Sync up with Linus #77
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In big endian mode regmap_bulk_read gives incorrect data for byte reads. This is because memcpy of a single byte from an address after full word read gives different results when endianness differs. ie. we get little-end in LE and big-end in BE. Signed-off-by: Arun Chandran <achandran@mvista.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
The PM Domain code uses ktime_get() to perform various latency
measurements. However, if ktime_get() is called while timekeeping is
suspended, the following warning is printed:
WARNING: CPU: 0 PID: 1340 at kernel/time/timekeeping.c:576 ktime_get+0x3
This happens when resuming the PM Domain that contains the clock events
source, which calls pm_genpd_syscore_poweron(). Chain of operations is:
timekeeping_resume()
{
clockevents_resume()
sh_cmt_clock_event_resume()
pm_genpd_syscore_poweron()
pm_genpd_sync_poweron()
genpd_syscore_switch()
genpd_power_on()
ktime_get(), but timekeeping_suspended == 1
...
timekeeping_suspended = 0;
}
Fix this by adding a "timed" parameter to genpd_power_{on,off}() and
pm_genpd_sync_power{off,on}(), to indicate whether latency measurements
are allowed. This parameter is passed as false in
genpd_syscore_switch() (i.e. during syscore suspend/resume), and true in
all other cases.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Currently the con_id of the acquired clock is printed for debugging
purposes. But in several cases, the con_id is NULL, which doesn't
provide much debugging information when printed. These cases are:
- When explicitly passing a NULL con_id (which means the first clock
tied to the device, if available),
- When not using pm_clk_add(), but pm_clk_add_clk() (which takes a
"struct clk *" directly).
Hence print the actual clock name in addition to (and not instead of;
thanks Grygorii Strashko!) the con_id.
Note that the clock name is not available with legacy clock frameworks,
and the hex pointer address will be printed instead.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Grygorii Strashko <grygorii.strashko@linaro.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Patch 1c6c9b1 caused a regression for rsrc_nonstatic: It relies on pccard_validate_cis() to determine whether an iomem resource can be used for PCMCIA cards. This override, however, lead invalid iomem resources to be accepted -- and lead to a fake CIS being used instead of the original CIS. To fix this issue, move the override for anonymous cards to the one place where it is needed -- when adding a PCMCIA device. Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
No other video driver uses MTRR types except for MTRR_TYPE_WRCOMB, the other MTRR types were implemented and supported here but with no real good reason. The ioremap() APIs are architecture agnostic and at least on x86 PAT is a new design that extends MTRRs and can replace it in a much cleaner way, where so long as the proper ioremap_wc() or variant API is used the right thing will be done behind the scenes. This is the only driver left using the other MTRR types -- and since there is no good reason for it now rip them out. Cc: Toshi Kani <toshi.kani@hp.com> Cc: Suresh Siddha <sbsiddha@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Juergen Gross <jgross@suse.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Dave Airlie <airlied@redhat.com> Cc: Antonino Daplas <adaplas@gmail.com> Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Rob Clark <robdclark@gmail.com> Cc: Jingoo Han <jg1.han@samsung.com> Cc: Wolfram Sang <wsa@the-dreams.de> Cc: linux-fbdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
The MTRR added was never being deleted, in order to store the MTRR cookie we need to make use of the private info->par so we create a struct for this. This driver was already using the extra space typically used for info->par for the info->pseudo_palette which typically used stuffed on driver's own private structs (the respective info->par), so we just move the pseudo_palette into the private struct as well. Cc: Toshi Kani <toshi.kani@hp.com> Cc: Suresh Siddha <sbsiddha@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Juergen Gross <jgross@suse.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Dave Airlie <airlied@redhat.com> Cc: Antonino Daplas <adaplas@gmail.com> Cc: Rob Clark <robdclark@gmail.com> Cc: Jingoo Han <jg1.han@samsung.com> Cc: Wolfram Sang <wsa@the-dreams.de> Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: linux-fbdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
This driver uses the same area for MTRR as for the ioremap_wc(), if anything it just uses a smaller size in case MTRR reservation fails. ioremap_wc() API is already used to take advantage of architecture write-combining when available. Convert the driver from using the x86 specific MTRR code to the architecture agnostic arch_phys_wc_add(). arch_phys_wc_add() will avoid MTRR if write-combining is available. There are a few motivations for this: a) Take advantage of PAT when available b) Help bury MTRR code away, MTRR is architecture specific and on x86 its replaced by PAT c) Help with the goal of eventually using _PAGE_CACHE_UC over _PAGE_CACHE_UC_MINUS on x86 on ioremap_nocache() (see commit de33c44 titled "x86 PAT: fix performance drop for glx, use UC minus for ioremap(), ioremap_nocache() and pci_mmap_page_range()") The conversion done is expressed by the following Coccinelle SmPL patch, it additionally required manual intervention to address all the #ifdery and removal of redundant things which arch_phys_wc_add() already addresses such as verbose message about when MTRR fails and doing nothing when we didn't get an MTRR. @ mtrr_found @ expression index, base, size; @@ -index = mtrr_add(base, size, MTRR_TYPE_WRCOMB, 1); +index = arch_phys_wc_add(base, size); @ mtrr_rm depends on mtrr_found @ expression mtrr_found.index, mtrr_found.base, mtrr_found.size; @@ -mtrr_del(index, base, size); +arch_phys_wc_del(index); @ mtrr_rm_zero_arg depends on mtrr_found @ expression mtrr_found.index; @@ -mtrr_del(index, 0, 0); +arch_phys_wc_del(index); @ mtrr_rm_fb_info depends on mtrr_found @ struct fb_info *info; expression mtrr_found.index; @@ -mtrr_del(index, info->fix.smem_start, info->fix.smem_len); +arch_phys_wc_del(index); @ ioremap_replace_nocache depends on mtrr_found @ struct fb_info *info; expression base, size; @@ -info->screen_base = ioremap_nocache(base, size); +info->screen_base = ioremap_wc(base, size); @ ioremap_replace_default depends on mtrr_found @ struct fb_info *info; expression base, size; @@ -info->screen_base = ioremap(base, size); +info->screen_base = ioremap_wc(base, size); Generated-by: Coccinelle SmPL Cc: Toshi Kani <toshi.kani@hp.com> Cc: Suresh Siddha <sbsiddha@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Juergen Gross <jgross@suse.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Dave Airlie <airlied@redhat.com> Cc: Antonino Daplas <adaplas@gmail.com> Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com> Cc: Rob Clark <robdclark@gmail.com> Cc: Jingoo Han <jg1.han@samsung.com> Cc: Wolfram Sang <wsa@the-dreams.de> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: linux-fbdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Change AMD CZ SMBUS device ID from 0x790b to use Macro definition Signed-off-by: Wan ZongShun <Vincent.Wan@amd.com> Acked-by: Wolfram Sang <wsa@the-dreams.de> Acked-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Change this quirk to apply to AMD Carrizo platform. Signed-off-by: Wan ZongShun <Vincent.Wan@amd.com> Tested-by: Nath, Arindam <Arindam.Nath@amd.com> Tested-by: Ramesh, Ramya <Ramya.Ramesh@amd.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
When dma mapping (dma_map_sg) fails in sdhci_pre_dma_transfer, -EINVAL is returned. There are 3 callers of sdhci_pre_dma_transfer: * sdhci_pre_req and sdhci_adma_table_pre: handle negative return * sdhci_prepare_data: handles 0 (error) and "else" (good) only sdhci_prepare_data is therefore broken. When it receives -EINVAL from sdhci_pre_dma_transfer, it assumes 1 sg mapping was mapped. Later, this non-existent mapping with address 0 is kmap'ped and written to: Corrupted low memory at ffff880000001000 (1000 phys) = 22b7d67df2f6d1cf Corrupted low memory at ffff880000001008 (1008 phys) = 63848a5216b7dd95 Corrupted low memory at ffff880000001010 (1010 phys) = 330eb7ddef39e427 Corrupted low memory at ffff880000001018 (1018 phys) = 8017ac7295039bda Corrupted low memory at ffff880000001020 (1020 phys) = 8ce039eac119074f ... So teach sdhci_prepare_data to understand negative return values from sdhci_pre_dma_transfer and disable DMA in that case, as well as for zero. It was introduced in 348487c (mmc: sdhci: use pipeline mmc requests to improve performance). The commit seems to be suspicious also by assigning host->sg_count both in sdhci_pre_dma_transfer and sdhci_adma_table_pre. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: stable@vger.kernel.org # 4.0+ Fixes: 348487c Cc: Ulf Hansson <ulf.hansson@linaro.org> Cc: Haibo Chen <haibo.chen@freescale.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function
may cause new coming request permanent missing when the ongoing
request (previoulsy started) complete end.
The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err()
end request A completed and return zero. Continue the error handling,
suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.
The process related to the missing request may wait that IO request
complete forever, possibly crashing the application or hanging the system.
Fix this issue by starting new request when reset success.
Signed-off-by: Ding Wang <justin.wang@spreadtrum.com>
Fixes: 6771632 ("mmc: block: add eMMC hardware reset support")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
fb_videomode_from_videomode() may fail, but of_get_fb_videomode() silently covers this fact. Instead, trow the error code to the caller. Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Document the device-tree binding of Mediatek MMC host Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Now pcf857x_irq() IRQ's dispatcher will try to run nested IRQ handlers for each GPIO pin which state has changed. Such IRQs are, actually, spurious and nested IRQ handlers have to be called only for IRQs wich were enabled by users. This is not critical issue - just /proc/interrupts will display counters for unused IRQS: 399: 4 0 pcf857x 0 Edge 428: 1 0 pcf857x 13 Edge 430: 1 0 pcf857x 15 Edge Hence, fix it by adding irq_enabled field in struct pcf857x to track enabled GPIO IRQs and corresponding callbacks in pcf857x_irq_chip. Similar functionality was presented in pcf857x driver, commit 21fd3cd ('gpio: pcf857x: call the gpio user handler iff...') and then it was removed by commit a39294b ('gpio: pcf857x: Switch to use gpiolib irqchip...') Cc: Geert Uytterhoeven <geert+renesas@glider.be> Fixes: a39294b ('gpio: pcf857x: Switch to use gpiolib irqchip helpers') Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Give them a common prefix that can be grepped for and improve the wording here and there. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
QI needs to be available when we write the root entry into hardware because flushes might be necessary after this. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
In case there was an old root entry, make our new one visible immediately after it was allocated. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Add code to detect whether translation is already enabled in the IOMMU. Save this state in a flags field added to struct intel_iommu. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
If we are in a kdump kernel and find translation enabled in the iommu, try to copy the translation tables from the old kernel to preserve the mappings until the device driver takes over. This supports old and the extended root-entry and context-table formats. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Mark all domain-ids we find as reserved, so that there could be no collision between domains from the previous kernel and our domains in the IOMMU TLB. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Mark the context entries we copied over from the old kernel, so that we don't detect them as present in other code paths. This makes sure we safely overwrite old context entries when a new domain is assigned. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
This seperates the allocation of the si_domain from its assignment to devices. It makes sure that the iommu=pt case still works in the kdump kernel, when we have to defer the assignment of devices to domains to device driver initialization time. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
When we copied over context tables from an old kernel, we need to defer assignment of devices to domains until the device driver takes over. So skip this part of initialization when we copied over translation tables from the old kernel. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
We can't change the RTT bit when translation is enabled, so don't copy translation tables when we would change the bit with our new root entry. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
For all the copy-translation code to run, we have to keep translation enabled in intel_iommu_init(). So remove the code disabling it. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Do not touch the TE bit unless we know translation is disabled. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
We need this to be detected already when we program the irq remapping table pointer to hardware. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
QI needs to be enabled when we program the irq remapping table to hardware in the prepare phase later. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Move it to this function for now, so that the copy routines for irq remapping take no effect yet. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
This way we can give the hardware the new IR table right after it has been allocated and initialized. Tested-by: ZhenHua Li <zhen-hual@hp.com> Tested-by: Baoquan He <bhe@redhat.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Since 39b2bbe (gpio: add flags argument to gpiod_get*() functions) which appeared in v3.17-rc1, the gpiod_get* functions take an additional parameter that allows to specify direction and initial value for output. Use this to simplify the driver. Furthermore this is one caller less that stops us making the flags argument to gpiod_get*() mandatory. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Sebastian Reichel <sre@kernel.org>
…nel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This has a couple of fixes for Atmel, Samsung and Broadcom drivers. Some preparatory patches for more upcoming Intel work is included as well" * tag 'pwm/for-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: lpss: pci: Add support for Broxton platform pwm: bcm-kona: Don't set polarity in probe pwm: Add pwmchip_add_with_polarity() API pwm: atmel: Fix incorrect CDTY value after disabling pwm: atmel: Fix incorrect CDTY value after enabling pwm: samsung: Use MODULE_DEVICE_TABLE() to include OF modalias pwm: Add support to remove registered consumer lookup tables
…git/linusw/linux-gpio
Pull gpio updates from Linus Walleij:
"This is the big bulk of GPIO changes queued for the v4.2 kernel
series:
- a big set of cleanups to the aged sysfs interface from Johan
Hovold. To get these in, v4.1-rc3 was merged into the tree as the
first patch in that series had to go into stable. This makes the
locking much more fine-grained (get rid of the "big GPIO lock(s)"
and store states in the GPIO descriptors.
- rename gpiod_[g|s]et_array() to gpiod_[g|s]et_array_value() to
avoid confusions.
- New drivers for:
* NXP LPC18xx (currently LPC1850)
* NetLogic XLP
* Broadcom STB SoC's
* Axis ETRAXFS
* Zynq Ultrascale+ (subdriver)
- ACPI:
* make it possible to retrieve GpioInt resources from a GPIO
device using acpi_dev_gpio_irq_get()
* merge some dependent I2C changes exploiting this.
* support the ARM X-Gene GPIO standby driver.
- make it possible for the generic GPIO driver to read back the value
set registers to reflect current status.
- loads of OMAP IRQ handling fixes.
- incremental improvements to Kona, max732x, OMAP, MXC, RCAR,
PCA953x, STP-XWAY, PCF857x, Crystalcove, TB10x.
- janitorial (constification, checkpatch cleanups)"
* tag 'gpio-v4.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (71 commits)
gpio: Fix checkpatch.pl issues
gpio: pcf857x: handle only enabled irqs
gpio / ACPI: Return -EPROBE_DEFER if the gpiochip was not found
GPIO / ACPI: export acpi_gpiochip_request(free)_interrupts for module use
gpio: improve error reporting on own descriptors
gpio: promote own request failure to pr_err()
gpio: Added support to Zynq Ultrascale+ MPSoC
gpio: add ETRAXFS GPIO driver
fix documentation after renaming gpiod_set_array to gpiod_set_array_value
gpio: Add GPIO support for Broadcom STB SoCs
gpio: xgene: add ACPI support for APM X-Gene GPIO standby driver
gpio: tb10x: Drop unneeded free_irq() call
gpio: crystalcove: set IRQCHIP_SKIP_SET_WAKE for the irqchip
gpio: stp-xway: Use the of_property_read_u32 helper
gpio: pcf857x: Check for irq_set_irq_wake() failures
gpio-stp-xway: Fix enabling the highest bit of the PHY LEDs
gpio: Prevent an integer overflow in the pca953x driver
gpio: omap: rework omap_gpio_irq_startup to handle current pin state properly
gpio: omap: rework omap_gpio_request to touch only gpio specific registers
gpio: omap: rework omap_x_irq_shutdown to touch only irqs specific registers
...
Pull MMC updates from Ulf Hansson: "Here are the changes for MMC for v4.2. MMC core: - Fix an error path in the mmc block layer - Fix PM domain attachment for the SDIO bus - Add support for driver strength selection - Increase a delay to let voltage stabilize - Add support for disabling write-protect detection - Add facility to support re-tuning - Re-tune and retry in the recovery path - Add reset option for SDIO - Consolidations and clean-ups MMC host: - Add Mediatek MMC driver - Constify platform_device_id for a couple of hosts - Fix modalias to make module auto-loading work for a couple of hosts - sdhci: Add support for sdhci-arasan4.9a - sdhci: Fix low memory corruption - sdhci: Restore behavior while creating OCR mask - sdhci: Add a callback to select drive strength - sdhci: Fix driver type B and D handling - sdhci: Add support for drive strength selection for SPT - sdhci: Enable HS400 for some Intel host controllers - sdhci: Convert to use the new re-tuning facility - sdhci: Various minor fixes and clean-ups - dw_mmc: Add support for hi6220 - dw_mmc: Use core to handle absent write protect line - dw_mmc: Add support to switch voltage - tmio: Some fixes and modernizations - sh_mmcif: Improve clock rate calculation" * tag 'mmc-v4.2' of git://git.linaro.org/people/ulf.hansson/mmc: (98 commits) mmc: queue: prevent soft lockups on PREEMPT=n mmc: mediatek: Add PM support for MMC driver mmc: mediatek: Add Mediatek MMC driver mmc: dt-bindings: add Mediatek MMC bindings mmc: card: Fixup request missing in mmc_blk_issue_rw_rq mmc: sdhci: fix low memory corruption mmc: sdhci-pci: Change AMD SDHCI quirk application scope i2c-piix4: Use Macro for AMD CZ SMBus device ID pci_ids: Add AMD KERNCZ device ID support mmc: queue: use swap() in mmc_queue_thread() mmc: dw_mmc: insmod followed by rmmod will hung for eMMC mmc: sdhci: Restore behavior while creating OCR mask mmc: sdhci-pxav3: fix device wakeup initialization mmc: core: Attach PM domain prior probing of SDIO func driver mmc: core: Remove redundant ->power_restore() callback for SD mmc: core: Remove redundant ->power_restore() callback for MMC mmc: sdhci-bcm2835: Actually enable the clock mmc: sdhci-bcm2835: Clean up platform allocations if sdhci init fails. mmc: sdhci-of-esdhc: enable interrupt mode to detect card mmc: sdhci-esdhc-imx: add quirk SDHCI_QUIRK2_BROKEN_HS200 for imx6qdl ...
…x/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - new driver for Microchip TC74 - support for ncpXXwf104 added to ntc_thermistor driver - minor cleanup * tag 'hwmon-for-linus-v4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: add driver for Microchip TC74 hwmon: (ntc_thermistor) Improve precision of resistance calculation hwmon: (ntc_thermistor) fix iio raw to microvolts conversion hwmon: (atxp1) Drop auto-detection hwmon: (atxp1) Drop FSF mailing address hwmon: Allow compile test of GPIO consumers if !GPIOLIB hwmon: (sht15) Constify platform_device_id hwmon: (max197) Constify platform_device_id hwmon: (ntc_thermistor) Add support for ncpXXwf104
…rnel/git/helgaas/pci
Pull PCI updates from Bjorn Helgaas:
"PCI changes for the v4.2 merge window:
Enumeration
- Move pci_ari_enabled() to global header (Alex Williamson)
- Account for ARI in _PRT lookups (Alex Williamson)
- Remove unused pci_scan_bus_parented() (Yijing Wang)
Resource management
- Use host bridge _CRS info on systems with >32 bit addressing (Bjorn Helgaas)
- Use host bridge _CRS info on Foxconn K8M890-8237A (Bjorn Helgaas)
- Fix pci_address_to_pio() conversion of CPU address to I/O port (Zhichang Yuan)
- Add pci_bus_addr_t (Yinghai Lu)
PCI device hotplug
- Wait for pciehp command completion where necessary (Alex Williamson)
- Drop pointless ACPI-based "slot detection" check (Rafael J. Wysocki)
- Check ignore_hotplug for all downstream devices (Rafael J. Wysocki)
- Propagate the "ignore hotplug" setting to parent (Rafael J. Wysocki)
- Inline pciehp "handle event" functions into the ISR (Bjorn Helgaas)
- Clean up pciehp debug logging (Bjorn Helgaas)
Power management
- Remove redundant PCIe port type checking (Yijing Wang)
- Add dev->has_secondary_link to track downstream PCIe links (Yijing Wang)
- Use dev->has_secondary_link to find downstream links for ASPM (Yijing Wang)
- Drop __pci_disable_link_state() useless "force" parameter (Bjorn Helgaas)
- Simplify Clock Power Management setting (Bjorn Helgaas)
Virtualization
- Add ACS quirks for Intel 9-series PCH root ports (Alex Williamson)
- Add function 1 DMA alias quirk for Marvell 9120 (Sakari Ailus)
MSI
- Disable MSI at enumeration even if kernel doesn't support MSI (Michael S. Tsirkin)
- Remove unused pci_msi_off() (Bjorn Helgaas)
- Rename msi_set_enable(), msix_clear_and_set_ctrl() (Michael S. Tsirkin)
- Export pci_msi_set_enable(), pci_msix_clear_and_set_ctrl() (Michael S. Tsirkin)
- Drop pci_msi_off() calls during probe (Michael S. Tsirkin)
APM X-Gene host bridge driver
- Add APM X-Gene v1 PCIe MSI/MSIX termination driver (Duc Dang)
- Add APM X-Gene PCIe MSI DTS nodes (Duc Dang)
- Disable Configuration Request Retry Status for v1 silicon (Duc Dang)
- Allow config access to Root Port even when link is down (Duc Dang)
Broadcom iProc host bridge driver
- Allow override of device tree IRQ mapping function (Hauke Mehrtens)
- Add BCMA PCIe driver (Hauke Mehrtens)
- Directly add PCI resources (Hauke Mehrtens)
- Free resource list after registration (Hauke Mehrtens)
Freescale i.MX6 host bridge driver
- Add speed change timeout message (Troy Kisky)
- Rename imx6_pcie_start_link() to imx6_pcie_establish_link() (Bjorn Helgaas)
Freescale Layerscape host bridge driver
- Use dw_pcie_link_up() consistently (Bjorn Helgaas)
- Factor out ls_pcie_establish_link() (Bjorn Helgaas)
Marvell MVEBU host bridge driver
- Remove mvebu_pcie_scan_bus() (Yijing Wang)
NVIDIA Tegra host bridge driver
- Remove tegra_pcie_scan_bus() (Yijing Wang)
Synopsys DesignWare host bridge driver
- Consolidate outbound iATU programming functions (Jisheng Zhang)
- Use iATU0 for cfg and IO, iATU1 for MEM (Jisheng Zhang)
- Add support for x8 links (Zhou Wang)
- Wait for link to come up with consistent style (Bjorn Helgaas)
- Use pci_scan_root_bus() for simplicity (Yijing Wang)
TI DRA7xx host bridge driver
- Use dw_pcie_link_up() consistently (Bjorn Helgaas)
Miscellaneous
- Include <linux/pci.h>, not <asm/pci.h> (Bjorn Helgaas)
- Remove unnecessary #includes of <asm/pci.h> (Bjorn Helgaas)
- Remove unused pcibios_select_root() (again) (Bjorn Helgaas)
- Remove unused pci_dma_burst_advice() (Bjorn Helgaas)
- xen/pcifront: Don't use deprecated function pci_scan_bus_parented() (Arnd Bergmann)"
* tag 'pci-v4.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (58 commits)
PCI: pciehp: Inline the "handle event" functions into the ISR
PCI: pciehp: Rename queue_interrupt_event() to pciehp_queue_interrupt_event()
PCI: pciehp: Make queue_interrupt_event() void
PCI: xgene: Allow config access to Root Port even when link is down
PCI: xgene: Disable Configuration Request Retry Status for v1 silicon
PCI: pciehp: Clean up debug logging
x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
PCI: imx6: Add #define PCIE_RC_LCSR
PCI: imx6: Use "u32", not "uint32_t"
PCI: Remove unused pci_scan_bus_parented()
xen/pcifront: Don't use deprecated function pci_scan_bus_parented()
PCI: imx6: Add speed change timeout message
PCI/ASPM: Simplify Clock Power Management setting
PCI: designware: Wait for link to come up with consistent style
PCI: layerscape: Factor out ls_pcie_establish_link()
PCI: layerscape: Use dw_pcie_link_up() consistently
PCI: dra7xx: Use dw_pcie_link_up() consistently
x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
PCI: pciehp: Wait for hotplug command completion where necessary
PCI: Remove unused pci_dma_burst_advice()
...
Pull PCMCIA update from Dominik Brodowski: "A few PCMCIA fixes and cleanups are available in the PCMCIA tree. Most of them are trivial and self-explanatory. Of particular note are the last three patches which add an important hardware quirk for Toshiba ToPIC95 sockets (or BIOS breakage on systems with these sockets), fix resource leaks in yenta_socket enable/disable call paths, and fix a regression caused by patch 1c6c9b1 since v4.0. Alan stated he is OK with me pushing this patch upstream. Once it works out well in your tree, I will push it to stable for 4.0/4.1 as well" * git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia: pcmcia: do not break rsrc_nonstatic when handling anonymous cards pcmcia: Fix resource leaks in yenta_probe() and _close() Disable write buffering on Toshiba ToPIC95 pcmcia: Convert dev_printk to dev_<level> pcmcia/vrc4171: Remove typedefs for enums and struct pcmcia: Remove typedef in structs and emum pcmcia: Remove typedef tuple_flags drivers: pcmcia: electra_cf.c fix checkpatch error and warnings drivers: pcmcia: ds.c fix checkpatch errors PCMCIA: Remove commented references to dead class_device_create_file() drivers/pcmcia/electra_cf.c: add missing iounmap and kfree pcmcia: replace open-coded ARRAY_SIZE with macro
…/git/jikos/hid Pull HID updates from Jiri Kosina: - spurious power/wakeup sysfs files removal for I2C-HID devices, from Andrew Duggan - Logitech M560 support, from Goffredo Baroncelli - a lot of housekeeping cleanups to hid-lg4ff driver, from Michal Maly - improved support for Plantronics devices, from Terry Junge - Sony Motion Controller and Navigation Controller support and subsequent cleanups of hid-sony driver, from Frank Praznik and Simon Wood - HW support improvements to the Wacom driver, from Jason Gerecke and Ping Cheng - assorted small cleanups and device ID additions all over the place * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (69 commits) HID: cypress: use swap() in cp_report_fixup() HID: microsoft: Add Surface Power Cover HID: hid-sony: Fix report descriptor for Navigation Controller HID: hid-sony: Navigation controller only has 1 LED and no rumble HID: hid-sony: Add BT support for Navigation Controller HID: wacom: Introduce new 'touch_input' device HID: wacom: Split apart 'wacom_setup_pentouch_input_capabilites' HID: wacom: Introduce a new WACOM_DEVICETYPE_PAD device_type HID: wacom: Treat features->device_type values as flags HID: wacom: Simplify 'wacom_update_name' HID: rmi: Disable populating F30 when the touchpad has physical buttons HID: plantronics: Update to map volume up/down controls HID: sony: PS Move fix report descriptor HID: sony: PS3 Move enable LEDs and Rumble via BT HID: sony: Add support PS3 Move Battery via BT HID: sony: Add quirk for MOTION_CONTROLLER_BT HID: sony: Support PS3 Move Controller when connected via Bluetooth HID: i2c-hid: Do not set the ACPI companion field in the HID device usb, HID: Remove Vernier devices from lsusb and hid_ignore_list HID: hidpp: Add driver for mouse logitech M560 ...
…/git/jikos/livepatching Pull livepatching fixes from Jiri Kosina: - symbol lookup locking fix, from Miroslav Benes - error handling improvements in case of failure of the module coming notifier, from Minfei Huang - we were too pessimistic when kASLR has been enabled on x86 and were dropping address hints on the floor unnecessarily in such case. Fix from Jiri Kosina - a few other small fixes and cleanups * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: livepatch: add module locking around kallsyms calls livepatch: annotate klp_init() with __init livepatch: introduce patch/func-walking helpers livepatch: make kobject in klp_object statically allocated livepatch: Prevent patch inconsistencies if the coming module notifier fails livepatch: match return value to function signature x86: kaslr: fix build due to missing ALIGN definition livepatch: x86: make kASLR logic more accurate x86: introduce kaslr_offset()
…/git/jikos/trivial Pull trivial tree updates from Jiri Kosina: "As usual, mostly comment, kerneldoc and printk() fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: lpfc: Grammar s/an negative/a negative/ ARM: lib/lib1funcs.S: fix typo s/substractions/subtractions/ cx25821: cx25821-medusa-reg.h: fix 0x0x prefix lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants rapidio: Fix kerneldoc and comment qla4xxx: Fix printk() in qla4_83xx_read_reset_template() and qla4_83xx_pre_loopback_config() treewide: Kconfig: fix wording / spelling usb/serial: fix grammar in Kconfig help text for FTDI_SIO megaraid_sas: fix kerneldoc netfilter: ebtables: fix comment grammar drm/radeon: fix comment isdn: fix grammar in comment ARM: KVM: fix comment
…nel/git/rafael/linux-pm
Pull power management and ACPI updates from Rafael Wysocki:
"The rework of backlight interface selection API from Hans de Goede
stands out from the number of commits and the number of affected
places perspective. The cpufreq core fixes from Viresh Kumar are
quite significant too as far as the number of commits goes and because
they should reduce CPU online/offline overhead quite a bit in the
majority of cases.
From the new featues point of view, the ACPICA update (to upstream
revision 20150515) adding support for new ACPI 6 material to ACPICA is
the one that matters the most as some new significant features will be
based on it going forward. Also included is an update of the ACPI
device power management core to follow ACPI 6 (which in turn reflects
the Windows' device PM implementation), a PM core extension to support
wakeup interrupts in a more generic way and support for the ACPI _CCA
device configuration object.
The rest is mostly fixes and cleanups all over and some documentation
updates, including new DT bindings for Operating Performance Points.
There is one fix for a regression introduced in the 4.1 cycle, but it
adds quite a number of lines of code, it wasn't really ready before
Thursday and you were on vacation, so I refrained from pushing it on
the last minute for 4.1.
Specifics:
- ACPICA update to upstream revision 20150515 including basic support
for ACPI 6 features: new ACPI tables introduced by ACPI 6 (STAO,
XENV, WPBT, NFIT, IORT), changes related to the other tables (DTRM,
FADT, LPIT, MADT), new predefined names (_BTH, _CR3, _DSD, _LPI,
_MTL, _PRR, _RDI, _RST, _TFP, _TSN), fixes and cleanups (Bob Moore,
Lv Zheng).
- ACPI device power management core code update to follow ACPI 6
which reflects the ACPI device power management implementation in
Windows (Rafael J Wysocki).
- rework of the backlight interface selection logic to reduce the
number of kernel command line options and improve the handling of
DMI quirks that may be involved in that and to make the code
generally more straightforward (Hans de Goede).
- fixes for the ACPI Embedded Controller (EC) driver related to the
handling of EC transactions (Lv Zheng).
- fix for a regression related to the ACPI resources management and
resulting from a recent change of ACPI initialization code ordering
(Rafael J Wysocki).
- fix for a system initialization regression related to ACPI
introduced during the 3.14 cycle and caused by running the code
that switches the platform over to the ACPI mode too early in the
initialization sequence (Rafael J Wysocki).
- support for the ACPI _CCA device configuration object related to
DMA cache coherence (Suravee Suthikulpanit).
- ACPI/APEI fixes and cleanups (Jiri Kosina, Borislav Petkov).
- ACPI battery driver cleanups (Luis Henriques, Mathias Krause).
- ACPI processor driver cleanups (Hanjun Guo).
- cleanups and documentation update related to the ACPI device
properties interface based on _DSD (Rafael J Wysocki).
- ACPI device power management fixes (Rafael J Wysocki).
- assorted cleanups related to ACPI (Dominik Brodowski, Fabian
Frederick, Lorenzo Pieralisi, Mathias Krause, Rafael J Wysocki).
- fix for a long-standing issue causing General Protection Faults to
be generated occasionally on return to user space after resume from
ACPI-based suspend-to-RAM on 32-bit x86 (Ingo Molnar).
- fix to make the suspend core code return -EBUSY consistently in all
cases when system suspend is aborted due to wakeup detection (Ruchi
Kandoi).
- support for automated device wakeup IRQ handling allowing drivers
to make their PM support more starightforward (Tony Lindgren).
- new tracepoints for suspend-to-idle tracing and rework of the
prepare/complete callbacks tracing in the PM core (Todd E Brandt,
Rafael J Wysocki).
- wakeup sources framework enhancements (Jin Qian).
- new macro for noirq system PM callbacks (Grygorii Strashko).
- assorted cleanups related to system suspend (Rafael J Wysocki).
- cpuidle core cleanups to make the code more efficient (Rafael J
Wysocki).
- powernv/pseries cpuidle driver update (Shilpasri G Bhat).
- cpufreq core fixes related to CPU online/offline that should reduce
the overhead of these operations quite a bit, unless the CPU in
question is physically going away (Viresh Kumar, Saravana Kannan).
- serialization of cpufreq governor callbacks to avoid race
conditions in some cases (Viresh Kumar).
- intel_pstate driver fixes and cleanups (Doug Smythies, Prarit
Bhargava, Joe Konno).
- cpufreq driver (arm_big_little, cpufreq-dt, qoriq) updates (Sudeep
Holla, Felipe Balbi, Tang Yuantian).
- assorted cleanups in cpufreq drivers and core (Shailendra Verma,
Fabian Frederick, Wang Long).
- new Device Tree bindings for representing Operating Performance
Points (Viresh Kumar).
- updates for the common clock operations support code in the PM core
(Rajendra Nayak, Geert Uytterhoeven).
- PM domains core code update (Geert Uytterhoeven).
- Intel Knights Landing support for the RAPL (Running Average Power
Limit) power capping driver (Dasaratharaman Chandramouli).
- fixes related to the floor frequency setting on Atom SoCs in the
RAPL power capping driver (Ajay Thomas).
- runtime PM framework documentation update (Ben Dooks).
- cpupower tool fix (Herton R Krzesinski)"
* tag 'pm+acpi-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (194 commits)
cpuidle: powernv/pseries: Auto-promotion of snooze to deeper idle state
x86: Load __USER_DS into DS/ES after resume
PM / OPP: Add binding for 'opp-suspend'
PM / OPP: Allow multiple OPP tables to be passed via DT
PM / OPP: Add new bindings to address shortcomings of existing bindings
ACPI: Constify ACPI device IDs in documentation
ACPI / enumeration: Document the rules regarding the PRP0001 device ID
ACPI / video: Make acpi_video_unregister_backlight() private
acpi-video-detect: Remove old API
toshiba-acpi: Port to new backlight interface selection API
thinkpad-acpi: Port to new backlight interface selection API
sony-laptop: Port to new backlight interface selection API
samsung-laptop: Port to new backlight interface selection API
msi-wmi: Port to new backlight interface selection API
msi-laptop: Port to new backlight interface selection API
intel-oaktrail: Port to new backlight interface selection API
ideapad-laptop: Port to new backlight interface selection API
fujitsu-laptop: Port to new backlight interface selection API
eeepc-laptop: Port to new backlight interface selection API
dell-wmi: Port to new backlight interface selection API
...
…-arm
Pull clkdev updates from Russell King:
"This series addresses some breakage in clkdev caused by a previous
patch set from the clk tree which introduced per-user clk structures.
This basically renamed the existing 'struct clk' to 'struct clk_hw',
and introduced a new 'struct clk'.
This change will break anyone using clk_add_alias() with the common
clk code enabled. Thankfully, the intersection of users of
clk_add_alias() and those using the common clk code is practically
zero, but this is something which should be fixed to keep the code
sane.
The problem is that clk_add_alias() does this:
r = clk_get(...);
l = clkdev_alloc(r, ...);
clk_put(...);
which causes the alias to store a pointer to 'r', which has been
freed.
The original patch set tried to work around this problem incorrectly -
at clk_get() time, it tried to convert the struct clk to a struct
clk_hw, and then creating a new struct clk from that. Clearly, if the
original struct clk has been freed, then we have a use-after-free bug.
We have other places in the tree which do something similar, so this
series also addresses those locations too.
This series addresses this problem by converting clkdev to store and
use the clk_hw pointer. This allows clk_get() to only have to create
it's per-user struct clk from the clk_hw. We can also get to the
desired clk_hw at clk_add_alias() or clk lookup creation time, when
the struct clk is "alive".
We also perform some cleanups of the code:
- replacing looped calls to clkdev_add() with clkdev_add_table()
- replacing open-coded lookup allocation (which should have been
using clkdev_alloc()) and subsequent clkdev_add() with
clkdev_create()
- replacing open-coded clk_add_alias() with clk_add_alias()"
* 'for-linus-clk' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
clk: s2mps11: use clkdev_create()
ASoC: migor: use clkdev_create()
ARM: omap2: use clkdev_add_alias()
ARM: omap2: use clkdev_create()
ARM: orion: use clkdev_create()
ARM: lpc32xx: convert to use clkdev_add_table()
SH: use clkdev_add_table()
clkdev: add clkdev_create() helper
clkdev: const-ify connection id to clk_add_alias()
clkdev: get rid of redundant clk_add_alias() prototype in linux/clk.h
clkdev: drop __init from clkdev_add_table()
clk: update clk API documentation to clarify clk_round_rate()
clkdev: use clk_hw internally
…t/dledford/rdma Pull rdma updates from Doug Ledford: - a large cleanup of how device capabilities are checked for various features - additional cleanups in the MAD processing - update to the srp driver - creation and use of centralized log message helpers - add const to a number of args to calls and clean up call chain - add support for extended cq create verb - add support for timestamps on cq completion - add support for processing OPA MAD packets * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (92 commits) IB/mad: Add final OPA MAD processing IB/mad: Add partial Intel OPA MAD support IB/mad: Add partial Intel OPA MAD support IB/core: Add OPA MAD core capability flag IB/mad: Add support for additional MAD info to/from drivers IB/mad: Convert allocations from kmem_cache to kzalloc IB/core: Add ability for drivers to report an alternate MAD size. IB/mad: Support alternate Base Versions when creating MADs IB/mad: Create a generic helper for DR forwarding checks IB/mad: Create a generic helper for DR SMP Recv processing IB/mad: Create a generic helper for DR SMP Send processing IB/mad: Split IB SMI handling from MAD Recv handler IB/mad cleanup: Generalize processing of MAD data IB/mad cleanup: Clean up function params -- find_mad_agent IB/mlx4: Add support for CQ time-stamping IB/mlx4: Add mmap call to map the hardware clock IB/core: Pass hardware specific data in query_device IB/core: Add timestamp_mask and hca_core_clock to query_device IB/core: Extend ib_uverbs_create_cq IB/core: Add CQ creation time-stamping flag ...
…t/jejb/scsi Pull SCSI updates from James Bottomley: "This is the usual grab bag of driver updates (lpfc, hpsa, megaraid_sas, cxgbi, be2iscsi) plus an assortment of minor updates. There is also one new driver: the Cisco snic. The advansys driver has been rewritten to get rid of the warning about converting it to the DMA API, the tape statistics patch got in and finally, there's a resuffle of SCSI header files to separate more cleanly initiator from target mode (and better share the common definitions)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (156 commits) snic: driver for Cisco SCSI HBA qla2xxx: Fix indentation qla2xxx: Comment out unreachable code fusion: remove dead MTRR code advansys: fix compilation errors and warnings when CONFIG_PCI is not set mptsas: fix depth param in scsi_track_queue_full megaraid: fix irq setup process regression lpfc: Update version to 10.7.0.0 for upstream patch set. lpfc: Fix to drop PLOGIs from fabric node till LOGO processing completes lpfc: Fix scsi task management error message. lpfc: Fix cq_id masking problem. lpfc: Fix scsi prep dma buf error. lpfc: Add support for using block multi-queue lpfc: Devices are not discovered during takeaway/giveback testing lpfc: Fix vport deletion failure. lpfc: Check for active portpeerbeacon. lpfc: Update driver version for upstream patch set 10.6.0.1. lpfc: Change buffer pool empty message to miscellaneous category lpfc: Fix incorrect log message reported for empty FCF record. lpfc: Fix rport leak. ...
…git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: "Misc fixes" * tag 'hsi-for-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: nokia-modem: use flags argument of devm_gpiod_get to set direction HSI: nokia-modem: Reduce missing driver message to debug level HSI: cmt_speech: fix timestamp interface
Pull power supply and reset updates from Sebastian Reichel: - new charger drivers: BQ24257, BQ25890, AXP288, RT9455 - MAX17042 battery: add health & temperature support - BQ2415x charger: add ACPI support - misc fixes and cleanups * tag 'for-4.2' of git://git.infradead.org/battery-2.6: (32 commits) power_supply: Correct kerneldoc copy paste errors wm831x_power: Fix off-by-one at free_irq() power_supply: rt9455_charger: Fix error reported by static analysis tool power_supply: bq24257: use flags argument of devm_gpiod_get power_supply: bq25890: use flags argument of devm_gpiod_get sbs-battery: add option to always register battery power: Add devm_power_supply_get_by_phandle() helper function power_supply: max17042: Add OF support for setting thresholds power_supply: sysfs: Bring back write to writeable properties power_supply: rt9455_charger: Check if CONFIG_USB_PHY is enabled power: reset: gpio-restart: increase priority slightly power_supply: bq25890: make chip_id int power_supply: Add support for Richtek RT9455 battery charger Documentation: devicetree: Add Richtek RT9455 bindings of: Add vendor prefix for Richtek Technology Corporation power_supply: 88pm860x_charger: Do not call free_irq() twice power: bq24190_charger: Change first_time flag reset condition power: axp288_charger: axp288 charger driver power: max17042_battery: add HEALTH and TEMP_* properties support power_supply: Add support for TI BQ25890 charger chip ...
…t/tomba/linux Pull fbdev updates from Tomi Valkeinen: - ssd1307fb: various fixes and improvements, SSD1305 support - use architecture agnostic functions instead of MTRR functions in various fbdev drivers - TI DRA7xx SoC display support (arch/arm/ side) - OMAPDSS componentization to fix probing order issues - OMAPDSS scaling fixes - msm_fb: remove obsoleted driver * tag 'fbdev-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: (77 commits) msm: msm_fb: Remove dead code OMAPDSS: HDMI: wait for framedone when stopping video OMAPDSS: HDMI4: fix error handling OMAPDSS: DISPC: scaler debug print OMAPDSS: DISPC: do only y decimation on OMAP3 OMAPDSS: DISPC: check if scaling setup failed OMAPDSS: DISPC: fix 64 bit issue in 5-tap OMAPDSS: DISPC: fix row_inc for OMAP3 OMAPDSS: DISPC: add check for scaling limits OMAPDSS: DISPC: fix check_horiz_timing_omap3 args OMAPDSS: DISPC: fix predecimation for YUV modes OMAPDSS: DISPC: work-around for errata i631 OMAPDSS: simplify submodule reg/unreg code OMAPDSS: componentize omapdss OMAPDSS: reorder uninit calls OMAPDSS: remove uses of __init/__exit OMAPDSS: fix dss_init_ports error handling OMAPDSS: refactor dss probe function OMAPDSS: move 'dss_initialized' to dss driver fbdev: propagate result of fb_videomode_from_videomode() ...
…git/broonie/regmap
Pull regmap updates from Mark Brown:
"As well as a few fixes and updates for API changes there's two new
features for the API:
- Better support for handling a reset of the underlying hardware,
marking the register map as needing a resync to the device when we
need to do that automatically
- Support for querying the size and stride of the register map,
allowing higher level frameworks to configure themselves more
readily"
* tag 'regmap-v4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: Fix possible shift overflow in regmap_field_init()
regmap: Fix regmap_bulk_read in BE mode
regmap: kill off set_irq_flags usage
regmap: irq: Fixed a typo error
regmap: drop unneeded goto
regmap: Introduce regmap_get_reg_stride
regmap: Introduce regmap_get_max_register
regmap: Use regcache_mark_dirty() to indicate power loss or reset
regmap: Add a helper function for regcache sync test
regmap: Constify irq_domain_ops
…/broonie/spi
Pull spi updates from Mark Brown:
"No framework updates for the SPI API this time around aside from one
small fix, just driver improvments. Some highlights include:
- New driver support for CSR USP, Mikrotik RB4xx and Zynq GQSPI
controllers.
- Modernisation of the OMAP McSPI controller driver, moving it to
current APIs to enable support for a wider range of client drivers.
- DMA support for the bcm2835 controller"
* tag 'spi-v4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (60 commits)
spi: zynq: Remove execute bit
spi: atmel: add support to FIFOs
spi: atmel: update DT bindings documentation
spi: spi-fsl-dspi: Update DT binding documentation
spi: pxa2xx: Constify ACPI device ids
spi: Add support for Zynq Ultrascale+ MPSoC GQSPI controller
spi: zynq: Add DT bindings documentation for Zynq Ultrascale+ MPSoC GQSPI controller
spi: fsl-dspi: Use pinctrl PM helpers
spi: davinci: change the lower limit of pre-scale divider to 1
spi: spi-fsl-dspi: Change the way of increasing spi_message->actual_length
spi: spi-fsl-dspi: Enable TCF interrupt mode support
spi: atmel: add support for the internal chip-select of the spi controller
spi: spi-pxa2xx: remove legacy PXA DMA bits
spi: pxa2xx: Make LPSS SPI general register optional
spi: pxa2xx: Prepare for new Intel LPSS SPI type
spi: pxa2xx: Differentiate Intel LPSS types
spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA
spi: rspi: Re-do the returning value of qspi_transfer_out_in
spi: rspi: modify the name of "qspi_trigger_transfer_out_int" function
spi: orion: Fix extended baud rates for each Armada SoCs
...
…el/git/broonie/regulator
Pull regulator updates from Mark Brown:
"Another fairly quiet release, some new drivers with generic handling
for minor features but nothing that makes a substantial difference
outside of the subsystem or for most boards:
- support for a bunch of new parameters which are present on enough
regulators to be worth having generic handling for in the
framework.
- fixes for some issues with printing constraints during boot which
should probably have gone in for v4.1 but didn't.
- new drivers for Dialog DA9062, Maxim MAX77621 and Qualcomm SPMI
regulators"
* tag 'regulator-v4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (45 commits)
regulator: qcom_spmi: Fix calculating number of voltages
regulator: qcom_spmi: Add missing braces for aligned code
regulator: fix simple_return.cocci warnings
regulator: Add QCOM SPMI regulator driver
regulator: Add docbook for soft start
regulator: Add input current limit support
regulator: Add soft start support
regulator: Add pull down support
regulator: Add system_load constraint
regulator: max8973: Fix up ramp_delay for MAX8973_RAMP_25mV_PER_US case
regulator: core: replace sprintf with scnprintf
regulator: core: fix constraints output buffer
regulator: core: Don't corrupt display when printing uV offsets
regulator: max8973: add support for MAX77621
regulator: max8973: configure ramp delay through callback
regulator: pwm-regulator: Diffientiate between dev (device) and rdev (regulator_dev)
regulator: pwm-regulator: Remove superfluous is_enabled check
regulator: pwm-regulator: Remove unnecessary descriptor attribute from ddata
regulator: core: Don't spew backtraces on duplicate sysfs
regulator: da9063: Fix up irq leak
...
…ernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"Changes to existing drivers:
- Constify structures; throughout the subsystem
- Move support to DT in; cros_ec
- DT changes and documentation; cros-ec, max77693, max77686, arizona, da9063
- ACPI changes and documentation; mfd-core
- Use different platform specific API in; cros_ec_*, arizona-core
- Remove unused parent field from; cros_ec_i2c
- Add wake-up/reset delay in; cross_ec_spi, arizona-core
- Staticise structures/functions in; cros_ec
- Remove redundant code; arizona-core, max77686
- Bugfix; twl4030-power
- Allow compile test; aat2870, tps65910
- MAINTAINERS adaptions; samsung, syscon
- Resource Management (devm_*); arizona-core
- Refactor Reset code; arizona-core
- Insist on at least one full boot; arizona-core
- Trivial formatting; arizona-core
- Add low-power-sleep; arizona-core
- IRQ ONESHOT changes; twl4030-irq, mc13xxx-core, wm831x-auxadc, htc-i2cpld,
wm8350-core, ab8500-debugfs, ab8500-gpadc, si476x-i2c
(Re-)moved drivers:
- Move protocol helpers out to drivers/platform; cros_ec
New drivers/supported devices:
- Add support for AXP22x into axp20x
- Add support for OnKey into da9063-core
- Add support for Pinctrl into mt6397-core
- New STMicroelectronics LPC Watchdog driver
- New STMicroelectronics LPC Real-Time Clock driver"
* tag 'mfd-for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (59 commits)
mfd: lpc_ich: Assign subdevice ids automatically
mfd: si476x-i2c: Pass the IRQF_ONESHOT flag
mfd: ab8500-gpadc: Pass the IRQF_ONESHOT flag
mfd: ab8500-debugfs: Pass the IRQF_ONESHOT flag
mfd: wm8350-core: Pass the IRQF_ONESHOT flag
mfd: htc-i2cpld: Pass the IRQF_ONESHOT flag
mfd: wm831x-auxadc: Pass the IRQF_ONESHOT flag
mfd: mc13xxx-core: Pass the IRQF_ONESHOT flag
mfd: twl4030-irq: Pass the IRQF_ONESHOT flag
mfd: mt6397-core: Add GPIO sub-module support
mfd: arizona: Add convience defines for micd_rate/micd_bias_starttime
mfd: dt: Add bindings for DA9063 OnKey
mfd: da9063: Add support for OnKey driver
mfd: arizona: Fix incorrect Makefile conditionals
mfd: arizona: Add stub for wm5102_patch()
mfd: Check ACPI device companion before checking resources
Documentation: Add WM8998/WM1814 device tree bindings
mfd: arizona: Split INx_MODE into two fields
mfd: wm5110: Add delay before releasing reset line
mfd: arizona: Add better support for system suspend
...
Pull MTD updates from Brian Norris:
"JFFS2:
- fix a theoretical unbalanced locking issue; the lock handling was a
bit unclean, but AFAICT, it didn't actually lead to real deadlocks
NAND:
- brcmnand driver: new driver supporting NAND controller found
originally on Broadcom STB SoCs (BCM7xxx), but now also found on
BCM63xxx, iProc (e.g., Cygnus, BCM5301x), BCM3xxx, and more
- begin factoring out BBT code so it can be shared between
traditional (parallel) NAND drivers and upcoming SPI NAND drivers
(WIP)
- add common DT-based init support, so nand_base can pick up some
flash properties automatically, using established common NAND DT
properties
- mxc_nand: support 8-bit ECC
- pxa3xx_nand:
* fix build for ARM64
* use a jiffies-based timeout
SPI NOR:
- add a few new IDs
- clear out some unnecessary entries
- make sure SECT_4K flags are correct for all (?) entries
Core:
- fix mtd->usecount race conditions (BUG_ON())
- switch to modern PM ops
Other:
- CFI: save code space by de-inlining large functions
- clean up some partition parser selection code across several
drivers
- various miscellaneous changes, mostly minor"
* tag 'for-linus-20150623' of git://git.infradead.org/linux-mtd: (57 commits)
mtd: docg3: Fix kasprintf() usage
mtd: docg3: Don't leak docg3->bbt in error path
mtd: nandsim: Fix kasprintf() usage
mtd: cs553x_nand: Fix kasprintf() usage
mtd: r852: Fix device_create_file() usage
mtd: brcmnand: drop unnecessary initialization
mtd: propagate error codes from add_mtd_device()
mtd: diskonchip: remove two-phase partitioning / registration
mtd: dc21285: use raw spinlock functions for nw_gpio_lock
mtd: chips: fixup dependencies, to prevent build error
mtd: cfi_cmdset_0002: Initialize datum before calling map_word_load_partial
mtd: cfi: deinline large functions
mtd: lantiq-flash: use default partition parsers
mtd: plat_nand: use default partition probe
mtd: nand: correct indentation within conditional
mtd: remove incorrect file name
mtd: blktrans: use better error code for unimplemented ioctl()
mtd: maps: Spelling s/reseved/reserved/
mtd: blktrans: change blktrans_getgeo return value
mtd: mxc_nand: generate nand_ecclayout for 8 bit ECC
...
…kernel/git/joro/iommu
Pull IOMMU updates from Joerg Roedel:
"This time with bigger changes than usual:
- A new IOMMU driver for the ARM SMMUv3.
This IOMMU is pretty different from SMMUv1 and v2 in that it is
configured through in-memory structures and not through the MMIO
register region. The ARM SMMUv3 also supports IO demand paging for
PCI devices with PRI/PASID capabilities, but this is not
implemented in the driver yet.
- Lots of cleanups and device-tree support for the Exynos IOMMU
driver. This is part of the effort to bring Exynos DRM support
upstream.
- Introduction of default domains into the IOMMU core code.
The rationale behind this is to move functionalily out of the IOMMU
drivers to common code to get to a unified behavior between
different drivers. The patches here introduce a default domain for
iommu-groups (isolation groups).
A device will now always be attached to a domain, either the
default domain or another domain handled by the device driver. The
IOMMU drivers have to be modified to make use of that feature. So
long the AMD IOMMU driver is converted, with others to follow.
- Patches for the Intel VT-d drvier to fix DMAR faults that happen
when a kdump kernel boots.
When the kdump kernel boots it re-initializes the IOMMU hardware,
which destroys all mappings from the crashed kernel. As this
happens before the endpoint devices are re-initialized, any
in-flight DMA causes a DMAR fault. These faults cause PCI master
aborts, which some devices can't handle properly and go into an
undefined state, so that the device driver in the kdump kernel
fails to initialize them and the dump fails.
This is now fixed by copying over the mapping structures (only
context tables and interrupt remapping tables) from the old kernel
and keep the old mappings in place until the device driver of the
new kernel takes over. This emulates the the behavior without an
IOMMU to the best degree possible.
- A couple of other small fixes and cleanups"
* tag 'iommu-updates-v4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (69 commits)
iommu/amd: Handle large pages correctly in free_pagetable
iommu/vt-d: Don't disable IR when it was previously enabled
iommu/vt-d: Make sure copied over IR entries are not reused
iommu/vt-d: Copy IR table from old kernel when in kdump mode
iommu/vt-d: Set IRTA in intel_setup_irq_remapping
iommu/vt-d: Disable IRQ remapping in intel_prepare_irq_remapping
iommu/vt-d: Move QI initializationt to intel_setup_irq_remapping
iommu/vt-d: Move EIM detection to intel_prepare_irq_remapping
iommu/vt-d: Enable Translation only if it was previously disabled
iommu/vt-d: Don't disable translation prior to OS handover
iommu/vt-d: Don't copy translation tables if RTT bit needs to be changed
iommu/vt-d: Don't do early domain assignment if kdump kernel
iommu/vt-d: Allocate si_domain in init_dmars()
iommu/vt-d: Mark copied context entries
iommu/vt-d: Do not re-use domain-ids from the old kernel
iommu/vt-d: Copy translation tables from old kernel
iommu/vt-d: Detect pre enabled translation
iommu/vt-d: Make root entry visible for hardware right after allocation
iommu/vt-d: Init QI before root entry is allocated
iommu/vt-d: Cleanup log messages
...
dabrace
pushed a commit
that referenced
this pull request
Mar 27, 2017
The DSPS glue calls del_timer_sync() in its musb_platform_disable() implementation, which requires the caller to not hold a lock. But musb_remove() calls musb_platform_disable() will musb->lock held. This could causes spinlock deadlock. So change musb_remove() to call musb_platform_disable() without holds musb->lock. This doesn't impact the musb_platform_disable implementation in other glue drivers. root@am335x-evm:~# modprobe -r musb-dsps [ 126.134879] musb-hdrc musb-hdrc.1: remove, state 1 [ 126.140465] usb usb2: USB disconnect, device number 1 [ 126.146178] usb 2-1: USB disconnect, device number 2 [ 126.416985] musb-hdrc musb-hdrc.1: USB bus 2 deregistered [ 126.423943] [ 126.425525] ====================================================== [ 126.431997] [ INFO: possible circular locking dependency detected ] [ 126.438564] 4.11.0-rc1-00003-g1557f13bca04-dirty #77 Not tainted [ 126.444852] ------------------------------------------------------- [ 126.451414] modprobe/778 is trying to acquire lock: [ 126.456523] (((&glue->timer))){+.-...}, at: [<c01b8788>] del_timer_sync+0x0/0xd0 [ 126.464403] [ 126.464403] but task is already holding lock: [ 126.470511] (&(&musb->lock)->rlock){-.-...}, at: [<bf30b7f8>] musb_remove+0x50/0x1 30 [musb_hdrc] [ 126.479965] [ 126.479965] which lock already depends on the new lock. [ 126.479965] [ 126.488531] [ 126.488531] the existing dependency chain (in reverse order) is: [ 126.496368] [ 126.496368] -> #1 (&(&musb->lock)->rlock){-.-...}: [ 126.502968] otg_timer+0x80/0xec [musb_dsps] [ 126.507990] call_timer_fn+0xb4/0x390 [ 126.512372] expire_timers+0xf0/0x1fc [ 126.516754] run_timer_softirq+0x80/0x178 [ 126.521511] __do_softirq+0xc4/0x554 [ 126.525802] irq_exit+0xe8/0x158 [ 126.529735] __handle_domain_irq+0x58/0xb8 [ 126.534583] __irq_usr+0x54/0x80 [ 126.538507] [ 126.538507] -> #0 (((&glue->timer))){+.-...}: [ 126.544636] del_timer_sync+0x40/0xd0 [ 126.549066] musb_remove+0x6c/0x130 [musb_hdrc] [ 126.554370] platform_drv_remove+0x24/0x3c [ 126.559206] device_release_driver_internal+0x14c/0x1e0 [ 126.565225] bus_remove_device+0xd8/0x108 [ 126.569970] device_del+0x1e4/0x308 [ 126.574170] platform_device_del+0x24/0x8c [ 126.579006] platform_device_unregister+0xc/0x20 [ 126.584394] dsps_remove+0x14/0x30 [musb_dsps] [ 126.589595] platform_drv_remove+0x24/0x3c [ 126.594432] device_release_driver_internal+0x14c/0x1e0 [ 126.600450] driver_detach+0x38/0x6c [ 126.604740] bus_remove_driver+0x4c/0xa0 [ 126.609407] SyS_delete_module+0x11c/0x1e4 [ 126.614252] __sys_trace_return+0x0/0x10 Fixes: ea2f35c ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") Cc: <stable@vger.kernel.org> #4.9+ Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Bin Liu <b-liu@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dabrace
pushed a commit
that referenced
this pull request
Feb 26, 2019
syzbot reported a WARN_ON(!tcp_skb_pcount(skb)) in tcp_send_loss_probe() [1] This was caused by TCP_REPAIR sent skbs that inadvertenly were missing a call to tcp_init_tso_segs() [1] WARNING: CPU: 1 PID: 0 at net/ipv4/tcp_output.c:2534 tcp_send_loss_probe+0x771/0x8a0 net/ipv4/tcp_output.c:2534 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc7+ #77 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2cb/0x65c kernel/panic.c:214 __warn.cold+0x20/0x45 kernel/panic.c:571 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:tcp_send_loss_probe+0x771/0x8a0 net/ipv4/tcp_output.c:2534 Code: 88 fc ff ff 4c 89 ef e8 ed 75 c8 fb e9 c8 fc ff ff e8 43 76 c8 fb e9 63 fd ff ff e8 d9 75 c8 fb e9 94 f9 ff ff e8 bf 03 91 fb <0f> 0b e9 7d fa ff ff e8 b3 03 91 fb 0f b6 1d 37 43 7a 03 31 ff 89 RSP: 0018:ffff8880ae907c60 EFLAGS: 00010206 RAX: ffff8880a989c340 RBX: 0000000000000000 RCX: ffffffff85dedbdb RDX: 0000000000000100 RSI: ffffffff85dee0b1 RDI: 0000000000000005 RBP: ffff8880ae907c90 R08: ffff8880a989c340 R09: ffffed10147d1ae1 R10: ffffed10147d1ae0 R11: ffff8880a3e8d703 R12: ffff888091b90040 R13: ffff8880a3e8d540 R14: 0000000000008000 R15: ffff888091b90860 tcp_write_timer_handler+0x5c0/0x8a0 net/ipv4/tcp_timer.c:583 tcp_write_timer+0x10e/0x1d0 net/ipv4/tcp_timer.c:607 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694 __do_softirq+0x266/0x95a kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 </IRQ> RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58 Code: ff ff ff 48 89 c7 48 89 45 d8 e8 59 0c a1 fa 48 8b 45 d8 e9 ce fe ff ff 48 89 df e8 48 0c a1 fa eb 82 90 90 90 90 90 90 fb f4 <c3> 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90 RSP: 0018:ffff8880a98afd78 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff1125061 RBX: ffff8880a989c340 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a989cbbc RBP: ffff8880a98afda8 R08: ffff8880a989c340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffffffff889282f8 R14: 0000000000000001 R15: 0000000000000000 arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:555 default_idle_call+0x36/0x90 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x386/0x570 kernel/sched/idle.c:262 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:353 start_secondary+0x404/0x5c0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 7986191 ("tcp: fix TCP_REPAIR xmit queue setup") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Andrey Vagin <avagin@openvz.org> Cc: Soheil Hassas Yeganeh <soheil@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
dabrace
pushed a commit
that referenced
this pull request
Apr 29, 2019
Before calling __ip_options_compile(), we need to ensure the network header is a an IPv4 one, and that it is already pulled in skb->head. RAW sockets going through a tunnel can end up calling ipv4_link_failure() with total garbage in the skb, or arbitrary lengthes. syzbot report : BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:355 [inline] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x294/0x1120 net/ipv4/ip_options.c:123 Write of size 69 at addr ffff888096abf068 by task syz-executor.4/9204 CPU: 0 PID: 9204 Comm: syz-executor.4 Not tainted 5.1.0-rc5+ #77 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x123/0x190 mm/kasan/generic.c:191 memcpy+0x38/0x50 mm/kasan/common.c:133 memcpy include/linux/string.h:355 [inline] __ip_options_echo+0x294/0x1120 net/ipv4/ip_options.c:123 __icmp_send+0x725/0x1400 net/ipv4/icmp.c:695 ipv4_link_failure+0x29f/0x550 net/ipv4/route.c:1204 dst_link_failure include/net/dst.h:427 [inline] vti6_xmit net/ipv6/ip6_vti.c:514 [inline] vti6_tnl_xmit+0x10d4/0x1c0c net/ipv6/ip6_vti.c:553 __netdev_start_xmit include/linux/netdevice.h:4414 [inline] netdev_start_xmit include/linux/netdevice.h:4423 [inline] xmit_one net/core/dev.c:3292 [inline] dev_hard_start_xmit+0x1b2/0x980 net/core/dev.c:3308 __dev_queue_xmit+0x271d/0x3060 net/core/dev.c:3878 dev_queue_xmit+0x18/0x20 net/core/dev.c:3911 neigh_direct_output+0x16/0x20 net/core/neighbour.c:1527 neigh_output include/net/neighbour.h:508 [inline] ip_finish_output2+0x949/0x1740 net/ipv4/ip_output.c:229 ip_finish_output+0x73c/0xd50 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x21f/0x670 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] raw_send_hdrinc net/ipv4/raw.c:432 [inline] raw_sendmsg+0x1d2b/0x2f20 net/ipv4/raw.c:663 inet_sendmsg+0x147/0x5d0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:661 sock_write_iter+0x27c/0x3e0 net/socket.c:988 call_write_iter include/linux/fs.h:1866 [inline] new_sync_write+0x4c7/0x760 fs/read_write.c:474 __vfs_write+0xe4/0x110 fs/read_write.c:487 vfs_write+0x20c/0x580 fs/read_write.c:549 ksys_write+0x14f/0x2d0 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:608 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f293b44bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29 RDX: 0000000000000014 RSI: 00000000200002c0 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f293b44c6d4 R13: 00000000004c8623 R14: 00000000004ded68 R15: 00000000ffffffff The buggy address belongs to the page: page:ffffea00025aafc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x1fffc0000000000() raw: 01fffc0000000000 0000000000000000 ffffffff025a0101 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888096abef80: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 f2 ffff888096abf000: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888096abf080: 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 ^ ffff888096abf100: 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00 00 ffff888096abf180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fixes: ed0de45 ("ipv4: recompile ip options in ipv4_link_failure") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Stephen Suryaputra <ssuryaextr@gmail.com> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
dabrace
pushed a commit
that referenced
this pull request
May 19, 2020
And there are no multiple TRBs on EP0 and WA1 workaround, so it doesn't need to change TRB for EP0. It fixes below oops. configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED Unable to handle kernel read from unreadable memory at virtual address 0000000000000008 Mem abort info: android_work: sent uevent USB_STATE=DISCONNECTED ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000 [0000000000000008] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 60400085 (nZCv daIf +PAN -UAO) pc : cdns3_gadget_ep_dequeue+0x1d4/0x270 lr : cdns3_gadget_ep_dequeue+0x48/0x270 sp : ffff800012763ba0 x29: ffff800012763ba0 x28: ffff00082c653c00 x27: 0000000000000000 x26: ffff000068fa7b00 x25: ffff0000699b2000 x24: ffff00082c6ac000 x23: ffff000834f0a480 x22: ffff000834e87b9c x21: 0000000000000000 x20: ffff000834e87800 x19: ffff000069eddc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001 x11: ffff80001180fbe8 x10: 0000000000000001 x9 : ffff800012101558 x8 : 0000000000000001 x7 : 0000000000000006 x6 : ffff000835d9c668 x5 : ffff000834f0a4c8 x4 : 0000000096000000 x3 : 0000000000001810 x2 : 0000000000000000 x1 : ffff800024bd001c x0 : 0000000000000001 Call trace: cdns3_gadget_ep_dequeue+0x1d4/0x270 usb_ep_dequeue+0x34/0xf8 composite_dev_cleanup+0x154/0x170 configfs_composite_unbind+0x6c/0xa8 usb_gadget_remove_driver+0x44/0x70 usb_gadget_unregister_driver+0x74/0xe0 unregister_gadget+0x28/0x58 gadget_dev_desc_UDC_store+0x80/0x110 configfs_write_file+0x1e0/0x2a0 __vfs_write+0x48/0x90 vfs_write+0xe4/0x1c8 ksys_write+0x78/0x100 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x74/0x168 el0_svc_handler+0x34/0xa0 el0_svc+0x8/0xc Code: 52830203 b9407660 f94042e4 11000400 (b9400841) ---[ end trace 1574516e4c1772ca ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,20002008 Memory Limit: none Rebooting in 5 seconds.. Fixes: f616c3b ("usb: cdns3: Fix dequeue implementation") Cc: stable <stable@vger.kernel.org> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
dabrace
pushed a commit
that referenced
this pull request
Nov 5, 2020
Richard reported a warning which can be reproduced by running the LTP madvise6 test (cgroup v1 in the non-hierarchical mode should be used): WARNING: CPU: 0 PID: 12 at mm/page_counter.c:57 page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156) Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.9.0-rc7-22-default #77 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812d-rebuilt.opensuse.org 04/01/2014 Workqueue: events drain_local_stock RIP: 0010:page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156) Call Trace: __memcg_kmem_uncharge (mm/memcontrol.c:3022) drain_obj_stock (./include/linux/rcupdate.h:689 mm/memcontrol.c:3114) drain_local_stock (mm/memcontrol.c:2255) process_one_work (./arch/x86/include/asm/jump_label.h:25 ./include/linux/jump_label.h:200 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2274) worker_thread (./include/linux/list.h:282 kernel/workqueue.c:2416) kthread (kernel/kthread.c:292) ret_from_fork (arch/x86/entry/entry_64.S:300) The problem occurs because in the non-hierarchical mode non-root page counters are not linked to root page counters, so the charge is not propagated to the root memory cgroup. After the removal of the original memory cgroup and reparenting of the object cgroup, the root cgroup might be uncharged by draining a objcg stock, for example. It leads to an eventual underflow of the charge and triggers a warning. Fix it by linking all page counters to corresponding root page counters in the non-hierarchical mode. Please note, that in the non-hierarchical mode all objcgs are always reparented to the root memory cgroup, even if the hierarchy has more than 1 level. This patch doesn't change it. The patch also doesn't affect how the hierarchical mode is working, which is the only sane and truly supported mode now. Thanks to Richard for reporting, debugging and providing an alternative version of the fix! Fixes: bf4f059 ("mm: memcg/slab: obj_cgroup API") Reported-by: <ltp@lists.linux.it> Signed-off-by: Roman Gushchin <guro@fb.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Shakeel Butt <shakeelb@google.com> Reviewed-by: Michal Koutný <mkoutny@suse.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: <stable@vger.kernel.org> Link: https://lkml.kernel.org/r/20201026231326.3212225-1-guro@fb.com Debugged-by: Richard Palethorpe <rpalethorpe@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.