb10b89 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
@@ -601,7 +601,7 @@ int ptl_send_rpc(struct ptlrpc_request *request, int 
noreply)
/* Manage remote for early replies */
reply_md.options = PTLRPC_MD_OPTIONS | LNET_MD_OP_PUT |
LNET_MD_MANAGE_REMOTE |
-   LNET_MD_TRUNCATE; /* allow to make EOVERFLOW error */;
+   LNET_MD_TRUNCATE; /* allow to make EOVERFLOW error */
reply_md.user_ptr = >rq_reply_cbid;
reply_md.eq_handle = ptlrpc_eq_h;
 
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 0/3] Thermal: Fix thermal zone update problems during bootup/suspend

2015-09-26 Thread Chen Yu
This patch set is to fix a series of thermal issues during system
bootup and suspend/resume. Two major reasons for these bugs are:
1.thermal core is unaware of suspending process, and uses the invalid
  value cached after resuming, which brings the problems.
  (PATCH 1/3 and 2/3]
2.thermal core forgets to update the device's status in some situations,
  this may lead to unexpected behavior after system bootup.
  [PATCH 3/3]

Please refer to:
https://bugzilla.kernel.org/show_bug.cgi?id=78201
for why these patches are proposed.

Chen Yu (3):
  Thermal: initialize thermal zone device correctly
  Thermal: handle thermal zone device properly during system sleep
  Thermal: do thermal zone update after a cooling device registered

 drivers/thermal/step_wise.c| 18 +--
 drivers/thermal/thermal_core.c | 68 --
 drivers/thermal/thermal_core.h |  1 +
 include/linux/thermal.h|  3 ++
 4 files changed, 86 insertions(+), 4 deletions(-)

-- 
1.8.4.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 2/3] Thermal: handle thermal zone device properly during system sleep

2015-09-26 Thread Chen Yu
From: Zhang Rui 

Current thermal code does not handle system sleep well because
1. the cooling device cooling state may be changed during suspend
2. the previous temperature reading becomes invalid after resumed because
   it is got before system sleep
3. updating thermal zone device during suspending/resuming
   is wrong because some devices may have already been suspended
   or may have not been resumed.

Thus, the proper way to do this is to cancel all thermal zone
device update requirements during suspend/resume, and after all
the devices have been resumed, reset and update every registered
thermal zone devices.

This also fixes a regression introduced by:
Commit 19593a1fb1f6 ("ACPI / fan: convert to platform driver")
Because, with above commit applied, all the fan devices are attached
to the acpi_general_pm_domain, and they are turned on by the pm_domain
automatically after resume, without the awareness of thermal core.

CC:  #3.18+
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=78201
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=91411
Tested-by: Manuel Krause 
Tested-by: szegad 
Tested-by: prash 
Tested-by: amish 
Tested-by: Matthias 
Signed-off-by: Zhang Rui 
Signed-off-by: Chen Yu 
---
 drivers/thermal/thermal_core.c | 39 +++
 1 file changed, 39 insertions(+)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 682bc1e..c3bdb48 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -37,6 +37,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #define CREATE_TRACE_POINTS
 #include 
@@ -59,6 +60,8 @@ static LIST_HEAD(thermal_governor_list);
 static DEFINE_MUTEX(thermal_list_lock);
 static DEFINE_MUTEX(thermal_governor_lock);
 
+static atomic_t in_suspend;
+
 static struct thermal_governor *def_governor;
 
 static struct thermal_governor *__find_governor(const char *name)
@@ -554,6 +557,9 @@ void thermal_zone_device_update(struct thermal_zone_device 
*tz)
 {
int count;
 
+   if (atomic_read(_suspend))
+   return;
+
if (!tz->ops->get_temp)
return;
 
@@ -2155,6 +2161,36 @@ static void thermal_unregister_governors(void)
thermal_gov_power_allocator_unregister();
 }
 
+static int thermal_pm_notify(struct notifier_block *nb,
+   unsigned long mode, void *_unused)
+{
+   struct thermal_zone_device *tz;
+
+   switch (mode) {
+   case PM_HIBERNATION_PREPARE:
+   case PM_RESTORE_PREPARE:
+   case PM_SUSPEND_PREPARE:
+   atomic_set(_suspend, 1);
+   break;
+   case PM_POST_HIBERNATION:
+   case PM_POST_RESTORE:
+   case PM_POST_SUSPEND:
+   atomic_set(_suspend, 0);
+   list_for_each_entry(tz, _tz_list, node) {
+   thermal_zone_device_reset(tz);
+   thermal_zone_device_update(tz);
+   }
+   break;
+   default:
+   break;
+   }
+   return 0;
+}
+
+static struct notifier_block thermal_pm_nb = {
+   .notifier_call = thermal_pm_notify,
+};
+
 static int __init thermal_init(void)
 {
int result;
@@ -2175,6 +2211,8 @@ static int __init thermal_init(void)
if (result)
goto exit_netlink;
 
+   register_pm_notifier(_pm_nb);
+
return 0;
 
 exit_netlink:
@@ -2194,6 +2232,7 @@ error:
 
 static void __exit thermal_exit(void)
 {
+   unregister_pm_notifier(_pm_nb);
of_thermal_destroy_zones();
genetlink_exit();
class_unregister(_class);
-- 
1.8.4.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3/3] Thermal: do thermal zone update after a cooling device registered

2015-09-26 Thread Chen Yu
From: Zhang Rui 

When a new cooling device is registered, we need to update the
thermal zone to set the new registered cooling device to a proper
state.

This fixes a problem that the system is cool, while the fan devices
are left running on full speed after boot, if fan device is registered
after thermal zone device.

CC:  #3.18+
Reference:https://bugzilla.kernel.org/show_bug.cgi?id=92431
Tested-by: Manuel Krause 
Tested-by: szegad 
Tested-by: prash 
Tested-by: amish 
Signed-off-by: Zhang Rui 
Signed-off-by: Chen Yu 
---
 drivers/thermal/thermal_core.c | 10 ++
 1 file changed, 10 insertions(+)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index c3bdb48..09c78a4 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1450,6 +1450,7 @@ __thermal_cooling_device_register(struct device_node *np,
  const struct thermal_cooling_device_ops *ops)
 {
struct thermal_cooling_device *cdev;
+   struct thermal_instance *pos, *next;
int result;
 
if (type && strlen(type) >= THERMAL_NAME_LENGTH)
@@ -1494,6 +1495,15 @@ __thermal_cooling_device_register(struct device_node *np,
/* Update binding information for 'this' new cdev */
bind_cdev(cdev);
 
+   list_for_each_entry_safe(pos, next, >thermal_instances, 
cdev_node) {
+   if (next->cdev_node.next == >thermal_instances) {
+   thermal_zone_device_update(next->tz);
+   break;
+   }
+   if (pos->tz != next->tz)
+   thermal_zone_device_update(pos->tz);
+   }
+
return cdev;
 }
 
-- 
1.8.4.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 4/6] extcon: arizona: Add device binding for second jack detect pin on GPIO5

2015-09-26 Thread Chanwoo Choi
On Fri, Sep 25, 2015 at 6:10 PM, Charles Keepax
 wrote:
> On Fri, Sep 25, 2015 at 09:54:26AM +0900, Chanwoo Choi wrote:
>> Hi Charles,
>>
>> I have one comment.
>> I think current extcon-arizona.c has the many platform data
>> so, extcon-arizona.c use the too much if statement to support each feature
>> for different wolfsonmicro codec. I think it cause the complicated code.
>>
>> For example,
>> You may use 'struct of_device_id' as following. You used already this method
>> on drivers/mfd/arizona-core.c. If you separate the function of each wm 
>> arizona,
>> it makes improved readability for extcon-arizona.c and some user will use 
>> extcon-arizora
>> more easily.
>>
>> struct arizona_extcon_data {
>>   void (*init)(...);
>>   void (*irq_handler)(...);
>>   ...
>> };
>>
>> struct arizona_extcon_data wm8994_data {
>>   .init = wm8994_extcon_init,
>>   .irq_handler = wm8994_extcon_irq_handler;
>>   ...
>> };
>>
>> static const struct of_device_id arizona_extcon_dt_match[] = {
>>   {
>>   .compatible = "wm8994-arizona-extcon",
>>   .data = (void *)wm8994_data;
>>   }, {
>>   .compatible = "wm-arizona-extcon",
>>   .data = (void *)wm_data;
>>   },
>> };
>>
>> I expect that you will revise the arizona-extcon.c driver on next time.
>
> I will have an investigation to see what ideas I can come up with
> here and send through some patches.
>
> But I am slightly worried you think the gains will be better than
> they actually will be. Most of the platform data is just that
> platform data, and needs to be configured based on the system not
> based on the CODEC.

I agree. As you mentioned, platform data will be configured based on the system.
But, I mean that there are many platform datas for extcon-arizona in
"struct arizona_pdata" (in include/linux/mfd/arizona/pdata.h).

There are four sound code using the extcon-arizona driver as
following: I check the following list
in drivers/mfd/arizona-core.c.
- wm5102
- wm5110
- wm8997
- wm8998

If upper four sound codec include the same headset detection IP
(extcon-arizona.c)
without any difference about detection IP in sound codec, you don't
need to revise
the extcon-arizona.c driver.

But, If some field of  "struct arizona_pdata" (in
include/linux/mfd/arizona/pdata.h)
are used for only specific sound codec (wmXXX series), I think we need
to revise it.

I'm positive about your patches of extcon-arizona. Just I think that
you can make it
more easier and improved readability.

Thanks,
Chanwoo Choi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH v2 1/3] staging: sm7xxfb: move sm712fb out of staging

2015-09-26 Thread Mike Rapoport
Hi Sudip,

On Fri, Sep 25, 2015 at 07:12:06PM +0530, Sudip Mukherjee wrote:
> On Thu, Sep 24, 2015 at 02:58:31PM +0300, Tomi Valkeinen wrote:
> > 
> > On 02/09/15 15:48, Sudip Mukherjee wrote:
> > 
> 
> > 
> > Is there a public datasheet for the HW?
> I could not find one in Silicon Motion website. I will try to find else
> I can talk to them and keep it in my github. And can send you also if
> you want.

I'd appreciate sm750 datasheet, if you have one.

> > 
> > The driver as it is now is quite horrible. Huge tables of raw data,
> > written directly to the registers. Lots of magic numbers all around.
> > Even with a datasheet, presuming it's public and it contains all those
> > values, the driver is rather unmaintainable.
> > 
> > All those need to be sorted out for the DRM driver anyway, so maybe it's
> > better to clean up the fb driver first.
> Ok. I never looked at them to see how they can be made better. I will
> see.
> 
> regards
> sudip

--
Sincerely yours,
Mike.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[GIT PULL rcu/urgent] Fix two more 4.3 regressions

2015-09-26 Thread Paul E. McKenney
Hello, Ingo,

This series contains two small fixes for regressions introduced during
the past merge window:

1.  Recent versions of gcc are fatally confused by use of a const
int variable for array bounds in inline functions, one of which
was introduced by 114b7fd4b (rcu: Create rcu_sync infrastructure).
For more information on the gcc bug, see:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67055#c13

This workaround for that gcc bug, courtesy of Oleg Nesterov,
simply substitutes the constant expression for the two uses of
the const int variable.

2.  Commit 2cd6ffafec06 (rcu: Extend expedited funnel locking
to rcu_data structure) extended contention-reducing
funnel locking from the rcu_node structures to the rcu_data
structures, but failed to create a separate lock class for the
rcu_sched_data structures, which is needed due to the fact that
synchronize_rcu_expedited() invokes synchronize_sched_expedited().
In the absence of this separate lock class, lockdep can give
false-positive splats.  This commit therefore creates the
required lock class so that lockdep can see that there is in
fact no deadlock.

Both fixes have been exposed to -next and 0day Test Robot testing.

These changes are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git for-mingo

for you to fetch changes up to 19a5ecde086a6a5287978b12ae948fa691b197b7:

  rcu: Suppress lockdep false positive for rcp->exp_funnel_mutex (2015-09-20 
21:01:22 -0700)


Oleg Nesterov (1):
  rcu: Change _wait_rcu_gp() to work around GCC bug 67055

Paul E. McKenney (1):
  rcu: Suppress lockdep false positive for rcp->exp_funnel_mutex

 include/linux/rcupdate.h | 11 +--
 kernel/rcu/tree.c|  5 +
 2 files changed, 10 insertions(+), 6 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] iio: gyro: ssp_gyro_sensor: Use devm_iio_device_register

2015-09-26 Thread Vaishali Thakkar
On Mon, Sep 21, 2015 at 4:48 PM, Karol Wrona  wrote:
> On 09/21/2015 11:53 AM, Jonathan Cameron wrote:
>>
>>
>> On 21 September 2015 09:18:39 BST, Karol Wrona  wrote:
>>> On 09/20/2015 09:18 PM, Jonathan Cameron wrote:
 On 14/09/15 17:08, Vaishali Thakkar wrote:
> Use resourced managed function devm_iio_device_register to
> make error path simpler. To be compatible with the change,
> the remove function is removed as it is now redundant.
>
> Signed-off-by: Vaishali Thakkar 
 This patch is reasonable, but makes me wonder if there is an issue
 in the remove path for this driver.  It relies on the ssp_sensors
>>> common
 module.  That in ssp_spi.c uses the fact ssp_register_consumer
 has saved the struct iio_dev into a local array in the core driver.
 I think this means that a remove of this function will leave a
>>> possible
 null pointer de reference.
>>> You are right. In this case we need something like
>>> ssp_deregister_consumer(...) in ssp_dev.c. So I think that "remove
>>> func"
>>> should stay. Of course we can switch to devm iio register.
>> Not if you want to remove the userspace interface before doing you new 
>> function call.  Doing so gives a nasty race.
> So better leave it out:
> iio_device_unregister(indio_dev) will disable the buffers and through
> ops disables the sensor and than remove iio dev ptr from the internal table.
>

Sorry for the late reply. Yes, I guess I missed the point that
'ssp_register_consumer' is
used in probe function. And I believe that devm_iio_register is useful
only when we
can convert all other functions to their devm counterparts and remove
function will go
away.

But then why don't we need ssp_deregister_consumer here in the remove function?
Is it automatically handled by  iio_device_unregister? I guess Karol
tried to explain
the same thing but I am still confused. Same case applies for
ssp_sensors/ssp_dev.c.

>>>
>>> Also the same can (rather should) be done for accelerometer sensor
>>> (ssp_accel_sensor.c).
>>>
>>> Vaishali, if you want please feel free and send patch.
>>>

 Now I suspect that case doesn't actually occur because the relevant
 device elements are disabled whenever this module is removed.  Having
 said that we might expect an ssp_unregister_consumer function that
 sets the relevant pointer back to null on removal so as to avoid
 any possible race conditions around driver removal / reprobing.
 A spot of defensive programming rather than necessarily a bug to be
 fixed!

 One little process thing. This driver was written by Karol so patches
 should probably always cc Karol as well as the more general
 maintainer / reviewers for IIO.  Added cc.

 Jonathan
> ---
>  drivers/iio/gyro/ssp_gyro_sensor.c | 12 +---
>  1 file changed, 1 insertion(+), 11 deletions(-)
>
> diff --git a/drivers/iio/gyro/ssp_gyro_sensor.c
>>> b/drivers/iio/gyro/ssp_gyro_sensor.c
> index 0a8afdd..ac88de7 100644
> --- a/drivers/iio/gyro/ssp_gyro_sensor.c
> +++ b/drivers/iio/gyro/ssp_gyro_sensor.c
> @@ -134,7 +134,7 @@ static int ssp_gyro_probe(struct platform_device
>>> *pdev)
>
>platform_set_drvdata(pdev, indio_dev);
>
> -  ret = iio_device_register(indio_dev);
> +  ret = devm_iio_device_register(>dev, indio_dev);
>if (ret < 0)
>return ret;
>
> @@ -144,21 +144,11 @@ static int ssp_gyro_probe(struct
>>> platform_device *pdev)
>return 0;
>  }
>
> -static int ssp_gyro_remove(struct platform_device *pdev)
> -{
> -  struct iio_dev *indio_dev = platform_get_drvdata(pdev);
> -
> -  iio_device_unregister(indio_dev);
> -
> -  return 0;
> -}
> -
>  static struct platform_driver ssp_gyro_driver = {
>.driver = {
>.name = SSP_GYROSCOPE_NAME,
>},
>.probe = ssp_gyro_probe,
> -  .remove = ssp_gyro_remove,
>  };
>
>  module_platform_driver(ssp_gyro_driver);
>

 --
 To unsubscribe from this list: send the line "unsubscribe linux-iio"
>>> in
 the body of a message to majord...@vger.kernel.org
 More majordomo info at  http://vger.kernel.org/majordomo-info.html

>>
>



-- 
Vaishali
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH v2] USB: serial: add Moxa UPORT 11x0 driver

2015-09-26 Thread Johan Hovold
On Tue, Sep 22, 2015 at 03:08:29PM +0200, Mathieu OTHACEHE wrote:
> Add a driver which supports :
> 
> - UPort 1110  : 1 port RS-232 USB to Serial Hub.
> - UPort 1130  : 1 port RS-422/485 USB to Serial Hub.
> - UPort 1130I : 1 port RS-422/485 USB to Serial Hub with Isolation.
> - UPort 1150  : 1 port RS-232/422/485 USB to Serial Hub.
> - UPort 1150I : 1 port RS-232/422/485 USB to Serial Hub with Isolation.
> 
> This driver is based on GPL MOXA driver written by Hen Huang and available
> on MOXA website. The original driver was based on io_ti serial driver.
> 
> Signed-off-by: Mathieu OTHACEHE 



> +/* Operation modes */
> +#define MXU1_UART_2320x00
> +#define MXU1_UART_485_RECEIVER_DISABLED  0x01
> +#define MXU1_UART_485_RECEIVER_ENABLED   0x02
> +#define MXU1_TYPE_RS232  (1 << 0)
> +#define MXU1_TYPE_RS422  (1 << 1)
> +#define MXU1_TYPE_RS485  (1 << 2)

You can use BIT(n) for these.

> +/* Pipe transfer mode and timeout */
> +#define MXU1_PIPE_MODE_CONTINUOUS0x01
> +#define MXU1_PIPE_MODE_MASK  0x03
> +#define MXU1_PIPE_TIMEOUT_MASK   0x7C
> +#define MXU1_PIPE_TIMEOUT_ENABLE 0x80
> +
> +/* Config struct */
> +struct mxu1_uart_config {
> + __be16  wBaudRate;
> + __be16  wFlags;
> + u8  bDataBits;
> + u8  bParity;
> + u8  bStopBits;
> + charcXon;
> + charcXoff;
> + u8  bUartMode;
> +} __packed;
> +
> +/* Purge modes */
> +#define MXU1_PURGE_OUTPUT0x00
> +#define MXU1_PURGE_INPUT 0x80
> +
> +/* Read/Write data */
> +#define MXU1_RW_DATA_ADDR_SFR0x10
> +#define MXU1_RW_DATA_ADDR_IDATA  0x20
> +#define MXU1_RW_DATA_ADDR_XDATA  0x30
> +#define MXU1_RW_DATA_ADDR_CODE   0x40
> +#define MXU1_RW_DATA_ADDR_GPIO   0x50
> +#define MXU1_RW_DATA_ADDR_I2C0x60
> +#define MXU1_RW_DATA_ADDR_FLASH  0x70
> +#define MXU1_RW_DATA_ADDR_DSP0x80
> +
> +#define MXU1_RW_DATA_UNSPECIFIED 0x00
> +#define MXU1_RW_DATA_BYTE0x01
> +#define MXU1_RW_DATA_WORD0x02
> +#define MXU1_RW_DATA_DOUBLE_WORD 0x04
> +
> +struct mxu1_write_data_bytes {
> + u8  bAddrType;
> + u8  bDataType;
> + u8  bDataCounter;
> + __be16  wBaseAddrHi;
> + __be16  wBaseAddrLo;
> + u8  bData[0];
> +} __packed;
> +
> +/* Interrupt codes */
> +#define MXU1_GET_PORT_FROM_CODE(c)   (((c) >> 4) - 3)
> +#define MXU1_GET_FUNC_FROM_CODE(c)   ((c) & 0x0f)
> +#define MXU1_CODE_HARDWARE_ERROR 0xFF
> +#define MXU1_CODE_DATA_ERROR 0x03
> +#define MXU1_CODE_MODEM_STATUS   0x04
> +
> +/* Download firmware max packet size */
> +#define MXU1_DOWNLOAD_MAX_PACKET_SIZE64
> +
> +/* Firmware image header */
> +struct mxu1_firmware_header {
> + __le16 wLength;
> + u8 bCheckSum;
> +} __packed;
> +
> +/* UART addresses */
> +/* UART 1 base address */
> +#define MXU1_UART1_BASE_ADDR 0xFFA0
> +/* UART 2 base address*/
> +#define MXU1_UART2_BASE_ADDR 0xFFB0
> +#define MXU1_UART_OFFSET_LCR 0x0002

Why are these unused defines here? This driver is for one-port devices, right?

> +/*UART MCR register offset */
> +#define MXU1_UART_OFFSET_MCR 0x0004
> +
> +#define MXU1_SET_SERIAL_FLAGS0
> +
> +#define MXU1_TRANSFER_TIMEOUT2
> +#define MXU1_MSR_WAIT_TIMEOUT(5 * HZ)

This one does not seem to be used either.

> +
> +/* Configuration ids */
> +#define MXU1_BOOT_CONFIG 1
> +#define MXU1_ACTIVE_CONFIG   2

Nor are these. Please drop unused defines unless useful for future feature
additions (e.g. register definitions).

> +
> +#define MXU1_DEFAULT_CLOSING_WAIT   4000 /* in .01 secs */
> +
> +struct mxu1_port {
> + u8 mxp_msr;
> + u8 mxp_lsr;
> + u8 mxp_shadow_mcr;
> + u8 mxp_uart_types;
> + u8 mxp_uart_mode;
> + unsigned int mxp_uart_base_addr;

u32 or u16?

> + int mxp_flags;
> + int mxp_msr_wait_flags;
> + wait_queue_head_t mxp_msr_wait; /* wait for msr change */
> + struct mxu1_device *mxp_mxdev;
> + struct usb_serial_port *mxp_port;
> + spinlock_t mxp_lock;
> + int mxp_send_break;
> + int mxp_set_B0;
> +};
> +
> +struct mxu1_device {
> + struct mutex mxd_lock;
> + struct usb_serial *mxd_serial;
> + u16 mxd_model;
> +};
> +
> +static const struct usb_device_id mxuport11_idtable[] = {
> + { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1110_PRODUCT_ID) },
> + { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1130_PRODUCT_ID) },
> + { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) },

Re: [PATCH] Removed extra spaces, and error from checkpatch.pl

2015-09-26 Thread Jes Sorensen
Pinkesh Badjatiya  writes:
> Removed trailing spaces.
> Fixed some errors from checkpatch.pl verification.
> No changes made to actual functional code.
>
> Signed-off-by: Pinkesh Badjatiya 
> ---
>  drivers/staging/rtl8723au/include/rtw_cmd.h | 162 
> ++--
>  1 file changed, 80 insertions(+), 82 deletions(-)

Please read the guidelines for how to post a patch for staging. The
subject line needs to have the correct prefixes for it to be considered.

Jes
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] mm: fix cpu hangs on truncating last page of a 16t sparse file

2015-09-26 Thread angelo

Hi Hugh,

thanks for the fast reply..

Looks like the XFS file system can support files until 16 Tera
when CONFIG_LBDAF is enabled.

On XFS, 32 bit arch, s_maxbytes is actually set (CONFIG_LBDAF=y) as
17592186044415.

But if s_maxbytes doesn't have to be greater than MAX_LFS_FILESIZE,
i agree the issue should be fixed in layers above.

The fact is that everything still works correct until an index as
17592186044415 - 4096, and there can be users that could already
have so big files in use in their setup.

What do you think ?

Best regards
Angelo Dureghello

On 27/09/2015 03:36, Hugh Dickins wrote:

Let's Cc linux-fsdevel, who will be more knowledgable.

On Sun, 27 Sep 2015, angelo wrote:


Hi all,

running xfstests, generic 308 on whatever 32bit arch is possible
to observe cpu to hang near 100% on unlink.
The test removes a sparse file of length 16tera where only the last
4096 bytes block is mapped.
At line 265 of truncate.c there is a
if (index >= end)
 break;
But if index is, as in this case, a 4294967295, it match -1 used as
eof. Hence the cpu loops 100% just after.

That's odd.  I've not checked your patch, because I think the problem
would go beyond truncate, and the root cause lie elsewhere.

My understanding is that the 32-bit
#define MAX_LFS_FILESIZE (((loff_t)PAGE_CACHE_SIZE << (BITS_PER_LONG-1))-1)
makes a page->index of -1 (or any "negative") impossible to reach.

I don't know offhand the rules for mounting a filesystem populated with
a 64-bit kernel on a 32-bit kernel, what's to happen when a too-large
file is encountered; but assume that's not the case here - you're
just running xfstests/tests/generic/308.

Is pwrite missing a check for offset beyond s_maxbytes?

Or is this filesystem-dependent?  Which filesystem?

Hugh


---

On 32bit archs, with CONFIG_LBDAF=y, if truncating last page
of a 16tera file, "index" variable is set to 4294967295, and hence
matches with -1 used as EOF value. This result in an inifite loop
when unlink is executed on this file.

Signed-off-by: Angelo Dureghello 
---
  mm/truncate.c | 11 ++-
  1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mm/truncate.c b/mm/truncate.c
index 76e35ad..3751034 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,14 +283,15 @@ void truncate_inode_pages_range(struct address_space
*mapping,
 pagevec_remove_exceptionals();
 pagevec_release();
 cond_resched();
-   index++;
+   if (index < end)
+   index++;
 }

 if (partial_start) {
 struct page *page = find_lock_page(mapping, start - 1);
 if (page) {
 unsigned int top = PAGE_CACHE_SIZE;
-   if (start > end) {
+   if (start > end && end != -1) {
 /* Truncation within a single page */
 top = partial_end;
 partial_end = 0;
@@ -322,7 +323,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,
  * If the truncation happened within a single page no pages
  * will be released, just zeroed, so we can bail out now.
  */
-   if (start >= end)
+   if (start >= end && end != -1)
 return;

 index = start;
@@ -337,7 +338,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,
 index = start;
 continue;
 }
-   if (index == start && indices[0] >= end) {
+   if (index == start && (indices[0] >= end && end != -1)) {
 /* All gone out of hole to be punched, we're done */
 pagevec_remove_exceptionals();
 pagevec_release();
@@ -348,7 +349,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,

 /* We rely upon deletion not changing page->index */
 index = indices[i];
-   if (index >= end) {
+   if (index >= end && (end != -1)) {
 /* Restart punch to make sure all gone */
 index = start - 1;
 break;
--
2.5.3


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] mm: fix cpu hangs on truncating last page of a 16t sparse file

2015-09-26 Thread angelo

Hi Hugh,

thanks for the fast reply..

Looks like the XFS file system can support files until 16 Tera
when CONFIG_LBDAF is enabled.

On XFS, 32 bit arch, s_maxbytes is actually set (CONFIG_LBDAF=y) as
17592186044415.

But if s_maxbytes doesn't have to be greater than MAX_LFS_FILESIZE,
i agree the issue should be fixed in layers above.

The fact is that everything still works correct until an index as
17592186044415 - 4096, and there can be users that could already
have so big files in use in their setup.

What do you think ?

Best regards
Angelo Dureghello


On 27/09/2015 03:36, Hugh Dickins wrote:

Let's Cc linux-fsdevel, who will be more knowledgable.

On Sun, 27 Sep 2015, angelo wrote:


Hi all,

running xfstests, generic 308 on whatever 32bit arch is possible
to observe cpu to hang near 100% on unlink.
The test removes a sparse file of length 16tera where only the last
4096 bytes block is mapped.
At line 265 of truncate.c there is a
if (index >= end)
 break;
But if index is, as in this case, a 4294967295, it match -1 used as
eof. Hence the cpu loops 100% just after.

That's odd.  I've not checked your patch, because I think the problem
would go beyond truncate, and the root cause lie elsewhere.

My understanding is that the 32-bit
#define MAX_LFS_FILESIZE (((loff_t)PAGE_CACHE_SIZE << (BITS_PER_LONG-1))-1)
makes a page->index of -1 (or any "negative") impossible to reach.

I don't know offhand the rules for mounting a filesystem populated with
a 64-bit kernel on a 32-bit kernel, what's to happen when a too-large
file is encountered; but assume that's not the case here - you're
just running xfstests/tests/generic/308.

Is pwrite missing a check for offset beyond s_maxbytes?

Or is this filesystem-dependent?  Which filesystem?

Hugh


---

On 32bit archs, with CONFIG_LBDAF=y, if truncating last page
of a 16tera file, "index" variable is set to 4294967295, and hence
matches with -1 used as EOF value. This result in an inifite loop
when unlink is executed on this file.

Signed-off-by: Angelo Dureghello 
---
  mm/truncate.c | 11 ++-
  1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mm/truncate.c b/mm/truncate.c
index 76e35ad..3751034 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,14 +283,15 @@ void truncate_inode_pages_range(struct address_space
*mapping,
 pagevec_remove_exceptionals();
 pagevec_release();
 cond_resched();
-   index++;
+   if (index < end)
+   index++;
 }

 if (partial_start) {
 struct page *page = find_lock_page(mapping, start - 1);
 if (page) {
 unsigned int top = PAGE_CACHE_SIZE;
-   if (start > end) {
+   if (start > end && end != -1) {
 /* Truncation within a single page */
 top = partial_end;
 partial_end = 0;
@@ -322,7 +323,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,
  * If the truncation happened within a single page no pages
  * will be released, just zeroed, so we can bail out now.
  */
-   if (start >= end)
+   if (start >= end && end != -1)
 return;

 index = start;
@@ -337,7 +338,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,
 index = start;
 continue;
 }
-   if (index == start && indices[0] >= end) {
+   if (index == start && (indices[0] >= end && end != -1)) {
 /* All gone out of hole to be punched, we're done */
 pagevec_remove_exceptionals();
 pagevec_release();
@@ -348,7 +349,7 @@ void truncate_inode_pages_range(struct address_space
*mapping,

 /* We rely upon deletion not changing page->index */
 index = indices[i];
-   if (index >= end) {
+   if (index >= end && (end != -1)) {
 /* Restart punch to make sure all gone */
 index = start - 1;
 break;
--
2.5.3


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] mm: fix cpu hangs on truncating last page of a 16t sparse file

2015-09-26 Thread Hugh Dickins
Let's Cc linux-fsdevel, who will be more knowledgable.

On Sun, 27 Sep 2015, angelo wrote:

> Hi all,
> 
> running xfstests, generic 308 on whatever 32bit arch is possible
> to observe cpu to hang near 100% on unlink.
> The test removes a sparse file of length 16tera where only the last
> 4096 bytes block is mapped.
> At line 265 of truncate.c there is a
> if (index >= end)
> break;
> But if index is, as in this case, a 4294967295, it match -1 used as
> eof. Hence the cpu loops 100% just after.

That's odd.  I've not checked your patch, because I think the problem
would go beyond truncate, and the root cause lie elsewhere.

My understanding is that the 32-bit
#define MAX_LFS_FILESIZE (((loff_t)PAGE_CACHE_SIZE << (BITS_PER_LONG-1))-1) 
makes a page->index of -1 (or any "negative") impossible to reach.

I don't know offhand the rules for mounting a filesystem populated with
a 64-bit kernel on a 32-bit kernel, what's to happen when a too-large
file is encountered; but assume that's not the case here - you're
just running xfstests/tests/generic/308.

Is pwrite missing a check for offset beyond s_maxbytes?

Or is this filesystem-dependent?  Which filesystem?

Hugh

> 
> ---
> 
> On 32bit archs, with CONFIG_LBDAF=y, if truncating last page
> of a 16tera file, "index" variable is set to 4294967295, and hence
> matches with -1 used as EOF value. This result in an inifite loop
> when unlink is executed on this file.
> 
> Signed-off-by: Angelo Dureghello 
> ---
>  mm/truncate.c | 11 ++-
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/truncate.c b/mm/truncate.c
> index 76e35ad..3751034 100644
> --- a/mm/truncate.c
> +++ b/mm/truncate.c
> @@ -283,14 +283,15 @@ void truncate_inode_pages_range(struct address_space
> *mapping,
> pagevec_remove_exceptionals();
> pagevec_release();
> cond_resched();
> -   index++;
> +   if (index < end)
> +   index++;
> }
> 
> if (partial_start) {
> struct page *page = find_lock_page(mapping, start - 1);
> if (page) {
> unsigned int top = PAGE_CACHE_SIZE;
> -   if (start > end) {
> +   if (start > end && end != -1) {
> /* Truncation within a single page */
> top = partial_end;
> partial_end = 0;
> @@ -322,7 +323,7 @@ void truncate_inode_pages_range(struct address_space
> *mapping,
>  * If the truncation happened within a single page no pages
>  * will be released, just zeroed, so we can bail out now.
>  */
> -   if (start >= end)
> +   if (start >= end && end != -1)
> return;
> 
> index = start;
> @@ -337,7 +338,7 @@ void truncate_inode_pages_range(struct address_space
> *mapping,
> index = start;
> continue;
> }
> -   if (index == start && indices[0] >= end) {
> +   if (index == start && (indices[0] >= end && end != -1)) {
> /* All gone out of hole to be punched, we're done */
> pagevec_remove_exceptionals();
> pagevec_release();
> @@ -348,7 +349,7 @@ void truncate_inode_pages_range(struct address_space
> *mapping,
> 
> /* We rely upon deletion not changing page->index */
> index = indices[i];
> -   if (index >= end) {
> +   if (index >= end && (end != -1)) {
> /* Restart punch to make sure all gone */
> index = start - 1;
> break;
> -- 
> 2.5.3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH] [v2] ACPI / PM: Fix incorrect wakeup irq setting before suspend-to-idle

2015-09-26 Thread Chen Yu
For ACPI compatible system, SCI(ACPI System Control
Interrupt) is used to wake system up from suspend-to-idle.
Once CPU is woken up by SCI, interrupt handler will
firstly checks if current interrupt is legal to wake up
the whole system, thus irq_pm_check_wakeup is invoked
to validate the irq number. However, before suspend-to-idle,
acpi_gbl_FADT.sci_interrupt is marked rather than actual
irq number in acpi_freeze_prepare, this might lead to unable
to wake up the system.

This patch fixes this problem by marking the irq number
return by acpi_gsi_to_irq as IRQD_WAKEUP_STATE, rather than
marking the acpi_gbl_FADT.sci_interrupt. Meanwhile this patch
fixes the same problems inside acpi_os_remove_interrupt_handler
and acpi_os_wait_events_complete respectively.

Signed-off-by: Chen Yu 
---
v2:
 - 1.Define a global acpi_inuse_irq variable, store irq in it
   and access it directly from acpi_freeze_prepare(), and it
   doesn't have to depend on CONFIG_SUSPEND as it is just the
   IRQ number actually used by ACPI.
   2.Also fix the same problems inside acpi_os_remove_interrupt_handler,
   acpi_os_wait_events_complete.
---
 drivers/acpi/osl.c   |  9 -
 drivers/acpi/sleep.c | 10 --
 include/linux/acpi.h |  3 +++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 739a4a6..97507fc 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -81,6 +81,7 @@ static struct workqueue_struct *kacpid_wq;
 static struct workqueue_struct *kacpi_notify_wq;
 static struct workqueue_struct *kacpi_hotplug_wq;
 static bool acpi_os_initialized;
+unsigned int acpi_inuse_irq = INVALID_ACPI_IRQ;
 
 /*
  * This list of permanent mappings is for memory that may be accessed from
@@ -856,6 +857,7 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_handler 
handler,
acpi_irq_handler = NULL;
return AE_NOT_ACQUIRED;
}
+   acpi_inuse_irq = irq;
 
return AE_OK;
 }
@@ -865,6 +867,9 @@ acpi_status acpi_os_remove_interrupt_handler(u32 irq, 
acpi_osd_handler handler)
if (irq != acpi_gbl_FADT.sci_interrupt)
return AE_BAD_PARAMETER;
 
+   if (!IS_INVALID_ACPI_IRQ(acpi_inuse_irq))
+   irq = acpi_inuse_irq;
+
free_irq(irq, acpi_irq);
acpi_irq_handler = NULL;
 
@@ -1176,12 +1181,14 @@ EXPORT_SYMBOL(acpi_os_execute);
 
 void acpi_os_wait_events_complete(void)
 {
+   unsigned int irq = IS_INVALID_ACPI_IRQ(acpi_inuse_irq) ?
+   acpi_gbl_FADT.sci_interrupt : acpi_inuse_irq;
/*
 * Make sure the GPE handler or the fixed event handler is not used
 * on another CPU after removal.
 */
if (acpi_irq_handler)
-   synchronize_hardirq(acpi_gbl_FADT.sci_interrupt);
+   synchronize_hardirq(irq);
flush_workqueue(kacpid_wq);
flush_workqueue(kacpi_notify_wq);
 }
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 2f0d4db..a7a467b 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -629,17 +629,23 @@ static int acpi_freeze_begin(void)
 
 static int acpi_freeze_prepare(void)
 {
+   unsigned int irq = IS_INVALID_ACPI_IRQ(acpi_inuse_irq) ?
+   acpi_gbl_FADT.sci_interrupt : acpi_inuse_irq;
+
acpi_enable_wakeup_devices(ACPI_STATE_S0);
acpi_enable_all_wakeup_gpes();
acpi_os_wait_events_complete();
-   enable_irq_wake(acpi_gbl_FADT.sci_interrupt);
+   enable_irq_wake(irq);
return 0;
 }
 
 static void acpi_freeze_restore(void)
 {
+   unsigned int irq = IS_INVALID_ACPI_IRQ(acpi_inuse_irq) ?
+   acpi_gbl_FADT.sci_interrupt : acpi_inuse_irq;
+
acpi_disable_wakeup_devices(ACPI_STATE_S0);
-   disable_irq_wake(acpi_gbl_FADT.sci_interrupt);
+   disable_irq_wake(irq);
acpi_enable_all_runtime_gpes();
 }
 
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 7235c48..df8ed19 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -193,6 +193,9 @@ int acpi_ioapic_registered(acpi_handle handle, u32 
gsi_base);
 void acpi_irq_stats_init(void);
 extern u32 acpi_irq_handled;
 extern u32 acpi_irq_not_handled;
+extern unsigned int acpi_inuse_irq;
+#define INVALID_ACPI_IRQ  ((unsigned)-1)
+#define IS_INVALID_ACPI_IRQ(x) unlikely((x) == INVALID_ACPI_IRQ)
 
 extern int sbf_port;
 extern unsigned long acpi_realmode_flags;
-- 
1.8.4.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH] pinctrl: berlin: fix BG2CD field widths

2015-09-26 Thread Thomas Hebb
The previous register layout was incorrect, many of the fields having
fewer bits than were needed to represent all their modes. The new layout
is taken from the bootloader source of a BG2CD device.

Signed-off-by: Thomas Hebb 
---
 drivers/pinctrl/berlin/berlin-bg2cd.c | 62
++-
 1 file changed, 32 insertions(+), 30 deletions(-)

diff --git a/drivers/pinctrl/berlin/berlin-bg2cd.c
b/drivers/pinctrl/berlin/berlin-bg2cd.c
index 0cb793a..af5e465 100644
--- a/drivers/pinctrl/berlin/berlin-bg2cd.c
+++ b/drivers/pinctrl/berlin/berlin-bg2cd.c
@@ -19,24 +19,24 @@

 static const struct berlin_desc_group berlin2cd_soc_pinctrl_groups[] = {
/* G */
-   BERLIN_PINCTRL_GROUP("G0", 0x00, 0x1, 0x00,
+   BERLIN_PINCTRL_GROUP("G0", 0x00, 0x3, 0x00,
BERLIN_PINCTRL_FUNCTION(0x0, "jtag"),
BERLIN_PINCTRL_FUNCTION(0x1, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x2, "led"),
BERLIN_PINCTRL_FUNCTION(0x3, "pwm")),
-   BERLIN_PINCTRL_GROUP("G1", 0x00, 0x2, 0x01,
+   BERLIN_PINCTRL_GROUP("G1", 0x00, 0x3, 0x03,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "sd0"),
BERLIN_PINCTRL_FUNCTION(0x6, "usb0_dbg"),
BERLIN_PINCTRL_FUNCTION(0x7, "usb1_dbg")),
-   BERLIN_PINCTRL_GROUP("G2", 0x00, 0x2, 0x02,
+   BERLIN_PINCTRL_GROUP("G2", 0x00, 0x3, 0x06,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "sd0"),
BERLIN_PINCTRL_FUNCTION(0x2, "fe"),
BERLIN_PINCTRL_FUNCTION(0x3, "pll"),
BERLIN_PINCTRL_FUNCTION(0x6, "usb0_dbg"),
BERLIN_PINCTRL_FUNCTION(0x7, "usb1_dbg")),
-   BERLIN_PINCTRL_GROUP("G3", 0x00, 0x2, 0x04,
+   BERLIN_PINCTRL_GROUP("G3", 0x00, 0x3, 0x09,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "sd0"),
BERLIN_PINCTRL_FUNCTION(0x2, "twsi2"),
@@ -44,7 +44,7 @@ static const struct berlin_desc_group
berlin2cd_soc_pinctrl_groups[] = {
BERLIN_PINCTRL_FUNCTION(0x4, "fe"),
BERLIN_PINCTRL_FUNCTION(0x6, "usb0_dbg"),
BERLIN_PINCTRL_FUNCTION(0x7, "usb1_dbg")),
-   BERLIN_PINCTRL_GROUP("G4", 0x00, 0x2, 0x06,
+   BERLIN_PINCTRL_GROUP("G4", 0x00, 0x3, 0x0c,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "sd0"),
BERLIN_PINCTRL_FUNCTION(0x2, "twsi3"),
@@ -52,7 +52,7 @@ static const struct berlin_desc_group
berlin2cd_soc_pinctrl_groups[] = {
BERLIN_PINCTRL_FUNCTION(0x4, "pwm"),
BERLIN_PINCTRL_FUNCTION(0x6, "usb0_dbg"),
BERLIN_PINCTRL_FUNCTION(0x7, "usb1_dbg")),
-   BERLIN_PINCTRL_GROUP("G5", 0x00, 0x3, 0x08,
+   BERLIN_PINCTRL_GROUP("G5", 0x00, 0x3, 0x0f,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "sd0"),
BERLIN_PINCTRL_FUNCTION(0x2, "twsi3"),
@@ -60,64 +60,66 @@ static const struct berlin_desc_group
berlin2cd_soc_pinctrl_groups[] = {
BERLIN_PINCTRL_FUNCTION(0x4, "pwm"),
BERLIN_PINCTRL_FUNCTION(0x6, "usb0_dbg"),
BERLIN_PINCTRL_FUNCTION(0x7, "usb1_dbg")),
-   BERLIN_PINCTRL_GROUP("G6", 0x00, 0x2, 0x0b,
+   BERLIN_PINCTRL_GROUP("G6", 0x00, 0x3, 0x12,
BERLIN_PINCTRL_FUNCTION(0x0, "uart0"),  /* RX/TX */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio")),
-   BERLIN_PINCTRL_GROUP("G7", 0x00, 0x3, 0x0d,
+   BERLIN_PINCTRL_GROUP("G7", 0x00, 0x3, 0x15,
BERLIN_PINCTRL_FUNCTION(0x0, "eddc"),
BERLIN_PINCTRL_FUNCTION(0x1, "twsi1"),
BERLIN_PINCTRL_FUNCTION(0x2, "gpio")),
-   BERLIN_PINCTRL_GROUP("G8", 0x00, 0x3, 0x10,
+   BERLIN_PINCTRL_GROUP("G8", 0x00, 0x3, 0x18,
BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio")),
-   BERLIN_PINCTRL_GROUP("G9", 0x00, 0x3, 0x13,
+   BERLIN_PINCTRL_GROUP("G9", 0x00, 0x3, 0x1b,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"),
BERLIN_PINCTRL_FUNCTION(0x1, "spi1"), /* SS1n/SS2n */
-   BERLIN_PINCTRL_FUNCTION(0x2, "twsi0")),
-   BERLIN_PINCTRL_GROUP("G10", 0x00, 0x2, 0x16,
+   BERLIN_PINCTRL_FUNCTION(0x3, "twsi0")),
+   BERLIN_PINCTRL_GROUP("G10", 0x00, 0x2, 0x1e,
BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* CLK */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio")),
-   BERLIN_PINCTRL_GROUP("G11", 0x00, 0x2, 0x18,
+   BERLIN_PINCTRL_GROUP("G11", 0x04, 0x2, 0x00,
BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SDI/SDO */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio")),
-   BERLIN_PINCTRL_GROUP("G12", 0x00, 0x3, 0x1a,
+   BERLIN_PINCTRL_GROUP("G12", 0x04, 0x3, 0x02,

[PATCH 2/4 RESEND] ARM: dts: berlin: change BG2Q's USB PHY compatible

2015-09-26 Thread Thomas Hebb
Currently, BG2Q shares a compatible with BG2. This is incorrect, since
BG2 and BG2Q use different USB PLL dividers. In reality, BG2Q shares a
divider with BG2CD. Change BG2Q's USB PHY compatible string to reflect
that.

Signed-off-by: Thomas Hebb 
Cc: sta...@vger.kernel.org
---
This patch seems to have been missed from my original series (all the
rest made it into 4.2), and as a result the BG2Q currently uses the
wrong divider.

 arch/arm/boot/dts/berlin2q.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/berlin2q.dtsi
b/arch/arm/boot/dts/berlin2q.dtsi
index 63a4849..d4dbd28 100644
--- a/arch/arm/boot/dts/berlin2q.dtsi
+++ b/arch/arm/boot/dts/berlin2q.dtsi
@@ -152,7 +152,7 @@
};

usb_phy2: phy@a2f400 {
-   compatible = "marvell,berlin2-usb-phy";
+   compatible = "marvell,berlin2cd-usb-phy";
reg = <0xa2f400 0x128>;
#phy-cells = <0>;
resets = <_rst 0x104 14>;
@@ -170,7 +170,7 @@
};

usb_phy0: phy@b74000 {
-   compatible = "marvell,berlin2-usb-phy";
+   compatible = "marvell,berlin2cd-usb-phy";
reg = <0xb74000 0x128>;
#phy-cells = <0>;
resets = <_rst 0x104 12>;
@@ -178,7 +178,7 @@
};

usb_phy1: phy@b78000 {
-   compatible = "marvell,berlin2-usb-phy";
+   compatible = "marvell,berlin2cd-usb-phy";
reg = <0xb78000 0x128>;
#phy-cells = <0>;
resets = <_rst 0x104 13>;
-- 
2.4.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 4.1 000/159] 4.1.9-stable review (build error)

2015-09-26 Thread Guenter Roeck

On 09/26/2015 01:54 PM, Greg Kroah-Hartman wrote:

This is the start of the stable review cycle for the 4.1.9 release.
There are 159 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Sep 28 20:51:39 UTC 2015.
Anything received after that time might be too late.



This is an early report, build is still going on.

Building powerpc:defconfig ... failed
Building powerpc:allmodconfig ... failed

drivers/misc/cxl/pci.c: In function 'cxl_reset':
drivers/misc/cxl/pci.c:784:7: error: 'i' undeclared (first use in this function)
  for (i = 0; i < adapter->slices; i++)

Culprit is 'cxl: Remove racy attempt to force EEH invocation in reset'.
The build passes after reverting this commit.

I had reported the same problem earlier against 4.2. Feedback was that
4e1efb403c1c ("cxl: Don't remove AFUs/vPHBs in cxl_reset")
was also needed. Unfortunately, that patch does not apply cleanly to 4.1,
so some backport or an additional patch may be needed.

Copying Daniel for additional input.

Guenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH] Removed extra spaces, and error from checkpatch.pl

2015-09-26 Thread Pinkesh Badjatiya
Removed trailing spaces.
Fixed some errors from checkpatch.pl verification.
No changes made to actual functional code.

Signed-off-by: Pinkesh Badjatiya 
---
 drivers/staging/rtl8723au/include/rtw_cmd.h | 162 ++--
 1 file changed, 80 insertions(+), 82 deletions(-)

diff --git a/drivers/staging/rtl8723au/include/rtw_cmd.h 
b/drivers/staging/rtl8723au/include/rtw_cmd.h
index d1fa95d..82e6411 100644
--- a/drivers/staging/rtl8723au/include/rtw_cmd.h
+++ b/drivers/staging/rtl8723au/include/rtw_cmd.h
@@ -60,10 +60,10 @@ struct  evt_priv {
 do {\
pcmd->cmdcode = code;\
pcmd->parmbuf = (u8 *)(pparm);\
-   pcmd->cmdsz = sizeof (*pparm);\
+   pcmd->cmdsz = sizeof(*pparm);\
pcmd->rsp = NULL;\
pcmd->rspsz = 0;\
-} while(0)
+} while (0)
 
 struct c2h_evt_hdr {
u8 id:4;
@@ -97,12 +97,11 @@ int rtw_cmd_thread23a(void *context);
 
 int rtw_init_cmd_priv23a(struct cmd_priv *pcmdpriv);
 
-u32 rtw_init_evt_priv23a (struct evt_priv *pevtpriv);
-void rtw_free_evt_priv23a (struct evt_priv *pevtpriv);
+u32 rtw_init_evt_priv23a(struct evt_priv *pevtpriv);
+void rtw_free_evt_priv23a(struct evt_priv *pevtpriv);
 void rtw_evt_notify_isr(struct evt_priv *pevtpriv);
 
-enum rtw_drvextra_cmd_id
-{
+enum rtw_drvextra_cmd_id {
NONE_WK_CID,
DYNAMIC_CHK_WK_CID,
DM_CTRL_WK_CID,
@@ -118,14 +117,13 @@ enum rtw_drvextra_cmd_id
MAX_WK_CID
 };
 
-enum LPS_CTRL_TYPE
-{
-   LPS_CTRL_SCAN=0,
-   LPS_CTRL_JOINBSS=1,
-   LPS_CTRL_CONNECT=2,
-   LPS_CTRL_DISCONNECT=3,
-   LPS_CTRL_SPECIAL_PACKET=4,
-   LPS_CTRL_LEAVE=5,
+enum LPS_CTRL_TYPE {
+   LPS_CTRL_SCAN = 0,
+   LPS_CTRL_JOINBSS = 1,
+   LPS_CTRL_CONNECT = 2,
+   LPS_CTRL_DISCONNECT = 3,
+   LPS_CTRL_SPECIAL_PACKET = 4,
+   LPS_CTRL_LEAVE = 5,
 };
 
 enum RFINTFS {
@@ -555,41 +553,41 @@ struct getratable_rsp {
 };
 
 /* to get TX,RX retry count */
-struct gettxretrycnt_parm{
+struct gettxretrycnt_parm {
unsigned int rsvd;
 };
-struct gettxretrycnt_rsp{
+struct gettxretrycnt_rsp {
unsigned long tx_retrycnt;
 };
 
-struct getrxretrycnt_parm{
+struct getrxretrycnt_parm {
unsigned int rsvd;
 };
-struct getrxretrycnt_rsp{
+struct getrxretrycnt_rsp {
unsigned long rx_retrycnt;
 };
 
 /* to get BCNOK,BCNERR count */
-struct getbcnokcnt_parm{
+struct getbcnokcnt_parm {
unsigned int rsvd;
 };
-struct getbcnokcnt_rsp{
+struct getbcnokcnt_rsp {
unsigned long  bcnokcnt;
 };
 
-struct getbcnerrcnt_parm{
+struct getbcnerrcnt_parm {
unsigned int rsvd;
 };
-struct getbcnerrcnt_rsp{
+struct getbcnerrcnt_rsp {
unsigned long bcnerrcnt;
 };
 
 /*  to get current TX power level */
-struct getcurtxpwrlevel_parm{
+struct getcurtxpwrlevel_parm {
unsigned int rsvd;
 };
 
-struct getcurtxpwrlevel_rsp{
+struct getcurtxpwrlevel_rsp {
unsigned short tx_power;
 };
 
@@ -683,38 +681,38 @@ int rtw_createbss_cmd23a_ex(struct rtw_adapter  
*padapter, unsigned char *pbss,
 int rtw_setphy_cmd(struct rtw_adapter  *padapter, u8 modem, u8 ch);
 int rtw_setstakey_cmd23a(struct rtw_adapter  *padapter, u8 *psta, u8 
unicast_key);
 int rtw_clearstakey_cmd23a(struct rtw_adapter *padapter, u8 *psta, u8 entry, 
u8 enqueue);
-int rtw_joinbss_cmd23a(struct rtw_adapter  *padapter, struct wlan_network* 
pnetwork);
+int rtw_joinbss_cmd23a(struct rtw_adapter *padapter, struct wlan_network 
*pnetwork);
 int rtw_disassoc_cmd23a(struct rtw_adapter *padapter, u32 deauth_timeout_ms, 
bool enqueue);
 int rtw_setopmode_cmd23a(struct rtw_adapter *padapter, enum nl80211_iftype 
ifmode);
-int rtw_setdatarate_cmd(struct rtw_adapter  *padapter, u8 *rateset);
-int rtw_setbasicrate_cmd(struct rtw_adapter  *padapter, u8 *rateset);
+int rtw_setdatarate_cmd(struct rtw_adapter *padapter, u8 *rateset);
+int rtw_setbasicrate_cmd(struct rtw_adapter *padapter, u8 *rateset);
 int rtw_setbbreg_cmd(struct rtw_adapter *padapter, u8 offset, u8 val);
 int rtw_setrfreg_cmd(struct rtw_adapter *padapter, u8 offset, u32 val);
 int rtw_getbbreg_cmd(struct rtw_adapter *padapter, u8 offset, u8 *pval);
 int rtw_getrfreg_cmd(struct rtw_adapter *padapter, u8 offset, u8 *pval);
-int rtw_setrfintfs_cmd(struct rtw_adapter  *padapter, u8 mode);
-int rtw_setrttbl_cmd(struct rtw_adapter  *padapter, struct setratable_parm 
*prate_table);
-int rtw_getrttbl_cmd(struct rtw_adapter  *padapter, struct getratable_rsp 
*pval);
+int rtw_setrfintfs_cmd(struct rtw_adapter *padapter, u8 mode);
+int rtw_setrttbl_cmd(struct rtw_adapter *padapter, struct setratable_parm 
*prate_table);
+int rtw_getrttbl_cmd(struct rtw_adapter *padapter, struct getratable_rsp 
*pval);
 
-int rtw_gettssi_cmd(struct rtw_adapter  *padapter, u8 offset, u8 *pval);
-int rtw_setfwdig_cmd(struct rtw_adapter*padapter, u8 type);
-int rtw_setfwra_cmd(struct rtw_adapter*padapter, u8 type);
+int rtw_gettssi_cmd(struct rtw_adapter *padapter, u8 offset, u8 *pval);
+int rtw_setfwdig_cmd(struct rtw_adapter 

[PATCH] mm: fix cpu hangs on truncating last page of a 16t sparse file

2015-09-26 Thread angelo

Hi all,

running xfstests, generic 308 on whatever 32bit arch is possible
to observe cpu to hang near 100% on unlink.
The test removes a sparse file of length 16tera where only the last
4096 bytes block is mapped.
At line 265 of truncate.c there is a
if (index >= end)
break;
But if index is, as in this case, a 4294967295, it match -1 used as
eof. Hence the cpu loops 100% just after.

---

On 32bit archs, with CONFIG_LBDAF=y, if truncating last page
of a 16tera file, "index" variable is set to 4294967295, and hence
matches with -1 used as EOF value. This result in an inifite loop
when unlink is executed on this file.

Signed-off-by: Angelo Dureghello 
---
 mm/truncate.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mm/truncate.c b/mm/truncate.c
index 76e35ad..3751034 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,14 +283,15 @@ void truncate_inode_pages_range(struct 
address_space *mapping,

pagevec_remove_exceptionals();
pagevec_release();
cond_resched();
-   index++;
+   if (index < end)
+   index++;
}

if (partial_start) {
struct page *page = find_lock_page(mapping, start - 1);
if (page) {
unsigned int top = PAGE_CACHE_SIZE;
-   if (start > end) {
+   if (start > end && end != -1) {
/* Truncation within a single page */
top = partial_end;
partial_end = 0;
@@ -322,7 +323,7 @@ void truncate_inode_pages_range(struct address_space 
*mapping,

 * If the truncation happened within a single page no pages
 * will be released, just zeroed, so we can bail out now.
 */
-   if (start >= end)
+   if (start >= end && end != -1)
return;

index = start;
@@ -337,7 +338,7 @@ void truncate_inode_pages_range(struct address_space 
*mapping,

index = start;
continue;
}
-   if (index == start && indices[0] >= end) {
+   if (index == start && (indices[0] >= end && end != -1)) {
/* All gone out of hole to be punched, we're 
done */

pagevec_remove_exceptionals();
pagevec_release();
@@ -348,7 +349,7 @@ void truncate_inode_pages_range(struct address_space 
*mapping,


/* We rely upon deletion not changing 
page->index */

index = indices[i];
-   if (index >= end) {
+   if (index >= end && (end != -1)) {
/* Restart punch to make sure all gone */
index = start - 1;
break;
--
2.5.3









--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH v2 0/5] drivers/tty: make more bool drivers explicitly non-modular

2015-09-26 Thread Paul Gortmaker
[[PATCH v2 0/5] drivers/tty: make more bool drivers explicitly non-modular] On 
19/08/2015 (Wed 17:48) Paul Gortmaker wrote:

> [v2: drop dead module code removal from 8250_lpc18xx.c ; instead convert it
>  from bool to tristate ; also add ack to hvc_console commit.]
> 
> This second set of patches to drivers/tty steps outside of the serial
> dir, and an improved auditing finds two more serial drivers pretending
> to be modular that really are not.

Hi Greg -- wondering if this is still in your to-do queue.  I see the
patches to drivers/char that I sent about the same time made it onto
your char-testing branch but not these onto tty-testing.

The reason I ask is that I've about a 1/2 dozen more similar patches
that showed up once I started auditing non-x86 code.  I don't want to
re-spam you with these along with the new ones, if these are still in
your backlog for processing.

Thanks,
Paul.
--

> 
> The reasoning for doing this is the same as the first set[1] of patches
> and is largely copied below:
> 
>   In the previous merge window, we made changes to allow better
>   delineation between modular and non-modular code in commit
>   0fd972a7d91d6e15393c449492a04d94c0b89351 ("module: relocate module_init
>   from init.h to module.h").  This allows us to now ensure module code
>   looks modular and non-modular code does not accidentally look modular
>   without suffering build breakage.
>   
>   Here we target code that is, by nature of their Kconfig settings, only
>   available to be built-in, but implicitly presenting itself as being
>   possibly modular by way of using modular headers, macros, and functions.
>   
>   The goal here is to remove that illusion of modularity from these
>   drivers, but in a way that leaves the actual runtime unchanged.
>   In doing so, we remove code that has never been tested and adds
>   no value to the tree.  And we begin the process of expecting a
>   level of consistency between the Kconfig of a driver and the code
>   that the driver uses.
>   
> Build tested for allyesconfig on x86_64, and ARM for lpc81xx, and powerpc
> for hvc_console and mpsc, layered onto tty/tty-next as a baseline.
> 
> Paul.
> 
> [1] 
> https://lkml.kernel.org/r/1437530538-5078-1-git-send-email-paul.gortma...@windriver.com
> --
> 
> Cc: Greg Kroah-Hartman 
> Cc: Jiri Slaby 
> Cc: Joachim Eastwood 
> Cc: linux-arm-ker...@lists.infradead.org
> Cc: linuxppc-...@lists.ozlabs.org
> Cc: linux-ser...@vger.kernel.org
> 
> Paul Gortmaker (5):
>   drivers/tty: make pty.c slightly more explicitly non-modular
>   drivers/tty: make sysrq.c slightly more explicitly non-modular
>   drivers/tty: make hvc_console.c explicitly non-modular
>   drivers/tty: make serial/mpsc.c driver explicitly non-modular
>   drivers/tty: make serial 8250_lpc18xx.c Kconfig a tristate
> 
>  drivers/tty/hvc/hvc_console.c   | 18 +-
>  drivers/tty/pty.c   |  7 +--
>  drivers/tty/serial/8250/Kconfig |  2 +-
>  drivers/tty/serial/mpsc.c   | 36 +++-
>  drivers/tty/sysrq.c |  6 +-
>  5 files changed, 15 insertions(+), 54 deletions(-)
> 
> -- 
> 2.5.0
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 010/134] nfc: nci: hci: Add check on skb nci_hci_send_cmd parameter

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit 5a9e0ffc0f128ecdf7c770f76c268e4f9f3c9118 upstream.

skb can be NULL and may lead to a NULL pointer error.

Add a check condition before setting HCI rx buffer.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 net/nfc/nci/hci.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -233,7 +233,7 @@ int nci_hci_send_cmd(struct nci_dev *nde
r = nci_request(ndev, nci_hci_send_data_req, (unsigned long),
msecs_to_jiffies(NCI_DATA_TIMEOUT));
 
-   if (r == NCI_STATUS_OK)
+   if (r == NCI_STATUS_OK && skb)
*skb = conn_info->rx_skb;
 
return r;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 021/134] mac80211: enable assoc check for mesh interfaces

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Bob Copeland 

commit 3633ebebab2bbe88124388b7620442315c968e8f upstream.

We already set a station to be associated when peering completes, both
in user space and in the kernel.  Thus we should always have an
associated sta before sending data frames to that station.

Failure to check assoc state can cause crashes in the lower-level driver
due to transmitting unicast data frames before driver sta structures
(e.g. ampdu state in ath9k) are initialized.  This occurred when
forwarding in the presence of fixed mesh paths: frames were transmitted
to stations with whom we hadn't yet completed peering.

Reported-by: Alexis Green 
Tested-by: Jesse Jones 
Signed-off-by: Bob Copeland 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/tx.c |3 ---
 1 file changed, 3 deletions(-)

--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -311,9 +311,6 @@ ieee80211_tx_h_check_assoc(struct ieee80
if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
return TX_CONTINUE;
 
-   if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-   return TX_CONTINUE;
-
if (tx->flags & IEEE80211_TX_PS_BUFFERED)
return TX_CONTINUE;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 025/134] ext4: dont manipulate recovery flag when freezing no-journal fs

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Sandeen 

commit c642dc9e1aaed953597e7092d7df329e6234096e upstream.

At some point along this sequence of changes:

f6e63f9 ext4: fold ext4_nojournal_sops into ext4_sops
bb04457 ext4: support freezing ext2 (nojournal) file systems
9ca9238 ext4: Use separate super_operations structure for no_journal filesystems

ext4 started setting needs_recovery on filesystems without journals
when they are unfrozen.  This makes no sense, and in fact confuses
blkid to the point where it doesn't recognize the filesystem at all.

(freeze ext2; unfreeze ext2; run blkid; see no output; run dumpe2fs,
see needs_recovery set on fs w/ no journal).

To fix this, don't manipulate the INCOMPAT_RECOVER feature on
filesystems without journals.

Reported-by: Stu Mark 
Reviewed-by: Jan Kara 
Signed-off-by: Eric Sandeen 
Signed-off-by: Theodore Ts'o 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 fs/ext4/super.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4833,10 +4833,11 @@ static int ext4_freeze(struct super_bloc
error = jbd2_journal_flush(journal);
if (error < 0)
goto out;
+
+   /* Journal blocked and flushed, clear needs_recovery flag. */
+   EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
}
 
-   /* Journal blocked and flushed, clear needs_recovery flag. */
-   EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
error = ext4_commit_super(sb, 1);
 out:
if (journal)
@@ -4854,8 +4855,11 @@ static int ext4_unfreeze(struct super_bl
if (sb->s_flags & MS_RDONLY)
return 0;
 
-   /* Reset the needs_recovery flag before the fs is unlocked. */
-   EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+   if (EXT4_SB(sb)->s_journal) {
+   /* Reset the needs_recovery flag before the fs is unlocked. */
+   EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+   }
+
ext4_commit_super(sb, 1);
return 0;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 022/134] cxl: Allow release of contexts which have been OPENED but not STARTED

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Andrew Donnellan 

commit 7c26b9cf5347c24272152438cdd9675183804425 upstream.

If we open a context but do not start it (either because we do not attempt
to start it, or because it fails to start for some reason), we are left
with a context in state OPENED. Previously, cxl_release_context() only
allowed releasing contexts in state CLOSED, so attempting to release an
OPENED context would fail.

In particular, this bug causes available contexts to run out after some EEH
failures, where drivers attempt to release contexts that have failed to
start.

Allow releasing contexts in any state with a value lower than STARTED, i.e.
OPENED or CLOSED (we can't release a STARTED context as it's currently
using the hardware, and we assume that contexts in any new states which may
be added in future with a value higher than STARTED are also unsafe to
release).

Fixes: 6f7f0b3df6d4 ("cxl: Add AFU virtual PHB and kernel API")
Signed-off-by: Andrew Donnellan 
Signed-off-by: Daniel Axtens 
Acked-by: Ian Munsie 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/misc/cxl/api.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -59,7 +59,7 @@ EXPORT_SYMBOL_GPL(cxl_get_phys_dev);
 
 int cxl_release_context(struct cxl_context *ctx)
 {
-   if (ctx->status != CLOSED)
+   if (ctx->status >= STARTED)
return -EBUSY;
 
put_device(>afu->dev);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 026/134] Revert "ext4: remove block_device_ejected"

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Theodore Ts'o 

commit bdfe0cbd746aa9b2509c2f6d6be17193cf7facd7 upstream.

This reverts commit 08439fec266c3cc5702953b4f54bdf5649357de0.

Unfortunately we still need to test for bdi->dev to avoid a crash when a
USB stick is yanked out while a file system is mounted:

   usb 2-2: USB disconnect, device number 2
   Buffer I/O error on dev sdb1, logical block 15237120, lost sync page write
   JBD2: Error -5 detected when updating journal superblock for sdb1-8.
   BUG: unable to handle kernel paging request at 34beb000
   IP: [] __percpu_counter_add+0x18/0xc0
   *pdpt = 23db9001 *pde = 
   Oops:  [#1] SMP
   CPU: 0 PID: 4083 Comm: umount Tainted: G U OE   4.1.1-040101-generic 
#201507011435
   Hardware name: LENOVO 7675CTO/7675CTO, BIOS 7NETC2WW (2.22 ) 03/22/2011
   task: ebf06b50 ti: ebebc000 task.ti: ebebc000
   EIP: 0060:[] EFLAGS: 00010082 CPU: 0
   EIP is at __percpu_counter_add+0x18/0xc0
   EAX: f21c8e88 EBX: f21c8e88 ECX:  EDX: 0001
   ESI: 0001 EDI:  EBP: ebebde60 ESP: ebebde40
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
   CR0: 8005003b CR2: 34beb000 CR3: 33354200 CR4: 07f0
   Stack:
c1abe100 edcb0098 edcb00ec  f21c8e68  f21c8e68 f286d160
ebebde84 c1160454 0010 0282 f72a77f8 0984 f72a77f8 f286d160
f286d170 ebebdea0 c11e613f  0282 f72a77f8 edd7f4d0 
   Call Trace:
[] account_page_dirtied+0x74/0x110
[] __set_page_dirty+0x3f/0xb0
[] mark_buffer_dirty+0x53/0xc0
[] ext4_commit_super+0x17b/0x250
[] ext4_put_super+0xc1/0x320
[] ? fsnotify_unmount_inodes+0x1aa/0x1c0
[] ? evict_inodes+0xca/0xe0
[] generic_shutdown_super+0x6a/0xe0
[] ? prepare_to_wait_event+0xd0/0xd0
[] ? unregister_shrinker+0x40/0x50
[] kill_block_super+0x26/0x70
[] deactivate_locked_super+0x45/0x80
[] deactivate_super+0x47/0x60
[] cleanup_mnt+0x39/0x80
[] __cleanup_mnt+0x10/0x20
[] task_work_run+0x91/0xd0
[] do_notify_resume+0x7c/0x90
[] work_notify
   Code: 8b 55 e8 e9 f4 fe ff ff 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 83 
ec 20 89 5d f4 89 c3 89 75 f8 89 d6 89 7d fc 89 cf 8b 48 14 <64> 8b 01 89 45 ec 
89 c2 8b 45 08 c1 fa 1f 01 75 ec 89 55 f0 89
   EIP: [] __percpu_counter_add+0x18/0xc0 SS:ESP 0068:ebebde40
   CR2: 34beb000
   ---[ end trace dd564a7bea834ecd ]---

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101011

Signed-off-by: Theodore Ts'o 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/ext4/super.c |   18 +-
 1 file changed, 17 insertions(+), 1 deletion(-)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -325,6 +325,22 @@ static void save_error_info(struct super
ext4_commit_super(sb, 1);
 }
 
+/*
+ * The del_gendisk() function uninitializes the disk-specific data
+ * structures, including the bdi structure, without telling anyone
+ * else.  Once this happens, any attempt to call mark_buffer_dirty()
+ * (for example, by ext4_commit_super), will cause a kernel OOPS.
+ * This is a kludge to prevent these oops until we can put in a proper
+ * hook in del_gendisk() to inform the VFS and file system layers.
+ */
+static int block_device_ejected(struct super_block *sb)
+{
+   struct inode *bd_inode = sb->s_bdev->bd_inode;
+   struct backing_dev_info *bdi = inode_to_bdi(bd_inode);
+
+   return bdi->dev == NULL;
+}
+
 static void ext4_journal_commit_callback(journal_t *journal, transaction_t 
*txn)
 {
struct super_block  *sb = journal->j_private;
@@ -4617,7 +4633,7 @@ static int ext4_commit_super(struct supe
struct buffer_head *sbh = EXT4_SB(sb)->s_sbh;
int error = 0;
 
-   if (!sbh)
+   if (!sbh || block_device_ejected(sb))
return error;
if (buffer_write_io_error(sbh)) {
/*


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 024/134] cxl: Fix unbalanced pci_dev_get in cxl_probe

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Daniel Axtens 

commit 2925c2fdf1e0eb642482f5b30577e9435aaa8edb upstream.

Currently the first thing we do in cxl_probe is to grab a reference
on the pci device. Later on, we call device_register on our adapter.
In our remove path, we call device_unregister, but we never call
pci_dev_put. We therefore leak the device every time we do a
reflash.

device_register/unregister is sufficient to hold the reference.
Therefore, drop the call to pci_dev_get.

Here's why this is safe.
The proposed cxl_probe(pdev) calls cxl_adapter_init:
a) init calls cxl_adapter_alloc, which creates a struct cxl,
   conventionally called adapter. This struct contains a
   device entry, adapter->dev.

b) init calls cxl_configure_adapter, where we set
   adapter->dev.parent = >dev (here dev is the pci dev)

So at this point, the cxl adapter's device's parent is the PCI
device that I want to be refcounted properly.

c) init calls cxl_register_adapter
   *) cxl_register_adapter calls device_register(>dev)

So now we're in device_register, where dev is the adapter device, and
we want to know if the PCI device is safe after we return.

device_register(>dev) calls device_initialize() and then
device_add().

device_add() does a get_device(). device_add() also explicitly grabs
the device's parent, and calls get_device() on it:

 parent = get_device(dev->parent);

So therefore, device_register() takes a lock on the parent PCI dev,
which is what pci_dev_get() was guarding. pci_dev_get() can therefore
be safely removed.

Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for 
userspace access")
Signed-off-by: Daniel Axtens 
Acked-by: Ian Munsie 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/misc/cxl/pci.c |2 --
 1 file changed, 2 deletions(-)

--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1124,8 +1124,6 @@ static int cxl_probe(struct pci_dev *dev
int slice;
int rc;
 
-   pci_dev_get(dev);
-
if (cxl_verbose)
dump_cxl_config_space(dev);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 023/134] cxl: Remove racy attempt to force EEH invocation in reset

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Daniel Axtens 

commit 9d8e27673c45927fee9e7d8992ffb325a6b0b0e4 upstream.

cxl_reset currently PERSTs the slot, and then repeatedly tries to
read MMIO space in order to kick off EEH.

There are 2 problems with this: it's unnecessary, and it's racy.

It's unnecessary because the PERST will bring down the PHB link.
That will be picked up by the CAPP, which will send out an HMI.
Skiboot, noticing an HMI from the CAPP, will send an OPAL
notification to the kernel, which will trigger EEH recovery.

It's also racy: the EEH recovery triggered by the CAPP will
eventually cause the MMIO space to have its mapping invalidated
and the pointer NULLed out. This races with our attempt to read
the MMIO space. This is causing OOPSes in testing.

Simply drop all the attempts to force EEH detection, and trust
that Skiboot will send the notification and that we'll act on it.
The Skiboot code to send the EEH notification has been in Skiboot
for as long as CAPP recovery has been supported, so we don't need
to worry about breaking obscure setups with ancient firmware.

Cc: Ryan Grimm 
Fixes: 62fa19d4b4fd ("cxl: Add ability to reset the card")
Signed-off-by: Daniel Axtens 
Acked-by: Ian Munsie 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/misc/cxl/pci.c |   16 
 1 file changed, 16 deletions(-)

--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -851,8 +851,6 @@ int cxl_reset(struct cxl *adapter)
 {
struct pci_dev *dev = to_pci_dev(adapter->dev.parent);
int rc;
-   int i;
-   u32 val;
 
dev_info(>dev, "CXL reset\n");
 
@@ -869,20 +867,6 @@ int cxl_reset(struct cxl *adapter)
return rc;
}
 
-   /* the PERST done above fences the PHB.  So, reset depends on EEH
-* to unbind the driver, tell Sapphire to reinit the PHB, and rebind
-* the driver.  Do an mmio read explictly to ensure EEH notices the
-* fenced PHB.  Retry for a few seconds before giving up. */
-   i = 0;
-   while (((val = mmio_read32be(adapter->p1_mmio)) != 0x) &&
-   (i < 5)) {
-   msleep(500);
-   i++;
-   }
-
-   if (val != 0x)
-   dev_err(>dev, "cxl: PERST failed to trigger EEH\n");
-
return rc;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 027/134] arm64: kconfig: Move LIST_POISON to a safe value

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jeff Vander Stoep 

commit bf0c4e04732479f650ff59d1ee82de761c0071f0 upstream.

Move the poison pointer offset to 0xdead, a
recognized value that is not mappable by user-space exploits.

Acked-by: Catalin Marinas 
Signed-off-by: Thierry Strudel 
Signed-off-by: Jeff Vander Stoep 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/Kconfig |4 
 1 file changed, 4 insertions(+)

--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -104,6 +104,10 @@ config NO_IOPORT_MAP
 config STACKTRACE_SUPPORT
def_bool y
 
+config ILLEGAL_POINTER_VALUE
+   hex
+   default 0xdead
+
 config LOCKDEP_SUPPORT
def_bool y
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 002/134] nfc: st-nci: Fix typo when changing from st21nfcb to st-nci

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit 30458aac63c89771d19f023083d64d018562812e upstream.

Replace ST21NFCB with ST_NCI or st21nfcb with st_nci as it
was forgotten in commit "nfc: st-nci: Rename st21nfcb to st-nci"
ed06aeefdac348cfb91a3db5fe1067e3202afd70

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st-nci/i2c.c |   18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

--- a/drivers/nfc/st-nci/i2c.c
+++ b/drivers/nfc/st-nci/i2c.c
@@ -29,11 +29,11 @@
 
 #include "ndlc.h"
 
-#define DRIVER_DESC "NCI NFC driver for ST21NFCB"
+#define DRIVER_DESC "NCI NFC driver for ST_NCI"
 
 /* ndlc header */
-#define ST21NFCB_FRAME_HEADROOM1
-#define ST21NFCB_FRAME_TAILROOM 0
+#define ST_NCI_FRAME_HEADROOM  1
+#define ST_NCI_FRAME_TAILROOM 0
 
 #define ST_NCI_I2C_MIN_SIZE 4   /* PCB(1) + NCI Packet header(3) */
 #define ST_NCI_I2C_MAX_SIZE 250 /* req 4.2.1 */
@@ -118,14 +118,14 @@ static int st_nci_i2c_write(void *phy_id
 /*
  * Reads an ndlc frame and returns it in a newly allocated sk_buff.
  * returns:
- * frame size : if received frame is complete (find ST21NFCB_SOF_EOF at
+ * frame size : if received frame is complete (find ST_NCI_SOF_EOF at
  * end of read)
- * -EAGAIN : if received frame is incomplete (not find ST21NFCB_SOF_EOF
+ * -EAGAIN : if received frame is incomplete (not find ST_NCI_SOF_EOF
  * at end of read)
  * -EREMOTEIO : i2c read error (fatal)
  * -EBADMSG : frame was incorrect and discarded
  * (value returned from st_nci_i2c_repack)
- * -EIO : if no ST21NFCB_SOF_EOF is found after reaching
+ * -EIO : if no ST_NCI_SOF_EOF is found after reaching
  * the read length end sequence
  */
 static int st_nci_i2c_read(struct st_nci_i2c_phy *phy,
@@ -179,7 +179,7 @@ static int st_nci_i2c_read(struct st_nci
 /*
  * Reads an ndlc frame from the chip.
  *
- * On ST21NFCB, IRQ goes in idle state when read starts.
+ * On ST_NCI, IRQ goes in idle state when read starts.
  */
 static irqreturn_t st_nci_irq_thread_fn(int irq, void *phy_id)
 {
@@ -325,12 +325,12 @@ static int st_nci_i2c_probe(struct i2c_c
}
} else {
nfc_err(>dev,
-   "st21nfcb platform resources not available\n");
+   "st_nci platform resources not available\n");
return -ENODEV;
}
 
r = ndlc_probe(phy, _phy_ops, >dev,
-   ST21NFCB_FRAME_HEADROOM, ST21NFCB_FRAME_TAILROOM,
+   ST_NCI_FRAME_HEADROOM, ST_NCI_FRAME_TAILROOM,
>ndlc);
if (r < 0) {
nfc_err(>dev, "Unable to register ndlc layer\n");


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 019/134] MIPS: math-emu: Allow m{f,t}hc emulation on MIPS R6

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Markos Chandras 

commit e8f80cc1a6d80587136b015e989a12827e1fcfe5 upstream.

The mfhc/mthc instructions are supported on MIPS R6 so emulate
them if needed.

Signed-off-by: Markos Chandras 
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10737/
Signed-off-by: Ralf Baechle 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/math-emu/cp1emu.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1137,7 +1137,7 @@ emul:
break;
 
case mfhc_op:
-   if (!cpu_has_mips_r2)
+   if (!cpu_has_mips_r2_r6)
goto sigill;
 
/* copregister rd -> gpr[rt] */
@@ -1148,7 +1148,7 @@ emul:
break;
 
case mthc_op:
-   if (!cpu_has_mips_r2)
+   if (!cpu_has_mips_r2_r6)
goto sigill;
 
/* copregister rd <- gpr[rt] */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 020/134] MIPS: math-emu: Emulate missing BC1{EQ,NE}Z instructions

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Markos Chandras 

commit c909ca718e8f50cf484ef06a8dd935e738e8e53d upstream.

Commit c8a34581ec09 ("MIPS: Emulate the BC1{EQ,NE}Z FPU instructions")
added support for emulating the new R6 BC1{EQ,NE}Z branches but it missed
the case where the instruction that caused the exception was not on a DS.

Signed-off-by: Markos Chandras 
Fixes: c8a34581ec09 ("MIPS: Emulate the BC1{EQ,NE}Z FPU instructions")
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10738/
Signed-off-by: Ralf Baechle 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/math-emu/cp1emu.c |   20 +++-
 1 file changed, 19 insertions(+), 1 deletion(-)

--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1181,6 +1181,24 @@ emul:
}
break;
 
+   case bc1eqz_op:
+   case bc1nez_op:
+   if (!cpu_has_mips_r6 || delay_slot(xcp))
+   return SIGILL;
+
+   cond = likely = 0;
+   switch (MIPSInst_RS(ir)) {
+   case bc1eqz_op:
+   if 
(get_fpr32(>thread.fpu.fpr[MIPSInst_RT(ir)], 0) & 0x1)
+   cond = 1;
+   break;
+   case bc1nez_op:
+   if 
(!(get_fpr32(>thread.fpu.fpr[MIPSInst_RT(ir)], 0) & 0x1))
+   cond = 1;
+   break;
+   }
+   goto branch_common;
+
case bc_op:
if (delay_slot(xcp))
return SIGILL;
@@ -1207,7 +1225,7 @@ emul:
case bct_op:
break;
}
-
+branch_common:
set_delay_slot(xcp);
if (cond) {
/*


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 028/134] arm64: entry: always restore x0 from the stack on syscall return

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Will Deacon 

commit 412fcb6cebd758d080cacd5a41a0cbc656ea5fce upstream.

We have a micro-optimisation on the fast syscall return path where we
take care to keep x0 live with the return value from the syscall so that
we can avoid restoring it from the stack. The benefit of doing this is
fairly suspect, since we will be restoring x1 from the stack anyway
(which lives adjacent in the pt_regs structure) and the only additional
cost is saving x0 back to pt_regs after the syscall handler, which could
be seen as a poor man's prefetch.

More importantly, this causes issues with the context tracking code.

The ct_user_enter macro ends up branching into C code, which is free to
use x0 as a scratch register and consequently leads to us returning junk
back to userspace as the syscall return value. Rather than special case
the context-tracking code, this patch removes the questionable
optimisation entirely.

Cc: Larry Bassel 
Cc: Kevin Hilman 
Reviewed-by: Catalin Marinas 
Reported-by: Hanjun Guo 
Tested-by: Hanjun Guo 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/entry.S |   17 ++---
 1 file changed, 6 insertions(+), 11 deletions(-)

--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -116,7 +116,7 @@
*/
.endm
 
-   .macro  kernel_exit, el, ret = 0
+   .macro  kernel_exit, el
ldp x21, x22, [sp, #S_PC]   // load ELR, SPSR
.if \el == 0
ct_user_enter
@@ -146,11 +146,7 @@
.endif
msr elr_el1, x21// set up the return data
msr spsr_el1, x22
-   .if \ret
-   ldr x1, [sp, #S_X1] // preserve x0 (syscall return)
-   .else
ldp x0, x1, [sp, #16 * 0]
-   .endif
ldp x2, x3, [sp, #16 * 1]
ldp x4, x5, [sp, #16 * 2]
ldp x6, x7, [sp, #16 * 3]
@@ -613,22 +609,21 @@ ENDPROC(cpu_switch_to)
  */
 ret_fast_syscall:
disable_irq // disable interrupts
+   str x0, [sp, #S_X0] // returned x0
ldr x1, [tsk, #TI_FLAGS]// re-check for syscall tracing
and x2, x1, #_TIF_SYSCALL_WORK
cbnzx2, ret_fast_syscall_trace
and x2, x1, #_TIF_WORK_MASK
-   cbnzx2, fast_work_pending
+   cbnzx2, work_pending
enable_step_tsk x1, x2
-   kernel_exit 0, ret = 1
+   kernel_exit 0
 ret_fast_syscall_trace:
enable_irq  // enable interrupts
-   b   __sys_trace_return
+   b   __sys_trace_return_skipped  // we already saved x0
 
 /*
  * Ok, we need to do extra processing, enter the slow path.
  */
-fast_work_pending:
-   str x0, [sp, #S_X0] // returned x0
 work_pending:
tbnzx1, #TIF_NEED_RESCHED, work_resched
/* TIF_SIGPENDING, TIF_NOTIFY_RESUME or TIF_FOREIGN_FPSTATE case */
@@ -652,7 +647,7 @@ ret_to_user:
cbnzx2, work_pending
enable_step_tsk x1, x2
 no_work_pending:
-   kernel_exit 0, ret = 0
+   kernel_exit 0
 ENDPROC(ret_to_user)
 
 /*


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 029/134] arm64: flush FP/SIMD state correctly after execve()

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit 674c242c9323d3c293fc4f9a3a3a619fe3063290 upstream.

When a task calls execve(), its FP/SIMD state is flushed so that
none of the original program state is observeable by the incoming
program.

However, since this flushing consists of setting the in-memory copy
of the FP/SIMD state to all zeroes, the CPU field is set to CPU 0 as
well, which indicates to the lazy FP/SIMD preserve/restore code that
the FP/SIMD state does not need to be reread from memory if the task
is scheduled again on CPU 0 without any other tasks having entered
userland (or used the FP/SIMD in kernel mode) on the same CPU in the
mean time. If this happens, the FP/SIMD state of the old program will
still be present in the registers when the new program starts.

So set the CPU field to the invalid value of NR_CPUS when performing
the flush, by calling fpsimd_flush_task_state().

Reported-by: Chunyan Zhang 
Reported-by: Janet Liu 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/fpsimd.c |1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -158,6 +158,7 @@ void fpsimd_thread_switch(struct task_st
 void fpsimd_flush_thread(void)
 {
memset(>thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
+   fpsimd_flush_task_state(current);
set_thread_flag(TIF_FOREIGN_FPSTATE);
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 003/134] nfc: st-nci: Fix non accurate comment for st_nci_i2c_read

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit e7723b33077b04648213f043bc22654c54e375e4 upstream.

Due to a copy and paste error st_nci_i2c_read still contains
st21nfca header comment.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st-nci/i2c.c |9 ++---
 1 file changed, 2 insertions(+), 7 deletions(-)

--- a/drivers/nfc/st-nci/i2c.c
+++ b/drivers/nfc/st-nci/i2c.c
@@ -118,15 +118,10 @@ static int st_nci_i2c_write(void *phy_id
 /*
  * Reads an ndlc frame and returns it in a newly allocated sk_buff.
  * returns:
- * frame size : if received frame is complete (find ST_NCI_SOF_EOF at
- * end of read)
- * -EAGAIN : if received frame is incomplete (not find ST_NCI_SOF_EOF
- * at end of read)
+ * 0 : if received frame is complete
  * -EREMOTEIO : i2c read error (fatal)
  * -EBADMSG : frame was incorrect and discarded
- * (value returned from st_nci_i2c_repack)
- * -EIO : if no ST_NCI_SOF_EOF is found after reaching
- * the read length end sequence
+ * -ENOMEM : cannot allocate skb, frame dropped
  */
 static int st_nci_i2c_read(struct st_nci_i2c_phy *phy,
 struct sk_buff **skb)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 006/134] nfc: st-nci: Remove data from ack_pending_q when receiving a SYNC_ACK

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit 1d816b6eb513498aa28a0ff1e4db7632bded1707 upstream.

When receiving a NDLC PCB_SYNC_ACK the pending data was never
removed from ack_pending_q and cleared.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st-nci/ndlc.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/nfc/st-nci/ndlc.c
+++ b/drivers/nfc/st-nci/ndlc.c
@@ -171,6 +171,8 @@ static void llt_ndlc_rcv_queue(struct ll
if ((pcb & PCB_TYPE_MASK) == PCB_TYPE_SUPERVISOR) {
switch (pcb & PCB_SYNC_MASK) {
case PCB_SYNC_ACK:
+   skb = skb_dequeue(>ack_pending_q);
+   kfree_skb(skb);
del_timer_sync(>t1_timer);
del_timer_sync(>t2_timer);
ndlc->t2_active = false;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 030/134] of/fdt: make memblock maximum physical address arch configurable

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit 8eafeb48022816513abc4f440bdad4c350fe81a3 upstream.

When parsing the memory nodes to populate the memblock memory
table, we check against high and low limits and clip any memory
that exceeds either one of them.

However, for arm64, the high limit of (phys_addr_t)~0 is not very
meaningful, since phys_addr_t is 64 bits (i.e., no limit) but there
may be other constraints that limit the memory ranges that we can
support.

So rename MAX_PHYS_ADDR to MAX_MEMBLOCK_ADDR (for clarity) and only
define it if the arch does not supply a definition of its own.

Acked-by: Rob Herring 
Reviewed-by: Catalin Marinas 
Tested-by: Stuart Yoder 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/of/fdt.c |   12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -967,7 +967,9 @@ int __init early_init_dt_scan_chosen(uns
 }
 
 #ifdef CONFIG_HAVE_MEMBLOCK
-#define MAX_PHYS_ADDR  ((phys_addr_t)~0)
+#ifndef MAX_MEMBLOCK_ADDR
+#define MAX_MEMBLOCK_ADDR  ((phys_addr_t)~0)
+#endif
 
 void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
 {
@@ -984,16 +986,16 @@ void __init __weak early_init_dt_add_mem
}
size &= PAGE_MASK;
 
-   if (base > MAX_PHYS_ADDR) {
+   if (base > MAX_MEMBLOCK_ADDR) {
pr_warning("Ignoring memory block 0x%llx - 0x%llx\n",
base, base + size);
return;
}
 
-   if (base + size - 1 > MAX_PHYS_ADDR) {
+   if (base + size - 1 > MAX_MEMBLOCK_ADDR) {
pr_warning("Ignoring memory range 0x%llx - 0x%llx\n",
-   ((u64)MAX_PHYS_ADDR) + 1, base + size);
-   size = MAX_PHYS_ADDR - base + 1;
+   ((u64)MAX_MEMBLOCK_ADDR) + 1, base + size);
+   size = MAX_MEMBLOCK_ADDR - base + 1;
}
 
if (base + size < phys_offset) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 033/134] arm64: head.S: initialise mdcr_el2 in el2_setup

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Will Deacon 

commit d10bcd473301888f957ec4b6b12aa3621be78d59 upstream.

When entering the kernel at EL2, we fail to initialise the MDCR_EL2
register which controls debug access and PMU capabilities at EL1.

This patch ensures that the register is initialised so that all traps
are disabled and all the PMU counters are available to the host. When a
guest is scheduled, KVM takes care to configure trapping appropriately.

Acked-by: Marc Zyngier 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/head.S |5 +
 1 file changed, 5 insertions(+)

--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -528,6 +528,11 @@ CPU_LE(movkx0, #0x30d0, lsl #16)   // C
msr hstr_el2, xzr   // Disable CP15 traps to EL2
 #endif
 
+   /* EL2 debug */
+   mrs x0, pmcr_el0// Disable debug access traps
+   ubfxx0, x0, #11, #5 // to EL2 and allow access to
+   msr mdcr_el2, x0// all PMU counters from EL1
+
/* Stage-2 translation */
msr vttbr_el2, xzr
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 032/134] arm64: compat: fix vfp save/restore across signal handlers in big-endian

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Will Deacon 

commit bdec97a855ef1e239f130f7a11584721c9a1bf04 upstream.

When saving/restoring the VFP registers from a compat (AArch32)
signal frame, we rely on the compat registers forming a prefix of the
native register file and therefore make use of copy_{to,from}_user to
transfer between the native fpsimd_state and the compat_vfp_sigframe.

Unfortunately, this doesn't work so well in a big-endian environment.
Our fpsimd save/restore code operates directly on 128-bit quantities
(Q registers) whereas the compat_vfp_sigframe represents the registers
as an array of 64-bit (D) registers. The architecture packs the compat D
registers into the Q registers, with the least significant bytes holding
the lower register. Consequently, we need to swap the 64-bit halves when
converting between these two representations on a big-endian machine.

This patch replaces the __copy_{to,from}_user invocations in our
compat VFP signal handling code with explicit __put_user loops that
operate on 64-bit values and swap them accordingly.

Reviewed-by: Catalin Marinas 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/signal32.c |   47 ---
 1 file changed, 36 insertions(+), 11 deletions(-)

--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -212,14 +212,32 @@ int copy_siginfo_from_user32(siginfo_t *
 
 /*
  * VFP save/restore code.
+ *
+ * We have to be careful with endianness, since the fpsimd context-switch
+ * code operates on 128-bit (Q) register values whereas the compat ABI
+ * uses an array of 64-bit (D) registers. Consequently, we need to swap
+ * the two halves of each Q register when running on a big-endian CPU.
  */
+union __fpsimd_vreg {
+   __uint128_t raw;
+   struct {
+#ifdef __AARCH64EB__
+   u64 hi;
+   u64 lo;
+#else
+   u64 lo;
+   u64 hi;
+#endif
+   };
+};
+
 static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user 
*frame)
 {
struct fpsimd_state *fpsimd = >thread.fpsimd_state;
compat_ulong_t magic = VFP_MAGIC;
compat_ulong_t size = VFP_STORAGE_SIZE;
compat_ulong_t fpscr, fpexc;
-   int err = 0;
+   int i, err = 0;
 
/*
 * Save the hardware registers to the fpsimd_state structure.
@@ -235,10 +253,15 @@ static int compat_preserve_vfp_context(s
/*
 * Now copy the FP registers. Since the registers are packed,
 * we can copy the prefix we want (V0-V15) as it is.
-* FIXME: Won't work if big endian.
 */
-   err |= __copy_to_user(>ufp.fpregs, fpsimd->vregs,
- sizeof(frame->ufp.fpregs));
+   for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+   union __fpsimd_vreg vreg = {
+   .raw = fpsimd->vregs[i >> 1],
+   };
+
+   __put_user_error(vreg.lo, >ufp.fpregs[i], err);
+   __put_user_error(vreg.hi, >ufp.fpregs[i + 1], err);
+   }
 
/* Create an AArch32 fpscr from the fpsr and the fpcr. */
fpscr = (fpsimd->fpsr & VFP_FPSCR_STAT_MASK) |
@@ -263,7 +286,7 @@ static int compat_restore_vfp_context(st
compat_ulong_t magic = VFP_MAGIC;
compat_ulong_t size = VFP_STORAGE_SIZE;
compat_ulong_t fpscr;
-   int err = 0;
+   int i, err = 0;
 
__get_user_error(magic, >magic, err);
__get_user_error(size, >size, err);
@@ -273,12 +296,14 @@ static int compat_restore_vfp_context(st
if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
return -EINVAL;
 
-   /*
-* Copy the FP registers into the start of the fpsimd_state.
-* FIXME: Won't work if big endian.
-*/
-   err |= __copy_from_user(fpsimd.vregs, frame->ufp.fpregs,
-   sizeof(frame->ufp.fpregs));
+   /* Copy the FP registers into the start of the fpsimd_state. */
+   for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+   union __fpsimd_vreg vreg;
+
+   __get_user_error(vreg.lo, >ufp.fpregs[i], err);
+   __get_user_error(vreg.hi, >ufp.fpregs[i + 1], err);
+   fpsimd.vregs[i >> 1] = vreg.raw;
+   }
 
/* Extract the fpsr and the fpcr from the fpscr */
__get_user_error(fpscr, >ufp.fpscr, err);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 004/134] NFC: st21nfca: fix use of uninitialized variables in error path

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit 5a3570061a131309143a49e4bbdbce7e23f261e7 upstream.

st21nfca_hci_load_session() calls kfree_skb() on unitialized
variables skb_pipe_info and skb_pipe_list if the call to
nfc_hci_connect_gate() failed. Reword the error path to not use
these variables when they are not initialized. While at it, there
seemed to be a memory leak because skb_pipe_info was only freed
once, after the for-loop, even though several ones were created
by nfc_hci_send_cmd.

Fixes: ec03ff1a8f9a
("NFC: st21nfca: Remove skb_pipe_list and skb_pipe_info
useless allocation")

Acked-by: Christophe Ricard 
Signed-off-by: Nicolas Iooss 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st21nfca/st21nfca.c |   11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/nfc/st21nfca/st21nfca.c
+++ b/drivers/nfc/st21nfca/st21nfca.c
@@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(str
ST21NFCA_DEVICE_MGNT_GATE,
ST21NFCA_DEVICE_MGNT_PIPE);
if (r < 0)
-   goto free_info;
+   return r;
 
/* Get pipe list */
r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
_pipe_list);
if (r < 0)
-   goto free_info;
+   return r;
 
/* Complete the existing gate_pipe table */
for (i = 0; i < skb_pipe_list->len; i++) {
@@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(str
info->src_host_id != ST21NFCA_ESE_HOST_ID) {
pr_err("Unexpected apdu_reader pipe on host %x\n",
info->src_host_id);
+   kfree_skb(skb_pipe_info);
continue;
}
 
@@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(str
hdev->pipes[st21nfca_gates[j].pipe].dest_host =
info->src_host_id;
}
+   kfree_skb(skb_pipe_info);
}
 
/*
@@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(str
st21nfca_gates[i].gate,
st21nfca_gates[i].pipe);
if (r < 0)
-   goto free_info;
+   goto free_list;
}
}
 
memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
-free_info:
-   kfree_skb(skb_pipe_info);
+free_list:
kfree_skb(skb_pipe_list);
return r;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 031/134] arm64: set MAX_MEMBLOCK_ADDR according to linear region size

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit 34ba2c4247e5c4b1542b1106e156af324660c4f0 upstream.

The linear region size of a 39-bit VA kernel is only 256 GB, which
may be insufficient to cover all of system RAM, even on platforms
that have much less than 256 GB of memory but which is laid out
very sparsely.

So make sure we clip the memory we will not be able to map before
installing it into the memblock memory table, by setting
MAX_MEMBLOCK_ADDR accordingly.

Reviewed-by: Catalin Marinas 
Tested-by: Stuart Yoder 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/include/asm/memory.h |8 
 1 file changed, 8 insertions(+)

--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -114,6 +114,14 @@ extern phys_addr_t memstart_addr;
 #define PHYS_OFFSET({ memstart_addr; })
 
 /*
+ * The maximum physical address that the linear direct mapping
+ * of system RAM can cover. (PAGE_OFFSET can be interpreted as
+ * a 2's complement signed quantity and negated to derive the
+ * maximum size of the linear mapping.)
+ */
+#define MAX_MEMBLOCK_ADDR  ({ memstart_addr - PAGE_OFFSET - 1; })
+
+/*
  * PFNs are used to describe any physical page; this means
  * PFN 0 == physical address 0.
  *


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 005/134] NFC: st-nci: fix use of uninitialized variables in error path

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit daaf1e1f1640eb11259954d1d847d8a72ab5b938 upstream.

st_nci_hci_load_session() calls kfree_skb() on unitialized
variables skb_pipe_info and skb_pipe_list if the call to
nci_hci_connect_gate() failed. Reword the error path to not use
these variables when they are not initialized. While at it, there
seemed to be a memory leak because skb_pipe_info was only freed
once, after the for-loop, even though several ones were created
by nci_hci_send_cmd.

Acked-by: Christophe Ricard 
Signed-off-by: Nicolas Iooss 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st-nci/st-nci_se.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/nfc/st-nci/st-nci_se.c
+++ b/drivers/nfc/st-nci/st-nci_se.c
@@ -189,14 +189,14 @@ int st_nci_hci_load_session(struct nci_d
ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DEVICE_MGNT_PIPE);
if (r < 0)
-   goto free_info;
+   return r;
 
/* Get pipe list */
r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),
_pipe_list);
if (r < 0)
-   goto free_info;
+   return r;
 
/* Complete the existing gate_pipe table */
for (i = 0; i < skb_pipe_list->len; i++) {
@@ -222,6 +222,7 @@ int st_nci_hci_load_session(struct nci_d
dm_pipe_info->src_host_id != ST_NCI_ESE_HOST_ID) {
pr_err("Unexpected apdu_reader pipe on host %x\n",
   dm_pipe_info->src_host_id);
+   kfree_skb(skb_pipe_info);
continue;
}
 
@@ -241,13 +242,12 @@ int st_nci_hci_load_session(struct nci_d
ndev->hci_dev->pipes[st_nci_gates[j].pipe].host =
dm_pipe_info->src_host_id;
}
+   kfree_skb(skb_pipe_info);
}
 
memcpy(ndev->hci_dev->init_data.gates, st_nci_gates,
   sizeof(st_nci_gates));
 
-free_info:
-   kfree_skb(skb_pipe_info);
kfree_skb(skb_pipe_list);
return r;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 017/134] tg3: Fix temperature reporting

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jean Delvare 

commit d3d11fe08ccc9bff174fc958722b5661f0932486 upstream.

The temperature registers appear to report values in degrees Celsius
while the hwmon API mandates values to be exposed in millidegrees
Celsius. Do the conversion so that the values reported by "sensors"
are correct.

Fixes: aed93e0bf493 ("tg3: Add hwmon support for temperature")
Signed-off-by: Jean Delvare 
Cc: Prashant Sreedharan 
Cc: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/broadcom/tg3.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -10757,7 +10757,7 @@ static ssize_t tg3_show_temp(struct devi
tg3_ape_scratchpad_read(tp, , attr->index,
sizeof(temperature));
spin_unlock_bh(>lock);
-   return sprintf(buf, "%u\n", temperature);
+   return sprintf(buf, "%u\n", temperature * 1000);
 }
 
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 035/134] arm/arm64: KVM: vgic: Check for !irqchip_in_kernel() when mapping resources

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Pavel Fedin 

commit c2f58514cfb374d5368c9da945f1765cd48eb0da upstream.

Until b26e5fdac43c ("arm/arm64: KVM: introduce per-VM ops"),
kvm_vgic_map_resources() used to include a check on irqchip_in_kernel(),
and vgic_v2_map_resources() still has it.

But now vm_ops are not initialized until we call kvm_vgic_create().
Therefore kvm_vgic_map_resources() can being called without a VGIC,
and we die because vm_ops.map_resources is NULL.

Fixing this restores QEMU's kernel-irqchip=off option to a working state,
allowing to use GIC emulation in userspace.

Fixes: b26e5fdac43c ("arm/arm64: KVM: introduce per-VM ops")
Signed-off-by: Pavel Fedin 
[maz: reworked commit message]
Signed-off-by: Marc Zyngier 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/kvm/arm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -449,7 +449,7 @@ static int kvm_vcpu_first_run_init(struc
 * Map the VGIC hardware resources before running a vcpu the first
 * time on this VM.
 */
-   if (unlikely(!vgic_ready(kvm))) {
+   if (unlikely(irqchip_in_kernel(kvm) && !vgic_ready(kvm))) {
ret = kvm_vgic_map_resources(kvm);
if (ret)
return ret;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 018/134] MIPS: CPS: use 32b accesses to GCRs

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Paul Burton 

commit 90996511187d6282db6d02d3f97006b4dbb5c457 upstream.

Commit b677bc03d757 ("MIPS: cps-vec: Use macros for various arithmetics
and memory operations") replaced various load & store instructions
through cps-vec.S with the PTR_L & PTR_S macros. However it was somewhat
overzealous in doing so for CM GCR accesses, since the bit width of the
CM doesn't necessarily match that of the CPU. The registers accessed
(GCR_CL_COHERENCE & GCR_CL_ID) should be safe to simply always access
using 32b instructions, so do so in order to avoid issues when using a
32b CM with a 64b CPU.

Signed-off-by: Paul Burton 
Cc: Markos Chandras 
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Cc: James Hogan 
Patchwork: https://patchwork.linux-mips.org/patch/10864/
Signed-off-by: Ralf Baechle 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kernel/cps-vec.S |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -152,7 +152,7 @@ dcache_done:
 
/* Enter the coherent domain */
li  t0, 0xff
-   PTR_S   t0, GCR_CL_COHERENCE_OFS(v1)
+   sw  t0, GCR_CL_COHERENCE_OFS(v1)
ehb
 
/* Jump to kseg0 */
@@ -302,7 +302,7 @@ LEAF(mips_cps_boot_vpes)
PTR_L   t0, 0(t0)
 
/* Calculate a pointer to this cores struct core_boot_config */
-   PTR_L   t0, GCR_CL_ID_OFS(t0)
+   lw  t0, GCR_CL_ID_OFS(t0)
li  t1, COREBOOTCFG_SIZE
mul t0, t0, t1
PTR_LA  t1, mips_cps_core_bootcfg


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[GIT PULL] target fixes for v4.3-rc3

2015-09-26 Thread Nicholas A. Bellinger
Hi Linus,

Here are the outstanding target-pending fixes for v4.3-rc3 code.

Please go ahead and pull from:

  git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git master

This includes a iser-target series from Jenny + Sagi @ Mellanox that
addresses the few remaining active I/O shutdown bugs, along with a patch
to support zero-copy for immediate data payloads that gives a nice
performance improvement for small block WRITEs. 

Also included are some recent >= v4.2 regression bug-fixes.  The most
notable is a RCU conversion regression for SPC-3 PR registrations, and
recent removal of obsolete RFC-3720 markers that introduced a login
regression bug with MSFT iSCSI initiators.

Thanks to everyone who has been testing + reporting bugs for v4.x.

--nab

Jenny Derzhavetz (7):
  iser-target: remove command with state ISTATE_REMOVE
  iser-target: Put the reference on commands waiting for unsol data
  iser-target: Remove unused variables
  iser-target: Remove np_ prefix from isert_np members
  iser-target: Fix pending connections handling in target stack shutdown
sequnce
  iser-target: Change the recv buffers posting logic
  iser-target: Skip data copy if all the command data comes as immediate

Nicholas Bellinger (5):
  target: Fix PR registration + APTPL RCU conversion regression
  target: Propigate backend read-only to core_tpg_add_lun
  target: Fix target_sense_desc_format NULL pointer dereference
  target: Make TCM_WRITE_PROTECT failure honor D_SENSE bit
  iscsi-target: Avoid OFMarker + IFMarker negotiation

 drivers/infiniband/ulp/isert/ib_isert.c| 293 -
 drivers/infiniband/ulp/isert/ib_isert.h|  21 +-
 drivers/target/iscsi/iscsi_target_parameters.c |   5 +-
 drivers/target/target_core_device.c|  45 ++--
 drivers/target/target_core_hba.c   |   2 +-
 drivers/target/target_core_iblock.c|   2 +
 drivers/target/target_core_pr.c|  91 ++--
 drivers/target/target_core_tpg.c   |   5 +-
 include/target/target_core_base.h  |   1 +
 9 files changed, 299 insertions(+), 166 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 009/134] nfc: netlink: Warning fix

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit adca3c38d807b341a965d0aba8721d0784d8471b upstream.

When NFC_ATTR_VENDOR_DATA is not set, data_len is 0 and data is NULL.

Fixes the following warning:

net/nfc/netlink.c:1536:3: warning: 'data' may be used uninitialized
+in this function [-Wmaybe-uninitialized]
  return cmd->doit(dev, data, data_len);

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 net/nfc/netlink.c |1 +
 1 file changed, 1 insertion(+)

--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1524,6 +1524,7 @@ static int nfc_genl_vendor_cmd(struct sk
if (data_len == 0)
return -EINVAL;
} else {
+   data = NULL;
data_len = 0;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 007/134] nfc: st-nci: Free data with irrelevant NDLC PCB_SYNC value

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit 8b706884eac958ec16518315053f77e052627084 upstream.

PCB_SYNC different than PCB_TYPE_SUPERVISOR or PCB_TYPE_DATAFRAME
should be discarded.

Irrelevant data may be forwarded up to the ndlc state machine by
phys like spi to prevent missing potential data during "write"
transactions.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/nfc/st-nci/ndlc.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/nfc/st-nci/ndlc.c
+++ b/drivers/nfc/st-nci/ndlc.c
@@ -198,8 +198,10 @@ static void llt_ndlc_rcv_queue(struct ll
kfree_skb(skb);
break;
}
-   } else {
+   } else if ((pcb & PCB_TYPE_MASK) == PCB_TYPE_DATAFRAME) {
nci_recv_frame(ndlc->ndev, skb);
+   } else {
+   kfree_skb(skb);
}
}
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 000/134] 4.2.2-stable review

2015-09-26 Thread Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.2.2 release.
There are 134 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Sep 28 20:51:27 UTC 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.2.2-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 4.2.2-rc1

Jan Kara 
jbd2: avoid infinite loop when destroying aborted journal

Yinghai Lu 
lib/decompressors: use real out buf size for gunzip with kernel

Hin-Tak Leung 
hfs,hfsplus: cache pages correctly between bnode_create and bnode_free

Alexey Brodkin 
stmmac: fix check for phydev being open

Ariel Nahum 
IB/mlx4: Fix incorrect cq flushing in error state

Noa Osherovich 
IB/mlx4: Use correct SL on AH query under RoCE

Jack Morgenstein 
IB/mlx4: Forbid using sysfs to change RoCE pkeys

Jack Morgenstein 
IB/mlx4: Fix potential deadlock when sending mad to wire

Haggai Eran 
IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow

Sagi Grimberg 
IB/iser: Fix possible bogus DMA unmapping

Sagi Grimberg 
IB/iser: Fix missing return status check in iser_send_data_out

Yishai Hadas 
IB/uverbs: Fix race between ib_uverbs_open and remove_one

Christoph Hellwig 
IB/uverbs: reject invalid or unknown opcodes

Mike Marciniszyn 
IB/qib: Change lkey table allocation to support more MRs

Bart Van Assche 
IB/srp: Stop the scsi_eh_ and scsi_tmf_ threads if login fails

Bart Van Assche 
IB/srp: Handle partial connection success correctly

Hans de Goede 
ideapad-laptop: Add Lenovo Yoga 3 14 to no_hw_rfkill dmi list

Dan Carpenter 
i2c: xgene-slimpro: dma_mapping_error() doesn't return an error code

Hin-Tak Leung 
hfs: fix B-tree corruption after insertion at position 0

Tyler Hicks 
eCryptfs: Invalidate dcache entries when lower i_nlink is zero

Joerg Roedel 
iommu/vt-d: Really use upper context table when necessary

Thierry Reding 
iommu/tegra-smmu: Parameterize number of TLB lines

Will Deacon 
iommu/io-pgtable-arm: Unmap and free table when overwriting with block

Emil Medve 
iommu/fsl: Really fix init section(s) content

Jialing Fu 
mmc: core: fix race condition in mmc_wait_data_done

Haibo Chen 
mmc: sdhci: fix dma memory leak in sdhci_pre_req()

Jisheng Zhang 
mmc: sdhci: also get preset value and driver type for MMC_DDR52

Yangbo Lu 
mmc: sdhci-of-esdhc: add workaround for pre divider initial value

Adam Lee 
mmc: sdhci-pci: set the clear transfer mode register quirk for O2Micro

Jann Horn 
fs: Don't dump core if the corefile would become world-readable.

Jann Horn 
fs: if a coredump already exists, unlink and recreate with O_EXCL

Jaewon Kim 
vmscan: fix increasing nr_isolated incurred by putback unevictable pages

Tim Gardner 
workqueue: Make flush_workqueue() available again to non GPL modules

Helge Deller 
parisc: Filter out spurious interrupts in PA-RISC irq handler

John David Anglin 
parisc: Use double word condition in 64bit CAS operation

Helge Deller 
PCI,parisc: Enable 64-bit bus addresses on PA-RISC

Mitja Spes 
rtc: abx80x: fix RTC write bit

Joonyoung Shim 
rtc: s5m: fix to update ctrl register

Joonyoung Shim 
rtc: s3c: fix disabled clocks for alarm

Trond Myklebust 
SUNRPC: Lock the transport layer on shutdown

Trond Myklebust 
SUNRPC: Ensure that we wait for connections to complete before retrying

Trond Myklebust 
SUNRPC: xs_reset_transport must mark the connection as disconnected

Trond Myklebust 
SUNRPC: Fix a thinko in xs_connect()

Pratyush Anand 
net: sunrpc: fix tracepoint Warning: unknown op '->'

Chuck Lever 
svcrdma: Change maximum server payload back to RPCSVC_MAXPAYLOAD

Trond Myklebust 
Revert "NFSv4: Remove incorrect check in can_open_delegated()"

Kinglong Mee 
nfs: Fix truncated client owner id without proto type

Trond Myklebust 
NFSv4.1: Fix a protocol issue with CLOSE stateids

Trond Myklebust 
NFSv4.1/flexfiles: Fix a protocol error in layoutreturn

Peng Tao 
NFS41/flexfiles: zero out DS write wcc

Trond Myklebust 
NFSv4: Force a post-op attribute update when holding a delegation

Peng Tao 
NFS41/flexfiles: update inode after write finishes

Trond Myklebust 
NFS: nfs_set_pgio_error sometimes misses errors

Kinglong Mee 
NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 
client

Trond Myklebust 
NFSv4.1/pNFS: Fix borken function _same_data_server_addrs_locked()

Trond Myklebust 
NFS: Don't let the ctime override attribute barriers.

NeilBrown 
NFSv4: don't set SETATTR for O_RDONLY|O_EXCL

Trond Myklebust 
NFSv4.1/pnfs: Fix atomicity of 

[PATCH 4.2 008/134] nfc: netlink: Add check on NFC_ATTR_VENDOR_DATA

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christophe Ricard 

commit fe202fe95564023223ce1910c9e352f391abb1d5 upstream.

NFC_ATTR_VENDOR_DATA is an optional vendor_cmd argument.
The current code was potentially using a non existing argument
leading to potential catastrophic results.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman 

---
 net/nfc/netlink.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1518,8 +1518,8 @@ static int nfc_genl_vendor_cmd(struct sk
if (!dev || !dev->vendor_cmds || !dev->n_vendor_cmds)
return -ENODEV;
 
-   data = nla_data(info->attrs[NFC_ATTR_VENDOR_DATA]);
-   if (data) {
+   if (info->attrs[NFC_ATTR_VENDOR_DATA]) {
+   data = nla_data(info->attrs[NFC_ATTR_VENDOR_DATA]);
data_len = nla_len(info->attrs[NFC_ATTR_VENDOR_DATA]);
if (data_len == 0)
return -EINVAL;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 016/134] igb: Fix oops caused by missing queue pairing

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Shota Suzuki 

commit 72ddef0506da852dc82f078f37ced8ef4d74a2bf upstream.

When initializing igb driver (e.g. 82576, I350), IGB_FLAG_QUEUE_PAIRS is
set if adapter->rss_queues exceeds half of max_rss_queues in
igb_init_queue_configuration().
On the other hand, IGB_FLAG_QUEUE_PAIRS is not set even if the number of
queues exceeds half of max_combined in igb_set_channels() when changing
the number of queues by "ethtool -L".
In this case, if numvecs is larger than MAX_MSIX_ENTRIES (10), the size
of adapter->msix_entries[], an overflow can occur in
igb_set_interrupt_capability(), which in turn leads to an oops.

Fix this problem as follows:
 - When changing the number of queues by "ethtool -L", set
   IGB_FLAG_QUEUE_PAIRS in the same way as initializing igb driver.
 - When increasing the size of q_vector, reallocate it appropriately.
   (With IGB_FLAG_QUEUE_PAIRS set, the size of q_vector gets larger.)

Another possible way to fix this problem is to cap the queues at its
initial number, which is the number of the initial online cpus. But this
is not the optimal way because we cannot increase queues when another
cpu becomes online.

Note that before commit cd14ef54d25b ("igb: Change to use statically
allocated array for MSIx entries"), this problem did not cause oops
but just made the number of queues become 1 because of entering msi_only
mode in igb_set_interrupt_capability().

Fixes: 907b7835799f ("igb: Add ethtool support to configure number of channels")
Signed-off-by: Shota Suzuki 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/intel/igb/igb.h |1 +
 drivers/net/ethernet/intel/igb/igb_ethtool.c |5 -
 drivers/net/ethernet/intel/igb/igb_main.c|   16 ++--
 3 files changed, 19 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -540,6 +540,7 @@ void igb_ptp_rx_pktstamp(struct igb_q_ve
 struct sk_buff *skb);
 int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr);
 int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr);
+void igb_set_flag_queue_pairs(struct igb_adapter *, const u32);
 #ifdef CONFIG_IGB_HWMON
 void igb_sysfs_exit(struct igb_adapter *adapter);
 int igb_sysfs_init(struct igb_adapter *adapter);
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2991,6 +2991,7 @@ static int igb_set_channels(struct net_d
 {
struct igb_adapter *adapter = netdev_priv(netdev);
unsigned int count = ch->combined_count;
+   unsigned int max_combined = 0;
 
/* Verify they are not requesting separate vectors */
if (!count || ch->rx_count || ch->tx_count)
@@ -3001,11 +3002,13 @@ static int igb_set_channels(struct net_d
return -EINVAL;
 
/* Verify the number of channels doesn't exceed hw limits */
-   if (count > igb_max_channels(adapter))
+   max_combined = igb_max_channels(adapter);
+   if (count > max_combined)
return -EINVAL;
 
if (count != adapter->rss_queues) {
adapter->rss_queues = count;
+   igb_set_flag_queue_pairs(adapter, max_combined);
 
/* Hardware has to reinitialize queues and interrupts to
 * match the new configuration.
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1205,10 +1205,14 @@ static int igb_alloc_q_vector(struct igb
 
/* allocate q_vector and rings */
q_vector = adapter->q_vector[v_idx];
-   if (!q_vector)
+   if (!q_vector) {
q_vector = kzalloc(size, GFP_KERNEL);
-   else
+   } else if (size > ksize(q_vector)) {
+   kfree_rcu(q_vector, rcu);
+   q_vector = kzalloc(size, GFP_KERNEL);
+   } else {
memset(q_vector, 0, size);
+   }
if (!q_vector)
return -ENOMEM;
 
@@ -2888,6 +2892,14 @@ static void igb_init_queue_configuration
 
adapter->rss_queues = min_t(u32, max_rss_queues, num_online_cpus());
 
+   igb_set_flag_queue_pairs(adapter, max_rss_queues);
+}
+
+void igb_set_flag_queue_pairs(struct igb_adapter *adapter,
+ const u32 max_rss_queues)
+{
+   struct e1000_hw *hw = >hw;
+
/* Determine if we need to pair queues. */
switch (hw->mac.type) {
case e1000_82575:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 045/134] ALSA: hda - Fix white noise on Dell M3800

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Niranjan Sivakumar 

commit 467e1436ba85f78b8c4610c4549eb255a8211c42 upstream.

The M3800 is very minor workstation variant of the XPS 15 which has
already been patched for this issue.  I figured it's probably more
important for this version of the laptop to be patched than the
regular XPS as Dell sells is pre-configured with Ubuntu to be used as
a Linux workstation.  I have tested the patch on my the hardware on
Linux 4.2.0.

Signed-off-by: Niranjan Sivakumar 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6582,6 +6582,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1028, 0x05db, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x05fe, "Dell XPS 15", ALC668_FIXUP_DELL_XPS13),
SND_PCI_QUIRK(0x1028, 0x060a, "Dell XPS 13", ALC668_FIXUP_DELL_XPS13),
+   SND_PCI_QUIRK(0x1028, 0x060d, "Dell M3800", ALC668_FIXUP_DELL_XPS13),
SND_PCI_QUIRK(0x1028, 0x0625, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0626, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0696, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH cgroup/for-4.3-fixes] cgroup, writeback: don't enable cgroup writeback on traditional hierarchies

2015-09-26 Thread Tejun Heo
Hello, Artem.

Thanks a lot for the debug dump.  Can you please test whether the
below patch fixes the issue?

Index: work/mm/page-writeback.c
===
--- work.orig/mm/page-writeback.c
+++ work/mm/page-writeback.c
@@ -1956,7 +1956,6 @@ void laptop_mode_timer_fn(unsigned long
int nr_pages = global_page_state(NR_FILE_DIRTY) +
global_page_state(NR_UNSTABLE_NFS);
struct bdi_writeback *wb;
-   struct wb_iter iter;
 
/*
 * We want to write everything out, not just down to the dirty
@@ -1965,10 +1964,12 @@ void laptop_mode_timer_fn(unsigned long
if (!bdi_has_dirty_io(>backing_dev_info))
return;
 
-   bdi_for_each_wb(wb, >backing_dev_info, , 0)
+   rcu_read_lock();
+   list_for_each_entry_rcu(wb, >backing_dev_info.wb_list, bdi_node)
if (wb_has_dirty_io(wb))
wb_start_writeback(wb, nr_pages, true,
   WB_REASON_LAPTOP_TIMER);
+   rcu_read_unlock();
 }
 
 /*
Index: work/fs/fs-writeback.c
===
--- work.orig/fs/fs-writeback.c
+++ work/fs/fs-writeback.c
@@ -778,19 +778,24 @@ static void bdi_split_work_to_wbs(struct
  struct wb_writeback_work *base_work,
  bool skip_if_busy)
 {
-   int next_memcg_id = 0;
-   struct bdi_writeback *wb;
-   struct wb_iter iter;
+   struct bdi_writeback *last_wb = NULL;
+   struct bdi_writeback *wb = list_entry_rcu(>wb_list,
+   struct bdi_writeback, bdi_node);
 
might_sleep();
 restart:
rcu_read_lock();
-   bdi_for_each_wb(wb, bdi, , next_memcg_id) {
+   list_for_each_entry_continue_rcu(wb, >wb_list, bdi_node) {
DEFINE_WB_COMPLETION_ONSTACK(fallback_work_done);
struct wb_writeback_work fallback_work;
struct wb_writeback_work *work;
long nr_pages;
 
+   if (last_wb) {
+   wb_put(last_wb);
+   last_wb = NULL;
+   }
+
/* SYNC_ALL writes out I_DIRTY_TIME too */
if (!wb_has_dirty_io(wb) &&
(base_work->sync_mode == WB_SYNC_NONE ||
@@ -819,7 +824,14 @@ restart:
 
wb_queue_work(wb, work);
 
-   next_memcg_id = wb->memcg_css->id + 1;
+   /*
+* Pin @wb so that it stays on @bdi->wb_list.  This allows
+* continuing iteration from @wb after dropping regrabbing
+* rcu read lock.
+*/
+   wb_get(wb);
+   last_wb = wb;
+
rcu_read_unlock();
wb_wait_for_completion(bdi, _work_done);
goto restart;
@@ -1857,12 +1869,11 @@ void wakeup_flusher_threads(long nr_page
rcu_read_lock();
list_for_each_entry_rcu(bdi, _list, bdi_list) {
struct bdi_writeback *wb;
-   struct wb_iter iter;
 
if (!bdi_has_dirty_io(bdi))
continue;
 
-   bdi_for_each_wb(wb, bdi, , 0)
+   list_for_each_entry_rcu(wb, >wb_list, bdi_node)
wb_start_writeback(wb, wb_split_bdi_pages(wb, nr_pages),
   false, reason);
}
@@ -1894,11 +1905,10 @@ static void wakeup_dirtytime_writeback(s
rcu_read_lock();
list_for_each_entry_rcu(bdi, _list, bdi_list) {
struct bdi_writeback *wb;
-   struct wb_iter iter;
 
-   bdi_for_each_wb(wb, bdi, , 0)
-   if (!list_empty(>wb.b_dirty_time))
-   wb_wakeup(>wb);
+   list_for_each_entry_rcu(wb, >wb_list, bdi_node)
+   if (!list_empty(>b_dirty_time))
+   wb_wakeup(wb);
}
rcu_read_unlock();
schedule_delayed_work(_work, dirtytime_expire_interval * HZ);
Index: work/include/linux/backing-dev-defs.h
===
--- work.orig/include/linux/backing-dev-defs.h
+++ work/include/linux/backing-dev-defs.h
@@ -116,6 +116,8 @@ struct bdi_writeback {
struct list_head work_list;
struct delayed_work dwork;  /* work item used for writeback */
 
+   struct list_head bdi_node;  /* anchored at bdi->wb_list */
+
 #ifdef CONFIG_CGROUP_WRITEBACK
struct percpu_ref refcnt;   /* used only for !root wb's */
struct fprop_local_percpu memcg_completions;
@@ -150,6 +152,7 @@ struct backing_dev_info {
atomic_long_t tot_write_bandwidth;
 
struct bdi_writeback wb;  /* the root writeback info for this bdi */
+   struct list_head wb_list; /* list of all wbs */
 #ifdef CONFIG_CGROUP_WRITEBACK
   

[PATCH 4.2 044/134] ALSA: hda - Add some FIXUP quirks for white noise on Dell laptop.

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Woodrow Shen 

commit 1adecc6755e1e4193b5618ddb2e107f6d6e88f4b upstream.

Dell laptop has a series model to use the same codec but different subsystem ID.
At the same time they happens the white noise by login screen and headphone;
for fixing them together, I only can add these IDs to FIXUP function 
ALC292_FIXUP_DISABLE_AAMIX,
then try to solve such the similar issues.

Codec: Realtek ALC3235
Vendor Id: 0x10ec0293
Subsystem Id: 0x102806dd
Subsystem Id: 0x102806df
Subsystem Id: 0x102806e0

BugLink: https://bugs.launchpad.net/bugs/1492132
Signed-off-by: Woodrow Shen 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5189,8 +5189,11 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", 
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x06da, "Dell", 
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
-   SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
SND_PCI_QUIRK(0x1028, 0x06db, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+   SND_PCI_QUIRK(0x1028, 0x06dd, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+   SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+   SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+   SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
SND_PCI_QUIRK(0x1028, 0x164a, "Dell", 
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x164b, "Dell", 
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 052/134] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Huth 

commit 1c2cb594441d02815d304cccec9742ff5c707495 upstream.

The EPOW interrupt handler uses rtas_get_sensor(), which in turn
uses rtas_busy_delay() to wait for RTAS becoming ready in case it
is necessary. But rtas_busy_delay() is annotated with might_sleep()
and thus may not be used by interrupts handlers like the EPOW handler!
This leads to the following BUG when CONFIG_DEBUG_ATOMIC_SLEEP is
enabled:

 BUG: sleeping function called from invalid context at 
arch/powerpc/kernel/rtas.c:496
 in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1
 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc2-thuth #6
 Call Trace:
 [c0007ffe7b90] [c0807670] dump_stack+0xa0/0xdc (unreliable)
 [c0007ffe7bc0] [c00e1f14] ___might_sleep+0x134/0x180
 [c0007ffe7c20] [c002aec0] rtas_busy_delay+0x30/0xd0
 [c0007ffe7c50] [c002bde4] rtas_get_sensor+0x74/0xe0
 [c0007ffe7ce0] [c0083264] ras_epow_interrupt+0x44/0x450
 [c0007ffe7d90] [c0120260] handle_irq_event_percpu+0xa0/0x300
 [c0007ffe7e70] [c0120524] handle_irq_event+0x64/0xc0
 [c0007ffe7eb0] [c0124dbc] handle_fasteoi_irq+0xec/0x260
 [c0007ffe7ef0] [c011f4f0] generic_handle_irq+0x50/0x80
 [c0007ffe7f20] [c0010f3c] __do_irq+0x8c/0x200
 [c0007ffe7f90] [c00236cc] call_do_irq+0x14/0x24
 [c0007e6f39e0] [c0011144] do_IRQ+0x94/0x110
 [c0007e6f3a30] [c0002594] hardware_interrupt_common+0x114/0x180

Fix this issue by introducing a new rtas_get_sensor_fast() function
that does not use rtas_busy_delay() - and thus can only be used for
sensors that do not cause a BUSY condition - known as "fast" sensors.

The EPOW sensor is defined to be "fast" in sPAPR - mpe.

Fixes: 587f83e8dd50 ("powerpc/pseries: Use rtas_get_sensor in RAS code")
Signed-off-by: Thomas Huth 
Reviewed-by: Nathan Fontenot 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/include/asm/rtas.h  |1 +
 arch/powerpc/kernel/rtas.c   |   17 +
 arch/powerpc/platforms/pseries/ras.c |3 ++-
 3 files changed, 20 insertions(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/rtas.h
+++ b/arch/powerpc/include/asm/rtas.h
@@ -343,6 +343,7 @@ extern void rtas_power_off(void);
 extern void rtas_halt(void);
 extern void rtas_os_term(char *str);
 extern int rtas_get_sensor(int sensor, int index, int *state);
+extern int rtas_get_sensor_fast(int sensor, int index, int *state);
 extern int rtas_get_power_level(int powerdomain, int *level);
 extern int rtas_set_power_level(int powerdomain, int level, int *setlevel);
 extern bool rtas_indicator_present(int token, int *maxindex);
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -584,6 +584,23 @@ int rtas_get_sensor(int sensor, int inde
 }
 EXPORT_SYMBOL(rtas_get_sensor);
 
+int rtas_get_sensor_fast(int sensor, int index, int *state)
+{
+   int token = rtas_token("get-sensor-state");
+   int rc;
+
+   if (token == RTAS_UNKNOWN_SERVICE)
+   return -ENOENT;
+
+   rc = rtas_call(token, 2, 2, state, sensor, index);
+   WARN_ON(rc == RTAS_BUSY || (rc >= RTAS_EXTENDED_DELAY_MIN &&
+   rc <= RTAS_EXTENDED_DELAY_MAX));
+
+   if (rc < 0)
+   return rtas_error_rc(rc);
+   return rc;
+}
+
 bool rtas_indicator_present(int token, int *maxindex)
 {
int proplen, count, i;
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -189,7 +189,8 @@ static irqreturn_t ras_epow_interrupt(in
int state;
int critical;
 
-   status = rtas_get_sensor(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, );
+   status = rtas_get_sensor_fast(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX,
+ );
 
if (state > 3)
critical = 1;   /* Time Critical */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 053/134] powerpc: Uncomment and make enable_kernel_vsx() routine available

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Leonidas Da Silva Barbosa 

commit 72cd7b44bc99376b3f3c93cedcd052663fcdf705 upstream.

enable_kernel_vsx() function was commented since anything was using
it. However, vmx-crypto driver uses VSX instructions which are
only available if VSX is enable. Otherwise it rises an exception oops.

This patch uncomment enable_kernel_vsx() routine and makes it available.

Signed-off-by: Leonidas S. Barbosa 
Signed-off-by: Herbert Xu 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/include/asm/switch_to.h |1 +
 arch/powerpc/kernel/process.c|3 ---
 2 files changed, 1 insertion(+), 3 deletions(-)

--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -29,6 +29,7 @@ static inline void save_early_sprs(struc
 
 extern void enable_kernel_fp(void);
 extern void enable_kernel_altivec(void);
+extern void enable_kernel_vsx(void);
 extern int emulate_altivec(struct pt_regs *);
 extern void __giveup_vsx(struct task_struct *);
 extern void giveup_vsx(struct task_struct *);
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -204,8 +204,6 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_threa
 #endif /* CONFIG_ALTIVEC */
 
 #ifdef CONFIG_VSX
-#if 0
-/* not currently used, but some crazy RAID module might want to later */
 void enable_kernel_vsx(void)
 {
WARN_ON(preemptible());
@@ -220,7 +218,6 @@ void enable_kernel_vsx(void)
 #endif /* CONFIG_SMP */
 }
 EXPORT_SYMBOL(enable_kernel_vsx);
-#endif
 
 void giveup_vsx(struct task_struct *tsk)
 {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 036/134] KVM: arm64: add workaround for Cortex-A57 erratum #852523

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Will Deacon 

commit 43297dda0a51e4ffed0888ce727c218cfb7474b6 upstream.

When restoring the system register state for an AArch32 guest at EL2,
writes to DACR32_EL2 may not be correctly synchronised by Cortex-A57,
which can lead to the guest effectively running with junk in the DACR
and running into unexpected domain faults.

This patch works around the issue by re-ordering our restoration of the
AArch32 register aliases so that they happen before the AArch64 system
registers. Ensuring that the registers are restored in this order
guarantees that they will be correctly synchronised by the core.

Reviewed-by: Marc Zyngier 
Signed-off-by: Will Deacon 
Signed-off-by: Marc Zyngier 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kvm/hyp.S |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -943,13 +943,15 @@ ENTRY(__kvm_vcpu_run)
// Guest context
add x2, x0, #VCPU_CONTEXT
 
+   // We must restore the 32-bit state before the sysregs, thanks
+   // to Cortex-A57 erratum #852523.
+   restore_guest_32bit_state
bl __restore_sysregs
bl __restore_fpsimd
 
skip_debug_state x3, 1f
bl  __restore_debug
 1:
-   restore_guest_32bit_state
restore_guest_regs
 
// That's it, no more messing around.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 015/134] rtlwifi: rtl8821ae: Fix an expression that is always false

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Larry Finger 

commit 251086f588720277a6f5782020a648ce32c4e00b upstream.

In routine _rtl8821ae_set_media_status(), an incorrect mask results in a test
for AP status to always be false. Similar bugs were fixed in rtl8192cu and
rtl8192de, but this instance was missed at that time.

Reported-by: David Binderman 
Signed-off-by: Larry Finger 
Cc: David Binderman 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/rtlwifi/rtl8821ae/hw.c  |2 +-
 drivers/net/wireless/rtlwifi/rtl8821ae/reg.h |1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -2180,7 +2180,7 @@ static int _rtl8821ae_set_media_status(s
 
rtl_write_byte(rtlpriv, MSR, bt_msr);
rtlpriv->cfg->ops->led_control(hw, ledaction);
-   if ((bt_msr & 0xfc) == MSR_AP)
+   if ((bt_msr & MSR_MASK) == MSR_AP)
rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x00);
else
rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x66);
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h
@@ -429,6 +429,7 @@
 #defineMSR_ADHOC   0x01
 #defineMSR_INFRA   0x02
 #defineMSR_AP  0x03
+#define MSR_MASK   0x03
 
 #defineRRSR_RSC_OFFSET 21
 #defineRRSR_SHORT_OFFSET   23


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 047/134] pinctrl: at91: fix null pointer dereference

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: David Dueck 

commit 1ab36387ea4face01aac3560b396b1e2ce07c4ff upstream.

Not all gpio banks are necessarily enabled, in the current code this can
lead to null pointer dereferences.

[   51.13] Unable to handle kernel NULL pointer dereference at virtual 
address 0058
[   51.13] pgd = dee04000
[   51.13] [0058] *pgd=3f66d831, *pte=, *ppte=
[   51.14] Internal error: Oops: 17 [#1] ARM
[   51.14] Modules linked in:
[   51.14] CPU: 0 PID: 1664 Comm: cat Not tainted 4.1.1+ #6
[   51.14] Hardware name: Atmel SAMA5
[   51.14] task: df6dd880 ti: dec6 task.ti: dec6
[   51.14] PC is at at91_pinconf_get+0xb4/0x200
[   51.14] LR is at at91_pinconf_get+0xb4/0x200
[   51.14] pc : []lr : []psr: 600f0013
sp : dec61e48  ip : 600f0013  fp : df522538
[   51.14] r10: df52250c  r9 : 0058  r8 : 0068
[   51.14] r7 :   r6 : df53c910  r5 :   r4 : dec61e7c
[   51.14] r3 :   r2 : c06746d4  r1 :   r0 : 0003
[   51.14] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   51.14] Control: 10c53c7d  Table: 3ee04059  DAC: 0015
[   51.14] Process cat (pid: 1664, stack limit = 0xdec60208)
[   51.14] Stack: (0xdec61e48 to 0xdec62000)
[   51.14] 1e40:   0358  df522500 ded15f80 
c05a9d08 ded15f80
[   51.14] 1e60: 048c 0061 df522500 ded15f80 c05a9d08 c01e7304 
ded15f80 
[   51.14] 1e80: c01e6008 0060 048c c01e6034 c01e5f6c ded15f80 
dec61ec0 
[   51.14] 1ea0: 0002 ded6f280 dec61f80 0001 0001 c00ae0b8 
b6e8 ded15fb0
[   51.14] 1ec0:   df4bc974 0055 0800 ded6f280 
b6e8 ded6f280
[   51.14] 1ee0: ded6f280 0002 b6e8  0002 c0090dec 
c0671e1c dec61fb0
[   51.14] 1f00: b6f8b510 0001 4201 c000924c  0003 
0003 
[   51.14] 1f20: df4bc940 00022000 0022 c066e188 b6e7f000 c00836f4 
000b6e7f ded6f280
[   51.14] 1f40: ded6f280 b6e8 dec61f80 ded6f280 0002 c0091508 
 0003
[   51.14] 1f60: 00022000   ded6f280 ded6f280 0002 
b6e8 c0091d9c
[   51.14] 1f80:    0002 0002 b6e8 
0003 c000f124
[   51.14] 1fa0: dec6 c000efa0 0002 0002 0003 b6e8 
0002 000271c4
[   51.14] 1fc0: 0002 0002 b6e8 0003 7fffe000  
 0002
[   51.14] 1fe0:  bef50b64 00013835 b6f29c76 400f0030 0003 
 
[   51.14] [] (at91_pinconf_get) from [] 
(at91_pinconf_dbg_show+0x18/0x2c0)
[   51.14] [] (at91_pinconf_dbg_show) from [] 
(pinconf_pins_show+0xc8/0xf8)
[   51.14] [] (pinconf_pins_show) from [] 
(seq_read+0x1a0/0x464)
[   51.14] [] (seq_read) from [] (__vfs_read+0x20/0xd0)
[   51.14] [] (__vfs_read) from [] (vfs_read+0x7c/0x108)
[   51.14] [] (vfs_read) from [] (SyS_read+0x40/0x94)
[   51.14] [] (SyS_read) from [] 
(ret_fast_syscall+0x0/0x3c)
[   51.14] Code: eb010ec2 e30a0d08 e34c005a eb0ae5a7 (e5993000)
[   51.15] ---[ end trace fb3c370da3ea4794 ]---

Fixes: a0b957f306fa ("pinctrl: at91: allow to have disabled gpio bank")
Signed-off-by: David Dueck 
Acked-by: Ludovic Desroches 
Acked-by: Alexandre Belloni 
Acked-by: Nicolas Ferre 
Cc: Boris Brezillon 
Cc: Jean-Christophe PLAGNIOL-VILLARD 
Cc: linux-arm-ker...@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Linus Walleij 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pinctrl/pinctrl-at91.c |   15 +++
 1 file changed, 15 insertions(+)

--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -320,6 +320,9 @@ static const struct pinctrl_ops at91_pct
 static void __iomem *pin_to_controller(struct at91_pinctrl *info,
 unsigned int bank)
 {
+   if (!gpio_chips[bank])
+   return NULL;
+
return gpio_chips[bank]->regbase;
 }
 
@@ -729,6 +732,10 @@ static int at91_pmx_set(struct pinctrl_d
pin = _conf[i];
at91_pin_dbg(info->dev, pin);
pio = pin_to_controller(info, pin->bank);
+
+   if (!pio)
+   continue;
+
mask = pin_to_mask(pin->pin);
at91_mux_disable_interrupt(pio, mask);
switch (pin->mux) {
@@ -848,6 +855,10 @@ static int at91_pinconf_get(struct pinct
*config = 0;
dev_dbg(info->dev, "%s:%d, pin_id=%d", __func__, __LINE__, pin_id);
pio = pin_to_controller(info, pin_to_bank(pin_id));
+
+   if (!pio)
+   return -EINVAL;
+
pin = pin_id % MAX_NB_GPIO_PER_BANK;
 
if (at91_mux_get_multidrive(pio, pin))
@@ -889,6 +900,10 @@ static int at91_pinconf_set(struct pinct

[PATCH 4.2 051/134] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Michael Ellerman 

commit 74b5037baa2011a2799e2c43adde7d171b072f9e upstream.

The powerpc kernel can be built to have either a 4K PAGE_SIZE or a 64K
PAGE_SIZE.

However when built with a 4K PAGE_SIZE there is an additional config
option which can be enabled, PPC_HAS_HASH_64K, which means the kernel
also knows how to hash a 64K page even though the base PAGE_SIZE is 4K.

This is used in one obscure configuration, to support 64K pages for SPU
local store on the Cell processor when the rest of the kernel is using
4K pages.

In this configuration, pte_pagesize_index() is defined to just pass
through its arguments to get_slice_psize(). However pte_pagesize_index()
is called for both user and kernel addresses, whereas get_slice_psize()
only knows how to handle user addresses.

This has been broken forever, however until recently it happened to
work. That was because in get_slice_psize() the large kernel address
would cause the right shift of the slice mask to return zero.

However in commit 7aa0727f3302 ("powerpc/mm: Increase the slice range to
64TB"), the get_slice_psize() code was changed so that instead of a
right shift we do an array lookup based on the address. When passed a
kernel address this means we index way off the end of the slice array
and return random junk.

That is only fatal if we happen to hit something non-zero, but when we
do return a non-zero value we confuse the MMU code and eventually cause
a check stop.

This fix is ugly, but simple. When we're called for a kernel address we
return 4K, which is always correct in this configuration, otherwise we
use the slice mask.

Fixes: 7aa0727f3302 ("powerpc/mm: Increase the slice range to 64TB")
Reported-by: Cyril Bur 
Signed-off-by: Michael Ellerman 
Reviewed-by: Aneesh Kumar K.V 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/include/asm/pgtable-ppc64.h |   14 +-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -135,7 +135,19 @@
 #define pte_iterate_hashed_end() } while(0)
 
 #ifdef CONFIG_PPC_HAS_HASH_64K
-#define pte_pagesize_index(mm, addr, pte)  get_slice_psize(mm, addr)
+/*
+ * We expect this to be called only for user addresses or kernel virtual
+ * addresses other than the linear mapping.
+ */
+#define pte_pagesize_index(mm, addr, pte)  \
+   ({  \
+   unsigned int psize; \
+   if (is_kernel_addr(addr))   \
+   psize = MMU_PAGE_4K;\
+   else\
+   psize = get_slice_psize(mm, addr);  \
+   psize;  \
+   })
 #else
 #define pte_pagesize_index(mm, addr, pte)  MMU_PAGE_4K
 #endif


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 048/134] powerpc/pseries: Fix corrupted pdn list

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Gavin Shan 

commit 590c7567a2895f939525ead57b0334c6d47986f0 upstream.

Commit cca87d30 ("powerpc/pci: Refactor pci_dn") introduced pdn
list for SRIOV VFs. It means the pdn is be put into the child list
of its parent pdn when the pdn is created. When doing PCI hot
unplugging on pSeries, the PCI device node as well as its pdn are
released through procfs entry "powerpc/ofdt". Some one else grabs
the memory chunk of the pdn and update it accordingly. At the same
time, the pdn is still tracked in the child list of parent pdn. It
leads to corrupted child list in the parent pdn.

This fixes above issue by removing the pdn from the child list of
its parent pdn when the device node is detached from the system.
Note the pdn is free'd when the device node is released if the
device node is dynamic one. Otherwise, the device node as well
as the pdn won't be released.

Fixes: cca87d30 ("powerpc/pci: Refactor pci_dn")
Reported-by: Santwana Samantray 
Signed-off-by: Gavin Shan 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/platforms/pseries/setup.c |5 +
 1 file changed, 5 insertions(+)

--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -268,6 +268,11 @@ static int pci_dn_reconfig_notifier(stru
eeh_dev_init(PCI_DN(np), pci->phb);
}
break;
+   case OF_RECONFIG_DETACH_NODE:
+   pci = PCI_DN(np);
+   if (pci)
+   list_del(>list);
+   break;
default:
err = NOTIFY_DONE;
break;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 049/134] powerpc/eeh: Probe after unbalanced kref check

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Daniel Axtens 

commit e642d11bdbfe8eb10116ab3959a2b5d75efda832 upstream.

In the complete hotplug case, EEH PEs are supposed to be released
and set to NULL. Normally, this is done by eeh_remove_device(),
which is called from pcibios_release_device().

However, if something is holding a kref to the device, it will not
be released, and the PE will remain. eeh_add_device_late() has
a check for this which will explictly destroy the PE in this case.

This check in eeh_add_device_late() occurs after a call to
eeh_ops->probe(). On PowerNV, probe is a pointer to pnv_eeh_probe(),
which will exit without probing if there is an existing PE.

This means that on PowerNV, devices with outstanding krefs will not
be rediscovered by EEH correctly after a complete hotplug. This is
affecting CXL (CAPI) devices in the field.

Put the probe after the kref check so that the PE is destroyed
and affected devices are correctly rediscovered by EEH.

Fixes: d91dafc02f42 ("powerpc/eeh: Delay probing EEH device during hotplug")
Cc: Gavin Shan 
Signed-off-by: Daniel Axtens 
Acked-by: Gavin Shan 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/kernel/eeh.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -1116,9 +1116,6 @@ void eeh_add_device_late(struct pci_dev
return;
}
 
-   if (eeh_has_flag(EEH_PROBE_MODE_DEV))
-   eeh_ops->probe(pdn, NULL);
-
/*
 * The EEH cache might not be removed correctly because of
 * unbalanced kref to the device during unplug time, which
@@ -1142,6 +1139,9 @@ void eeh_add_device_late(struct pci_dev
dev->dev.archdata.edev = NULL;
}
 
+   if (eeh_has_flag(EEH_PROBE_MODE_DEV))
+   eeh_ops->probe(pdn, NULL);
+
edev->pdev = dev;
dev->dev.archdata.edev = edev;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 050/134] powerpc/eeh: Fix fenced PHB caused by eeh_slot_error_detail()

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Gavin Shan 

commit 259800135c654a098d9f0adfdd3d1f20eef1f231 upstream.

The config space of some PCI devices can't be accessed when their
PEs are in frozen state. Otherwise, fenced PHB might be seen.
Those PEs are identified with flag EEH_PE_CFG_RESTRICTED, meaing
EEH_PE_CFG_BLOCKED is set automatically when the PE is put to
frozen state (EEH_PE_ISOLATED). eeh_slot_error_detail() restores
PCI device BARs with eeh_pe_restore_bars(), which then calls
eeh_ops->restore_config() to reinitialize the PCI device in
(OPAL) firmware. eeh_ops->restore_config() produces PCI config
access that causes fenced PHB. The problem was reported on below
adapter:

   0001:01:00.0 0200: 14e4:168e (rev 10)
   0001:01:00.0 Ethernet controller: Broadcom Corporation \
NetXtreme II BCM57810 10 Gigabit Ethernet (rev 10)

This fixes the issue by skipping eeh_pe_restore_bars() in
eeh_slot_error_detail() when EEH_PE_CFG_BLOCKED is set for the PE.

Fixes: b6541db1 ("powerpc/eeh: Block PCI config access upon frozen PE")
Reported-by: Manvanthara B. Puttashankar 
Signed-off-by: Gavin Shan 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/kernel/eeh.c |   21 ++---
 1 file changed, 18 insertions(+), 3 deletions(-)

--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -308,11 +308,26 @@ void eeh_slot_error_detail(struct eeh_pe
if (!(pe->type & EEH_PE_PHB)) {
if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG))
eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
+
+   /*
+* The config space of some PCI devices can't be accessed
+* when their PEs are in frozen state. Otherwise, fenced
+* PHB might be seen. Those PEs are identified with flag
+* EEH_PE_CFG_RESTRICTED, indicating EEH_PE_CFG_BLOCKED
+* is set automatically when the PE is put to EEH_PE_ISOLATED.
+*
+* Restoring BARs possibly triggers PCI config access in
+* (OPAL) firmware and then causes fenced PHB. If the
+* PCI config is blocked with flag EEH_PE_CFG_BLOCKED, it's
+* pointless to restore BARs and dump config space.
+*/
eeh_ops->configure_bridge(pe);
-   eeh_pe_restore_bars(pe);
+   if (!(pe->state & EEH_PE_CFG_BLOCKED)) {
+   eeh_pe_restore_bars(pe);
 
-   pci_regs_buf[0] = 0;
-   eeh_pe_traverse(pe, eeh_dump_pe_log, );
+   pci_regs_buf[0] = 0;
+   eeh_pe_traverse(pe, eeh_dump_pe_log, );
+   }
}
 
eeh_ops->get_log(pe, severity, pci_regs_buf, loglen);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 037/134] arm64: KVM: Disable virtual timer even if the guest is not using it

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Zyngier 

commit c4cbba9fa078f55d9f6d081dbb4aec7cf969e7c7 upstream.

When running a guest with the architected timer disabled (with QEMU and
the kernel_irqchip=off option, for example), it is important to make
sure the timer gets turned off. Otherwise, the guest may try to
enable it anyway, leading to a screaming HW interrupt.

The fix is to unconditionally turn off the virtual timer on guest
exit.

Reviewed-by: Christoffer Dall 
Signed-off-by: Marc Zyngier 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kvm/hyp.S |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -840,8 +840,6 @@
mrs x3, cntv_ctl_el0
and x3, x3, #3
str w3, [x0, #VCPU_TIMER_CNTV_CTL]
-   bic x3, x3, #1  // Clear Enable
-   msr cntv_ctl_el0, x3
 
isb
 
@@ -849,6 +847,9 @@
str x3, [x0, #VCPU_TIMER_CNTV_CVAL]
 
 1:
+   // Disable the virtual timer
+   msr cntv_ctl_el0, xzr
+
// Allow physical timer/counter access for the host
mrs x2, cnthctl_el2
orr x2, x2, #3


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 054/134] crypto: vmx - Adding enable_kernel_vsx() to access VSX instructions

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Leonidas Da Silva Barbosa 

commit 2d6f0600b2cd755959527230ef5a6fba97bb762a upstream.

vmx-crypto driver make use of some VSX instructions which are
only available if VSX is enabled. Running in cases where VSX
are not enabled vmx-crypto fails in a VSX exception.

In order to fix this enable_kernel_vsx() was added to turn on
VSX instructions for vmx-crypto.

Signed-off-by: Leonidas S. Barbosa 
Signed-off-by: Herbert Xu 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/vmx/aes.c |3 +++
 drivers/crypto/vmx/aes_cbc.c |3 +++
 drivers/crypto/vmx/aes_ctr.c |3 +++
 drivers/crypto/vmx/ghash.c   |4 
 4 files changed, 13 insertions(+)

--- a/drivers/crypto/vmx/aes.c
+++ b/drivers/crypto/vmx/aes.c
@@ -84,6 +84,7 @@ static int p8_aes_setkey(struct crypto_t
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
ret = aes_p8_set_encrypt_key(key, keylen * 8, >enc_key);
ret += aes_p8_set_decrypt_key(key, keylen * 8, >dec_key);
pagefault_enable();
@@ -103,6 +104,7 @@ static void p8_aes_encrypt(struct crypto
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
aes_p8_encrypt(src, dst, >enc_key);
pagefault_enable();
preempt_enable();
@@ -119,6 +121,7 @@ static void p8_aes_decrypt(struct crypto
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
aes_p8_decrypt(src, dst, >dec_key);
pagefault_enable();
preempt_enable();
--- a/drivers/crypto/vmx/aes_cbc.c
+++ b/drivers/crypto/vmx/aes_cbc.c
@@ -85,6 +85,7 @@ static int p8_aes_cbc_setkey(struct cryp
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
ret = aes_p8_set_encrypt_key(key, keylen * 8, >enc_key);
ret += aes_p8_set_decrypt_key(key, keylen * 8, >dec_key);
pagefault_enable();
@@ -115,6 +116,7 @@ static int p8_aes_cbc_encrypt(struct blk
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
 
blkcipher_walk_init(, dst, src, nbytes);
ret = blkcipher_walk_virt(desc, );
@@ -155,6 +157,7 @@ static int p8_aes_cbc_decrypt(struct blk
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
 
blkcipher_walk_init(, dst, src, nbytes);
ret = blkcipher_walk_virt(desc, );
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -82,6 +82,7 @@ static int p8_aes_ctr_setkey(struct cryp
 
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
ret = aes_p8_set_encrypt_key(key, keylen * 8, >enc_key);
pagefault_enable();
 
@@ -100,6 +101,7 @@ static void p8_aes_ctr_final(struct p8_a
 
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
aes_p8_encrypt(ctrblk, keystream, >enc_key);
pagefault_enable();
 
@@ -132,6 +134,7 @@ static int p8_aes_ctr_crypt(struct blkci
while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) {
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
aes_p8_ctr32_encrypt_blocks(walk.src.virt.addr,
walk.dst.virt.addr,
(nbytes &
--- a/drivers/crypto/vmx/ghash.c
+++ b/drivers/crypto/vmx/ghash.c
@@ -119,6 +119,7 @@ static int p8_ghash_setkey(struct crypto
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
enable_kernel_fp();
gcm_init_p8(ctx->htable, (const u64 *) key);
pagefault_enable();
@@ -149,6 +150,7 @@ static int p8_ghash_update(struct shash_
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();
enable_kernel_fp();
gcm_ghash_p8(dctx->shash, ctx->htable,
 dctx->buffer, GHASH_DIGEST_SIZE);
@@ -163,6 +165,7 @@ static int p8_ghash_update(struct shash_
preempt_disable();
pagefault_disable();
enable_kernel_altivec();
+   enable_kernel_vsx();

[PATCH 4.2 063/134] x86/mm: Initialize pmd_idx in page_table_range_init_count()

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Minfei Huang 

commit 9962eea9e55f797f05f20ba6448929cab2a9f018 upstream.

The variable pmd_idx is not initialized for the first iteration of the
for loop.

Assign the proper value which indexes the start address.

Fixes: 719272c45b82 'x86, mm: only call early_ioremap_page_table_range_init() 
once'
Signed-off-by: Minfei Huang 
Cc: tony.l...@intel.com
Cc: wangn...@huawei.com
Cc: david.vra...@citrix.com
Reviewed-by: ying...@kernel.org
Link: 
http://lkml.kernel.org/r/1436703522-29552-1-git-send-email-mhu...@redhat.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/mm/init_32.c |1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -137,6 +137,7 @@ page_table_range_init_count(unsigned lon
 
vaddr = start;
pgd_idx = pgd_index(vaddr);
+   pmd_idx = pmd_index(vaddr);
 
for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd_idx++) {
for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 056/134] powerpc/powernv/pci-ioda: fix kdump with non-power-of-2 crashkernel=

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Nishanth Aravamudan 

commit fa14486979b3a47307bcdb10f8b5baa875a5cf68 upstream.

The 32-bit TCE table initialization relies on the DMA window having a
size equal to a power of 2 (and checks for it explicitly). But
crashkernel= has no constraint that requires a power-of-2 be specified.
This causes the kdump kernel to fail to boot as none of the PCI devices
(including the disk controller) are successfully initialized.

After this change, the PCI devices successfully set up the 32-bit TCE
table and kdump succeeds.

Fixes: aca6913f5551 ("powerpc/powernv/ioda2: Introduce helpers to allocate TCE 
pages")
Signed-off-by: Nishanth Aravamudan 
Tested-by: Jan Stancek 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/platforms/powernv/pci-ioda.c |   10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2079,12 +2079,18 @@ static long pnv_pci_ioda2_setup_default_
long rc;
 
/*
+* crashkernel= specifies the kdump kernel's maximum memory at
+* some offset and there is no guaranteed the result is a power
+* of 2, which will cause errors later.
+*/
+   const u64 max_memory = __rounddown_pow_of_two(memory_hotplug_max());
+
+   /*
 * In memory constrained environments, e.g. kdump kernel, the
 * DMA window can be larger than available memory, which will
 * cause errors later.
 */
-   const u64 window_size = min((u64)pe->table_group.tce32_size,
-memory_hotplug_max());
+   const u64 window_size = min((u64)pe->table_group.tce32_size, 
max_memory);
 
rc = pnv_pci_ioda2_create_table(>table_group, 0,
IOMMU_PAGE_SHIFT_4K,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 058/134] powerpc/boot: Specify ABI v2 when building an LE boot wrapper

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Benjamin Herrenschmidt 

commit 655471f54c2e395ba29ae4156ba0f49928177cc1 upstream.

The kernel does it, not the boot wrapper, which breaks with some
cross compilers that still default to ABI v1.

Fixes: 147c05168fc8 ("powerpc/boot: Add support for 64bit little endian 
wrapper")
Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/boot/Makefile |3 +++
 1 file changed, 3 insertions(+)

--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -28,6 +28,9 @@ BOOTCFLAGS+= -m64
 endif
 ifdef CONFIG_CPU_BIG_ENDIAN
 BOOTCFLAGS += -mbig-endian
+else
+BOOTCFLAGS += -mlittle-endian
+BOOTCFLAGS += $(call cc-option,-mabi=elfv2)
 endif
 
 BOOTAFLAGS := -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional -nostdinc


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 057/134] powerpc/pseries: Release DRC when configure_connector fails

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Bharata B Rao 

commit daebaabb5cfbe4a6f09ca0e0f8b7673efc704960 upstream.

Commit f32393c943e2 ("powerpc/pseries: Correct cpu affinity for
dlpar added cpus") moved dlpar_acquire_drc() call to before
dlpar_configure_connector() call in dlpar_cpu_probe(), but missed
to release the DRC if dlpar_configure_connector() failed.
During CPU hotplug, if configure-connector fails for any reason,
then this will result in subsequent CPU hotplug attempts to fail.

Release the acquired DRC if dlpar_configure_connector() call fails
so that the DRC is left in right isolation and allocation state
for the subsequent hotplug operation to succeed.

Fixes: f32393c943e2 ("powerpc/pseries: Correct cpu affinity for dlpar added 
cpus")
Signed-off-by: Bharata B Rao 
Reviewed-by: Nathan Fontenot 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/platforms/pseries/dlpar.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -422,8 +422,10 @@ static ssize_t dlpar_cpu_probe(const cha
 
dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
of_node_put(parent);
-   if (!dn)
+   if (!dn) {
+   dlpar_release_drc(drc_index);
return -EINVAL;
+   }
 
rc = dlpar_attach_node(dn);
if (rc) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 012/134] blk-mq: fix race between timeout and freeing request

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

commit 0048b4837affd153897ed183492070027aa9 upstream.

Inside timeout handler, blk_mq_tag_to_rq() is called
to retrieve the request from one tag. This way is obviously
wrong because the request can be freed any time and some
fiedds of the request can't be trusted, then kernel oops
might be triggered[1].

Currently wrt. blk_mq_tag_to_rq(), the only special case is
that the flush request can share same tag with the request
cloned from, and the two requests can't be active at the same
time, so this patch fixes the above issue by updating tags->rqs[tag]
with the active request(either flush rq or the request cloned
from) of the tag.

Also blk_mq_tag_to_rq() gets much simplified with this patch.

Given blk_mq_tag_to_rq() is mainly for drivers and the caller must
make sure the request can't be freed, so in bt_for_each() this
helper is replaced with tags->rqs[tag].

[1] kernel oops log
[  439.696220] BUG: unable to handle kernel NULL pointer dereference at 
0158^M
[  439.697162] IP: [] blk_mq_tag_to_rq+0x21/0x6e^M
[  439.700653] PGD 7ef765067 PUD 7ef764067 PMD 0 ^M
[  439.700653] Oops:  [#1] PREEMPT SMP DEBUG_PAGEALLOC ^M
[  439.700653] Dumping ftrace buffer:^M
[  439.700653](ftrace buffer empty)^M
[  439.700653] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M
[  439.700653] CPU: 6 PID: 2779 Comm: stress-ng-sigfd Not tainted 
4.2.0-rc5-next-20150805+ #265^M
[  439.730500] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
Bochs 01/01/2011^M
[  439.730500] task: 880605308000 ti: 88060530c000 task.ti: 
88060530c000^M
[  439.730500] RIP: 0010:[]  [] 
blk_mq_tag_to_rq+0x21/0x6e^M
[  439.730500] RSP: 0018:880819203da0  EFLAGS: 00010283^M
[  439.730500] RAX: 880811b0e000 RBX: 8800bb465f00 RCX: 
0002^M
[  439.730500] RDX:  RSI: 0202 RDI: 
^M
[  439.730500] RBP: 880819203db0 R08: 0002 R09: 
^M
[  439.730500] R10:  R11:  R12: 
0202^M
[  439.730500] R13: 880814104800 R14: 0002 R15: 
880811a2ea00^M
[  439.730500] FS:  7f165b3f5740() GS:88081920() 
knlGS:^M
[  439.730500] CS:  0010 DS:  ES:  CR0: 8005003b^M
[  439.730500] CR2: 0158 CR3: 0007ef766000 CR4: 
06e0^M
[  439.730500] Stack:^M
[  439.730500]  0008 8808114eed90 880819203e00 
812dc104^M
[  439.755663]  880819203e40 812d9f5e 0200 
8808114eed80^M
[  439.755663] Call Trace:^M
[  439.755663]   ^M
[  439.755663]  [] bt_for_each+0x6e/0xc8^M
[  439.755663]  [] ? blk_mq_rq_timed_out+0x6a/0x6a^M
[  439.755663]  [] ? blk_mq_rq_timed_out+0x6a/0x6a^M
[  439.755663]  [] blk_mq_tag_busy_iter+0x55/0x5e^M
[  439.755663]  [] ? blk_mq_bio_to_request+0x38/0x38^M
[  439.755663]  [] blk_mq_rq_timer+0x5d/0xd4^M
[  439.755663]  [] call_timer_fn+0xf7/0x284^M
[  439.755663]  [] ? call_timer_fn+0x5/0x284^M
[  439.755663]  [] ? blk_mq_bio_to_request+0x38/0x38^M
[  439.755663]  [] run_timer_softirq+0x1ce/0x1f8^M
[  439.755663]  [] __do_softirq+0x181/0x3a4^M
[  439.755663]  [] irq_exit+0x40/0x94^M
[  439.755663]  [] smp_apic_timer_interrupt+0x33/0x3e^M
[  439.755663]  [] apic_timer_interrupt+0x84/0x90^M
[  439.755663]   ^M
[  439.755663]  [] ? _raw_spin_unlock_irq+0x32/0x4a^M
[  439.755663]  [] finish_task_switch+0xe0/0x163^M
[  439.755663]  [] ? finish_task_switch+0xa2/0x163^M
[  439.755663]  [] __schedule+0x469/0x6cd^M
[  439.755663]  [] schedule+0x82/0x9a^M
[  439.789267]  [] signalfd_read+0x186/0x49a^M
[  439.790911]  [] ? wake_up_q+0x47/0x47^M
[  439.790911]  [] __vfs_read+0x28/0x9f^M
[  439.790911]  [] ? __fget_light+0x4d/0x74^M
[  439.790911]  [] vfs_read+0x7a/0xc6^M
[  439.790911]  [] SyS_read+0x49/0x7f^M
[  439.790911]  [] entry_SYSCALL_64_fastpath+0x12/0x6f^M
[  439.790911] Code: 48 89 e5 e8 a9 b8 e7 ff 5d c3 0f 1f 44 00 00 55 89
f2 48 89 e5 41 54 41 89 f4 53 48 8b 47 60 48 8b 1c d0 48 8b 7b 30 48 8b
53 38 <48> 8b 87 58 01 00 00 48 85 c0 75 09 48 8b 97 88 0c 00 00 eb 10
^M
[  439.790911] RIP  [] blk_mq_tag_to_rq+0x21/0x6e^M
[  439.790911]  RSP ^M
[  439.790911] CR2: 0158^M
[  439.790911] ---[ end trace d40af58949325661 ]---^M

Signed-off-by: Ming Lei 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman 

---
 block/blk-flush.c  |   15 ++-
 block/blk-mq-tag.c |4 ++--
 block/blk-mq-tag.h |   12 
 block/blk-mq.c |   16 +---
 block/blk.h|6 ++
 5 files changed, 35 insertions(+), 18 deletions(-)

--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -73,6 +73,7 @@
 
 #include "blk.h"
 #include "blk-mq.h"
+#include "blk-mq-tag.h"
 
 /* FLUSH/FUA sequences */
 enum {
@@ -226,7 +227,12 @@ static void flush_end_io(struct request
struct blk_flush_queue *fq 

[PATCH 4.2 061/134] Add radeon suspend/resume quirk for HP Compaq dc5750.

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jeffery Miller 

commit 09bfda10e6efd7b65bcc29237bee1765ed779657 upstream.

With the radeon driver loaded the HP Compaq dc5750
Small Form Factor machine fails to resume from suspend.
Adding a quirk similar to other devices avoids
the problem and the system resumes properly.

Signed-off-by: Jeffery Miller 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/radeon/radeon_combios.c |8 
 1 file changed, 8 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3387,6 +3387,14 @@ void radeon_combios_asic_init(struct drm
rdev->pdev->subsystem_device == 0x30ae)
return;
 
+   /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume
+* - it hangs on resume inside the dynclk 1 table.
+*/
+   if (rdev->family == CHIP_RS480 &&
+   rdev->pdev->subsystem_vendor == 0x103c &&
+   rdev->pdev->subsystem_device == 0x280a)
+   return;
+
/* DYN CLK 1 */
table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
if (table)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 059/134] powerpc/mm: Recompute hash value after a failed update

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: "Aneesh Kumar K.V" 

commit 36b35d5d807b7e57aff7d08e63de8b17731ee211 upstream.

If we had secondary hash flag set, we ended up modifying hash value in
the updatepp code path. Hence with a failed updatepp we will be using
a wrong hash value for the following hash insert. Fix this by
recomputing hash before insert.

Without this patch we can end up with using wrong slot number in linux
pte. That can result in us missing an hash pte update or invalidate
which can cause memory corruption or even machine check.

Fixes: 6d492ecc6489 ("powerpc/THP: Add code to handle HPTE faults for 
hugepages")
Signed-off-by: Aneesh Kumar K.V 
Reviewed-by: Paul Mackerras 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/powerpc/mm/hugepage-hash64.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -85,7 +85,6 @@ int __hash_page_thp(unsigned long ea, un
BUG_ON(index >= 4096);
 
vpn = hpt_vpn(ea, vsid, ssize);
-   hash = hpt_hash(vpn, shift, ssize);
hpte_slot_array = get_hpte_slot_array(pmdp);
if (psize == MMU_PAGE_4K) {
/*
@@ -101,6 +100,7 @@ int __hash_page_thp(unsigned long ea, un
valid = hpte_valid(hpte_slot_array, index);
if (valid) {
/* update the hpte bits */
+   hash = hpt_hash(vpn, shift, ssize);
hidx =  hpte_hash_index(hpte_slot_array, index);
if (hidx & _PTEIDX_SECONDARY)
hash = ~hash;
@@ -126,6 +126,7 @@ int __hash_page_thp(unsigned long ea, un
if (!valid) {
unsigned long hpte_group;
 
+   hash = hpt_hash(vpn, shift, ssize);
/* insert new entry */
pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
new_pmd |= _PAGE_HASHPTE;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 060/134] CIFS: fix type confusion in copy offload ioctl

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jann Horn 

commit 4c17a6d56bb0cad3066a714e94f7185a24b40f49 upstream.

This might lead to local privilege escalation (code execution as
kernel) for systems where the following conditions are met:

 - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled
 - a cifs filesystem is mounted where:
  - the mount option "vers" was used and set to a value >=2.0
  - the attacker has write access to at least one file on the filesystem

To attack this, an attacker would have to guess the target_tcon
pointer (but guessing wrong doesn't cause a crash, it just returns an
error code) and win a narrow race.

Signed-off-by: Jann Horn 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/cifs/ioctl.c |6 ++
 1 file changed, 6 insertions(+)

--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -70,6 +70,12 @@ static long cifs_ioctl_clone(unsigned in
goto out_drop_write;
}
 
+   if (src_file.file->f_op->unlocked_ioctl != cifs_ioctl) {
+   rc = -EBADF;
+   cifs_dbg(VFS, "src file seems to be from a different filesystem 
type\n");
+   goto out_fput;
+   }
+
if ((!src_file.file->private_data) || (!dst_file->private_data)) {
rc = -EBADF;
cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 062/134] mm: check if section present during memory block registering

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Yinghai Lu 

commit 04697858d89e4bf2650364f8d6956e2554e8ef88 upstream.

Tony Luck found on his setup, if memory block size 512M will cause crash
during booting.

  BUG: unable to handle kernel paging request at ea007420
  IP: get_nid_for_pfn+0x17/0x40
  PGD 128ffcb067 PUD 128ffc9067 PMD 0
  Oops:  [#1] SMP
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.0-rc8 #1
  ...
  Call Trace:
 ? register_mem_sect_under_node+0x66/0xe0
 register_one_node+0x17b/0x240
 ? pci_iommu_alloc+0x6e/0x6e
 topology_init+0x3c/0x95
 do_one_initcall+0xcd/0x1f0

The system has non continuous RAM address:
 BIOS-e820: [mem 0x0013-0x001c] usable
 BIOS-e820: [mem 0x001d7000-0x001ec7ffefff] usable
 BIOS-e820: [mem 0x001f-0x002b] usable
 BIOS-e820: [mem 0x002c1800-0x002d6fffefff] usable
 BIOS-e820: [mem 0x002e-0x0039] usable

So there are start sections in memory block not present.  For example:

memory block : [0x2c1800, 0x2c2000) 512M

first three sections are not present.

The current register_mem_sect_under_node() assume first section is
present, but memory block section number range [start_section_nr,
end_section_nr] would include not present section.

For arch that support vmemmap, we don't setup memmap for struct page
area within not present sections area.

So skip the pfn range that belong to absent section.

[a...@linux-foundation.org: simplification]
[rient...@google.com: more simplification]
Fixes: bdee237c0343 ("x86: mm: Use 2GB memory block size on large memory x86-64 
systems")
Fixes: 982792c782ef ("x86, mm: probe memory block size for generic x86 64bit")
Signed-off-by: Yinghai Lu 
Signed-off-by: David Rientjes 
Reported-by: Tony Luck 
Tested-by: Tony Luck 
Cc: Greg KH 
Cc: Ingo Molnar 
Tested-by: David Rientjes 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/base/node.c |   10 ++
 1 file changed, 10 insertions(+)

--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -392,6 +392,16 @@ int register_mem_sect_under_node(struct
for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
int page_nid;
 
+   /*
+* memory block could have several absent sections from start.
+* skip pfn range from absent section
+*/
+   if (!pfn_present(pfn)) {
+   pfn = round_down(pfn + PAGES_PER_SECTION,
+PAGES_PER_SECTION) - 1;
+   continue;
+   }
+
page_nid = get_nid_for_pfn(pfn);
if (page_nid < 0)
continue;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 072/134] [media] v4l: omap3isp: Fix async notifier registration order

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Sakari Ailus 

commit 5d479386983c5f1bb1aff4f88a027b6143f88a39 upstream.

The async notifier was registered before the v4l2_device was registered and
before the notifier callbacks were set. This could lead to missing the
bound() and complete() callbacks and to attempting to spin_lock() and
uninitialised spin lock.

Also fix unregistering the async notifier in the case of an error --- the
function may not fail anymore after the notifier is registered.

Fixes: da7f3843d2c7 ("[media] omap3isp: Add support for the Device Tree")

Signed-off-by: Sakari Ailus 
Reviewed-by: Sebastian Reichel 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/media/platform/omap3isp/isp.c |   23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2000,10 +2000,8 @@ static int isp_register_entities(struct
ret = v4l2_device_register_subdev_nodes(>v4l2_dev);
 
 done:
-   if (ret < 0) {
+   if (ret < 0)
isp_unregister_entities(isp);
-   v4l2_async_notifier_unregister(>notifier);
-   }
 
return ret;
 }
@@ -2423,10 +2421,6 @@ static int isp_probe(struct platform_dev
ret = isp_of_parse_nodes(>dev, >notifier);
if (ret < 0)
return ret;
-   ret = v4l2_async_notifier_register(>v4l2_dev,
-  >notifier);
-   if (ret)
-   return ret;
} else {
isp->pdata = pdev->dev.platform_data;
isp->syscon = syscon_regmap_lookup_by_pdevname("syscon.0");
@@ -2557,18 +2551,27 @@ static int isp_probe(struct platform_dev
if (ret < 0)
goto error_iommu;
 
-   isp->notifier.bound = isp_subdev_notifier_bound;
-   isp->notifier.complete = isp_subdev_notifier_complete;
-
ret = isp_register_entities(isp);
if (ret < 0)
goto error_modules;
 
+   if (IS_ENABLED(CONFIG_OF) && pdev->dev.of_node) {
+   isp->notifier.bound = isp_subdev_notifier_bound;
+   isp->notifier.complete = isp_subdev_notifier_complete;
+
+   ret = v4l2_async_notifier_register(>v4l2_dev,
+  >notifier);
+   if (ret)
+   goto error_register_entities;
+   }
+
isp_core_init(isp, 1);
omap3isp_put(isp);
 
return 0;
 
+error_register_entities:
+   isp_unregister_entities(isp);
 error_modules:
isp_cleanup_modules(isp);
 error_iommu:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 011/134] blk-mq: fix buffer overflow when reading sysfs file of pending

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

commit 596f5aad2a704b72934e5abec1b1b4114c16f45b upstream.

There may be lots of pending requests so that the buffer of PAGE_SIZE
can't hold them at all.

One typical example is scsi-mq, the queue depth(.can_queue) of
scsi_host and blk-mq is quite big but scsi_device's queue_depth
is a bit small(.cmd_per_lun), then it is quite easy to have lots
of pending requests in hw queue.

This patch fixes the following warning and the related memory
destruction.

[  359.025101] fill_read_buffer: blk_mq_hw_sysfs_show+0x0/0x7d returned bad 
count^M
[  359.055595] irq event stamp: 15537^M
[  359.055606] general protection fault:  [#1] PREEMPT SMP DEBUG_PAGEALLOC 
^M
[  359.055614] Dumping ftrace buffer:^M
[  359.055660](ftrace buffer empty)^M
[  359.055672] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M
[  359.055678] CPU: 4 PID: 21631 Comm: stress-ng-sysfs Not tainted 
4.2.0-rc5-next-20150805 #434^M
[  359.055679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
Bochs 01/01/2011^M
[  359.055682] task: 8802161cc000 ti: 88021b4a8000 task.ti: 
88021b4a8000^M
[  359.055693] RIP: 0010:[]  [] 
__kmalloc+0xe8/0x152^M

Signed-off-by: Ming Lei 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman 

---
 block/blk-mq-sysfs.c |   21 -
 1 file changed, 16 insertions(+), 5 deletions(-)

--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_sh
 
 static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
 {
-   char *start_page = page;
struct request *rq;
+   int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);
 
-   page += sprintf(page, "%s:\n", msg);
+   list_for_each_entry(rq, list, queuelist) {
+   const int rq_len = 2 * sizeof(rq) + 2;
 
-   list_for_each_entry(rq, list, queuelist)
-   page += sprintf(page, "\t%p\n", rq);
+   /* if the output will be truncated */
+   if (PAGE_SIZE - 1 < len + rq_len) {
+   /* backspacing if it can't hold '\t...\n' */
+   if (PAGE_SIZE - 1 < len + 5)
+   len -= rq_len;
+   len += snprintf(page + len, PAGE_SIZE - 1 - len,
+   "\t...\n");
+   break;
+   }
+   len += snprintf(page + len, PAGE_SIZE - 1 - len,
+   "\t%p\n", rq);
+   }
 
-   return page - start_page;
+   return len;
 }
 
 static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] cpufreq: p4-clockmod: Replace bool_int_array[NR_CPUS] with bitmap

2015-09-26 Thread Viresh Kumar
On 26-09-15, 14:47, Denys Vlasenko wrote:
> Straigntforward conversion from
> int has_N44_O17_errata[NR_CPUS]
> to
> DECLARE_BITMAP(has_N44_O17_errata, NR_CPUS)
> 
> Saves about 2 kbytes in bss for NR_CPUS=512.
> 
> Signed-off-by: Denys Vlasenko 
> CC: Viresh Kumar 
> CC: Rafael J. Wysocki 
> CC: Ingo Molnar 
> CC: Bartosz Golaszewski 
> CC: H. Peter Anvin 
> CC: Benoit Cousson 
> CC: Fenghua Yu 
> CC: Guenter Roeck 
> CC: Jean Delvare 
> CC: Jonathan Corbet 
> CC: Peter Zijlstra 
> CC: Thomas Gleixner 
> CC: x...@kernel.org
> CC: linux-kernel@vger.kernel.org
> ---
>  drivers/cpufreq/p4-clockmod.c | 8 
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
> index 5dd95da..dd15810 100644
> --- a/drivers/cpufreq/p4-clockmod.c
> +++ b/drivers/cpufreq/p4-clockmod.c
> @@ -49,7 +49,7 @@ enum {
>  #define DC_ENTRIES   8
>  
>  
> -static int has_N44_O17_errata[NR_CPUS];
> +static DECLARE_BITMAP(has_N44_O17_errata, NR_CPUS);
>  static unsigned int stock_freq;
>  static struct cpufreq_driver p4clockmod_driver;
>  static unsigned int cpufreq_p4_get(unsigned int cpu);
> @@ -66,7 +66,7 @@ static int cpufreq_p4_setdc(unsigned int cpu, unsigned int 
> newstate)
>   if (l & 0x01)
>   pr_debug("CPU#%d currently thermal throttled\n", cpu);
>  
> - if (has_N44_O17_errata[cpu] &&
> + if (test_bit(cpu, has_N44_O17_errata) &&
>   (newstate == DC_25PT || newstate == DC_DFLT))
>   newstate = DC_38PT;
>  
> @@ -182,7 +182,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy 
> *policy)
>   case 0x0f0a:
>   case 0x0f11:
>   case 0x0f12:
> - has_N44_O17_errata[policy->cpu] = 1;
> + set_bit(policy->cpu, has_N44_O17_errata);
>   pr_debug("has errata -- disabling low frequencies\n");
>   }
>  
> @@ -199,7 +199,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy 
> *policy)
>  
>   /* table init */
>   for (i = 1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
> - if ((i < 2) && (has_N44_O17_errata[policy->cpu]))
> + if ((i < 2) && test_bit(policy->cpu, has_N44_O17_errata))
>   p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
>   else
>   p4clockmod_table[i].frequency = (stock_freq * i)/8;

Acked-by: Viresh Kumar 
-- 
viresh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 068/134] [media] v4l: omap3isp: Fix sub-device power management code

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Sakari Ailus 

commit 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 upstream.

Commit 813f5c0ac5cc ("media: Change media device link_notify behaviour")
modified the media controller link setup notification API and updated the
OMAP3 ISP driver accordingly. As a side effect it introduced a bug by
turning power on after setting the link instead of before. This results in
sub-devices not being powered down in some cases when they should be. Fix
it.

Fixes: 813f5c0ac5cc [media] media: Change media device link_notify behaviour

Signed-off-by: Sakari Ailus 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/media/platform/omap3isp/isp.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -829,14 +829,14 @@ static int isp_pipeline_link_notify(stru
int ret;
 
if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
-   !(link->flags & MEDIA_LNK_FL_ENABLED)) {
+   !(flags & MEDIA_LNK_FL_ENABLED)) {
/* Powering off entities is assumed to never fail. */
isp_pipeline_pm_power(source, -sink_use);
isp_pipeline_pm_power(sink, -source_use);
return 0;
}
 
-   if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
+   if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH &&
(flags & MEDIA_LNK_FL_ENABLED)) {
 
ret = isp_pipeline_pm_power(source, sink_use);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 069/134] [media] media: am437x-vpfe: Requested frame size and fmt overwritten by current sensor setting

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Benoit Parrot 

commit f47c9045643f91e76d8a9030828b9fe1cf4a6bcf upstream.

Upon a S_FMT the input/requested frame size and pixel format is
overwritten by the current sub-device settings.
Fix this so application can actually set the frame size and format.

Fixes: 417d2e507edc ("[media] media: platform: add VPFE capture driver support 
for AM437X")

Signed-off-by: Benoit Parrot 
Acked-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/media/platform/am437x/am437x-vpfe.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/platform/am437x/am437x-vpfe.c
+++ b/drivers/media/platform/am437x/am437x-vpfe.c
@@ -1565,7 +1565,7 @@ static int vpfe_s_fmt(struct file *file,
return -EBUSY;
}
 
-   ret = vpfe_try_fmt(file, priv, fmt);
+   ret = vpfe_try_fmt(file, priv, );
if (ret)
return ret;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 040/134] ALSA: usb-audio: correct the value cache check.

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Yao-Wen Mao 

commit 6aa6925cad06159dc6e25857991bbc4960821242 upstream.

The check of cval->cached should be zero-based (including master channel).

Signed-off-by: Yao-Wen Mao 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/usb/mixer.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2522,7 +2522,7 @@ static int restore_mixer_value(struct us
for (c = 0; c < MAX_CHANNELS; c++) {
if (!(cval->cmask & (1 << c)))
continue;
-   if (cval->cached & (1 << c)) {
+   if (cval->cached & (1 << (c + 1))) {
err = snd_usb_set_cur_mix_value(cval, c + 1, 
idx,
cval->cache_val[idx]);
if (err < 0)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 070/134] [media] media: am437x-vpfe: Fix a race condition during release

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Benoit Parrot 

commit c99235fa3ef833c3c23926085f2bb68851c8460a upstream.

There was a race condition where during cleanup/release operation
on-going streaming would cause a kernel panic because the hardware
module was disabled prematurely with IRQ still pending.

Fixes: 417d2e507edc ("[media] media: platform: add VPFE capture driver support 
for AM437X")

Signed-off-by: Benoit Parrot 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/media/platform/am437x/am437x-vpfe.c |   14 --
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/drivers/media/platform/am437x/am437x-vpfe.c
+++ b/drivers/media/platform/am437x/am437x-vpfe.c
@@ -1186,14 +1186,24 @@ static int vpfe_initialize_device(struct
 static int vpfe_release(struct file *file)
 {
struct vpfe_device *vpfe = video_drvdata(file);
+   bool fh_singular;
int ret;
 
mutex_lock(>lock);
 
-   if (v4l2_fh_is_singular_file(file))
-   vpfe_ccdc_close(>ccdc, vpfe->pdev);
+   /* Save the singular status before we call the clean-up helper */
+   fh_singular = v4l2_fh_is_singular_file(file);
+
+   /* the release helper will cleanup any on-going streaming */
ret = _vb2_fop_release(file, NULL);
 
+   /*
+* If this was the last open file.
+* Then de-initialize hw module.
+*/
+   if (fh_singular)
+   vpfe_ccdc_close(>ccdc, vpfe->pdev);
+
mutex_unlock(>lock);
 
return ret;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 041/134] ALSA: hda - Fix missing inline for dummy snd_hdac_set_codec_wakeup()

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 6869de380e8c11c31b608bb2502dcacd634eda13 upstream.

This seems overlooked.

Fixes: 98d8fc6c5d36 ('ALSA: hda - Move hda_i915.c from sound/pci/hda to 
sound/hda')
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 include/sound/hda_i915.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/sound/hda_i915.h
+++ b/include/sound/hda_i915.h
@@ -11,7 +11,7 @@ int snd_hdac_get_display_clk(struct hdac
 int snd_hdac_i915_init(struct hdac_bus *bus);
 int snd_hdac_i915_exit(struct hdac_bus *bus);
 #else
-static int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable)
+static inline int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable)
 {
return 0;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 071/134] [media] v4l: xilinx: missing error code

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit e31f8f00bfc081ec1881d92a2dd192aeddf1d9d7 upstream.

We should set "ret" on this error path instead of returning success.

Fixes: df3305156f98 ('[media] v4l: xilinx: Add Xilinx Video IP core')

Signed-off-by: Dan Carpenter 
Acked-by: Hyun Kwon 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/media/platform/xilinx/xilinx-dma.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/media/platform/xilinx/xilinx-dma.c
+++ b/drivers/media/platform/xilinx/xilinx-dma.c
@@ -699,8 +699,10 @@ int xvip_dma_init(struct xvip_composite_
 
/* ... and the buffers queue... */
dma->alloc_ctx = vb2_dma_contig_init_ctx(dma->xdev->dev);
-   if (IS_ERR(dma->alloc_ctx))
+   if (IS_ERR(dma->alloc_ctx)) {
+   ret = PTR_ERR(dma->alloc_ctx);
goto error;
+   }
 
/* Don't enable VB2_READ and VB2_WRITE, as using the read() and write()
 * V4L2 APIs would be inefficient. Testing on the command line with a


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH V5 2/2] debugfs: Pass bool pointer to debugfs_create_bool()

2015-09-26 Thread Viresh Kumar
Its a bit odd that debugfs_create_bool() takes 'u32 *' as an argument,
when all it needs is a boolean pointer.

It would be better to update this API to make it accept 'bool *'
instead, as that will make it more consistent and often more convenient.
Over that bool takes just a byte.

That required updates to all user sites as well, in the same commit
updating the API. regmap core was also using
debugfs_{read|write}_file_bool(), directly and variable types were
updated for that to be bool as well.

Signed-off-by: Viresh Kumar 
Acked-by: Mark Brown 
Acked-by: Charles Keepax 

---
BCC'd a lot of people (rather than cc'ing them) to make sure
- the series reaches them
- mailing lists do not block the patchset due to long cc list
- and we don't spam the BCC'd people for every reply

V4->V5:
- No updates to ec_sys.c now.
---
 Documentation/filesystems/debugfs.txt  |  2 +-
 arch/arm64/kernel/debug-monitors.c |  4 ++--
 drivers/acpi/internal.h|  2 +-
 drivers/base/regmap/internal.h |  6 +++---
 drivers/base/regmap/regcache-lzo.c |  4 ++--
 drivers/base/regmap/regcache.c | 24 
 drivers/bluetooth/hci_qca.c|  4 ++--
 drivers/iommu/amd_iommu_init.c |  2 +-
 drivers/iommu/amd_iommu_types.h|  2 +-
 drivers/misc/mei/mei_dev.h |  2 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4.h |  4 ++--
 drivers/net/wireless/ath/ath10k/core.h |  2 +-
 drivers/net/wireless/ath/ath5k/ath5k.h |  2 +-
 drivers/net/wireless/ath/ath9k/hw.c|  2 +-
 drivers/net/wireless/ath/ath9k/hw.h|  4 ++--
 drivers/net/wireless/b43/debugfs.c | 18 +-
 drivers/net/wireless/b43/debugfs.h |  2 +-
 drivers/net/wireless/b43legacy/debugfs.c   | 10 +-
 drivers/net/wireless/b43legacy/debugfs.h   |  2 +-
 drivers/net/wireless/iwlegacy/common.h |  6 +++---
 drivers/net/wireless/iwlwifi/mvm/mvm.h |  6 +++---
 drivers/scsi/snic/snic_trc.c   |  4 ++--
 drivers/scsi/snic/snic_trc.h   |  2 +-
 drivers/uwb/uwb-debug.c|  2 +-
 fs/debugfs/file.c  |  6 +++---
 include/linux/debugfs.h|  4 ++--
 include/linux/edac.h   |  2 +-
 include/linux/fault-inject.h   |  2 +-
 kernel/futex.c |  4 ++--
 lib/dma-debug.c|  2 +-
 mm/failslab.c  |  8 
 mm/page_alloc.c|  8 
 sound/soc/codecs/wm_adsp.h |  2 +-
 33 files changed, 78 insertions(+), 78 deletions(-)

diff --git a/Documentation/filesystems/debugfs.txt 
b/Documentation/filesystems/debugfs.txt
index 463f595733e8..4f45f71149cb 100644
--- a/Documentation/filesystems/debugfs.txt
+++ b/Documentation/filesystems/debugfs.txt
@@ -105,7 +105,7 @@ a variable of type size_t.
 Boolean values can be placed in debugfs with:
 
 struct dentry *debugfs_create_bool(const char *name, umode_t mode,
-  struct dentry *parent, u32 *value);
+  struct dentry *parent, bool *value);
 
 A read on the resulting file will yield either Y (for non-zero values) or
 N, followed by a newline.  If written to, it will accept either upper- or
diff --git a/arch/arm64/kernel/debug-monitors.c 
b/arch/arm64/kernel/debug-monitors.c
index cebf78661a55..1c4cd4a0d7cc 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -58,7 +58,7 @@ static u32 mdscr_read(void)
  * Allow root to disable self-hosted debug from userspace.
  * This is useful if you want to connect an external JTAG debugger.
  */
-static u32 debug_enabled = 1;
+static bool debug_enabled = true;
 
 static int create_debug_debugfs_entry(void)
 {
@@ -69,7 +69,7 @@ fs_initcall(create_debug_debugfs_entry);
 
 static int __init early_debug_disable(char *buf)
 {
-   debug_enabled = 0;
+   debug_enabled = false;
return 0;
 }
 
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 9db196de003c..5a72e2b140fc 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -138,7 +138,7 @@ struct acpi_ec {
unsigned long gpe;
unsigned long command_addr;
unsigned long data_addr;
-   u32 global_lock;
+   bool global_lock;
unsigned long flags;
unsigned long reference_count;
struct mutex mutex;
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index cc557886ab23..5b907f2c62b9 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -122,9 +122,9 @@ struct regmap {
unsigned int num_reg_defaults_raw;
 
/* if set, only the cache is modified not the HW */
-   u32 cache_only;
+   bool cache_only;
/* if set, only the HW is modified not the cache */
-   u32 cache_bypass;
+   

[PATCH 4.2 039/134] Input: evdev - do not report errors form flush()

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit eb38f3a4f6e86f8bb10a3217ebd85ecc5d763aae upstream.

We've got bug reports showing the old systemd-logind (at least
system-210) aborting unexpectedly, and this turned out to be because
of an invalid error code from close() call to evdev devices.  close()
is supposed to return only either EINTR or EBADFD, while the device
returned ENODEV.  logind was overreacting to it and decided to kill
itself when an unexpected error code was received.  What a tragedy.

The bad error code comes from flush fops, and actually evdev_flush()
returns ENODEV when device is disconnected or client's access to it is
revoked. But in these cases the fact that flush did not actually happen is
not an error, but rather normal behavior. For non-disconnected devices
result of flush is also not that interesting as there is no potential of
data loss and even if it fails application has no way of handling the
error. Because of that we are better off always returning success from
evdev_flush().

Also returning EINTR from flush()/close() is discouraged (as it is not
clear how application should handle this error), so let's stop taking
evdev->mutex interruptibly.

Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=939834
Signed-off-by: Takashi Iwai 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/input/evdev.c |   13 -
 1 file changed, 4 insertions(+), 9 deletions(-)

--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -290,19 +290,14 @@ static int evdev_flush(struct file *file
 {
struct evdev_client *client = file->private_data;
struct evdev *evdev = client->evdev;
-   int retval;
 
-   retval = mutex_lock_interruptible(>mutex);
-   if (retval)
-   return retval;
+   mutex_lock(>mutex);
 
-   if (!evdev->exist || client->revoked)
-   retval = -ENODEV;
-   else
-   retval = input_flush_device(>handle, file);
+   if (evdev->exist && !client->revoked)
+   input_flush_device(>handle, file);
 
mutex_unlock(>mutex);
-   return retval;
+   return 0;
 }
 
 static void evdev_free(struct device *dev)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 038/134] Input: synaptics - fix handling of disabling gesture mode

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Torokhov 

commit e51e38494a8ecc18650efb0c840600637891de2c upstream.

Bit 2 of the mode byte has dual meaning: it can disable reporting of
gestures when touchpad works in Relative mode or normal Absolute mode,
or it can enable so called Extended W-Mode when touchpad uses enhanced
Absolute mode (W-mode). The extended W-Mode confuses our driver and
causes missing button presses on some Thinkpads (x250, T450s), so let's
make sure we do not enable it.

Also, according to the spec W mode "... bit is defined only in Absolute
mode on pads whose capExtended capability bit is set. In Relative mode and
in TouchPads without this capability, the bit is reserved and should be
left at 0.", so let's make sure we respect this requirement as well.

Reported-by: Nick Bowler 
Suggested-by: Gabor Balla 
Tested-by: Gabor Balla 
Tested-by: Nick Bowler 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/input/mouse/synaptics.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -519,14 +519,18 @@ static int synaptics_set_mode(struct psm
struct synaptics_data *priv = psmouse->private;
 
priv->mode = 0;
-   if (priv->absolute_mode)
+
+   if (priv->absolute_mode) {
priv->mode |= SYN_BIT_ABSOLUTE_MODE;
-   if (priv->disable_gesture)
+   if (SYN_CAP_EXTENDED(priv->capabilities))
+   priv->mode |= SYN_BIT_W_MODE;
+   }
+
+   if (!SYN_MODE_WMODE(priv->mode) && priv->disable_gesture)
priv->mode |= SYN_BIT_DISABLE_GESTURE;
+
if (psmouse->rate >= 80)
priv->mode |= SYN_BIT_HIGH_RATE;
-   if (SYN_CAP_EXTENDED(priv->capabilities))
-   priv->mode |= SYN_BIT_W_MODE;
 
if (synaptics_mode_cmd(psmouse, priv->mode))
return -1;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH V5 1/2] ACPI / EC: Fix broken 64bit big-endian users of 'global_lock'

2015-09-26 Thread Viresh Kumar
global_lock is defined as an unsigned long and accessing only its lower
32 bits from sysfs is incorrect, as we need to consider other 32 bits
for big endian 64-bit systems. There are no such platforms yet, but the
code needs to be robust for such a case.

Fix that by changing type of 'global_lock' to u32.

Signed-off-by: Viresh Kumar 
---
BCC'd a lot of people (rather than cc'ing them) to make sure
- the series reaches them
- mailing lists do not block the patchset due to long cc list
- and we don't spam the BCC'd people for every reply

V4->V5:
- Switch back to the original solution of making global_lock u32.
---
 drivers/acpi/ec_sys.c   | 2 +-
 drivers/acpi/internal.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
index b4c216bab22b..bea8e425a8de 100644
--- a/drivers/acpi/ec_sys.c
+++ b/drivers/acpi/ec_sys.c
@@ -128,7 +128,7 @@ static int acpi_ec_add_debugfs(struct acpi_ec *ec, unsigned 
int ec_device_count)
if (!debugfs_create_x32("gpe", 0444, dev_dir, (u32 *)_ec->gpe))
goto error;
if (!debugfs_create_bool("use_global_lock", 0444, dev_dir,
-(u32 *)_ec->global_lock))
+_ec->global_lock))
goto error;
 
if (write_support)
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 9e426210c2a8..9db196de003c 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -138,7 +138,7 @@ struct acpi_ec {
unsigned long gpe;
unsigned long command_addr;
unsigned long data_addr;
-   unsigned long global_lock;
+   u32 global_lock;
unsigned long flags;
unsigned long reference_count;
struct mutex mutex;
-- 
2.4.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 074/134] nfsd: Fix an FS_LAYOUT_TYPES/LAYOUT_TYPES encode bug

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Kinglong Mee 

commit 6896f15aabde505b35888039af93d1d182a0108a upstream.

Currently we'll respond correctly to a request for either
FS_LAYOUT_TYPES or LAYOUT_TYPES, but not to a request for both
attributes simultaneously.

Signed-off-by: Kinglong Mee 
Reviewed-by: Christoph Hellwig 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/nfsd/nfs4xdr.c |   45 +++--
 1 file changed, 31 insertions(+), 14 deletions(-)

--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2140,6 +2140,27 @@ nfsd4_encode_aclname(struct xdr_stream *
return nfsd4_encode_user(xdr, rqstp, ace->who_uid);
 }
 
+static inline __be32
+nfsd4_encode_layout_type(struct xdr_stream *xdr, enum pnfs_layouttype 
layout_type)
+{
+   __be32 *p;
+
+   if (layout_type) {
+   p = xdr_reserve_space(xdr, 8);
+   if (!p)
+   return nfserr_resource;
+   *p++ = cpu_to_be32(1);
+   *p++ = cpu_to_be32(layout_type);
+   } else {
+   p = xdr_reserve_space(xdr, 4);
+   if (!p)
+   return nfserr_resource;
+   *p++ = cpu_to_be32(0);
+   }
+
+   return 0;
+}
+
 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | 
\
  FATTR4_WORD0_RDATTR_ERROR)
 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
@@ -2688,20 +2709,16 @@ out_acl:
p = xdr_encode_hyper(p, stat.ino);
}
 #ifdef CONFIG_NFSD_PNFS
-   if ((bmval1 & FATTR4_WORD1_FS_LAYOUT_TYPES) ||
-   (bmval2 & FATTR4_WORD2_LAYOUT_TYPES)) {
-   if (exp->ex_layout_type) {
-   p = xdr_reserve_space(xdr, 8);
-   if (!p)
-   goto out_resource;
-   *p++ = cpu_to_be32(1);
-   *p++ = cpu_to_be32(exp->ex_layout_type);
-   } else {
-   p = xdr_reserve_space(xdr, 4);
-   if (!p)
-   goto out_resource;
-   *p++ = cpu_to_be32(0);
-   }
+   if (bmval1 & FATTR4_WORD1_FS_LAYOUT_TYPES) {
+   status = nfsd4_encode_layout_type(xdr, exp->ex_layout_type);
+   if (status)
+   goto out;
+   }
+
+   if (bmval2 & FATTR4_WORD2_LAYOUT_TYPES) {
+   status = nfsd4_encode_layout_type(xdr, exp->ex_layout_type);
+   if (status)
+   goto out;
}
 
if (bmval2 & FATTR4_WORD2_LAYOUT_BLKSIZE) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 043/134] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit a161574e200ae63a5042120e0d8c36830e81bde3 upstream.

It turned out that the machine has a bass speaker, so take a correct
fixup entry.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102501
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1364,7 +1364,7 @@ static const struct snd_pci_quirk alc880
SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", 
ALC880_FIXUP_MEDION_RIM),
SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST_AUTOMUTE),
-   SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
+   SND_PCI_QUIRK(0x1734, 0x107c, "FSC Amilo M1437", ALC880_FIXUP_FUJITSU),
SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
SND_PCI_QUIRK(0x1734, 0x10b0, "FSC Amilo Pi1556", ALC880_FIXUP_FUJITSU),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 034/134] arm64: errata: add module build workaround for erratum #843419

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Will Deacon 

commit df057cc7b4fa59e9b55f07ffdb6c62bf02e99a00 upstream.

Cortex-A53 processors <= r0p4 are affected by erratum #843419 which can
lead to a memory access using an incorrect address in certain sequences
headed by an ADRP instruction.

There is a linker fix to generate veneers for ADRP instructions, but
this doesn't work for kernel modules which are built as unlinked ELF
objects.

This patch adds a new config option for the erratum which, when enabled,
builds kernel modules with the mcmodel=large flag. This uses absolute
addressing for all kernel symbols, thereby removing the use of ADRP as
a PC-relative form of addressing. The ADRP relocs are removed from the
module loader so that we fail to load any potentially affected modules.

Acked-by: Catalin Marinas 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/Kconfig |   16 
 arch/arm64/Makefile|4 
 arch/arm64/kernel/module.c |2 ++
 3 files changed, 22 insertions(+)

--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -421,6 +421,22 @@ config ARM64_ERRATUM_845719
 
  If unsure, say Y.
 
+config ARM64_ERRATUM_843419
+   bool "Cortex-A53: 843419: A load or store might access an incorrect 
address"
+   depends on MODULES
+   default y
+   help
+ This option builds kernel modules using the large memory model in
+ order to avoid the use of the ADRP instruction, which can cause
+ a subsequent memory access to use an incorrect address on Cortex-A53
+ parts up to r0p4.
+
+ Note that the kernel itself must be linked with a version of ld
+ which fixes potentially affected ADRP instructions through the
+ use of veneers.
+
+ If unsure, say Y.
+
 endmenu
 
 
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -30,6 +30,10 @@ endif
 
 CHECKFLAGS += -D__aarch64__
 
+ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
+CFLAGS_MODULE  += -mcmodel=large
+endif
+
 # Default value
 head-y := arch/arm64/kernel/head.o
 
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -332,12 +332,14 @@ int apply_relocate_add(Elf64_Shdr *sechd
ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21,
 AARCH64_INSN_IMM_ADR);
break;
+#ifndef CONFIG_ARM64_ERRATUM_843419
case R_AARCH64_ADR_PREL_PG_HI21_NC:
overflow_check = false;
case R_AARCH64_ADR_PREL_PG_HI21:
ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21,
 AARCH64_INSN_IMM_ADR);
break;
+#endif
case R_AARCH64_ADD_ABS_LO12_NC:
case R_AARCH64_LDST8_ABS_LO12_NC:
overflow_check = false;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 085/134] NFS41/flexfiles: zero out DS write wcc

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Peng Tao 

commit 5420401079e152ff68a8024f6a375804b1c21505 upstream.

We do not want to update inode attributes with DS values.

Signed-off-by: Peng Tao 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/nfs/flexfilelayout/flexfilelayout.c |2 ++
 1 file changed, 2 insertions(+)

--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1199,6 +1199,8 @@ static int ff_layout_write_done_cb(struc
hdr->res.verf->committed == NFS_DATA_SYNC)
ff_layout_set_layoutcommit(hdr);
 
+   /* zero out fattr since we don't care DS attr at all */
+   hdr->fattr.valid = 0;
if (task->tk_status >= 0)
nfs_writeback_update_inode(hdr);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 113/134] iommu/tegra-smmu: Parameterize number of TLB lines

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Thierry Reding 

commit 11cec15bf3fb498206ef63b1fa26c27689e02d0e upstream.

The number of TLB lines was increased from 16 on Tegra30 to 32 on
Tegra114 and later. Parameterize the value so that the initial default
can be set accordingly.

On Tegra30, initializing the value to 32 would effectively disable the
TLB and hence cause massive latencies for memory accesses translated
through the SMMU. This is especially noticeable for isochronuous clients
such as display, whose FIFOs would continuously underrun.

Fixes: 891846516317 ("memory: Add NVIDIA Tegra memory controller support")
Signed-off-by: Thierry Reding 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iommu/tegra-smmu.c  |9 +++--
 drivers/memory/tegra/tegra114.c |1 +
 drivers/memory/tegra/tegra124.c |1 +
 drivers/memory/tegra/tegra30.c  |1 +
 include/soc/tegra/mc.h  |1 +
 5 files changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -27,6 +27,7 @@ struct tegra_smmu {
const struct tegra_smmu_soc *soc;
 
unsigned long pfn_mask;
+   unsigned long tlb_mask;
 
unsigned long *asids;
struct mutex lock;
@@ -68,7 +69,8 @@ static inline u32 smmu_readl(struct tegr
 #define SMMU_TLB_CONFIG 0x14
 #define  SMMU_TLB_CONFIG_HIT_UNDER_MISS (1 << 29)
 #define  SMMU_TLB_CONFIG_ROUND_ROBIN_ARBITRATION (1 << 28)
-#define  SMMU_TLB_CONFIG_ACTIVE_LINES(x) ((x) & 0x3f)
+#define  SMMU_TLB_CONFIG_ACTIVE_LINES(smmu) \
+   ((smmu)->soc->num_tlb_lines & (smmu)->tlb_mask)
 
 #define SMMU_PTC_CONFIG 0x18
 #define  SMMU_PTC_CONFIG_ENABLE (1 << 29)
@@ -816,6 +818,9 @@ struct tegra_smmu *tegra_smmu_probe(stru
smmu->pfn_mask = BIT_MASK(mc->soc->num_address_bits - PAGE_SHIFT) - 1;
dev_dbg(dev, "address bits: %u, PFN mask: %#lx\n",
mc->soc->num_address_bits, smmu->pfn_mask);
+   smmu->tlb_mask = (smmu->soc->num_tlb_lines << 1) - 1;
+   dev_dbg(dev, "TLB lines: %u, mask: %#lx\n", smmu->soc->num_tlb_lines,
+   smmu->tlb_mask);
 
value = SMMU_PTC_CONFIG_ENABLE | SMMU_PTC_CONFIG_INDEX_MAP(0x3f);
 
@@ -825,7 +830,7 @@ struct tegra_smmu *tegra_smmu_probe(stru
smmu_writel(smmu, value, SMMU_PTC_CONFIG);
 
value = SMMU_TLB_CONFIG_HIT_UNDER_MISS |
-   SMMU_TLB_CONFIG_ACTIVE_LINES(0x20);
+   SMMU_TLB_CONFIG_ACTIVE_LINES(smmu);
 
if (soc->supports_round_robin_arbitration)
value |= SMMU_TLB_CONFIG_ROUND_ROBIN_ARBITRATION;
--- a/drivers/memory/tegra/tegra114.c
+++ b/drivers/memory/tegra/tegra114.c
@@ -935,6 +935,7 @@ static const struct tegra_smmu_soc tegra
.num_swgroups = ARRAY_SIZE(tegra114_swgroups),
.supports_round_robin_arbitration = false,
.supports_request_limit = false,
+   .num_tlb_lines = 32,
.num_asids = 4,
.ops = _smmu_ops,
 };
--- a/drivers/memory/tegra/tegra124.c
+++ b/drivers/memory/tegra/tegra124.c
@@ -1023,6 +1023,7 @@ static const struct tegra_smmu_soc tegra
.num_swgroups = ARRAY_SIZE(tegra124_swgroups),
.supports_round_robin_arbitration = true,
.supports_request_limit = true,
+   .num_tlb_lines = 32,
.num_asids = 128,
.ops = _smmu_ops,
 };
--- a/drivers/memory/tegra/tegra30.c
+++ b/drivers/memory/tegra/tegra30.c
@@ -957,6 +957,7 @@ static const struct tegra_smmu_soc tegra
.num_swgroups = ARRAY_SIZE(tegra30_swgroups),
.supports_round_robin_arbitration = false,
.supports_request_limit = false,
+   .num_tlb_lines = 16,
.num_asids = 4,
.ops = _smmu_ops,
 };
--- a/include/soc/tegra/mc.h
+++ b/include/soc/tegra/mc.h
@@ -66,6 +66,7 @@ struct tegra_smmu_soc {
bool supports_round_robin_arbitration;
bool supports_request_limit;
 
+   unsigned int num_tlb_lines;
unsigned int num_asids;
 
const struct tegra_smmu_ops *ops;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 122/134] IB/uverbs: reject invalid or unknown opcodes

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Christoph Hellwig 

commit b632ffa7cee439ba5dce3b3bc4a5cbe2b3e20133 upstream.

We have many WR opcodes that are only supported in kernel space
and/or require optional information to be copied into the WR
structure.  Reject all those not explicitly handled so that we
can't pass invalid information to drivers.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Jason Gunthorpe 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/infiniband/core/uverbs_cmd.c |   10 +-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2346,6 +2346,12 @@ ssize_t ib_uverbs_post_send(struct ib_uv
next->send_flags = user_wr->send_flags;
 
if (is_ud) {
+   if (next->opcode != IB_WR_SEND &&
+   next->opcode != IB_WR_SEND_WITH_IMM) {
+   ret = -EINVAL;
+   goto out_put;
+   }
+
next->wr.ud.ah = idr_read_ah(user_wr->wr.ud.ah,
 file->ucontext);
if (!next->wr.ud.ah) {
@@ -2385,9 +2391,11 @@ ssize_t ib_uverbs_post_send(struct ib_uv
user_wr->wr.atomic.compare_add;
next->wr.atomic.swap = user_wr->wr.atomic.swap;
next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
+   case IB_WR_SEND:
break;
default:
-   break;
+   ret = -EINVAL;
+   goto out_put;
}
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 117/134] i2c: xgene-slimpro: dma_mapping_error() doesnt return an error code

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit a4a9a8cb3248b3b48a6049acaeaf23d4ad3712b9 upstream.

The dma_mapping_error() function returns true if there is an error, it
doesn't return an error code.  We should return -ENOMEM.

Signed-off-by: Dan Carpenter 
Reviewed-by: Axel Lin 
Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/i2c/busses/i2c-xgene-slimpro.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -198,10 +198,10 @@ static int slimpro_i2c_blkrd(struct slim
int rc;
 
paddr = dma_map_single(ctx->dev, ctx->dma_buffer, readlen, 
DMA_FROM_DEVICE);
-   rc = dma_mapping_error(ctx->dev, paddr);
-   if (rc) {
+   if (dma_mapping_error(ctx->dev, paddr)) {
dev_err(>adapter.dev, "Error in mapping dma buffer %p\n",
ctx->dma_buffer);
+   rc = -ENOMEM;
goto err;
}
 
@@ -241,10 +241,10 @@ static int slimpro_i2c_blkwr(struct slim
memcpy(ctx->dma_buffer, data, writelen);
paddr = dma_map_single(ctx->dev, ctx->dma_buffer, writelen,
   DMA_TO_DEVICE);
-   rc = dma_mapping_error(ctx->dev, paddr);
-   if (rc) {
+   if (dma_mapping_error(ctx->dev, paddr)) {
dev_err(>adapter.dev, "Error in mapping dma buffer %p\n",
ctx->dma_buffer);
+   rc = -ENOMEM;
goto err;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 115/134] eCryptfs: Invalidate dcache entries when lower i_nlink is zero

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Tyler Hicks 

commit 5556e7e6d30e8e9b5ee51b0e5edd526ee80e5e36 upstream.

Consider eCryptfs dcache entries to be stale when the corresponding
lower inode's i_nlink count is zero. This solves a problem caused by the
lower inode being directly modified, without going through the eCryptfs
mount, leaving stale eCryptfs dentries cached and the eCryptfs inode's
i_nlink count not being cleared.

Signed-off-by: Tyler Hicks 
Reported-by: Richard Weinberger 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 fs/ecryptfs/dentry.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -45,20 +45,20 @@
 static int ecryptfs_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-   int rc;
-
-   if (!(lower_dentry->d_flags & DCACHE_OP_REVALIDATE))
-   return 1;
+   int rc = 1;
 
if (flags & LOOKUP_RCU)
return -ECHILD;
 
-   rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
+   if (lower_dentry->d_flags & DCACHE_OP_REVALIDATE)
+   rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
+
if (d_really_is_positive(dentry)) {
-   struct inode *lower_inode =
-   ecryptfs_inode_to_lower(d_inode(dentry));
+   struct inode *inode = d_inode(dentry);
 
-   fsstack_copy_attr_all(d_inode(dentry), lower_inode);
+   fsstack_copy_attr_all(inode, ecryptfs_inode_to_lower(inode));
+   if (!inode->i_nlink)
+   return 0;
}
return rc;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 116/134] hfs: fix B-tree corruption after insertion at position 0

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Hin-Tak Leung 

commit b4cc0efea4f0bfa2477c56af406cfcf3d3e58680 upstream.

Fix B-tree corruption when a new record is inserted at position 0 in the
node in hfs_brec_insert().

This is an identical change to the corresponding hfs b-tree code to Sergei
Antonov's "hfsplus: fix B-tree corruption after insertion at position 0",
to keep similar code paths in the hfs and hfsplus drivers in sync, where
appropriate.

Signed-off-by: Hin-Tak Leung 
Cc: Sergei Antonov 
Cc: Joe Perches 
Reviewed-by: Vyacheslav Dubeyko 
Cc: Anton Altaparmakov 
Cc: Al Viro 
Cc: Christoph Hellwig 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/hfs/brec.c |   20 +++-
 1 file changed, 11 insertions(+), 9 deletions(-)

--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -131,13 +131,16 @@ skip:
hfs_bnode_write(node, entry, data_off + key_len, entry_len);
hfs_bnode_dump(node);
 
-   if (new_node) {
-   /* update parent key if we inserted a key
-* at the start of the first node
-*/
-   if (!rec && new_node != node)
-   hfs_brec_update_parent(fd);
+   /*
+* update parent key if we inserted a key
+* at the start of the node and it is not the new node
+*/
+   if (!rec && new_node != node) {
+   hfs_bnode_read_key(node, fd->search_key, data_off + size);
+   hfs_brec_update_parent(fd);
+   }
 
+   if (new_node) {
hfs_bnode_put(fd->bnode);
if (!new_node->parent) {
hfs_btree_inc_height(tree);
@@ -166,9 +169,6 @@ skip:
goto again;
}
 
-   if (!rec)
-   hfs_brec_update_parent(fd);
-
return 0;
 }
 
@@ -366,6 +366,8 @@ again:
if (IS_ERR(parent))
return PTR_ERR(parent);
__hfs_brec_find(parent, fd);
+   if (fd->record < 0)
+   return -ENOENT;
hfs_bnode_dump(parent);
rec = fd->record;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 4.2 118/134] ideapad-laptop: Add Lenovo Yoga 3 14 to no_hw_rfkill dmi list

2015-09-26 Thread Greg Kroah-Hartman
4.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Hans de Goede 

commit fa92a31b3335478c545cdc8e79e1e9b788184e6b upstream.

Like some of the other Yoga models the Lenovo Yoga 3 14 does not have a
hw rfkill switch, and trying to read the hw rfkill switch through the
ideapad module causes it to always reported blocking breaking wifi.

This commit adds the Lenovo Yoga 3 14 to the no_hw_rfkill dmi list, fixing
the wifi breakage.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1239050
Signed-off-by: Hans de Goede 
Signed-off-by: Darren Hart 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/platform/x86/ideapad-laptop.c |7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -853,6 +853,13 @@ static const struct dmi_system_id no_hw_
},
},
{
+   .ident = "Lenovo Yoga 3 14",
+   .matches = {
+   DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+   DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 3 14"),
+   },
+   },
+   {
.ident = "Lenovo Yoga 3 Pro 1370",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


  1   2   3   4   5   6   7   8   9   10   >