1. 17 Aug, 2015 40 commits
    • Ben Zhang's avatar
      ASoC: ssm4567: Keep TDM_BCLKS in ssm4567_set_dai_fmt · b0e4d399
      Ben Zhang authored
      commit a6c2a32a upstream.
      
      The regmap_write in ssm4567_set_dai_fmt accidentally clears the
      TDM_BCLKS field which was set earlier by ssm4567_set_tdm_slot.
      
      This patch fixes it by using regmap_update_bits with proper mask.
      Signed-off-by: default avatarBen Zhang <benzh@chromium.org>
      Acked-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarAnatol Pomozov <anatol.pomozov@gmail.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b0e4d399
    • Shilpa Sreeramalu's avatar
      ASoC: Intel: Get correct usage_count value to load firmware · ba8d2b48
      Shilpa Sreeramalu authored
      commit 412efa73 upstream.
      
      The usage_count variable was read before it was set to the correct
      value, due to which the firmware load was failing. Because of this
      IPC messages sent to the firmware were timing out causing a delay
      of about 1 second while playing audio from the internal speakers.
      
      With this patch the usage_count is read after the function call
      pm_runtime_get_sync which will increment the usage_count variable
      and the firmware load is successful and all the IPC messages are
      processed correctly.
      Signed-off-by: default avatarShilpa Sreeramalu <shilpa.sreeramalu@intel.com>
      Signed-off-by: default avatarFang, Yang A <yang.a.fang@intel.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ba8d2b48
    • Murali Karicheri's avatar
      ARM: dts: keystone: fix dt bindings to use post div register for mainpll · 40114a3e
      Murali Karicheri authored
      commit c1bfa985 upstream.
      
      All of the keystone devices have a separate register to hold post
      divider value for main pll clock. Currently the fixed-postdiv
      value used for k2hk/l/e SoCs works by sheer luck as u-boot happens to
      use a value of 2 for this. Now that we have fixed this in the pll
      clock driver change the dt bindings for the same.
      Signed-off-by: default avatarMurali Karicheri <m-karicheri2@ti.com>
      Acked-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      40114a3e
    • Murali Karicheri's avatar
      clk: keystone: add support for post divider register for main pll · c6fdd1b5
      Murali Karicheri authored
      commit 02fdfd70 upstream.
      
      Main PLL controller has post divider bits in a separate register in
      pll controller. Use the value from this register instead of fixed
      divider when available.
      Signed-off-by: default avatarMurali Karicheri <m-karicheri2@ti.com>
      Signed-off-by: default avatarMichael Turquette <mturquette@baylibre.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c6fdd1b5
    • David S. Miller's avatar
      sparc64: Fix userspace FPU register corruptions. · b75513b0
      David S. Miller authored
      [ Upstream commit 44922150 ]
      
      If we have a series of events from userpsace, with %fprs=FPRS_FEF,
      like follows:
      
      ETRAP
      	ETRAP
      		VIS_ENTRY(fprs=0x4)
      		VIS_EXIT
      		RTRAP (kernel FPU restore with fpu_saved=0x4)
      	RTRAP
      
      We will not restore the user registers that were clobbered by the FPU
      using kernel code in the inner-most trap.
      
      Traps allocate FPU save slots in the thread struct, and FPU using
      sequences save the "dirty" FPU registers only.
      
      This works at the initial trap level because all of the registers
      get recorded into the top-level FPU save area, and we'll return
      to userspace with the FPU disabled so that any FPU use by the user
      will take an FPU disabled trap wherein we'll load the registers
      back up properly.
      
      But this is not how trap returns from kernel to kernel operate.
      
      The simplest fix for this bug is to always save all FPU register state
      for anything other than the top-most FPU save area.
      
      Getting rid of the optimized inner-slot FPU saving code ends up
      making VISEntryHalf degenerate into plain VISEntry.
      
      Longer term we need to do something smarter to reinstate the partial
      save optimizations.  Perhaps the fundament error is having trap entry
      and exit allocate FPU save slots and restore register state.  Instead,
      the VISEntry et al. calls should be doing that work.
      
      This bug is about two decades old.
      Reported-by: default avatarJames Y Knight <jyknight@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b75513b0
    • Herbert Xu's avatar
      crypto: nx - Fix reentrancy bugs · 2d089963
      Herbert Xu authored
      commit 030f4e96 upstream.
      
      This patch fixes a host of reentrancy bugs in the nx driver.  The
      following algorithms are affected:
      
      * CCM
      * GCM
      * CTR
      * XCBC
      * SHA256
      * SHA512
      
      The crypto API allows a single transform to be used by multiple
      threads simultaneously.  For example, IPsec will use a single tfm
      to process packets for a given SA.  As packets may arrive on
      multiple CPUs that tfm must be reentrant.
      
      The nx driver does try to deal with this by using a spin lock.
      Unfortunately only the basic AES/CBC/ECB algorithms do this in
      the correct way.
      
      The symptom of these bugs may range from the generation of incorrect
      output to memory corruption.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2d089963
    • Leonidas Da Silva Barbosa's avatar
      crypto: nx - Fixing SHA update bug · 71a0c1ec
      Leonidas Da Silva Barbosa authored
      commit 10d87b73 upstream.
      
      Bug happens when a data size less than SHA block size is passed.
      Since first attempt will be saved in buffer, second round attempt
      get into two step to calculate op.inlen and op.outlen. The issue
      resides in this step. A  wrong value of op.inlen and outlen was being
      calculated.
      
      This patch fix this eliminate the nx_sha_build_sg_list, that is
      useless in SHA's algorithm context. Instead we call nx_build_sg_list
      directly and pass a previous calculated max_sg_len to it.
      Signed-off-by: default avatarLeonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      71a0c1ec
    • Leonidas Da Silva Barbosa's avatar
      crypto: nx - Fixing NX data alignment with nx_sg list · b2b6e166
      Leonidas Da Silva Barbosa authored
      commit c3365ce1 upstream.
      
      In NX we need to pass always a 16 multiple size nx_sg_list to
      co processor. Trim function handle with this assuring all nx_sg_lists
      are 16 multiple size, although data was not being considerated when
      crop was done. It was causing an unalignment between size of the list
      and data, corrupting csbcpb fields returning a -23 H_ST_PARM error, or
      invalid operation.
      
      This patch fix this recalculating how much data should be put back
      in to_process variable what assures the size of sg_list will be
      correct with size of the data.
      Signed-off-by: default avatarLeonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b2b6e166
    • Cyrille Pitchen's avatar
      dmaengine: at_xdmac: fix transfer data width in at_xdmac_prep_slave_sg() · c0e0ec97
      Cyrille Pitchen authored
      commit 1c8a38b1 upstream.
      
      This patch adds the missing update of the transfer data width in
      at_xdmac_prep_slave_sg().
      
      Indeed, for each item in the scatter-gather list, we check whether the
      transfer length is aligned with the data width provided by
      dmaengine_slave_config(). If so, we directly use this data width for the
      current part of the transfer we are preparing. Otherwise, the data width
      is reduced to 8 bits (1 byte). Of course, the actual number of register
      accesses must also be updated to match the new data width.
      
      So one chunk was missing in the original patch (see Fixes tag below): the
      number of register accesses was correctly set to (len >> fixed_dwidth) in
      mbr_ubc but the real data width was not updated in mbr_cfg. Since mbr_cfg
      may change for each part of the scatter-gather transfer this also explains
      why the original patch used the Descriptor View 2 instead of the
      Descriptor View 1.
      
      Let's take the example of a DMA transfer to write 8bit data into an Atmel
      USART with FIFOs. When FIFOs are enabled in the USART, its Transmit
      Holding Register (THR) works in multidata mode, that is to say that up to
      4 8bit data can be written into the THR in a single 32bit access and it is
      still possible to write only one data with a 8bit access. To take
      advantage of this new feature, the DMA driver was modified to allow
      multiple dwidths when doing slave transfers.
      For instance, when the total length is 22 bytes, the USART driver splits
      the transfer into 2 parts:
      
      First part: 20 bytes transferred through 5 32bit writes into THR
      Second part: 2 bytes transferred though 2 8bit writes into THR
      
      For the second part, the data width was first set to 4_BYTES by the USART
      driver thanks to dmaengine_slave_config() then at_xdmac_prep_slave_sg()
      reduces this data width to 1_BYTE because the 2 byte length is not aligned
      with the original 4_BYTES data width. Since the data width is modified,
      the actual number of writes into THR must be set accordingly.
      Signed-off-by: default avatarCyrille Pitchen <cyrille.pitchen@atmel.com>
      Fixes: 6d3a7d9e ("dmaengine: at_xdmac: allow muliple dwidths when doing slave transfers")
      Cc: stable@vger.kernel.org #4.0 and later
      Acked-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Acked-by: default avatarLudovic Desroches <ludovic.desroches@atmel.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c0e0ec97
    • Andy Lutomirski's avatar
      x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection · 37df1cab
      Andy Lutomirski authored
      commit 810bc075 upstream.
      
      We have a tricky bug in the nested NMI code: if we see RSP
      pointing to the NMI stack on NMI entry from kernel mode, we
      assume that we are executing a nested NMI.
      
      This isn't quite true.  A malicious userspace program can point
      RSP at the NMI stack, issue SYSCALL, and arrange for an NMI to
      happen while RSP is still pointing at the NMI stack.
      
      Fix it with a sneaky trick.  Set DF in the region of code that
      the RSP check is intended to detect.  IRET will clear DF
      atomically.
      
      ( Note: other than paravirt, there's little need for all this
        complexity. We could check RIP instead of RSP. )
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      37df1cab
    • Andy Lutomirski's avatar
      x86/nmi/64: Reorder nested NMI checks · d8246ca4
      Andy Lutomirski authored
      commit a27507ca upstream.
      
      Check the repeat_nmi .. end_repeat_nmi special case first.  The
      next patch will rework the RSP check and, as a side effect, the
      RSP check will no longer detect repeat_nmi .. end_repeat_nmi, so
      we'll need this ordering of the checks.
      
      Note: this is more subtle than it appears.  The check for
      repeat_nmi .. end_repeat_nmi jumps straight out of the NMI code
      instead of adjusting the "iret" frame to force a repeat.  This
      is necessary, because the code between repeat_nmi and
      end_repeat_nmi sets "NMI executing" and then writes to the
      "iret" frame itself.  If a nested NMI comes in and modifies the
      "iret" frame while repeat_nmi is also modifying it, we'll end up
      with garbage.  The old code got this right, as does the new
      code, but the new code is a bit more explicit.
      
      If we were to move the check right after the "NMI executing"
      check, then we'd get it wrong and have random crashes.
      
      ( Because the "NMI executing" check would jump to the code that would
        modify the "iret" frame without checking if the interrupted NMI was
        currently modifying it. )
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d8246ca4
    • Andy Lutomirski's avatar
      x86/nmi/64: Improve nested NMI comments · 1dd191d7
      Andy Lutomirski authored
      commit 0b22930e upstream.
      
      I found the nested NMI documentation to be difficult to follow.
      Improve the comments.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1dd191d7
    • Andy Lutomirski's avatar
      x86/nmi/64: Switch stacks on userspace NMI entry · 60e6cbaf
      Andy Lutomirski authored
      commit 9b6e6a83 upstream.
      
      Returning to userspace is tricky: IRET can fail, and ESPFIX can
      rearrange the stack prior to IRET.
      
      The NMI nesting fixup relies on a precise stack layout and
      atomic IRET.  Rather than trying to teach the NMI nesting fixup
      to handle ESPFIX and failed IRET, punt: run NMIs that came from
      user mode on the normal kernel stack.
      
      This will make some nested NMIs visible to C code, but the C
      code is okay with that.
      
      As a side effect, this should speed up perf: it eliminates an
      RDMSR when NMIs come from user mode.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      60e6cbaf
    • Andy Lutomirski's avatar
      x86/nmi/64: Remove asm code that saves CR2 · f163d838
      Andy Lutomirski authored
      commit 0e181bb5 upstream.
      
      Now that do_nmi saves CR2, we don't need to save it in asm.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Acked-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f163d838
    • Andy Lutomirski's avatar
      x86/nmi: Enable nested do_nmi() handling for 64-bit kernels · e0146756
      Andy Lutomirski authored
      commit 9d050416 upstream.
      
      32-bit kernels handle nested NMIs in C.  Enable the exact same
      handling on 64-bit kernels as well.  This isn't currently
      necessary, but it will become necessary once the asm code starts
      allowing limited nesting.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e0146756
    • Andy Lutomirski's avatar
      x86/asm/entry/64: Remove pointless jump to irq_return · 4e1fb62b
      Andy Lutomirski authored
      commit 5ca6f70f upstream.
      
      INTERRUPT_RETURN turns into a jmp instruction.  There's no need
      for extra indirection.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: <linux-kernel@vger.kernel.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/2f2318653dbad284a59311f13f08cea71298fd7c.1433449436.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4e1fb62b
    • Michal Kazior's avatar
      ath10k: fix qca61x4 hw2.1 support · b235edce
      Michal Kazior authored
      commit 11a002ef upstream.
      
      During initialization firmware does some sort of
      memory switch between DRAM and IRAM. If
      configuration value for bank switching isn't
      correct device crashes during init.
      
      The new value prevents firmware 11.0.0.302 (and
      possibly others) for qca61x4 hw2.1 from crashing
      during init.
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b235edce
    • Benjamin Randazzo's avatar
      md: use kzalloc() when bitmap is disabled · 33afeac2
      Benjamin Randazzo authored
      commit b6878d9e upstream.
      
      In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
      mdu_bitmap_file_t called "file".
      
      5769         file = kmalloc(sizeof(*file), GFP_NOIO);
      5770         if (!file)
      5771                 return -ENOMEM;
      
      This structure is copied to user space at the end of the function.
      
      5786         if (err == 0 &&
      5787             copy_to_user(arg, file, sizeof(*file)))
      5788                 err = -EFAULT
      
      But if bitmap is disabled only the first byte of "file" is initialized
      with zero, so it's possible to read some bytes (up to 4095) of kernel
      space memory from user space. This is an information leak.
      
      5775         /* bitmap disabled, zero the first byte and copy out */
      5776         if (!mddev->bitmap_info.file)
      5777                 file->pathname[0] = '\0';
      Signed-off-by: default avatarBenjamin Randazzo <benjamin@randazzo.fr>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      33afeac2
    • NeilBrown's avatar
      phy: twl4030-usb: make runtime pm more reliable. · 73f7d1ff
      NeilBrown authored
      commit 56301df6 upstream.
      
      A construct like:
      
              if (pm_runtime_suspended(twl->dev))
                     pm_runtime_get_sync(twl->dev);
      
      is against the spirit of the runtime_pm interface as it
      makes the internal refcounting useless.
      
      In this case it is also racy, particularly as 'put_autosuspend'
      is used to drop a reference.
      When that happens a timer is started and the device is
      runtime-suspended after the timeout.
      If the above code runs in this window, the device will not be
      found to be suspended so no pm_runtime reference is taken.
      When the timer expires the device will be suspended, which is
      against the intention of the code.
      
      So be more direct is taking and dropping references.
      If twl->linkstat is VBUS_VALID or ID_GROUND, then hold a
      pm_runtime reference, otherwise don't.
      Define "cable_present()" to test for this condition.
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarKishon Vijay Abraham I <kishon@ti.com>
      Cc: Alexander Holler <holler@ahsoftware.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      73f7d1ff
    • Peter Chen's avatar
      usb: chipidea: ehci_init_driver is intended to call one time · 87a73d80
      Peter Chen authored
      commit 2f01a33b upstream.
      
      The ehci_init_driver is used to initialize hcd APIs for each
      ehci controller driver, it is designed to be called only one time
      and before driver register is called. The current design will
      cause ehci_init_driver is called multiple times at probe process,
      it will cause hc_driver's initialization affect current running hcd.
      
      We run out NULL pointer dereference problem when one hcd is started
      by module_init, and the other is started by otg thread at SMP platform.
      The reason for this problem is ehci_init_driver will do memory copy
      for current uniform hc_driver, and this memory copy will do memset (as 0)
      first, so when the first hcd is running usb_add_hcd, and the second
      hcd may clear the uniform hc_driver's space (at ehci_init_driver),
      then the first hcd will meet NULL pointer at the same time.
      
      See below two logs:
      
      LOG_1:
      ci_hdrc ci_hdrc.0: EHCI Host Controller
      ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
      ci_hdrc ci_hdrc.1: doesn't support gadget
      Unable to handle kernel NULL pointer dereference at virtual address 00000014
      pgd = 80004000
      [00000014] *pgd=00000000
      Internal error: Oops: 805 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 0 PID: 108 Comm: kworker/u8:2 Not tainted 3.14.38-222193-g24b2734-dirty #25
      Workqueue: ci_otg ci_otg_work
      task: d839ec00 ti: d8400000 task.ti: d8400000
      PC is at ehci_run+0x4c/0x284
      LR is at _raw_spin_unlock_irqrestore+0x28/0x54
      pc : [<8041f9a0>]    lr : [<8070ea84>]    psr: 60000113
      sp : d8401e30  ip : 00000000  fp : d8004400
      r10: 00000001  r9 : 00000001  r8 : 00000000
      r7 : 00000000  r6 : d8419940  r5 : 80dd24c0  r4 : d8419800
      r3 : 8001d060  r2 : 00000000  r1 : 00000001  r0 : 00000000
      Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
      Control: 10c53c7d  Table: 1000404a  DAC: 00000015
      Process kworker/u8:2 (pid: 108, stack limit = 0xd8400238)
      Stack: (0xd8401e30 to 0xd8402000)
      1e20:                                     d87523c0 d8401e48 66667562 d8419800
      1e40: 00000000 00000000 d8419800 00000000 00000000 00000000 d84198b0 8040fcdc
      1e60: 00000000 80dd320c d8477610 d8419c00 d803d010 d8419800 00000000 00000000
      1e80: d8004400 00000000 d8400008 80431494 80431374 d803d100 d803d010 d803d1ac
      1ea0: 00000000 80432428 804323d4 d803d100 00000001 80435eb8 80e0d0bc d803d100
      1ec0: 00000006 80436458 00000000 d803d100 80e92ec8 80436f44 d803d010 d803d100
      1ee0: d83fde00 8043292c d8752710 d803d1f4 d803d010 8042ddfc 8042ddb8 d83f3b00
      1f00: d803d1f4 80042b60 00000000 00000003 00000001 00000001 80054598 d83f3b00
      1f20: d8004400 d83f3b18 d8004414 d8400000 80e3957b 00000089 d8004400 80043814
      1f40: d839ec00 00000000 d83fcd80 d83f3b00 800436e4 00000000 00000000 00000000
      1f60: 00000000 80048f34 00000000 00000000 00000000 d83f3b00 00000000 00000000
      1f80: d8401f80 d8401f80 00000000 00000000 d8401f90 d8401f90 d8401fac d83fcd80
      1fa0: 80048e68 00000000 00000000 8000e538 00000000 00000000 00000000 00000000
      1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
      [<8041f9a0>] (ehci_run) from [<8040fcdc>] (usb_add_hcd+0x248/0x6e8)
      [<8040fcdc>] (usb_add_hcd) from [<80431494>] (host_start+0x120/0x2e4)
      [<80431494>] (host_start) from [<80432428>] (ci_otg_start_host+0x54/0xbc)
      [<80432428>] (ci_otg_start_host) from [<80435eb8>] (otg_set_protocol+0xa4/0xd0)
      [<80435eb8>] (otg_set_protocol) from [<80436458>] (otg_set_state+0x574/0xc58)
      [<80436458>] (otg_set_state) from [<80436f44>] (otg_statemachine+0x408/0x46c)
      [<80436f44>] (otg_statemachine) from [<8043292c>] (ci_otg_fsm_work+0x3c/0x190)
      [<8043292c>] (ci_otg_fsm_work) from [<8042ddfc>] (ci_otg_work+0x44/0x1c4)
      [<8042ddfc>] (ci_otg_work) from [<80042b60>] (process_one_work+0xf4/0x35c)
      [<80042b60>] (process_one_work) from [<80043814>] (worker_thread+0x130/0x3bc)
      [<80043814>] (worker_thread) from [<80048f34>] (kthread+0xcc/0xe4)
      [<80048f34>] (kthread) from [<8000e538>] (ret_from_fork+0x14/0x3c)
      Code: e5953018 e3530000 0a000000 e12fff33 (e5878014)
      
      LOG_2:
      ci_hdrc ci_hdrc.0: EHCI Host Controller
      ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
      ci_hdrc ci_hdrc.1: doesn't support gadget
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      pgd = 80004000
      [00000000] *pgd=00000000
      In Online 00:00ternal e      Offline rror: Oops: 80000005 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 0 PID: 108 Comm: kworker/u8:2 Not tainted 3.14.38-02007-g24b2734-dirty #127
      Workque Online 00:00ue: ci_o      Offline tg ci_otg_work
      Online 00:00task: d8      Offline 39ec00 ti: d83ea000 task.ti: d83ea000
      PC is at 0x0
      LR is at usb_add_hcd+0x248/0x6e8
      pc : [<00000000>]    lr : [<8040f644>]    psr: 60000113
      sp : d83ebe60  ip : 00000000  fp : d8004400
      r10: 00000001  r9 : 00000001  r8 : d85fd4b0
      r7 : 00000000  r6 : 00000000  r5 : 00000000  r4 : d85fd400
      r3 : 00000000  r2 : d85fd4f4  r1 : 80410178  r0 : d85fd400
      Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
      Control: 10c53c7d  Table: 1000404a  DAC: 00000015
      Process kworker/u8:2 (pid: 108, stack limit = 0xd83ea238)
      Stack: (0xd83ebe60 to 0xd83ec000)
      be60: 00000000 80dd920c d8654e10 d85fd800 d803e010 d85fd400 00000000 00000000
      be80: d8004400 00000000 d83ea008 80430e34 80430d14 d803e100 d803e010 d803e1ac
      bea0: 00000000 80431dc8 80431d74 d803e100 00000001 80435858 80e130bc d803e100
      bec0: 00000006 80435df8 00000000 d803e100 80e98ec8 804368e4 d803e010 d803e100
      bee0: d86e8100 804322cc d86cf050 d803e1f4 d803e010 8042d79c 8042d758 d83cf900
      bf00: d803e1f4 80042b78 00000000 00000003 00000001 00000001 800545e8 d83cf900
      bf20: d8004400 d83cf918 d8004414 d83ea000 80e3f57b 00000089 d8004400 8004382c
      bf40: d839ec00 00000000 d8393780 d83cf900 800436fc 00000000 00000000 00000000
      bf60: 00000000 80048f50 80e019f4 00000000 0000264c d83cf900 00000000 00000000
      bf80: d83ebf80 d83ebf80 00000000 00000000 d83ebf90 d83ebf90 d83ebfac d8393780
      bfa0: 80048e84 00000000 00000000 8000e538 00000000 00000000 00000000 00000000
      bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ee66e85d 133ebd03
      [<804 Online 00:000f644>]       Offline (usb_add_hcd) from [<80430e34>] (host_start+0x120/0x2e4)
      [<80430e34>] (host_start) from [<80431dc8>] (ci_otg_start_host+0x54/0xbc)
      [<80431dc8>] (ci_otg_start_host) from [<80435858>] (otg_set_protocol+0xa4/0xd0)
      [<80435858>] (otg_set_protocol) from [<80435df8>] (otg_set_state+0x574/0xc58)
      [<80435df8>] (otg_set_state) from [<804368e4>] (otg_statemachine+0x408/0x46c)
      [<804368e4>] (otg_statemachine) from [<804322cc>] (ci_otg_fsm_work+0x3c/0x190)
      [<804322cc>] (ci_otg_fsm_work) from [<8042d79c>] (ci_otg_work+0x44/0x1c4)
      [<8042d79c>] (ci_otg_work) from [<80042b78>] (process_one_work+0xf4/0x35c)
      [<80042b78>] (process_one_work) from [<8004382c>] (worker_thread+0x130/0x3bc)
      [<8004382c>] (worker_thread) from [<80048f50>] (kthread+0xcc/0xe4)
      [<80048f50>] (kthread) from [<8000e538>] (ret_from_fork+0x14/0x3c)
      Code: bad PC value
      
      Cc: Jun Li <jun.li@freescale.com>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarPeter Chen <peter.chen@freescale.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      87a73d80
    • Alan Stern's avatar
      usb: udc: core: add device_del() call to error pathway · 89dd0d8c
      Alan Stern authored
      commit c93e64e9 upstream.
      
      This patch fixes a bug in the error pathway of
      usb_add_gadget_udc_release() in udc-core.c.  If the udc registration
      fails, the gadget registration is not fully undone; there's a
      put_device(&gadget->dev) call but no device_del().
      Acked-by: default avatarPeter Chen <peter.chen@freescale.com>
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      89dd0d8c
    • Dirk Behme's avatar
      USB: sierra: add 1199:68AB device ID · b5c270ed
      Dirk Behme authored
      commit 74472233 upstream.
      
      Add support for the Sierra Wireless AR8550 device with
      USB descriptor 0x1199, 0x68AB.
      
      It is common with MC879x modules 1199:683c/683d which
      also are composite devices with 7 interfaces (0..6)
      and also MDM62xx based as the AR8550.
      
      The major difference are only the interface attributes
      02/02/01 on interfaces 3 and 4 on the AR8550. They are
      vendor specific ff/ff/ff on MC879x modules.
      
      lsusb reports:
      
      Bus 001 Device 004: ID 1199:68ab Sierra Wireless, Inc.
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.00
        bDeviceClass            0 (Defined at Interface level)
        bDeviceSubClass         0
        bDeviceProtocol         0
        bMaxPacketSize0        64
        idVendor           0x1199 Sierra Wireless, Inc.
        idProduct          0x68ab
        bcdDevice            0.06
        iManufacturer           3 Sierra Wireless, Incorporated
        iProduct                2 AR8550
        iSerial                 0
        bNumConfigurations      1
        Configuration Descriptor:
          bLength                 9
          bDescriptorType         2
          wTotalLength          198
          bNumInterfaces          7
          bConfigurationValue     1
          iConfiguration          1 Sierra Configuration
          bmAttributes         0xe0
            Self Powered
            Remote Wakeup
          MaxPower                0mA
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        0
            bAlternateSetting       0
            bNumEndpoints           2
            bInterfaceClass       255 Vendor Specific Class
            bInterfaceSubClass    255 Vendor Specific Subclass
            bInterfaceProtocol    255 Vendor Specific Protocol
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x81  EP 1 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x01  EP 1 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        1
            bAlternateSetting       0
            bNumEndpoints           2
            bInterfaceClass       255 Vendor Specific Class
            bInterfaceSubClass    255 Vendor Specific Subclass
            bInterfaceProtocol    255 Vendor Specific Protocol
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x82  EP 2 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x02  EP 2 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        2
            bAlternateSetting       0
            bNumEndpoints           2
            bInterfaceClass       255 Vendor Specific Class
            bInterfaceSubClass    255 Vendor Specific Subclass
            bInterfaceProtocol    255 Vendor Specific Protocol
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x83  EP 3 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x03  EP 3 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        3
            bAlternateSetting       0
            bNumEndpoints           3
            bInterfaceClass         2 Communications
            bInterfaceSubClass      2 Abstract (modem)
            bInterfaceProtocol      1 AT-commands (v.25ter)
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x84  EP 4 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0040  1x 64 bytes
              bInterval               5
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x85  EP 5 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x04  EP 4 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        4
            bAlternateSetting       0
            bNumEndpoints           3
            bInterfaceClass         2 Communications
            bInterfaceSubClass      2 Abstract (modem)
            bInterfaceProtocol      1 AT-commands (v.25ter)
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x86  EP 6 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0040  1x 64 bytes
              bInterval               5
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x87  EP 7 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x05  EP 5 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        5
            bAlternateSetting       0
            bNumEndpoints           3
            bInterfaceClass       255 Vendor Specific Class
            bInterfaceSubClass    255 Vendor Specific Subclass
            bInterfaceProtocol    255 Vendor Specific Protocol
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x88  EP 8 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0040  1x 64 bytes
              bInterval               5
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x89  EP 9 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x06  EP 6 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        6
            bAlternateSetting       0
            bNumEndpoints           3
            bInterfaceClass       255 Vendor Specific Class
            bInterfaceSubClass    255 Vendor Specific Subclass
            bInterfaceProtocol    255 Vendor Specific Protocol
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x8a  EP 10 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0040  1x 64 bytes
              bInterval               5
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x8b  EP 11 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x07  EP 7 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval              32
      Device Qualifier (for other device speed):
        bLength                10
        bDescriptorType         6
        bcdUSB               2.00
        bDeviceClass            0 (Defined at Interface level)
        bDeviceSubClass         0
        bDeviceProtocol         0
        bMaxPacketSize0        64
        bNumConfigurations      1
      Device Status:     0x0001
        Self Powered
      Signed-off-by: default avatarDirk Behme <dirk.behme@de.bosch.com>
      Cc: Lars Melin <larsm17@gmail.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b5c270ed
    • Gavin Shan's avatar
      drivers/usb: Delete XHCI command timer if necessary · 57e5880a
      Gavin Shan authored
      commit ffe5adcb upstream.
      
      When xhci_mem_cleanup() is called, it's possible that the command
      timer isn't initialized and scheduled. For those cases, to delete
      the command timer causes soft-lockup as below stack dump shows.
      
      The patch avoids deleting the command timer if it's not scheduled
      with the help of timer_pending().
      
      NMI watchdog: BUG: soft lockup - CPU#40 stuck for 23s! [kworker/40:1:8140]
            :
      NIP [c000000000150b30] lock_timer_base.isra.34+0x90/0xa0
      LR [c000000000150c24] try_to_del_timer_sync+0x34/0xa0
      Call Trace:
      [c000000f67c975e0] [c0000000015b84f8] mon_ops+0x0/0x8 (unreliable)
      [c000000f67c97620] [c000000000150c24] try_to_del_timer_sync+0x34/0xa0
      [c000000f67c97660] [c000000000150cf0] del_timer_sync+0x60/0x80
      [c000000f67c97690] [c00000000070ac0c] xhci_mem_cleanup+0x5c/0x5e0
      [c000000f67c97740] [c00000000070c2e8] xhci_mem_init+0x1158/0x13b0
      [c000000f67c97860] [c000000000700978] xhci_init+0x88/0x110
      [c000000f67c978e0] [c000000000701644] xhci_gen_setup+0x2b4/0x590
      [c000000f67c97970] [c0000000006d4410] xhci_pci_setup+0x40/0x190
      [c000000f67c979f0] [c0000000006b1af8] usb_add_hcd+0x418/0xba0
      [c000000f67c97ab0] [c0000000006cb15c] usb_hcd_pci_probe+0x1dc/0x5c0
      [c000000f67c97b50] [c0000000006d3ba4] xhci_pci_probe+0x64/0x1f0
      [c000000f67c97ba0] [c0000000004fe9ac] local_pci_probe+0x6c/0x130
      [c000000f67c97c30] [c0000000000e5ce8] work_for_cpu_fn+0x38/0x60
      [c000000f67c97c60] [c0000000000eacb8] process_one_work+0x198/0x470
      [c000000f67c97cf0] [c0000000000eb6ac] worker_thread+0x37c/0x5a0
      [c000000f67c97d80] [c0000000000f2730] kthread+0x110/0x130
      [c000000f67c97e30] [c000000000009660] ret_from_kernel_thread+0x5c/0x7c
      Reported-by: default avatarPriya M. A <priyama2@in.ibm.com>
      Signed-off-by: default avatarGavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      57e5880a
    • Mathias Nyman's avatar
      xhci: fix off by one error in TRB DMA address boundary check · 5c09786f
      Mathias Nyman authored
      commit 7895086a upstream.
      
      We need to check that a TRB is part of the current segment
      before calculating its DMA address.
      
      Previously a ring segment didn't use a full memory page, and every
      new ring segment got a new memory page, so the off by one
      error in checking the upper bound was never seen.
      
      Now that we use a full memory page, 256 TRBs (4096 bytes), the off by one
      didn't catch the case when a TRB was the first element of the next segment.
      
      This is triggered if the virtual memory pages for a ring segment are
      next to each in increasing order where the ring buffer wraps around and
      causes errors like:
      
      [  106.398223] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 0 comp_code 1
      [  106.398230] xhci_hcd 0000:00:14.0: Looking for event-dma fffd3000 trb-start fffd4fd0 trb-end fffd5000 seg-start fffd4000 seg-end fffd4ff0
      
      The trb-end address is one outside the end-seg address.
      Tested-by: default avatarArkadiusz Miśkiewicz <arekm@maven.pl>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5c09786f
    • Krzysztof Kozlowski's avatar
      dmaengine: pl330: Really fix choppy sound because of wrong residue calculation · e9256548
      Krzysztof Kozlowski authored
      commit 5dd90e5b upstream.
      
      When pl330 driver was used during sound playback, after some time or
      after a number of plays the sound became choppy or totally noisy. For
      example on Odroid XU3 board the first four executions of aplay with
      small WAVE worked fine, but fifth was unrecognizable with errors:
      	$ aplay /usr/share/sounds/alsa/Front_Right.wava
      	underrun!!! (at least 0.095 ms long)
      
      Issue was caused by wrong residue reported by pl330 driver to
      pcm_dmaengine for its cyclic dma transfers.
      
      The pl330_tx_status(), residue reporting function, used a "last" flag in
      a descriptor to indicate that there is no more data to send.
      
      The pl330_tx_submit() iterated over descriptors trying to remove this
      flag from them and then mark last descriptor as "last".  However when
      iterating it actually removed the flag not from descriptors but always
      from last of it (and then reset it). Thus effectively once some
      descriptor was marked as last, then it stayed like this forever causing
      residue to be reported too low.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski.k@gmail.com>
      Fixes: aee4d1fa ("dmaengine: pl330: improve pl330_tx_status() function")
      Reported-by: gabriel@unseen.is
      Suggested-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Tested-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e9256548
    • Krzysztof Kozlowski's avatar
      dmaengine: pl330: Fix overflow when reporting residue in memcpy · 9cd4b78c
      Krzysztof Kozlowski authored
      commit ae128293 upstream.
      
      During memcpy operations the residue was always set to an u32 overflowed
      value.
      
      In pl330_tx_status() function number of currently transferred bytes was
      subtracted from internal "bytes_requested" field. However this
      "bytes_requested" was not initialized at start to length of memcpy
      buffer so transferred bytes were subtracted from 0 causing overflow.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: aee4d1fa ("dmaengine: pl330: improve pl330_tx_status() function")
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9cd4b78c
    • Johan Hedberg's avatar
      Bluetooth: Fix NULL pointer dereference in smp_conn_security · 4e200fca
      Johan Hedberg authored
      commit 25ba2653 upstream.
      
      The l2cap_conn->smp pointer may be NULL for various valid reasons where SMP has
      failed to initialize properly. One such scenario is when crypto support is
      missing, another when the adapter has been powered on through a legacy method.
      The smp_conn_security() function should have the appropriate check for this
      situation to avoid NULL pointer dereferences.
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4e200fca
    • Brian King's avatar
      ipr: Fix invalid array indexing for HRRQ · ccd98d0c
      Brian King authored
      commit 3f1c0581 upstream.
      
      Fixes another signed / unsigned array indexing bug in the ipr driver.
      Currently, when hrrq_index wraps, it becomes a negative number. We
      do the modulo, but still have a negative number, so we end up indexing
      backwards in the array. Given where the hrrq array is located in memory,
      we probably won't actually reference memory we don't own, but nonetheless
      ipr is still looking at data within struct ipr_ioa_cfg and interpreting it as
      struct ipr_hrr_queue data, so bad things could certainly happen.
      
      Each ipr adapter has anywhere from 1 to 16 HRRQs. By default, we use 2 on new
      adapters.  Let's take an example:
      
      Assume ioa_cfg->hrrq_index=0x7fffffffe and ioa_cfg->hrrq_num=4:
      
      The atomic_add_return will then return -1. We mod this with 3 and get -2, add
      one and get -1 for an array index.
      
      On adapters which support more than a single HRRQ, we dedicate HRRQ to adapter
      initialization and error interrupts so that we can optimize the other queues
      for fast path I/O. So all normal I/O uses HRRQ 1-15. So we want to spread the
      I/O requests across those HRRQs.
      
      With the default module parameter settings, this bug won't hit, only when
      someone sets the ipr.number_of_msix parameter to a value larger than 3 is when
      bad things start to happen.
      Tested-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
      Reviewed-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
      Reviewed-by: default avatarGabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ccd98d0c
    • Brian King's avatar
      ipr: Fix incorrect trace indexing · b91250c3
      Brian King authored
      commit bb7c5433 upstream.
      
      When ipr's internal driver trace was changed to an atomic, a signed/unsigned
      bug slipped in which results in us indexing backwards in our memory buffer
      writing on memory that does not belong to us. This patch fixes this by removing
      the modulo and instead just mask off the low bits.
      Tested-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
      Reviewed-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
      Reviewed-by: default avatarGabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b91250c3
    • Brian King's avatar
      ipr: Fix locking for unit attention handling · 65f3a9d8
      Brian King authored
      commit 36b8e180 upstream.
      
      Make sure we have the host lock held when calling scsi_report_bus_reset. Fixes
      a crash seen as the __devices list in the scsi host was changing as we were
      iterating through it.
      Reviewed-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
      Reviewed-by: default avatarGabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      65f3a9d8
    • Daniel Vetter's avatar
      drm/dp-mst: Remove debug WARN_ON · 220dad5a
      Daniel Vetter authored
      commit 42639ba5 upstream.
      
      Apparently been in there since forever and fairly easy to hit when
      hotplugging really fast. I can do that since my mst hub has a manual
      button to flick the hpd line for reprobing. The resulting WARNING spam
      isn't pretty.
      
      Cc: Dave Airlie <airlied@gmail.com>
      Reviewed-by: default avatarThierry Reding <treding@nvidia.com>
      Reviewed-by: default avatarAnder Conselvan de Oliveira <conselvan2@gmail.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      220dad5a
    • Alex Deucher's avatar
      drm/radeon/combios: add some validation of lvds values · 7b449d05
      Alex Deucher authored
      commit 0a90a0cf upstream.
      
      Fixes a broken hsync start value uncovered by:
      abc0b144
      (drm: Perform basic sanity checks on probed modes)
      
      The driver handled the bad hsync start elsewhere, but
      the above commit prevented it from getting added.
      
      bug:
      https://bugs.freedesktop.org/show_bug.cgi?id=91401Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7b449d05
    • Alex Deucher's avatar
      drm/radeon: rework audio detect (v4) · 6f9dbb52
      Alex Deucher authored
      commit d0ea397e upstream.
      
      1. Always assign audio function pointers even if the display does
      not support audio.  We need to properly disable the audio stream
      when when using a non-audio capable monitor.  Fixes purple line
      on some hdmi monitors.
      
      2. Check if a pin is in use by another encoder before disabling
      it.
      
      v2: make sure we've fetched the edid before checking audio and
          look up the encoder before calling audio_detect since
          connector->encoder may not be assigned yet.  Separate
          pin and afmt.  They are allocated at different times and
          have no dependency on eachother.
      v3: fix connector fetching in encoder functions
      v4: fix missed dig->pin check in dce6_afmt_write_latency_fields
      
      bugs:
      https://bugzilla.kernel.org/show_bug.cgi?id=93701
      https://bugzilla.redhat.com/show_bug.cgi?id=1236337
      https://bugs.freedesktop.org/show_bug.cgi?id=91041Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6f9dbb52
    • Chris Wilson's avatar
      drm/i915: Replace WARN inside I915_READ64_2x32 with retry loop · 7f62822f
      Chris Wilson authored
      commit ee0a227b upstream.
      
      Since we may conceivably encounter situations where the upper part of the
      64bit register changes between reads, for example when a timestamp
      counter overflows, change the WARN into a retry loop.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7f62822f
    • Chris Wilson's avatar
      drm/i915: Declare the swizzling unknown for L-shaped configurations · 57689a9f
      Chris Wilson authored
      commit 5eb3e5a5 upstream.
      
      The old style of memory interleaving swizzled upto the end of the
      first even bank of memory, and then used the remainder as unswizzled on
      the unpaired bank - i.e. swizzling is not constant for all memory. This
      causes problems when we try to migrate memory and so the kernel prevents
      migration at all when we detect L-shaped inconsistent swizzling.
      However, this issue also extends to userspace who try to manually detile
      into memory as the swizzling for an individual page is unknown (it
      depends on its physical address only known to the kernel), userspace
      cannot correctly swizzle.
      
      Note that this is a new attempt for the previously merged one,
      reverted in
      
      commit d82c0ba6
      Author: Daniel Vetter <daniel.vetter@ffwll.ch>
      Date:   Tue Jul 14 12:29:27 2015 +0200
      
          Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations"
      
      This is cc: stable since we need it to fix up troubles with wc cpu
      mmaps that userspace recently started to use widely.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91105Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      [danvet: Add note about previous (failed attempt).]
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      57689a9f
    • Jan Kara's avatar
      fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() · 14e69b5a
      Jan Kara authored
      commit 8f2f3eb5 upstream.
      
      fsnotify_clear_marks_by_group_flags() can race with
      fsnotify_destroy_marks() so that when fsnotify_destroy_mark_locked()
      drops mark_mutex, a mark from the list iterated by
      fsnotify_clear_marks_by_group_flags() can be freed and thus the next
      entry pointer we have cached may become stale and we dereference free
      memory.
      
      Fix the problem by first moving marks to free to a special private list
      and then always free the first entry in the special list.  This method
      is safe even when entries from the list can disappear once we drop the
      lock.
      Signed-off-by: default avatarJan Kara <jack@suse.com>
      Reported-by: default avatarAshish Sangwan <a.sangwan@samsung.com>
      Reviewed-by: default avatarAshish Sangwan <a.sangwan@samsung.com>
      Cc: Lino Sanfilippo <LinoSanfilippo@gmx.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      14e69b5a
    • David Daney's avatar
      MIPS: Make set_pte() SMP safe. · f7972963
      David Daney authored
      commit 46011e6e upstream.
      
      On MIPS the GLOBAL bit of the PTE must have the same value in any
      aligned pair of PTEs.  These pairs of PTEs are referred to as
      "buddies".  In a SMP system is is possible for two CPUs to be calling
      set_pte() on adjacent PTEs at the same time.  There is a race between
      setting the PTE and a different CPU setting the GLOBAL bit in its
      buddy PTE.
      
      This race can be observed when multiple CPUs are executing
      vmap()/vfree() at the same time.
      
      Make setting the buddy PTE's GLOBAL bit an atomic operation to close
      the race condition.
      
      The case of CONFIG_64BIT_PHYS_ADDR && CONFIG_CPU_MIPS32 is *not*
      handled.
      Signed-off-by: default avatarDavid Daney <david.daney@cavium.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/10835/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f7972963
    • James Hogan's avatar
      MIPS: Flush RPS on kernel entry with EVA · 9bc226ac
      James Hogan authored
      commit 3aff47c0 upstream.
      
      When EVA is enabled, flush the Return Prediction Stack (RPS) present on
      some MIPS cores on entry to the kernel from user mode.
      
      This is important specifically for interAptiv with EVA enabled,
      otherwise kernel mode RPS mispredicts may trigger speculative fetches of
      user return addresses, which may be sensitive in the kernel address
      space due to EVA's overlapping user/kernel address spaces.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Markos Chandras <markos.chandras@imgtec.com>
      Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/10812/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9bc226ac
    • Florian Fainelli's avatar
      Revert "MIPS: BCM63xx: Provide a plat_post_dma_flush hook" · 701af4ae
      Florian Fainelli authored
      commit 247bfb65 upstream.
      
      This reverts commit 3cf29543 ("MIPS:
      BCM63xx: Provide a plat_post_dma_flush hook") since this commit was
      found to prevent BCM6358 (early BMIPS4350 cores) and some BCM6368
      (BMIPS4380 cores) from booting reliably.
      
      Alvaro was able to track this down to an issue specifically located to
      devices that use the second thread (TP1) when booting. Since BCM63xx did
      not have a need for plat_post_dma_flush() hook before, let's just keep
      things the way they were.
      Reported-by: default avatarÁlvaro Fernández Rojas <noltari@gmail.com>
      Reported-by: default avatarJonas Gorski <jogo@openwrt.org>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Cc: Kevin Cernekee <cernekee@gmail.com>
      Cc: Nicolas Schichan <nschichan@freebox.fr>
      Cc: linux-mips@linux-mips.org
      Cc: blogic@openwrt.org
      Cc: noltari@gmail.com
      Cc: jogo@openwrt.org
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/10804/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      701af4ae
    • James Hogan's avatar
      MIPS: show_stack: Fix stack trace with EVA · c6adca1a
      James Hogan authored
      commit 1e77863a upstream.
      
      The show_stack() function deals exclusively with kernel contexts, but if
      it gets called in user context with EVA enabled, show_stacktrace() will
      attempt to access the stack using EVA accesses, which will either read
      other user mapped data, or more likely cause an exception which will be
      handled by __get_user().
      
      This is easily reproduced using SysRq t to show all task states, which
      results in the following stack dump output:
      
       Stack : (Bad stack address)
      
      Fix by setting the current user access mode to kernel around the call to
      show_stacktrace(). This causes __get_user() to use normal loads to read
      the kernel stack.
      
      Now we get the correct output, like this:
      
       Stack : 00000000 80168960 00000000 004a0000 00000000 00000000 8060016c 1f3abd0c
                 1f172cd8 8056f09c 7ff1e450 8014fc3c 00000001 806dd0b0 0000001d 00000002
                 1f17c6a0 1f17c804 1f17c6a0 8066f6e0 00000000 0000000a 00000000 00000000
                 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
                 00000000 00000000 00000000 00000000 00000000 0110e800 1f3abd6c 1f17c6a0
                 ...
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Markos Chandras <markos.chandras@imgtec.com>
      Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/10778/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c6adca1a