The driver was not bound checking the received length byte to ensure it was within the
the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows
whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up
in an infinite loop as the at91_twi_read_next_byte function returned immediately without
allowing RHR to be read to clear the RXRDY interrupt.
Tested agaisnt a SMBus compliant battery.
Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
In rk3x SOC, the I2C controller can receive/transmit up to 32 bytes data
in one chunk, so the size of data to be write/read to/from TXDATAx/RXDATAx
must be less than or equal 32 bytes at a time.
Tested on rk3288-pinky board, elan receive 158 bytes data.
Signed-off-by: Addy Ke <addy.ke@rock-chips.com>
Acked-by: Max Schwarz <max.schwarz@online.de>
Reviewed-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
There is a race condition in at91_do_twi_xfer when signals arrive.
If a signal is recieved while waiting for a transfer to complete
wait_for_completion_interruptible_timeout() will return -ERESTARTSYS.
This is not handled correctly resulting in interrupts still being
enabled and a transfer being in flight when we return.
Symptoms include a range of oopses and bus lockups. Oopses can happen
when the transfer completes because the interrupt handler will corrupt
the stack. If a new transfer is started before the interrupt fires
the controller will start a new transfer in the middle of the old one,
resulting in confused slaves and a locked bus.
To avoid this, use wait_for_completion_io_timeout instead so that we
don't have to deal with gracefully shutting down the transfer and
disabling the interrupts.
Signed-off-by: Simon Lindgren <simon@aqwary.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
The "clock-frequency" DT property is listed as optional, However,
the current code stores the return value of of_property_read_u32 in
the return code of mv64xxx_of_config, but then forgets to clear it
after setting the default value of "clock-frequency". It is then
passed out to the main probe function, resulting in a probe failure
when "clock-frequency" is missing.
This patch checks and then throws away the return value of
of_property_read_u32, instead of storing it and having to clear it
afterwards.
This issue was discovered after the property was removed from all
sunxi DTs.
Fixes: 4c730a06c1 ("i2c: mv64xxx: Set bus frequency to 100kHz if clock-frequency is not provided")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Cc: stable@vger.kernel.org
Acked-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Sometimes the MNR and MST interrupts happen simultaneously (stop automatically
follows NACK, according to the manuals) and in such case the ID_NACK flag isn't
set since the MST interrupt handling precedes MNR and all interrupts are cleared
and disabled then, so that MNR interrupt is never noticed -- this causes NACK'ed
transfers to be falsely reported as successful. Exchanging MNR and MST handlers
fixes this issue, however the MNR bit somehow gets set again even after being
explicitly cleared, so I decided to completely suppress handling of all disabled
interrupts (which is a good thing anyway)...
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Cc: stable@vger.kernel.org
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
When intel_tv_detect() fails to do load detection it would forget to
drop the locks and clean up the acquire context. Fix it up.
This is a regression from:
commit 208bf9fdcd
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Mon Aug 11 13:15:35 2014 +0300
drm/i915: Fix locking for intel_enable_pipe_a()
v2: Make the code more readable (Chris)
v3: Drop WARN_ON(type < 0) (Chris)
Cc: stable@vger.kernel.org
Cc: Tibor Billes <tbilles@gmx.com>
Reported-by: Tibor Billes <tbilles@gmx.com>
Tested-by: Tibor Billes <tbilles@gmx.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
commit 0944fe3f4a ("s390/mm: implement software referenced bits")
triggered another paging/storage key corruption. There is an
unhandled invalid->valid pte change where we have to set the real
storage key from the pgste.
When doing paging a guest page might be swapcache or swap and when
faulted in it might be read-only and due to a parallel scan old.
An do_wp_page will make it writeable and young. Due to software
reference tracking this page was invalid and now becomes valid.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: stable@vger.kernel.org # v3.12+
Since 3.12 or more precisely commit 0944fe3f4a ("s390/mm:
implement software referenced bits") guest storage keys get
corrupted during paging. This commit added another valid->invalid
translation for page tables - namely ptep_test_and_clear_young.
We have to transfer the storage key into the pgste in that case.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: stable@vger.kernel.org # v3.12+
commit 39b2bbe3d7
"gpio: add flags argument to gpiod_get*() functions"
added a dynamic flags argument to all the GPIOD getter
functions, however this did not cover the stubs so
when people used gpiod stubs to compile out descriptor
code, compilation failed.
Solve this by:
- Also rename all the stub functions __gpiod_*
- Moving the vararg hack outside of #ifdef CONFIG_GPIOLIB
so these will always be available.
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
As the race condition on the inode cache, following scenario can appear:
[Thread a] [Thread b]
->f2fs_mkdir
->f2fs_add_link
->__f2fs_add_link
->init_inode_metadata failed here
->gc_thread_func
->f2fs_gc
->do_garbage_collect
->gc_data_segment
->f2fs_iget
->iget_locked
->wait_on_inode
->unlock_new_inode
->move_data_page
->make_bad_inode
->iput
When we fail in create/symlink/mkdir/mknod/tmpfile, the new allocated inode
should be set as bad to avoid being accessed by other thread. But in above
scenario, it allows f2fs to access the invalid inode before this inode was set
as bad.
This patch fix the potential problem, and this issue was found by code review.
change log from v1:
o Add condition judgment in gc_data_segment() suggested by Changman Lee.
o use iget_failed to simplify code.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
ALC1150 codec seems to need the COEF- and PLL-setups just like its
compatible ALC882 codec. Some machines (e.g. SunMicro X10SAT) show
the problem like too low output volumes unless the COEF setup is
applied.
Reported-and-tested-by: Dana Goyette <danagoyette@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
xfs_collapse_file_space() currently writes back the entire file
undergoing collapse range to settle things down for the extent shift
algorithm. While this prevents changes to the extent list during the
collapse operation, the writeback itself is not enough to prevent
unnecessary collapse failures.
The current shift algorithm uses the extent index to iterate the in-core
extent list. If a post-eof delalloc extent persists after the writeback
(e.g., a prior zero range op where the end of the range aligns with eof
can separate the post-eof blocks such that they are not written back and
converted), xfs_bmap_shift_extents() becomes confused over the encoded
br_startblock value and fails the collapse.
As with the full writeback, this is a temporary fix until the algorithm
is improved to cope with a volatile extent list and avoid attempts to
shift post-eof extents.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
If we have delalloc extents on a file before we run a collapse range
opertaion, we sync the range that we are going to collapse to
convert delalloc extents in that region to real extents to simplify
the shift operation.
However, the shift operation then assumes that the extent list is
not going to change as it iterates over the extent list moving
things about. Unfortunately, this isn't true because we can't hold
the ILOCK over all the operations. We can prevent new IO from
modifying the extent list by holding the IOLOCK, but that doesn't
prevent writeback from running....
And when writeback runs, it can convert delalloc extents is the
range of the file prior to the region being collapsed, and this
changes the indexes of all the extents in the file. That causes the
collapse range operation to Go Bad.
The right fix is to rewrite the extent shift operation not to be
dependent on the extent list not changing across the entire
operation, but this is a fairly significant piece of work to do.
Hence, as a short-term workaround for the problem, sync the entire
file before starting a collapse operation to remove all delalloc
ranges from the file and so avoid the problem of concurrent
writeback changing the extent list.
Diagnosed-and-Reported-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
The file collapse mechanism uses xfs_bmap_shift_extents() to collapse
all subsequent extents down into the specified, previously punched out,
region. This function performs some validation, such as whether a
sufficient hole exists in the target region of the collapse, then shifts
the remaining exents downward.
The exit path of the function currently logs the inode unconditionally.
While we must log the inode (and abort) if an error occurs and the
transaction is dirty, the initial validation paths can generate errors
before the transaction has been dirtied. This creates an unnecessary
filesystem shutdown scenario, as the caller will cancel a transaction
that has been marked dirty.
Modify xfs_bmap_shift_extents() to OR the logflags bits as modifications
are made to the inode bmap. Only log the inode in the exit path if
logflags has been set. This ensures we only have to cancel a dirty
transaction if modifications have been made and prevents an unnecessary
filesystem shutdown otherwise.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Now we are not doing silly things with dirtying buffers beyond EOF
and using invalidation correctly, we can finally reduce the ranges of
writeback and invalidation used by direct IO to match that of the IO
being issued.
Bring the writeback and invalidation ranges back to match the
generic direct IO code - this will greatly reduce the perturbation
of cached data when direct IO and buffered IO are mixed, but still
provide the same buffered vs direct IO coherency behaviour we
currently have.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Similar to direct IO reads, direct IO writes are using
truncate_pagecache_range to invalidate the page cache. This is
incorrect due to the sub-block zeroing in the page cache that
truncate_pagecache_range() triggers.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
cc: stable@vger.kernel.org
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
xfs is using truncate_pagecache_range to invalidate the page cache
during DIO reads. This is different from the other filesystems who
only invalidate pages during DIO writes.
truncate_pagecache_range is meant to be used when we are freeing the
underlying data structs from disk, so it will zero any partial
ranges in the page. This means a DIO read can zero out part of the
page cache page, and it is possible the page will stay in cache.
buffered reads will find an up to date page with zeros instead of
the data actually on disk.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
[dchinner: catch error and warn if it fails. Comment.]
cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
generic/263 is failing fsx at this point with a page spanning
EOF that cannot be invalidated. The operations are:
1190 mapwrite 0x52c00 thru 0x5e569 (0xb96a bytes)
1191 mapread 0x5c000 thru 0x5d636 (0x1637 bytes)
1192 write 0x5b600 thru 0x771ff (0x1bc00 bytes)
where 1190 extents EOF from 0x54000 to 0x5e569. When the direct IO
write attempts to invalidate the cached page over this range, it
fails with -EBUSY and so any attempt to do page invalidation fails.
The real question is this: Why can't that page be invalidated after
it has been written to disk and cleaned?
Well, there's data on the first two buffers in the page (1k block
size, 4k page), but the third buffer on the page (i.e. beyond EOF)
is failing drop_buffers because it's bh->b_state == 0x3, which is
BH_Uptodate | BH_Dirty. IOWs, there's dirty buffers beyond EOF. Say
what?
OK, set_buffer_dirty() is called on all buffers from
__set_page_buffers_dirty(), regardless of whether the buffer is
beyond EOF or not, which means that when we get to ->writepage,
we have buffers marked dirty beyond EOF that we need to clean.
So, we need to implement our own .set_page_dirty method that
doesn't dirty buffers beyond EOF.
This is messy because the buffer code is not meant to be shared
and it has interesting locking issues on the buffer dirty bits.
So just copy and paste it and then modify it to suit what we need.
Note: the solutions the other filesystems and generic block code use
of marking the buffers clean in ->writepage does not work for XFS.
It still leaves dirty buffers beyond EOF and invalidations still
fail. Hence rather than play whack-a-mole, this patch simply
prevents those buffers from being dirtied in the first place.
cc: <stable@kernel.org>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Clevo W350etq's EC will not produce GPE interrupt some time after
booting. The ACPI notify event won't trigger when the issue takes
place. After debugging, adding msi quirk for the machine can fix
the issue. This patch is to add msi quirk for the machine.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=77431
Reported-and-tested-by: qbanin@gmail.com
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://bugs.freedesktop.org/show_bug.cgi?id=81515
Reported-and-tested-by: Hohahiu <rakothedin@gmail.com>
Cc: 3.16+ <stable@vger.kernel.org> # 3.16+
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Some laptops have a working acpi_video backlight control, and using native
backlight on these causes a regression where backlight control does not work
when userspace is not handling brightness key events. Disable native_backlight
on these to fix this.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=81691
Reported-and-tested-by: Andre Müller <andre.muller@web.de>
Cc: 3.16+ <stable@vger.kernel.org> # 3.16+
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Commit 751109aad5 ("ACPI / video: Change the default for
video.use_native_backlight to 1") has changed the default for
use_native_backlight from 0 to 1, but instead of changing
use_native_backlight_dmi to true, and leaving use_native_backlight_param at -1,
it has changed use_native_backlight_param to 1.
This causes acpi_video_use_native_backlight() to always think that a value was
specified through the param, making it impossible to add a dmi based quirk
to force 0 now that the default is 1.
This fixes this by restoring the use_native_backlight_param default to -1, and
instead setting the use_native_backlight_dmi default to true.
Fixes: 751109aad5 (ACPI / video: Change the default for video.use_native_backlight to 1)
Cc: 3.16+ <stable@vger.kernel.org> # 3.16+
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Adds ACPICA kernel runtime support to validate contents/format
of the _DSD package, similar to the iASL support. Ported by
Mika Westerberg.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Pull irq handling fixlet from Thomas Gleixner:
"Just an export for an interrupt flow handler which is now used in gpio
modules"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Export handle_fasteoi_irq
DAI links's cpu_of_node's and codec_of_node's refcounts shouldn't
be decremented immediately at the end of the probe() fucntion.
Because we will still use them before the audio card is removed.
Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
It turns out that vendors are relying on the format of /proc/cpuinfo,
and we've even spotted out-of-tree hacks attempting to make it look
identical to the format used by arch/arm/. That means we can't afford to
churn this interface in mainline, so revert the recent reformatting of
the file for arm64 pending discussions on the list to find out what
people actually want.
This reverts commit d7a49086f2.
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
In the HPD pulse handler we check for long pulses if the port is actually
connected, however we do that for IBX, but we use the pulse handling code on
GM45 systems as well, so we need to use a diffent check.
This patch refactors the digital port connected check out of the g4x detection
path and reuses it in the hpd pulse path.
Fixes: http://lkml.kernel.org/r/1409382202.5141.36.camel@marge.simpson.net
Reported-by: Mike Galbraith <umgwanakikbuti@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Acer Aspire 3830TG with CX20588 codec has a digital built-in mic that
has the same problem like many others, the inverted signal in stereo.
Apply the same fixup to this machine, too.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now arm64 defers reloading FPSIMD state, but this optimization also
introduces the bug after cpu resume back from low power mode.
The reason is after the cpu has been powered off, s/w need set the
cpu's fpsimd_last_state to NULL so that it will force to reload
FPSIMD state for the thread, otherwise there has the chance to meet
the condition for both the task's fpsimd_state.cpu field contains the
id of the current cpu, and the cpu's fpsimd_last_state per-cpu variable
points to the task's fpsimd_state, so finally kernel will skip to reload
the context during it return back to userland.
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Leo Yan <leoy@marvell.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
The code waiting for fifo idle was incorrect and could possibly spin
forever under certain circumstances.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reported-by: Mark Sheldon <markshel@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Reivewed-by: Mark Sheldon <markshel@vmware.com>
Cc: <stable@vger.kernel.org>
At the same time, make error paths return early for clarity.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: jakob Bornecrantz <jakob@vmware.com>
Cc: <stable@vger.kernel.org>
- support highmem on cores with aliasing data cache. Enable highmem on kc705
by default;
- simplify addition of new core variants (no need to modify Kconfig /
Makefiles);
- improve robustness of unaligned access handler and its interaction with
window overflow/underflow exception handlers;
- deprecate atomic and spill registers syscalls;
- clean up Kconfig: remove orphan MATH_EMULATION, sort 'select' statements;
- wire up renameat2 syscall.
Various fixes:
- fix address checks in dma_{alloc,free}_coherent (runtime BUG);
- fix access to THREAD_RA/THREAD_SP/THREAD_DS (debug build breakage);
- fix TLBTEMP_BASE_2 region handling in fast_second_level_miss (runtime
unrecoverable exception);
- fix a6 and a7 handling in fast_syscall_xtensa (runtime userspace register
clobbering);
- fix kernel/user jump out of fast_unaligned (potential runtime unrecoverabl
exception);
- replace termios IOCTL code definitions with constants (userspace build
breakage).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJUA2nrAAoJEI9vqH3mFV2sqS4P/j6+wtuPHhvNLmpzlIJ1//OP
zr6o4eRC77HDS0ArqFq+mteU8MH2CXoiMOFvUzXSyistSrQyENJ5Mg8f5vY9sqeJ
PQtHzBIg7gBpJTiI66n5k+Av65KdcLdz3JE9j1IHXy+Ovlv+BVAOBWfb6Mx59a5i
4rk+ovSrKbAOI50RBL4p/YpCgxu0hdpnpVJ0Ng7ApSXq18o9uxLdgekn11ZJFtob
hFgdh4i5Rg+hL+HV8ehE7K5xwxVaqU//dgdbCVB2g3gcNGaDINiEwyJBxWszln4W
wKr9kSCnHihSevDNby/AIw01d1HS18wZdIjTn10/jRnz9PzIET14K2lmqaU6+RyC
un8EZW3R0jabMMJ7DqKCiLK6Adz+lNuhs4hx7oGNJIuvyILiSrgqVQEDtwTJDNPk
43lcBYVgpaFviP0exMl9AUb12s8aIhN7D9vFguyuV7Rl8vgUIsEhE67CrIjvi2Hp
FV4s1+tVylFYCLbBITPtztfDKiJH4WUbaUGmiK27ReE8L7fAU2jicTau31r0L3ca
66FdInbchvl4TgZBi2ndEsVOmqKc7V8o0Xb+Cmgdda5mgZRw5y8KGnSi9I1YhPc0
xNZq1P6W5HcWbH0kFIRtnRJmGJjtHu+T5Z12yZ+o9EmMXfCePtUSUrMq8YkW/lMg
tJCSbnosd4z498k7hFHY
=mAYX
-----END PGP SIGNATURE-----
Merge tag 'xtensa-20140830' of git://github.com/czankel/xtensa-linux
Pull Xtensa updates from Chris Zankel:
"Xtensa improvements for 3.17:
- support highmem on cores with aliasing data cache. Enable highmem
on kc705 by default
- simplify addition of new core variants (no need to modify Kconfig /
Makefiles)
- improve robustness of unaligned access handler and its interaction
with window overflow/underflow exception handlers
- deprecate atomic and spill registers syscalls
- clean up Kconfig: remove orphan MATH_EMULATION, sort 'select'
statements
- wire up renameat2 syscall.
Various fixes:
- fix address checks in dma_{alloc,free}_coherent (runtime BUG)
- fix access to THREAD_RA/THREAD_SP/THREAD_DS (debug build breakage)
- fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
(runtime unrecoverable exception)
- fix a6 and a7 handling in fast_syscall_xtensa (runtime userspace
register clobbering)
- fix kernel/user jump out of fast_unaligned (potential runtime
unrecoverabl exception)
- replace termios IOCTL code definitions with constants (userspace
build breakage)"
* tag 'xtensa-20140830' of git://github.com/czankel/xtensa-linux: (25 commits)
xtensa: deprecate fast_xtensa and fast_spill_registers syscalls
xtensa: don't allow overflow/underflow on unaligned stack
xtensa: fix a6 and a7 handling in fast_syscall_xtensa
xtensa: allow single-stepping through unaligned load/store
xtensa: move invalid unaligned instruction handler closer to its users
xtensa: make fast_unaligned store restartable
xtensa: add double exception fixup handler for fast_unaligned
xtensa: fix kernel/user jump out of fast_unaligned
xtensa: configure kc705 for highmem
xtensa: support highmem in aliasing cache flushing code
xtensa: support aliasing cache in kmap
xtensa: support aliasing cache in k[un]map_atomic
xtensa: implement clear_user_highpage and copy_user_highpage
xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
xtensa: allow fixmap and kmap span more than one page table
xtensa: make fixmap region addressing grow with index
xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
xtensa: add renameat2 syscall
xtensa: fix address checks in dma_{alloc,free}_coherent
xtensa: replace IOCTL code definitions with constants
...
unicore32 builds fail with
arch/unicore32/kernel/signal.c: In function ‘setup_frame’:
arch/unicore32/kernel/signal.c:257: error: ‘usig’ undeclared (first use in this function)
arch/unicore32/kernel/signal.c:279: error: ‘usig’ undeclared (first use in this function)
arch/unicore32/kernel/signal.c: In function ‘handle_signal’:
arch/unicore32/kernel/signal.c:306: warning: unused variable ‘tsk’
arch/unicore32/kernel/signal.c: In function ‘do_signal’:
arch/unicore32/kernel/signal.c:376: error: implicit declaration of function ‘get_signsl’
make[1]: *** [arch/unicore32/kernel/signal.o] Error 1
make: *** [arch/unicore32/kernel/signal.o] Error 2
Bisect points to commit 649671c90e ("unicore32: Use get_signal()
signal_setup_done()").
This code never even compiled. Reverting the patch does not work, since
previously used functions no longer exist, so try to fix it up. Compile
tested only.
Fixes: 649671c90e ("unicore32: Use get_signal() signal_setup_done()")
Cc: Richard Weinberger <richard@nod.at>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull ARM fixes from Russell King:
"Various assorted fixes:
- a couple of patches from Mark Rutland to resolve an errata with
Cortex-A15 CPUs.
- fix cpuidle for the CPU part ID changes in the last merge window
- add support for a relocation which ARM binutils is generating in
some circumstances"
* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
ARM: 8130/1: cpuidle/cpuidle-big_little: fix reading cpu id part number
ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex
ARM: 8128/1: abort: don't clear the exclusive monitors
ARM: 8127/1: module: add support for R_ARM_TARGET1 relocations
Here's the weekly batch of fixes from arm-soc.
The delta is a largeish negative delta, due to revert of SMP support for Broadcom's
STB SoC -- it was accidentally merged before some issues had been addressed, so they
will make a new attempt for 3.18. I didn't see a need for a full revert of the whole
platform due to this, we're keeping the rest enabled.
The rest is mostly:
* A handful of DT fixes for i.MX (Hummingboard/Cubox-i in particular)
* Some MTD/NAND fixes for OMAP
* Minor DT fixes for shmobile
* Warning fix for UP builds on vexpress/spc
There's also a couple of patches that wires up hwmod on TI's DRA7 SoC
so it can boot. Drivers and the rest had landed for 3.17, and it's small
and isolated so it made sense to pick up now even if it's not a bugfix.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJUA1uwAAoJEIwa5zzehBx3dV8QAJv/6OcFofqWPqSapCdcCTkU
o9o+QxzTY4Fo4GDyTboLwvY2EE7aFKohiekKGoHHT+fXXR4n+/Xe5Dq58DijdZ0q
xUksd1h1ZuqzbWqT+1fyrlgJt3jOmQ1vzbBVpWA4tN1RUKJekU+ZF0oCAAdDwbaf
O925etd77+ij0euJ/l06fR9YUYIY23mufG+SELke5S7xS9T1sVFWcluf/z+y57qc
hxF6Uc5r4LOY4pFKYgjvsu3R7KPD4DANCiSYUvjS5sIWrJ3xenkyHVMxFEyQ5Tz+
TCrT8rXx3Ue7AlNMztY5P1dTmYftwJhWy6p/8J8UqPJ6ip633FWrhTfKHmLIR3lC
VkMYroFeg4Fp/YvFENeBe9QUbg0Xb920oZoDQA4SwkZJkQlWafYsOy4bLKSyMQGQ
nKcnyxeP2q5YaStTZMSNQ4xwT9yo3dwBllYGSbXUiTk0VJ3TX9jEMg6StvRM0YHG
sT8XKufqIAJugNZZsGtGyBLO6f8BbPVgFICvEVetgjMWHl9iGNVDbeqbYvQ6A8NL
TTqJUK7CXkNgQGX2rB7txSgR3XoaWU0rWjSnSXy2Xgtb/pd/jZYLicEY8Wd4Q1qp
Ww2misiX4viMxcD6AWiDUj1mcciSh915h1po5zZbLMTRp4qfuqh1BfSvPY/fh5DD
LKXAwm3PyL9+QrknP3//
=/AD8
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Olof Johansson:
"Here's the weekly batch of fixes from arm-soc.
The delta is a largeish negative delta, due to revert of SMP support
for Broadcom's STB SoC -- it was accidentally merged before some
issues had been addressed, so they will make a new attempt for 3.18.
I didn't see a need for a full revert of the whole platform due to
this, we're keeping the rest enabled.
The rest is mostly:
- a handful of DT fixes for i.MX (Hummingboard/Cubox-i in particular)
- some MTD/NAND fixes for OMAP
- minor DT fixes for shmobile
- warning fix for UP builds on vexpress/spc
There's also a couple of patches that wires up hwmod on TI's DRA7 SoC
so it can boot. Drivers and the rest had landed for 3.17, and it's
small and isolated so it made sense to pick up now even if it's not a
bugfix"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (23 commits)
vexpress/spc: fix a build warning on array bounds
ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
ARM: DRA7: Add support for soc_is_dra74x() and soc_is_dra72x() variants
MAINTAINERS: catch special Rockchip code locations
ARM: dts: microsom-ar8035: MDIO pad must be set open drain
ARM: dts: omap54xx-clocks: Fix the l3 and l4 clock rates
ARM: brcmstb: revert SMP support
ARM: OMAP2+: hwmod: Rearm wake-up interrupts for DT when MUSB is idled
ARM: dts: Enable UART wake-up events for beagleboard
ARM: dts: Remove twl6030 clk32g "regulator"
ARM: OMAP2+: omap_device: remove warning that clk alias already exists
ARM: OMAP: fix %d confusingly prefixed with 0x in format string
ARM: dts: DRA7: fix interrupt-cells for GPIO
mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
ARM: dts: omap3430-sdp: Revert to using software ECC for NAND
ARM: OMAP2+: GPMC: Support Software ECC scheme via DT
mtd: nand: omap: Revert to using software ECC by default
ARM: dts: hummingboard/cubox-i: change SPDIF output to be more descriptive
ARM: dts: hummingboard/cubox-i: add USB OC pinctrl configuration
ARM: shmobile: r8a7791: add missing 0x0100 for SDCKCR
...
With ARCH_VEXPRESS_SPC option, kernel build has the following
warning:
arch/arm/mach-vexpress/spc.c: In function ‘ve_spc_clk_init’:
arch/arm/mach-vexpress/spc.c:431:38: warning: array subscript is below array bounds [-Warray-bounds]
struct ve_spc_opp *opps = info->opps[cluster];
^
since 'cluster' maybe '-1' in UP system. This patch does a active
checking to fix this issue.
Signed-off-by: Alex Shi <alex.shi@linaro.org>
Acked-by: Pawel Moll <pawel.moll@arm.com>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
are OMAP2+ derivative SoCs. This should be low-risk to existing OMAP
platforms.
Basic build, boot, and PM test logs are available here:
http://www.pwsan.com/omap/testlogs/hwmod-a-early-v3.17-rc/20140827194314/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJT/saeAAoJEMePsQ0LvSpLKzgP+gK9LdsoYrsyVqDp7ZbSSzSy
scrlTlTa6iO+Et82TLDPEoWgsNb7BXSJDHWF6j5GxzSsZIM8hm2LEjvhvkf0BuHt
n8J1+uZduIZLEipBb2gLCY2td2hYrM8UUwNgLk3oFHf6uhLKrdK0WUzdBr6Aznlb
J+l42Pds2AI37tf7Fa3d1ZVEQhMrZb61g6SD77S2KdifL0rlWpE+rDaGBr71qBi5
CXibrKi2NikNGKHKdusLPCCcvo/tfpf3o32olO1W72kFbC8eTy2nZLj1qaxnLvbr
DfOzZDWEdS4I2AXrhh/EYiL298FecOtty3FX++/W2XWiM9VYq/wKYthBM/qrGous
tpnsbTEt7BhIaCwJte0xpwTeCLnke9se1aD+GptyPCOI7jQxG0CCWtd5gKeIIiEO
YrNZjjIXDOL6HZgVuETGuVf6NJYfjThZ8yglvnX6hr5awdcBao5yhb/AkdM629mB
ackueKLS0zysQo9p9LlwnqvUVU4PJHBmkyzBtUKDbv2FD/IFuvZm4ZaPR28eim+1
N17qTIdQPog2+4sxKQA96uj7n38K0UPFkgIbi7B25YFpSTPLAu4COiJeS45K8tWv
yWocbzPQPd5KVWXWxD/HfaQjKGUHbQQpNeJHn6CyQSqXTpPwzkVembC8gCL3gxed
CQaowzZfGWl0oDoLVXCy
=5ZS8
-----END PGP SIGNATURE-----
Merge tag 'for-v3.17-rc/omap-dra72x-d74x-support-a' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending into fixes
Pull "ARM: OMAP2+: DRA72x/DRA74x basic support" from Tony Lindgren:
Add basic subarchitecture support for the DRA72x and DRA74x. These
are OMAP2+ derivative SoCs. This should be low-risk to existing OMAP
platforms.
Basic build, boot, and PM test logs are available here:
http://www.pwsan.com/omap/testlogs/hwmod-a-early-v3.17-rc/20140827194314/
* tag 'for-v3.17-rc/omap-dra72x-d74x-support-a' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending:
ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
ARM: DRA7: Add support for soc_is_dra74x() and soc_is_dra72x() variants
Signed-off-by: Olof Johansson <olof@lixom.net>
A smattering of bug fixes for the SPI subsystem, all in driver code
which has seen active work recently and none of them with any great
global impact.
There's also a new ACPI ID for the pxa2xx driver which required no code
changes and the addition of kerneldoc for some structure fields that
were missing it and generating warnings during documentation builds as a
result.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJUAxlEAAoJELSic+t+oim9HQ8P+wXcMDSm7xc3JdLn0HhyF4yZ
8VQvlyrXKBWYvjQV/owXRf6YCIaisYZmL3wEXDAeISd8lTK7iIJb0An0gfYlrRDx
KVATpTLFAxILDldIKpiNiMwOOdbCm+B8vlpgitU/vpq/MpDt6KJPTSqDMSKSam+x
y6bjLAtZt+n92ZcOjNrofRWpT7qnVGptUu+wPH45kPEVh0sdJM9SOrQeNxyOtL5K
lJQ8c05p1202b1zYZ6EjQ2gZoOM1SAxSBRA5P+qYyezyM0vDdk28FFOh3HnLUVlL
b6cNJFHdj2qb7r4igyz3FDyGHsxDkE6pmbHTKiUU8dYambQcXuctiJi54aW5H4HL
PNWCds2lL7WKc1F46vXoPkEakSpOKXzY8sONw0b7DM5ne+RW2fQI39K9PohCH4AE
ptJR3Kh08MeDFBqYFZjEZZpqlPHYh8CLYnHVjoDEsU/mx4fYbyDvIBeVpgpoRqlc
LCSPjJ8Dyp2AjIs8fyZzWgn3m0sv7sfyauDK6nboDcyeMF0ertoCpowZNmighpST
YMni8HUE5Uu4ol1XLFz4bgYYeYSUcHxm6bKCxKPZcvK+DXVwKIigyJmTEWioiajY
AXSuhmPyVI7rwZMI8z3pc7s7qGq7yfrapfgJ3KzlV+o4uVjuQTkxc6ImRC+5rb1P
8FKlYXoxrp2paFNKr2ez
=QScZ
-----END PGP SIGNATURE-----
Merge tag 'spi-v3.17-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi bugfixes from Mark Brown:
"A smattering of bug fixes for the SPI subsystem, all in driver code
which has seen active work recently and none of them with any great
global impact.
There's also a new ACPI ID for the pxa2xx driver which required no
code changes and the addition of kerneldoc for some structure fields
that were missing it and generating warnings during documentation
builds as a result"
* tag 'spi-v3.17-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: sh-msiof: Fix transmit-only DMA transfers
spi/rockchip: Avoid accidentally turning off the clock
spi: dw: fix kernel crash due to NULL pointer dereference
spi: dw-pci: fix bug when regs left uninitialized
spi: davinci: fix SPI_NO_CS functionality
spi/rockchip: fixup incorrect dma direction setting
spi/pxa2xx: Add ACPI ID for Intel Braswell
spi: spi-au1550: fix build failure
spi: rspi: Fix leaking of unused DMA descriptors
spi: sh-msiof: Fix leaking of unused DMA descriptors
spi: Add missing kerneldoc bits
spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
A smattering of bug fixes for the SPI subsystem, all in driver code
which has seen active work recently and none of them with any great
global impact.
There's also a new ACPI ID for the pxa2xx driver which required no code
changes and the addition of kerneldoc for some structure fields that
were missing it and generating warnings during documentation builds as a
result.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJUAxLAAAoJELSic+t+oim9y+UP/1Nddo/4oWY5f/TAFT6O4j1O
HxpIEAywsy1I7MtyjLyvf6lIfgLLrHnNGJ67iVkjaeCf7TLVMRyQ565VXm8pAxj9
9vtVTYJ+qk7IvSEujkMUUDDemNReENmde2FR8zMcvQQMsuN7Ur/JM0KU9dHWSXnk
faZn7U+F7YP8ue4u5k3H4IwBff2RsMc9wPxNXqv8Q8d8sTdIJH/F5HBsCghy/7mw
20yFY6xY/4yw+1IEu8gqg8OvZxV73icil834iRqpv78rcHlq686apA8cVIQQb+i/
N8odklX5l0jXMpHoRBW2MSZDwfnYu2GL/F3mMixksXgDkZmCuLkruLP4KVZPhZxb
XrrVtM1TRGm0zl5uo2T34Fm9kPkWsipuIgbMdfX7I3GcWVjdUCEve+PqQybHNhWW
mX3jvbCWj/C5FPiU9Nh9MKNBMwXjhjQJ0yV6rfObDSQqxT08tDzERb49wFw7skCO
oZff9SVyg1ue3PimHv10WfVDCuDYeuWFsI0BdDTaH+LJLlyj9ijxaLs+sdlbEMk3
ad7Q5W9EoSd5BipmZjU/IoVCZtdIsfxTFT8bLa/l/BtsWXzRER4byqLHs0et8Fz0
z6xS0td0gOCbjVkN8FinM/AolorJNXt+a/JuWtrb8yAFr0EDmHJviHuqfZWP+A1m
ZQpgxoBcDFaV6ytpZWIG
=B62L
-----END PGP SIGNATURE-----
Merge tag 'spi-v3.17-rc3' into spi-linus
spi: Bug fixes for v3.17
A smattering of bug fixes for the SPI subsystem, all in driver code
which has seen active work recently and none of them with any great
global impact.
There's also a new ACPI ID for the pxa2xx driver which required no code
changes and the addition of kerneldoc for some structure fields that
were missing it and generating warnings during documentation builds as a
result.
# gpg: Signature made Sun 31 Aug 2014 13:19:12 BST using RSA key ID 7EA229BD
# gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>"
# gpg: aka "Mark Brown <broonie@debian.org>"
# gpg: aka "Mark Brown <broonie@kernel.org>"
# gpg: aka "Mark Brown <broonie@tardis.ed.ac.uk>"
# gpg: aka "Mark Brown <broonie@linaro.org>"
# gpg: aka "Mark Brown <Mark.Brown@linaro.org>"
If the device can't support block writes then don't attempt to use raw
syncing which will automatically generate block writes for adjacent
registers, use the existing _single() block syncing implementation.
Reported-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJUAmbRAAoJEAAOaEEZVoIVah4P/iupUO7Ae5ODMDMog/vOp+SM
+sWnyqnEyeMlQlNDoHoef5TPQ28aKEAq1Sg7CsqlK3qZSYSSPhb4KFsGWLZe6D5A
7iWSMKabdnuQ3qBCsb2Y6ZdB8IRAJz81sIAVI8F32NDmSs325wN/coVwfV4g8mQF
QSpv78TjwBY0qNhNw06pS/FLV45IaPTDDgnTHRcOLrfHajDdGTdqrKI/L0ES1PFB
0ZUtG3qMPS2XYRyS6ZQ0TZZrl2/HMA5/fOwqKspNKxYxKS+TOf/umKwPPjHBnMHo
mfD1XnG64ECkNio9bpg2CkjUqaT8aloNPgDxuP15vEV6bZ5WBLKjGUOY2IvPa198
do8CaAdp2Ql6kE2IyD+G+IkjqcxZ9H8hNH3cBM+3TzvxYqaiZKKZAky5UTau2LvG
E5cyWhDPsVBGvAJXEPBf4vhIgzhaSuNox0+73nL4xU+L7bPTDzYIYyhS/InKO0X+
ZwAZn2u62XQmUDI8b+zrgOAHfWB0hHlcIfIsIrDxotM24TPPbJ2k2Dz0hKCZAraR
DYDYPJZg+/QyPc8bujL5Hwjh8MogdDt1vxd9B65MwQWRn791LSGbq6VSsUnsMoAa
dhG5U+a5eI8oQ2gkMEEK45o2ljcnZ3BSim6SGdmZ6YrNyEdk63xA4GjozK1YhWzG
tLkXb4/7zV/dR8VTOQR/
=Wb1t
-----END PGP SIGNATURE-----
Merge tag 'locks-v3.17-3' of git://git.samba.org/jlayton/linux
Pull file locking bugfx from Jeff Layton:
"Just a bugfix for a bug that crept in to v3.15. It's in a rather rare
error path, and I'm not aware of anyone having hit it, but it's worth
fixing for v3.17"
* tag 'locks-v3.17-3' of git://git.samba.org/jlayton/linux:
locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease
We need the parents of victims alive until namespace_unlock() gets to
dput() of the (ex-)mountpoints. However, that screws up the "is it
busy" checks in case when we have shrinkable mounts that need to be
killed. Solution: go ahead and decrement refcounts of parents right
in umount_tree(), increment them again just before dropping rwsem in
namespace_unlock() (and let the loop in the end of namespace_unlock()
finally drop those references for good, as we do now). Parents can't
get freed until we drop rwsem - at least one reference is kept until
then, both in case when parent is among the victims and when it is
not. So they'll still be around when we get to namespace_unlock().
Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
The check in __propagate_umount() ("has somebody explicitly mounted
something on that slave?") is done *before* taking the already doomed
victims out of the child lists.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
