5 years agoMerge branch 'linux-3.4.57' into rel-17
Deepak Nibade [Wed, 14 Aug 2013 10:53:39 +0000]
Merge branch 'linux-3.4.57' into rel-17

Bug 1348440

Change-Id: If25c49f027dc2a69642f7ed4733e965962b2a5a2
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>

5 years agoARM: tegra: add CoreSight PTM and ETB driver
Xin Xie [Sat, 10 Aug 2013 00:27:43 +0000]
ARM: tegra: add CoreSight PTM and ETB driver

bug 9622188

Change-Id: Ifb011f7fa8eea655a5c7359928e79c1fdee6f80f
Signed-off-by: Xin Xie <xxie@nvidia.com>
Reviewed-on: http://git-master/r/260194
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>

5 years agomedia: video: tegra: imx091: remove bracket caps
Phil Breczinski [Thu, 8 Aug 2013 01:57:06 +0000]
media: video: tegra: imx091: remove bracket caps

Remove false bracket caps support.

Change-Id: I7e63b6f21d880ac092efdf0f5cc0b9040011fc98
Signed-off-by: Phil Breczinski <pbreczinski@nvidia.com>
Reviewed-on: http://git-master/r/259410
Reviewed-by: Simone Willett <swillett@nvidia.com>
Tested-by: Simone Willett <swillett@nvidia.com>

5 years agoARM: tegra: power: fix incorrect register usage
Jay Cheng [Thu, 8 Aug 2013 00:27:51 +0000]
ARM: tegra: power: fix incorrect register usage

r3 is timeout target for loop, so can't later be used to store
I2C_STATUS register value.

update loop_i2c_status_suspend subroutine sequence.

bug 1344148

Change-Id: I66c47699cae520ad3c1f39529317011bafc93ae1
Signed-off-by: Jay Cheng <jacheng@nvidia.com>
Reviewed-on: http://git-master/r/259389
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Karthik Ramakrishnan <karthikr@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>

5 years agoUSB: debugfs: USB test mode support with usb debugfs
Neil Chen [Wed, 17 Jul 2013 05:34:21 +0000]
USB: debugfs: USB test mode support with usb debugfs

To generate USB testmode pattern by accessing usb debugfs. It
need to be enabled with enable "CONFIG_USB_DEBUG" and disable
"CONFIG_USB_SUSPEND" config in def_config.

Bug 1323709

Change-Id: I2c9d4cb304435e9d36f11a97a8db2d2ffd582ecf
Signed-off-by: Neil Chen <neilc@nvidia.com>
Reviewed-on: http://git-master/r/250068
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Suresh Mangipudi <smangipudi@nvidia.com>
Reviewed-by: Petlozu Pravareshwar <petlozup@nvidia.com>
Reviewed-by: Venkat Moganty <vmoganty@nvidia.com>

5 years agoARM: tegra: pluto: memory: Updated the 2GB table
Jay Bhukhanwala [Wed, 24 Jul 2013 23:44:27 +0000]
ARM: tegra: pluto: memory: Updated the 2GB table

The revision for the table is now 0x42

Bug 1288185

Change-Id: I1fcdb882fd68cf500685c5583619cbae02671c47
Signed-off-by: Jay Bhukhanwala <jbhukhanwala@nvidia.com>
Reviewed-on: http://git-master/r/237401
Reviewed-by: Simone Willett <swillett@nvidia.com>
Tested-by: Simone Willett <swillett@nvidia.com>

5 years agohwmon: ina230: fix overflow in current limit
Xin Xie [Wed, 7 Aug 2013 17:57:22 +0000]
hwmon: ina230: fix overflow in current limit

bug 258076

Change-Id: I321677861aeddd3f14c46ae99b922a3f407ed6d1
Signed-off-by: Xin Xie <xxie@nvidia.com>
Reviewed-on: http://git-master/r/259273
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Andy Carman <acarman@nvidia.com>
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>

5 years agoinput: touchscreen: raydium v60.2 touch driver
Xiaohui Tao [Wed, 7 Aug 2013 17:39:26 +0000]
input: touchscreen: raydium v60.2 touch driver

input: touchscreen: raydium v60.2 touch driver

raydium code drop

[1] Add additional info for regulator event msg

[2] Add RM_PLATFORM_A010 for Ardbeg AVC sensor

[3] Fix no touch function in Pluto platform with RM31081 from idle mode

[4] Refine Pismo touch direction

[5] Fix idle mode problem with Ardbeg AVC sensor

Bug 1330952
Bug 1319875
Bug 1311609

Change-Id: I3bb5c4a8abc36ac4e83b7ffc4f5947ad6ca609ec
Signed-off-by: Xiaohui Tao <xtao@nvidia.com>
Reviewed-on: http://git-master/r/257604
(cherry picked from commit 227b8493a0795aff1bd8d1518e5e4fac1f5e7eae)
Reviewed-on: http://git-master/r/259264
GVS: Gerrit_Virtual_Submit
Reviewed-by: Robert Collins <rcollins@nvidia.com>
Tested-by: Robert Collins <rcollins@nvidia.com>
Reviewed-by: Jon Mayo <jmayo@nvidia.com>

5 years agoRevert"media:video:tegra:replace 12.6MP with 13MP"
David Wang [Wed, 7 Aug 2013 17:13:37 +0000]
Revert"media:video:tegra:replace 12.6MP with 13MP"

This reverts commit df64d710769ef3a5ae286a87fe193882e39cf8dd.

reverting due to lense shading issue caused by
the change.

Bug 1182690

Change-Id: I1e1b9bdab1a01c98dbe0c2c6cf36e1b5c96cd773
Signed-off-by: David Wang <davidw@nvidia.com>
Reviewed-on: http://git-master/r/259259
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Frank Chen <frankc@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>

5 years agoARM: defconfigs: Enable Tegra profiler
Igor Nabirushkin [Tue, 16 Jul 2013 14:45:34 +0000]
ARM: defconfigs: Enable Tegra profiler

Enable Tegra profiler for Tegra platforms

Bug 1312406

Change-Id: I8e617a3f87b62d41800a059e6031533f12c342f4
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/249722
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Andrey Trachenko <atrachenko@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
GVS: Gerrit_Virtual_Submit
Tested-by: Andrey Trachenko <atrachenko@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>

5 years agoARM: tegra11: clock: Move auto-refresh control to CCFIFO
Alex Frid [Sun, 19 May 2013 06:23:27 +0000]
ARM: tegra11: clock: Move auto-refresh control to CCFIFO

Disabled/Enabled auto-refresh during EMC clock change using CCFIFO
mechanism.

Bug 1339693

Change-Id: I00fc1cc4fe4668ed84c1e7a4e105ebbb684b0ca5
Signed-off-by: Alex Frid <afrid@nvidia.com>
Reviewed-on: http://git-master/r/230986
GVS: Gerrit_Virtual_Submit
Reviewed-by: Yu-Huan Hsu <yhsu@nvidia.com>

5 years agoLinux 3.4.57
Greg Kroah-Hartman [Mon, 12 Aug 2013 01:54:51 +0000]
Linux 3.4.57

5 years ago8139cp: Add dma_mapping_error checking
Neil Horman [Wed, 31 Jul 2013 13:03:56 +0000]
8139cp: Add dma_mapping_error checking

[ Upstream commit cf3c4c03060b688cbc389ebc5065ebcce5653e96 ]

Self explanitory dma_mapping_error addition to the 8139 driver, based on this:
https://bugzilla.redhat.com/show_bug.cgi?id=947250

It showed several backtraces arising for dma_map_* usage without checking the
return code on the mapping.  Add the check and abort the rx/tx operation if its
failed.  Untested as I have no hardware and the reporter has wandered off, but
seems pretty straightforward.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: "David S. Miller" <davem@davemloft.net>
CC: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agonet_sched: info leak in atm_tc_dump_class()
Dan Carpenter [Tue, 30 Jul 2013 10:23:39 +0000]
net_sched: info leak in atm_tc_dump_class()

[ Upstream commit 8cb3b9c3642c0263d48f31d525bcee7170eedc20 ]

The "pvc" struct has a hole after pvc.sap_family which is not cleared.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoaf_key: more info leaks in pfkey messages
Dan Carpenter [Sun, 28 Jul 2013 20:04:45 +0000]
af_key: more info leaks in pfkey messages

[ Upstream commit ff862a4668dd6dba962b1d2d8bd344afa6375683 ]

This is inspired by a5cc68f3d6 "af_key: fix info leaks in notify
messages".  There are some struct members which don't get initialized
and could disclose small amounts of private information.

Acked-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agonet_sched: Fix stack info leak in cbq_dump_wrr().
David S. Miller [Tue, 30 Jul 2013 07:16:21 +0000]
net_sched: Fix stack info leak in cbq_dump_wrr().

[ Upstream commit a0db856a95a29efb1c23db55c02d9f0ff4f0db48 ]

Make sure the reserved fields, and padding (if any), are
fully initialized.

Based upon a patch by Dan Carpenter and feedback from
Joe Perches.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agousbnet: do not pretend to support SG/TSO
Eric Dumazet [Wed, 24 Jul 2013 00:15:54 +0000]
usbnet: do not pretend to support SG/TSO

[ Upstream commit 20f0170377264e8449b6987041f0bcc4d746d3ed ]

usbnet doesn't support yet SG, so drivers should not advertise SG or TSO
capabilities, as they allow TCP stack to build large TSO packets that
need to be linearized and might use order-5 pages.

This adds an extra copy overhead and possible allocation failures.

Current code ignore skb_linearize() return code so crashes are even
possible.

Best is to not pretend SG/TSO is supported, and add this again when/if
usbnet really supports SG for devices who could get a performance gain.

Based on a prior patch from Freddy Xin <freddy@asix.com.tw>

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup
Hannes Frederic Sowa [Mon, 22 Jul 2013 21:45:53 +0000]
ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup

[ Upstream commit 905a6f96a1b18e490a75f810d733ced93c39b0e5 ]

Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer
which leads to a panic (from Srivatsa S. Bhat):

BUG: unable to handle kernel paging request at ffff882018552020
IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter
+ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod
CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4
Hardware name: IBM  -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012
Workqueue: netns cleanup_net
task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000
RIP: 0010:[<ffffffffa0366b02>]  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
RSP: 0018:ffff881039367bd8  EFLAGS: 00010286
RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200
RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68
RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222
R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040
R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0
Stack:
 ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000
 ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0
 ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0
Call Trace:
 [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6]
 [<ffffffff815bdecb>] inet_release+0xfb/0x220
 [<ffffffff815bddf2>] ? inet_release+0x22/0x220
 [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6]
 [<ffffffff8151c1d9>] sock_release+0x29/0xa0
 [<ffffffff81525520>] sk_release_kernel+0x30/0x70
 [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6]
 [<ffffffff8152fff9>] ops_exit_list+0x39/0x60
 [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0
 [<ffffffff81075e3a>] process_one_work+0x1da/0x610
 [<ffffffff81075dc9>] ? process_one_work+0x169/0x610
 [<ffffffff81076390>] worker_thread+0x120/0x3a0
 [<ffffffff81076270>] ? process_one_work+0x610/0x610
 [<ffffffff8107da2e>] kthread+0xee/0x100
 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
 [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0
 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65
RIP  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
 RSP <ffff881039367bd8>
CR2: ffff882018552020

Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agosctp: fully initialize sctp_outq in sctp_outq_init
Neil Horman [Wed, 12 Jun 2013 18:26:44 +0000]
sctp: fully initialize sctp_outq in sctp_outq_init

[ Upstream commit c5c7774d7eb4397891edca9ebdf750ba90977a69 ]

In commit 2f94aabd9f6c925d77aecb3ff020f1cc12ed8f86
(refactor sctp_outq_teardown to insure proper re-initalization)
we modified sctp_outq_teardown to use sctp_outq_init to fully re-initalize the
outq structure.  Steve West recently asked me why I removed the q->error = 0
initalization from sctp_outq_teardown.  I did so because I was operating under
the impression that sctp_outq_init would properly initalize that value for us,
but it doesn't.  sctp_outq_init operates under the assumption that the outq
struct is all 0's (as it is when called from sctp_association_init), but using
it in __sctp_outq_teardown violates that assumption. We should do a memset in
sctp_outq_init to ensure that the entire structure is in a known state there
instead.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: "West, Steve (NSN - US/Fort Worth)" <steve.west@nsn.com>
CC: Vlad Yasevich <vyasevich@gmail.com>
CC: netdev@vger.kernel.org
CC: davem@davemloft.net
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agosysctl net: Keep tcp_syn_retries inside the boundary
Michal Tesar [Fri, 19 Jul 2013 12:09:01 +0000]
sysctl net: Keep tcp_syn_retries inside the boundary

[ Upstream commit 651e92716aaae60fc41b9652f54cb6803896e0da ]

Limit the min/max value passed to the
/proc/sys/net/ipv4/tcp_syn_retries.

Signed-off-by: Michal Tesar <mtesar@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoarcnet: cleanup sizeof parameter
Dan Carpenter [Fri, 19 Jul 2013 05:48:05 +0000]
arcnet: cleanup sizeof parameter

[ Upstream commit 087d273caf4f7d3f2159256f255f1f432bc84a5b ]

This patch doesn't change the compiled code because ARC_HDR_SIZE is 4
and sizeof(int) is 4, but the intent was to use the header size and not
the sizeof the header size.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoperf: Use css_tryget() to avoid propping up css refcount
Salman Qazi [Thu, 14 Jun 2012 22:31:09 +0000]
perf: Use css_tryget() to avoid propping up css refcount

commit 9c5da09d266ca9b32eb16cf940f8161d949c2fe5 upstream.

An rmdir pushes css's ref count to zero.  However, if the associated
directory is open at the time, the dentry ref count is non-zero.  If
the fd for this directory is then passed into perf_event_open, it
does a css_get().  This bounces the ref count back up from zero.  This
is a problem by itself.  But what makes it turn into a crash is the
fact that we end up doing an extra dput, since we perform a dput
when css_put sees the ref count go down to zero.

css_tryget() does not fall into that trap. So, we use that instead.

Reproduction test-case for the bug:

 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <linux/unistd.h>
 #include <linux/perf_event.h>
 #include <string.h>
 #include <errno.h>
 #include <stdio.h>

 #define PERF_FLAG_PID_CGROUP    (1U << 2)

 int perf_event_open(struct perf_event_attr *hw_event_uptr,
                     pid_t pid, int cpu, int group_fd, unsigned long flags) {
         return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,
                 group_fd, flags);
 }

 /*
  * Directly poke at the perf_event bug, since it's proving hard to repro
  * depending on where in the kernel tree.  what moved?
  */
 int main(int argc, char **argv)
 {
        int fd;
        struct perf_event_attr attr;
        memset(&attr, 0, sizeof(attr));
        attr.exclude_kernel = 1;
        attr.size = sizeof(attr);
        mkdir("/dev/cgroup/perf_event/blah", 0777);
        fd = open("/dev/cgroup/perf_event/blah", O_RDONLY);
        perror("open");
        rmdir("/dev/cgroup/perf_event/blah");
        sleep(2);
        perf_event_open(&attr, fd, 0, -1,  PERF_FLAG_PID_CGROUP);
        perror("perf_event_open");
        close(fd);
        return 0;
 }

Signed-off-by: Salman Qazi <sqazi@google.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Tejun Heo <tj@kernel.org>
Link: http://lkml.kernel.org/r/20120614223108.1025.2503.stgit@dungbeetle.mtv.corp.google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodrm/i915: quirk no PCH_PWM_ENABLE for Dell XPS13 backlight
Kamal Mostafa [Fri, 19 Jul 2013 22:02:01 +0000]
drm/i915: quirk no PCH_PWM_ENABLE for Dell XPS13 backlight

commit e85843bec6c2ea7c10ec61238396891cc2b753a9 upstream.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=47941
BugLink: https://bugs.launchpad.net/bugs/1163720
BugLink: https://bugs.launchpad.net/bugs/1162026

Some machines suffer from non-functional backlight controls if
BLM_PCH_PWM_ENABLE is set, so provide a quirk to avoid doing so.
Apply this quirk to Dell XPS 13 models.

[ kamal: backport to 3.4 ]

Tested-by: Eric Griffith <EGriffith92@gmail.com>
Tested-by: Kent Baxley <kent.baxley@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agox86, fpu: correct the asm constraints for fxsave, unbreak mxcsr.daz
H.J. Lu [Fri, 26 Jul 2013 16:11:56 +0000]
x86, fpu: correct the asm constraints for fxsave, unbreak mxcsr.daz

commit eaa5a990191d204ba0f9d35dbe5505ec2cdd1460 upstream.

GCC will optimize mxcsr_feature_mask_init in arch/x86/kernel/i387.c:

memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
asm volatile("fxsave %0" : : "m" (fx_scratch));
mask = fx_scratch.mxcsr_mask;
if (mask == 0)
mask = 0x0000ffbf;

to

memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
asm volatile("fxsave %0" : : "m" (fx_scratch));
mask = 0x0000ffbf;

since asm statement doesn’t say it will update fx_scratch.  As the
result, the DAZ bit will be cleared.  This patch fixes it. This bug
dates back to at least kernel 2.6.12.

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoperf: Fix event group context move
Jiri Olsa [Fri, 1 Feb 2013 10:23:45 +0000]
perf: Fix event group context move

commit 0231bb5336758426b44ccd798ccd3c5419c95d58 upstream.

When we have group with mixed events (hw/sw) we want to end up
with group leader being in hw context. So if group leader is
initialy sw event, we move all the events under hw context.

The move is done for each event by removing it from its context
and adding it back into proper one. As a part of the removal the
event is automatically disabled, which is not what we want at
this stage of creating groups.

The fix is to initialize event state after removal from sw
context.

This fix resulted from the following discussion:

  http://thread.gmane.org/gmane.linux.kernel.perf.user/1144

Reported-by: Andreas Hollmann <hollmann@in.tum.de>
Signed-off-by: Jiri Olsa <jolsa@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Stephane Eranian <eranian@google.com>
Cc: Vince Weaver <vince@deater.net>
Link: http://lkml.kernel.org/r/1359714225-4231-1-git-send-email-jolsa@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agofanotify: info leak in copy_event_to_user()
Dan Carpenter [Mon, 8 Jul 2013 22:59:40 +0000]
fanotify: info leak in copy_event_to_user()

commit de1e0c40aceb9d5bff09c3a3b97b2f1b178af53f upstream.

The ->reserved field isn't cleared so we leak one byte of stack
information to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agosched: Fix the broken sched_rr_get_interval()
Zhu Yanhai [Tue, 8 Jan 2013 04:56:52 +0000]
sched: Fix the broken sched_rr_get_interval()

commit a59f4e079d19464eebb9b06513a1d4f55fdae5ba upstream.

The caller of sched_sliced() should pass se.cfs_rq and se as the
arguments, however in sched_rr_get_interval() we gave it
rq.cfs_rq and se, which made the following computation obviously
wrong.

The change was introduced by commit:

  77034937dc45 sched: fix crash in sys_sched_rr_get_interval()

... 5 years ago, while it had been the correct 'cfs_rq_of' before
the commit. The change seems to be irrelevant to the commit
msg, which was to return a 0 timeslice for tasks that are on an
idle runqueue. So I believe that was just a plain typo.

Signed-off-by: Zhu Yanhai <gaoyang.zyh@taobao.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Paul Turner <pjt@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/1357621012-15039-1-git-send-email-gaoyang.zyh@taobao.com
[ Since this is an ABI and an old bug, we'll test this via a
  slow upstream route, to hopefully discover any app breakage. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoACPI / battery: Fix parsing _BIX return value
Lan Tianyu [Tue, 30 Jul 2013 12:00:42 +0000]
ACPI / battery: Fix parsing _BIX return value

commit 016d5baad04269e8559332df05f89bd95b52d6ad upstream.

The _BIX method returns extended battery info as a package.
According the ACPI spec (ACPI 5, Section 10.2.2.2), the first member
of that package should be "Revision".  However, the current ACPI
battery driver treats the first member as "Power Unit" which should
be the second member.  This causes the result of _BIX return data
parsing to be incorrect.

Fix this by adding a new member called 'revision' to struct
acpi_battery and adding the offsetof() information on it to
extended_info_offsets[] as the first row.

[rjw: Changelog]
Reported-and-tested-by: Jan Hoffmann <jan.christian.hoffmann@gmail.com>
References: http://bugzilla.kernel.org/show_bug.cgi?id=60519
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agomwifiex: Add missing endian conversion.
Tomasz Moń [Tue, 23 Jul 2013 05:42:49 +0000]
mwifiex: Add missing endian conversion.

commit 83e612f632c3897be29ef02e0472f6d63e258378 upstream.

Both type and pkt_len variables are in host endian and these should be in
Little Endian in the payload.

Signed-off-by: Tomasz Moń <desowin@gmail.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agort2x00: fix stop queue
Stanislaw Gruszka [Sun, 28 Jul 2013 11:17:22 +0000]
rt2x00: fix stop queue

commit e2288b66fe7ff0288382b2af671b4da558b44472 upstream.

Since we clear QUEUE_STARTED in rt2x00queue_stop_queue(), following
call to rt2x00queue_pause_queue() reduce to noop, i.e we do not
stop queue in mac80211.

To fix that introduce rt2x00queue_pause_queue_nocheck() function,
which will stop queue in mac80211 directly.

Note that rt2x00_start_queue() explicitly set QUEUE_PAUSED bit.

Note also that reordering operations i.e. first call to
rt2x00queue_pause_queue() and then clear QUEUE_STARTED bit, will race
with rt2x00queue_unpause_queue(), so calling ieee80211_stop_queue()
directly is the only available solution to fix the problem without
major rework.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoixgbe: Fix Tx Hang issue with lldpad on 82598EB
Jacob Keller [Fri, 26 Jul 2013 12:46:35 +0000]
ixgbe: Fix Tx Hang issue with lldpad on 82598EB

commit 1eb9ac14c34a948bf1538bfb9034e8ab29099a64 upstream.

This patch fixes an issue with the 82598EB device, where lldpad is causing Tx
Hangs on the card as soon as it attempts to configure DCB for the device. The
adapter will continually Tx hang and reset in a loop.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Tested-by: Jack Morgan <jack.morgan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agomac80211: fix duplicate retransmission detection
Johannes Berg [Thu, 11 Jul 2013 20:33:26 +0000]
mac80211: fix duplicate retransmission detection

commit 6b0f32745dcfba01d7be33acd1b40306c7a914c6 upstream.

The duplicate retransmission detection code in mac80211
erroneously attempts to do the check for every frame,
even frames that don't have a sequence control field or
that don't use it (QoS-Null frames.)

This is problematic because it causes the code to access
data beyond the end of the SKB and depending on the data
there will drop packets erroneously.

Correct the code to not do duplicate detection for such
frames.

I found this error while testing AP powersave, it lead
to retransmitted PS-Poll frames being dropped entirely
as the data beyond the end of the SKB was always zero.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agonl80211: fix mgmt tx status and testmode reporting for netns
Michal Kazior [Tue, 25 Jun 2013 07:17:17 +0000]
nl80211: fix mgmt tx status and testmode reporting for netns

commit a0ec570f4f69c4cb700d743a915096c2c8f56a99 upstream.

These two events were sent to the default network
namespace.

This caused AP mode in a non-default netns to not
work correctly. Mgmt tx status was multicasted to
a different (default) netns instead of the one the
AP was in.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoath9k_htc: do some initial hardware configuration
Oleksij Rempel [Fri, 19 Jul 2013 18:16:17 +0000]
ath9k_htc: do some initial hardware configuration

commit dc2a87f519a4d8cb376ab54f22b6b98a943b51ce upstream.

Currently we configure harwdare and clock, only after
interface start. In this case, if we reload module or
reboot PC without configuring adapter, firmware will freeze.
There is no software way to reset adpter.

This patch add initial configuration and set it in
disabled state, to avoid this freeze. Behaviour of this patch
should be similar to: ifconfig wlan0 up; ifconfig wlan0 down.

Bug: https://github.com/qca/open-ath9k-htc-firmware/issues/1
Tested-by: Bo Shi <cnshibo@gmail.com>
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoserial/mxs-auart: increase time to wait for transmitter to become idle
Uwe Kleine-König [Fri, 28 Jun 2013 09:49:41 +0000]
serial/mxs-auart: increase time to wait for transmitter to become idle

commit 079a036f4283e2b0e5c26080b8c5112bc0cc1831 upstream.

Without this patch the driver waits ~1 ms for the UART to become idle. At
115200n8 this time is (theoretically) enough to transfer 11.5 characters
(= 115200 bits/s / (10 Bits/char) * 1ms). As the mxs-auart has a fifo size
of 16 characters the clock is gated too early. The problem is worse for
lower baud rates.

This only happens to really shut down the transmitter in the middle of a
transfer if /dev/ttyAPPx isn't opened in userspace (e.g. by a getty) but
was at least once (because the bootloader doesn't disable the transmitter).

So increase the timeout to 20 ms which should be enough for 9600n8, too.
Moreover skip gating the clock if the timeout is elapsed.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoserial/mxs-auart: fix race condition in interrupt handler
Uwe Kleine-König [Thu, 4 Jul 2013 09:28:51 +0000]
serial/mxs-auart: fix race condition in interrupt handler

commit d970d7fe65adff5efe75b4a73c4ffc9be57089f7 upstream.

The handler needs to ack the pending events before actually handling them.
Otherwise a new event might come in after it it considered non-pending or
handled and is acked then without being handled. So this event is only
noticed when the next interrupt happens.

Without this patch an i.MX28 based machine running an rt-patched kernel
regularly hangs during boot.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoALSA: compress: fix the return value for SNDRV_COMPRESS_VERSION
Vinod Koul [Mon, 29 Jul 2013 09:40:22 +0000]
ALSA: compress: fix the return value for SNDRV_COMPRESS_VERSION

commit a8d30608eaed6cc759b8e2e8a8bbbb42591f797f upstream.

the return value of SNDRV_COMPRESS_VERSION always return default -ENOTTY as the
return value was never updated for this call
assign return value from put_user()

Reported-by: Haynes <hgeorge@codeaurora.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agommc: host: simplify boost mode interface
Philip Rakity [Mon, 5 Aug 2013 21:05:26 +0000]
mmc: host: simplify boost mode interface

echo 1 > cmd_state # to set normal voltage
echo 2 > cmd_state # to set high voltage

   1 to set normal voltage
    echo 1 > /sys/devices/platform/sdhci-tegra.0/cmd_state
    echo 1 > /sys/devices/platform/sdhci-tegra.2/cmd_state
    echo 1 > /sys/devices/platform/sdhci-tegra.3/cmd_state

    2 to set high voltage
    echo 2 > /sys/devices/platform/sdhci-tegra.0/cmd_state
    echo 2 > /sys/devices/platform/sdhci-tegra.2/cmd_state
    echo 2 > /sys/devices/platform/sdhci-tegra.3/cmd_state

echo 0 command is no longer used
echo 3 command is no longer used

Bug 1329643

Change-Id: I21c0b5ae82e0ff0d940cbe2182c5f2bae6af304f
Signed-off-by: Philip Rakity <prakity@nvidia.com>
Reviewed-on: http://git-master/r/258314
Reviewed-by: Andy Carman <acarman@nvidia.com>
Tested-by: Andy Carman <acarman@nvidia.com>
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Rick Song <ricks@nvidia.com>
GVS: Gerrit_Virtual_Submit

5 years agommc: host: High Voltage Support
Philip Rakity [Wed, 24 Jul 2013 16:12:06 +0000]
mmc: host: High Voltage Support

Implement high voltage support using sysfs

3 stage commit
a) suspend controller
b) set voltage
c) resume controller

echo 0 > cmd_state
This will put controller in a suspended state

set voltage (echo 1 > cmd_state or echo 2 > cmd_state)

once this is done then
echo 3 > cmd_state
to start controller.

Note: The controller needs to be suspended because switching
the voltage when i/o is active may result in CRC or other errors

The following example refer to the interfaces on pluto

0 to suspend controller
echo 0 > /sys/devices/platform/sdhci-tegra.0/cmd_state
echo 0 > /sys/devices/platform/sdhci-tegra.2/cmd_state
echo 0 > /sys/devices/platform/sdhci-tegra.3/cmd_state

1 to set normal voltage
echo 1 > /sys/devices/platform/sdhci-tegra.0/cmd_state
echo 1 > /sys/devices/platform/sdhci-tegra.2/cmd_state
echo 1 > /sys/devices/platform/sdhci-tegra.3/cmd_state

2 to set high voltage
echo 2 > /sys/devices/platform/sdhci-tegra.0/cmd_state
echo 2 > /sys/devices/platform/sdhci-tegra.2/cmd_state
echo 2 > /sys/devices/platform/sdhci-tegra.3/cmd_state

3 to resume the controller after the voltage change
echo 3 > /sys/devices/platform/sdhci-tegra.0/cmd_state
echo 3 > /sys/devices/platform/sdhci-tegra.2/cmd_state
echo 3 > /sys/devices/platform/sdhci-tegra.3/cmd_state

based on
http://git-master/r/#change,251897
http://git-master/r/#change,250897
http://git-master/r/#change,252471

Includes code review changes suggested by Pavan

Bug 1329643

Change-Id: If38615b09704e73fc65e2dd0e6bc51c726d1fbc9
Signed-off-by: Philip Rakity <prakity@nvidia.com>
Signed-off-by: Andy Carman <acarman@nvidia.com>
Reviewed-on: http://git-master/r/252960
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Rick Song <ricks@nvidia.com>
GVS: Gerrit_Virtual_Submit

5 years agoregulator: palmas: add turn ON time for LDOs
Laxman Dewangan [Tue, 4 Jun 2013 14:53:48 +0000]
regulator: palmas: add turn ON time for LDOs

Palmas' LDO take 100 to 500us for turning it ON.
Add the enable time for LDOs.

bug 1289898

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-on: http://git-master/r/235483
(cherry picked from commit 62402fff39ee70744b06062324722564895caf59)

bug 1317941

Change-Id: I8a8aeee04d2a53443e7281f3e066cf51cd5c17b2
Signed-off-by: Bitan Biswas <bbiswas@nvidia.com>
Reviewed-on: http://git-master/r/258712
Reviewed-by: Automatic_Commit_Validation_User
Tested-by: Diwakar Tundlam <dtundlam@nvidia.com>
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>

5 years agomedia:video:tegra: Add Fuse ID read for IMX132.
Amey Asgaonkar [Fri, 26 Jul 2013 23:08:14 +0000]
media:video:tegra: Add Fuse ID read for IMX132.

Adds support for reading fuse ids for IMX132 sensor.

Bug 1307361

Change-Id: I7b750a91d3ead5fac383e85df013b78d7fe4c6a2
Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com>
Reviewed-on: http://git-master/r/254573
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Frank Chen <frankc@nvidia.com>
Reviewed-by: Philip Breczinski <pbreczinski@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

5 years agoarm: tegra: soctherm: enable throttling and shutdown on GPU zone
Diwakar Tundlam [Sun, 17 Feb 2013 08:20:25 +0000]
arm: tegra: soctherm: enable throttling and shutdown on GPU zone

Enabled throttling and shutdown on GPU zone for TegraTab platform.

Bug 1169070
Bug 1200077

Change-Id: I072af5aae0d23af93e3f8dcffdc25b476a723f1f
Reviewed-on: http://git-master/r/255341
(cherry picked from commit 4cddb9c4646fb17a3ccbd968aef8b53974f589c4)
Signed-off-by: Diwakar Tundlam <dtundlam@nvidia.com>
Reviewed-on: http://git-master/r/257695

5 years agopower: sbs-battery: Update battery properties only on change
Darbha Sriharsha [Fri, 2 Aug 2013 15:22:41 +0000]
power: sbs-battery: Update battery properties only on change

Call the power_supply_changed work only if battery SOC
reading or power supply status has changed

Bug 1223793

Change-Id: I929df2787fe33e526499e3a762e9adbfea4da8d1
Signed-off-by: Darbha Sriharsha <dsriharsha@nvidia.com>
Reviewed-on: http://git-master/r/257587
GVS: Gerrit_Virtual_Submit
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>

5 years agoCamera: driver: Added getting exposure time API into ov7695 yuv sensor driver
Alvin Park [Thu, 25 Jul 2013 06:42:08 +0000]
Camera: driver: Added getting exposure time API into ov7695 yuv sensor driver

Added getting exposure time API into ov7695 yuv sensor driver

Bug 1330342

(cherry picked from commit 56640855c05e3cee0ecaacfe2b789cb5df87bffc)
Change-Id: I745f893bfde153bc02479154072a8d66c84705e2

Signed-off-by: Alvin Park <apark@nvidia.com>
Change-Id: I4ef4d2a0987e727853132b70b245fedd6d5aca31
Reviewed-on: http://git-master/r/255529
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: David Schalig <dschalig@nvidia.com>
Reviewed-by: Peter Kim <pekim@nvidia.com>
Reviewed-by: Sean Pieper <spieper@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>

5 years agoLinux 3.4.56
Greg Kroah-Hartman [Sun, 4 Aug 2013 08:35:23 +0000]
Linux 3.4.56

5 years agomm/memory-hotplug: fix lowmem count overflow when offline pages
Wanpeng Li [Wed, 3 Jul 2013 22:02:40 +0000]
mm/memory-hotplug: fix lowmem count overflow when offline pages

commit cea27eb2a202959783f81254c48c250ddd80e129 upstream.

The logic for the memory-remove code fails to correctly account the
Total High Memory when a memory block which contains High Memory is
offlined as shown in the example below.  The following patch fixes it.

Before logic memory remove:

MemTotal:        7603740 kB
MemFree:         6329612 kB
Buffers:           94352 kB
Cached:           872008 kB
SwapCached:            0 kB
Active:           626932 kB
Inactive:         519216 kB
Active(anon):     180776 kB
Inactive(anon):   222944 kB
Active(file):     446156 kB
Inactive(file):   296272 kB
Unevictable:           0 kB
Mlocked:               0 kB
HighTotal:       7294672 kB
HighFree:        5704696 kB
LowTotal:         309068 kB
LowFree:          624916 kB

After logic memory remove:

MemTotal:        7079452 kB
MemFree:         5805976 kB
Buffers:           94372 kB
Cached:           872000 kB
SwapCached:            0 kB
Active:           626936 kB
Inactive:         519236 kB
Active(anon):     180780 kB
Inactive(anon):   222944 kB
Active(file):     446156 kB
Inactive(file):   296292 kB
Unevictable:           0 kB
Mlocked:               0 kB
HighTotal:       7294672 kB
HighFree:        5181024 kB
LowTotal:       4294752076 kB
LowFree:          624952 kB

[mhocko@suse.cz: fix CONFIG_HIGHMEM=n build]
Signed-off-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Cc: <stable@vger.kernel.org> [2.6.24+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Zhouping Liu <zliu@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agovirtio_net: fix race in RX VQ processing
Michael S. Tsirkin [Sun, 4 Aug 2013 08:26:06 +0000]
virtio_net: fix race in RX VQ processing

commit cbdadbbf0c790f79350a8f36029208944c5487d0 upstream

virtio net called virtqueue_enable_cq on RX path after napi_complete, so
with NAPI_STATE_SCHED clear - outside the implicit napi lock.
This violates the requirement to synchronize virtqueue_enable_cq wrt
virtqueue_add_buf.  In particular, used event can move backwards,
causing us to lose interrupts.
In a debug build, this can trigger panic within START_USE.

Jason Wang reports that he can trigger the races artificially,
by adding udelay() in virtqueue_enable_cb() after virtio_mb().

However, we must call napi_complete to clear NAPI_STATE_SCHED before
polling the virtqueue for used buffers, otherwise napi_schedule_prep in
a callback will fail, causing us to lose RX events.

To fix, call virtqueue_enable_cb_prepare with NAPI_STATE_SCHED
set (under napi lock), later call virtqueue_poll with
NAPI_STATE_SCHED clear (outside the lock).

Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Jason Wang <jasowang@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[wg: Backported to 3.2]
Signed-off-by: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agovirtio: support unlocked queue poll
Michael S. Tsirkin [Tue, 9 Jul 2013 10:19:18 +0000]
virtio: support unlocked queue poll

commit cc229884d3f77ec3b1240e467e0236c3e0647c0c upstream.

This adds a way to check ring empty state after enable_cb outside any
locks. Will be used by virtio_net.

Note: there's room for more optimization: caller is likely to have a
memory barrier already, which means we might be able to get rid of a
barrier here.  Deferring this optimization until we do some
benchmarking.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[wg: Backported to 3.2]
Signed-off-by: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
[bwh: Backported to 3.4: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agos390: move dummy io_remap_pfn_range() to asm/pgtable.h
Linus Torvalds [Wed, 17 Apr 2013 15:46:19 +0000]
s390: move dummy io_remap_pfn_range() to asm/pgtable.h

commit 4f2e29031e6c67802e7370292dd050fd62f337ee upstream.

Commit b4cbb197c7e7 ("vm: add vm_iomap_memory() helper function") added
a helper function wrapper around io_remap_pfn_range(), and every other
architecture defined it in <asm/pgtable.h>.

The s390 choice of <asm/io.h> may make sense, but is not very convenient
for this case, and gratuitous differences like that cause unexpected errors like this:

   mm/memory.c: In function 'vm_iomap_memory':
   mm/memory.c:2439:2: error: implicit declaration of function 'io_remap_pfn_range' [-Werror=implicit-function-declaration]

Glory be the kbuild test robot who noticed this, bisected it, and
reported it to the guilty parties (ie me).

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
[bwh: Backported to 3.2: the macro was not defined, so this is an addition
 and not a move]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agozfcp: status read buffers on first adapter open with link down
Steffen Maier [Fri, 26 Apr 2013 15:34:54 +0000]
zfcp: status read buffers on first adapter open with link down

commit 9edf7d75ee5f21663a0183d21f702682d0ef132f upstream.

Commit 64deb6efdc5504ce97b5c1c6f281fffbc150bd93
"[SCSI] zfcp: Use status_read_buf_num provided by FCP channel"
started using a value returned by the channel but only evaluated the value
if the fabric link is up.
Commit 8d88cf3f3b9af4713642caeb221b6d6a42019001
"[SCSI] zfcp: Update status read mempool"
introduced mempool resizings based on the above value.
On setting an FCP device online for the very first time since boot, a new
zeroed adapter object is allocated. If the link is down, the number of
status read requests remains zero. Since just the config data exchange is
incomplete, we proceed with adapter open recovery. However, we
unconditionally call mempool_resize with adapter->stat_read_buf_num == 0 in
this case.

This causes a kernel message "kernel BUG at mm/mempool.c:131!" in process
"zfcperp<FCP-device-bus-ID>" with last function mempool_resize in Krnl PSW
and zfcp_erp_thread in the Call Trace.

Don't evaluate channel values which are invalid on link down. The number of
status read requests is always valid, evaluated, and set to a positive
minimum greater than zero. The adapter open recovery can proceed and the
channel has status read buffers to inform us on a future link up event.
While we are not aware of any other code path that could result in mempool
resize attempts of size zero, we still also initialize the number of status
read buffers to be posted to a static minimum number on adapter object
allocation.

Backported for 3.4-stable. commit a53c8fa since v3.6-rc1 unified
copyright messages, e.g: revise such messages 'Copyright IBM Corporation'
as 'Copyright IBM Corp', so updated the messages as a53c8fa did.

Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org> #2.6.35+
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Zhouping Liu <zliu@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agofirewire: fix libdc1394/FlyCap2 iso event regression
Clemens Ladisch [Mon, 22 Jul 2013 19:32:09 +0000]
firewire: fix libdc1394/FlyCap2 iso event regression

commit 0699a73af3811b66b1ab5650575acee5eea841ab upstream.

Commit 18d627113b83 (firewire: prevent dropping of completed iso packet
header data) was intended to be an obvious bug fix, but libdc1394 and
FlyCap2 depend on the old behaviour by ignoring all returned information
and thus not noticing that not all packets have been received yet.  The
result was that the video frame buffers would be saved before they
contained the correct data.

Reintroduce the old behaviour for old clients.

Tested-by: Stepan Salenikovich <stepan.salenikovich@gmail.com>
Tested-by: Josep Bosch <jep250@gmail.com>
Cc: <stable@vger.kernel.org> # 3.4+
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoxen/evtchn: avoid a deadlock when unbinding an event channel
David Vrabel [Fri, 19 Jul 2013 14:51:58 +0000]
xen/evtchn: avoid a deadlock when unbinding an event channel

commit 179fbd5a45f0d4034cc6fd37b8d367a3b79663c4 upstream.

Unbinding an event channel (either with the ioctl or when the evtchn
device is closed) may deadlock because disable_irq() is called with
port_user_lock held which is also locked by the interrupt handler.

Think of the IOCTL_EVTCHN_UNBIND is being serviced, the routine has
just taken the lock, and an interrupt happens. The evtchn_interrupt
is invoked, tries to take the lock and spins forever.

A quick glance at the code shows that the spinlock is a local IRQ
variant. Unfortunately that does not help as "disable_irq() waits for
the interrupt handler on all CPUs to stop running.  If the irq occurs
on another VCPU, it tries to take port_user_lock and can't because
the unbind ioctl is holding it." (from David). Hence we cannot
depend on the said spinlock to protect us. We could make it a system
wide IRQ disable spinlock but there is a better way.

We can piggyback on the fact that the existence of the spinlock is
to make get_port_user() checks be up-to-date. And we can alter those
checks to not depend on the spin lock (as it's protected by u->bind_mutex
in the ioctl) and can remove the unnecessary locking (this is
IOCTL_EVTCHN_UNBIND) path.

In the interrupt handler we cannot use the mutex, but we do not
need it.

"The unbind disables the irq before making the port user stale, so when
you clear it you are guaranteed that the interrupt handler that might
use that port cannot be running." (from David).

Hence this patch removes the spinlock usage on the teardown path
and piggybacks on disable_irq happening before we muck with the
get_port_user() data. This ensures that the interrupt handler will
never run on stale data.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[v1: Expanded the commit description a bit]
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agomd/raid10: remove use-after-free bug.
NeilBrown [Wed, 24 Jul 2013 05:37:42 +0000]
md/raid10: remove use-after-free bug.

commit 0eb25bb027a100f5a9df8991f2f628e7d851bc1e upstream.

We always need to be careful when calling generic_make_request, as it
can start a chain of events which might free something that we are
using.

Here is one place I wasn't careful enough.  If the wbio2 is not in
use, then it might get freed at the first generic_make_request call.
So perform all necessary tests first.

This bug was introduced in 3.3-rc3 (24afd80d99) and can cause an
oops, so fix is suitable for any -stable since then.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agomd/raid5: fix interaction of 'replace' and 'recovery'.
NeilBrown [Mon, 22 Jul 2013 02:57:21 +0000]
md/raid5: fix interaction of 'replace' and 'recovery'.

commit f94c0b6658c7edea8bc19d13be321e3860a3fa54 upstream.

If a device in a RAID4/5/6 is being replaced while another is being
recovered, then the writes to the replacement device currently don't
happen, resulting in corruption when the replacement completes and the
new drive takes over.

This is because the replacement writes are only triggered when
's.replacing' is set and not when the similar 's.sync' is set (which
is the case during resync and recovery - it means all devices need to
be read).

So schedule those writes when s.replacing is set as well.

In this case we cannot use "STRIPE_INSYNC" to record that the
replacement has happened as that is needed for recording that any
parity calculation is complete.  So introduce STRIPE_REPLACED to
record if the replacement has happened.

For safety we should also check that STRIPE_COMPUTE_RUN is not set.
This has a similar effect to the "s.locked == 0" test.  The latter
ensure that now IO has been flagged but not started.  The former
checks if any parity calculation has been flagged by not started.
We must wait for both of these to complete before triggering the
'replace'.

Add a similar test to the subsequent check for "are we finished yet".
This possibly isn't needed (is subsumed in the STRIPE_INSYNC test),
but it makes it more obvious that the REPLACE will happen before we
think we are finished.

Finally if a NeedReplace device is not UPTODATE then that is an
error.  We really must trigger a warning.

This bug was introduced in commit 9a3e1101b827a59ac9036a672f5fa8d5279d0fe2
(md/raid5:  detect and handle replacements during recovery.)
which introduced replacement for raid5.
That was in 3.3-rc3, so any stable kernel since then would benefit
from this fix.

Reported-by: qindehua <13691222965@163.com>
Tested-by: qindehua <qindehua@163.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agolivelock avoidance in sget()
Al Viro [Fri, 19 Jul 2013 23:13:55 +0000]
livelock avoidance in sget()

commit acfec9a5a892f98461f52ed5770de99a3e571ae2 upstream.

Eric Sandeen has found a nasty livelock in sget() - take a mount(2) about
to fail.  The superblock is on ->fs_supers, ->s_umount is held exclusive,
->s_active is 1.  Along comes two more processes, trying to mount the same
thing; sget() in each is picking that superblock, bumping ->s_count and
trying to grab ->s_umount.  ->s_active is 3 now.  Original mount(2)
finally gets to deactivate_locked_super() on failure; ->s_active is 2,
superblock is still ->fs_supers because shutdown will *not* happen until
->s_active hits 0.  ->s_umount is dropped and now we have two processes
chasing each other:
s_active = 2, A acquired ->s_umount, B blocked
A sees that the damn thing is stillborn, does deactivate_locked_super()
s_active = 1, A drops ->s_umount, B gets it
A restarts the search and finds the same superblock.  And bumps it ->s_active.
s_active = 2, B holds ->s_umount, A blocked on trying to get it
... and we are in the earlier situation with A and B switched places.

The root cause, of course, is that ->s_active should not grow until we'd
got MS_BORN.  Then failing ->mount() will have deactivate_locked_super()
shut the damn thing down.  Fortunately, it's easy to do - the key point
is that grab_super() is called only for superblocks currently on ->fs_supers,
so it can bump ->s_count and grab ->s_umount first, then check MS_BORN and
bump ->s_active; we must never increment ->s_count for superblocks past
->kill_sb(), but grab_super() is never called for those.

The bug is pretty old; we would've caught it by now, if not for accidental
exclusion between sget() for block filesystems; the things like cgroup or
e.g. mtd-based filesystems don't have anything of that sort, so they get
bitten.  The right way to deal with that is obviously to fix sget()...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoUSB: serial: ftdi_sio: add more RT Systems ftdi devices
Rick Farina (Zero_Chaos) [Mon, 29 Jul 2013 19:17:59 +0000]
USB: serial: ftdi_sio: add more RT Systems ftdi devices

commit fed1f1ed90bce42ea010e2904cbc04e7b8304940 upstream.

RT Systems makes many usb serial cables based on the ftdi_sio driver for
programming various amateur radios.  This patch is a full listing of
their current product offerings and should allow these cables to all
be recognized.

Signed-off-by: Rick Farina (Zero_Chaos) <zerochaos@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodrm/radeon/atom: initialize more atom interpretor elements to 0
Alex Deucher [Tue, 30 Jul 2013 04:22:53 +0000]
drm/radeon/atom: initialize more atom interpretor elements to 0

commit 42a21826dc54583cdb79cc8477732e911ac9c376 upstream.

The ProcessAuxChannel table on some rv635 boards assumes
the divmul members are initialized to 0 otherwise we get
an invalid fb offset since it has a bad mask set when
setting the fb base.  While here initialize all the
atom interpretor elements to 0.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60639

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodrm/radeon: improve dac adjust heuristics for legacy pdac
Alex Deucher [Fri, 19 Jul 2013 21:44:43 +0000]
drm/radeon: improve dac adjust heuristics for legacy pdac

commit 03ed8cf9b28d886c64c7e705c7bb1a365fd8fb95 upstream.

Hopefully avoid more quirks in the future due to bogus
vbios dac data.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodrm/radeon: fix combios tables on older cards
Mark Kettenis [Sun, 21 Jul 2013 20:44:09 +0000]
drm/radeon: fix combios tables on older cards

commit cef1d00cd56f600121ad121875655ad410a001b8 upstream.

Noticed that my old Radeon 7500 hung after printing

   drm: GPU not posted. posting now...

when it wasn't selected as the primary card the BIOS.  Some digging
revealed that it was hanging in combios_parse_mmio_table() while
parsing the ASIC INIT 3 table.  Looking at the BIOS ROM for the card,
it becomes obvious that there is no ASIC INIT 3 table in the BIOS.
The code is just processing random garbage.  No surprise it hangs!

Why do I say that there is no ASIC INIT 3 table is the BIOS?  This
table is found through the MISC INFO table.  The MISC INFO table can
be found at offset 0x5e in the COMBIOS header.  But the header is
smaller than that.  The COMBIOS header starts at offset 0x126.  The
standard PCI Data Structure (the bit that starts with 'PCIR') lives at
offset 0x180.  That means that the COMBIOS header can not be larger
than 0x5a bytes and therefore cannot contain a MISC INFO table.

I looked at a dozen or so BIOS images, some my own, some downloaded from:

    <http://www.techpowerup.com/vgabios/index.php?manufacturer=ATI&page=1>

It is fairly obvious that the size of the COMBIOS header can be found
at offset 0x6 of the header.  Not sure if it is a 16-bit number or
just an 8-bit number, but that doesn't really matter since the tables
seems to be always smaller than 256 bytes.

So I think combios_get_table_offset() should check if the requested
table is present.  This can be done by checking the offset against the
size of the header.  See the diff below.  The diff is against the WIP
OpenBSD codebase that roughly corresponds to Linux 3.8.13 at this
point.  But I don't think this bit of the code changed much since
then.

For what it is worth:

Signed-off-by: Mark Kettenis <kettenis@openbsd.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodrm/radeon: fix endian issues with DP handling (v3)
Alex Deucher [Thu, 18 Jul 2013 15:13:53 +0000]
drm/radeon: fix endian issues with DP handling (v3)

commit 34be8c9af7b8728465963740fc11136ae90dfc36 upstream.

The atom interpreter expects data in LE format, so
swap the message buffer as apprioriate.

v2: properly handle non-dw aligned byte counts.
v3: properly handle remainder

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Dong He <hedonghust@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agodm verity: fix inability to use a few specific devices sizes
Mikulas Patocka [Wed, 10 Jul 2013 22:41:16 +0000]
dm verity: fix inability to use a few specific devices sizes

commit b1bf2de07271932326af847a3c6a01fdfd29d4be upstream.

Fix a boundary condition that caused failure for certain device sizes.

The problem is reported at
  http://code.google.com/p/cryptsetup/issues/detail?id=160

For certain device sizes the number of hashes at a specific level was
calculated incorrectly.

It happens for example for a device with data and metadata block size 4096
that has 16385 blocks and algorithm sha256.

The user can test if he is affected by this bug by running the
"veritysetup verify" command and also by activating the dm-verity kernel
driver and reading the whole block device. If it passes without an error,
then the user is not affected.

The condition for the bug is:

Split the total number of data blocks (data_block_bits) into bit strings,
each string has hash_per_block_bits bits. hash_per_block_bits is
rounddown(log2(metadata_block_size/hash_digest_size)). Equivalently, you
can say that you convert data_blocks_bits to 2^hash_per_block_bits base.

If there some zero bit string below the most significant bit string and at
least one bit below this zero bit string is set, then the bug happens.

The same bug exists in the userspace veritysetup tool, so you must use
fixed veritysetup too if you want to use devices that are affected by
this boundary condition.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoACPI / memhotplug: Fix a stale pointer in error path
Toshi Kani [Wed, 10 Jul 2013 16:47:13 +0000]
ACPI / memhotplug: Fix a stale pointer in error path

commit d19f503e22316a84c39bc19445e0e4fdd49b3532 upstream.

device->driver_data needs to be cleared when releasing its data,
mem_device, in an error path of acpi_memory_device_add().

The function evaluates the _CRS of memory device objects, and fails
when it gets an unexpected resource or cannot allocate memory.  A
kernel crash or data corruption may occur when the kernel accesses
the stale pointer.

Signed-off-by: Toshi Kani <toshi.kani@hp.com>
Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agopowerpc/modules: Module CRC relocation fix causes perf issues
Anton Blanchard [Mon, 15 Jul 2013 04:04:50 +0000]
powerpc/modules: Module CRC relocation fix causes perf issues

commit 0e0ed6406e61434d3f38fb58aa8464ec4722b77e upstream.

Module CRCs are implemented as absolute symbols that get resolved by
a linker script. We build an intermediate .o that contains an
unresolved symbol for each CRC. genksysms parses this .o, calculates
the CRCs and writes a linker script that "resolves" the symbols to
the calculated CRC.

Unfortunately the ppc64 relocatable kernel sees these CRCs as symbols
that need relocating and relocates them at boot. Commit d4703aef
(module: handle ppc64 relocating kcrctabs when CONFIG_RELOCATABLE=y)
added a hook to reverse the bogus relocations. Part of this patch
created a symbol at 0x0:

# head -2 /proc/kallsyms
0000000000000000 T reloc_start
c000000000000000 T .__start

This reloc_start symbol is causing lots of confusion to perf. It
thinks reloc_start is a massive function that stretches from 0x0 to
0xc000000000000000 and we get various cryptic errors out of perf,
including:

problem incrementing symbol count, skipping event

This patch removes the  reloc_start linker script label and instead
defines it as PHYSICAL_START. We also need to wrap it with
CONFIG_PPC64 because the ppc32 kernel can set a non zero
PHYSICAL_START at compile time and we wouldn't want to subtract
it from the CRCs in that case.

Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agolibata: make it clear that sata_inic162x is experimental
Tejun Heo [Mon, 22 Jul 2013 20:53:36 +0000]
libata: make it clear that sata_inic162x is experimental

commit bb9696192826a7d9279caf872e95b41bc26c7eff upstream.

sata_inic162x never reached a state where it's reliable enough for
production use and data corruption is a relatively common occurrence.
Make the driver generate warning about the issues and mark the Kconfig
option as experimental.

If the situation doesn't improve, we'd be better off making it depend
on CONFIG_BROKEN.  Let's wait for several cycles and see if the kernel
message draws any attention.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Martin Braure de Calignon <braurede@free.fr>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Reported-by: risc4all@yahoo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoata: Fix DVD not dectected at some platform with Wellsburg PCH
Youquan Song [Fri, 12 Jul 2013 01:15:57 +0000]
ata: Fix DVD not dectected at some platform with Wellsburg PCH

commit eac27f04a71e1f39f196f7e520d16dcefc955d77 upstream.

There is a patch b55f84e2d527182e7c611d466cd0bb6ddce201de "ata_piix: Fix DVD
 not dectected at some Haswell platforms" to fix an issue of DVD not
recognized on Haswell Desktop platform with Lynx Point.
Recently, it is also found the same issue at some platformas with Wellsburg PCH.

So deliver a similar patch to fix it by disables 32bit PIO in IDE mode.

Signed-off-by: Youquan Song <youquan.song@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoxen/blkback: Check device permissions before allowing OP_DISCARD
Konrad Rzeszutek Wilk [Wed, 16 Jan 2013 16:33:52 +0000]
xen/blkback: Check device permissions before allowing OP_DISCARD

commit 604c499cbbcc3d5fe5fb8d53306aa0fae1990109 upstream.

We need to make sure that the device is not RO or that
the request is not past the number of sectors we want to
issue the DISCARD operation for.

This fixes CVE-2013-2140.

Acked-by: Jan Beulich <JBeulich@suse.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
[v1: Made it pr_warn instead of pr_debug]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoBtrfs: re-add root to dead root list if we stop dropping it
Josef Bacik [Wed, 17 Jul 2013 23:30:20 +0000]
Btrfs: re-add root to dead root list if we stop dropping it

commit d29a9f629e009c9b90e5859bce581070fd6247fc upstream.

If we stop dropping a root for whatever reason we need to add it back to the
dead root list so that we will re-start the dropping next transaction commit.
The other case this happens is if we recover a drop because we will add a root
without adding it to the fs radix tree, so we can leak it's root and commit root
extent buffer, adding this to the dead root list makes this cleanup happen.
Thanks,

Reported-by: Alex Lyakas <alex.btrfs@zadarastorage.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoBtrfs: fix lock leak when resuming snapshot deletion
Josef Bacik [Mon, 15 Jul 2013 16:41:42 +0000]
Btrfs: fix lock leak when resuming snapshot deletion

commit fec386ac1428f9c0e672df952cbca5cebd4e4e2f upstream.

We aren't setting path->locks[level] when we resume a snapshot deletion which
means we won't unlock the buffer when we free the path.  This causes deadlocks
if we happen to re-allocate the block before we've evicted the extent buffer
from cache.  Thanks,

Reported-by: Alex Lyakas <alex.btrfs@zadarastorage.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agostaging: comedi: COMEDI_CANCEL ioctl should wake up read/write
Ian Abbott [Mon, 8 Jul 2013 12:36:19 +0000]
staging: comedi: COMEDI_CANCEL ioctl should wake up read/write

commit 69acbaac303e8cb948801a9ddd0ac24e86cc4a1b upstream.

Comedi devices can do blocking read() or write() (or poll()) if an
asynchronous command has been set up, blocking for data (for read()) or
buffer space (for write()).  Various events associated with the
asynchronous command will wake up the blocked reader or writer (or
poller).  It is also possible to force the asynchronous command to
terminate by issuing a `COMEDI_CANCEL` ioctl.  That shuts down the
asynchronous command, but does not currently wake up the blocked reader
or writer (or poller).  If the blocked task could be woken up, it would
see that the command is no longer active and return.  The caller of the
`COMEDI_CANCEL` ioctl could attempt to wake up the blocked task by
sending a signal, but that's a nasty workaround.

Change `do_cancel_ioctl()` to wake up the wait queue after it returns
from `do_cancel()`.  `do_cancel()` can propagate an error return value
from the low-level comedi driver's cancel routine, but it always shuts
the command down regardless, so `do_cancel_ioctl()` can wake up he wait
queue regardless of the return value from `do_cancel()`.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agousb: Clear both buffers when clearing a control transfer TT buffer.
William Gulland [Thu, 27 Jun 2013 23:10:20 +0000]
usb: Clear both buffers when clearing a control transfer TT buffer.

commit 2c7b871b9102c497ba8f972aa5d38532f05b654d upstream.

Control transfers have both IN and OUT (or SETUP) packets, so when
clearing TT buffers for a control transfer it's necessary to send
two HUB_CLEAR_TT_BUFFER requests to the hub.

Signed-off-by: William Gulland <wgulland@google.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoUSB: misc: Add Manhattan Hi-Speed USB DVI Converter to sisusbvga
Jóhann B. Guðmundsson [Thu, 4 Jul 2013 21:47:52 +0000]
USB: misc: Add Manhattan Hi-Speed USB DVI Converter to sisusbvga

commit 58fc90db8261b571c026bb8bf23aad48a7233118 upstream.

Signed-off-by: Jóhann B. Guðmundsson <johannbg@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoUSB: ti_usb_3410_5052: fix dynamic-id matching
Johan Hovold [Fri, 28 Jun 2013 10:24:26 +0000]
USB: ti_usb_3410_5052: fix dynamic-id matching

commit 1fad56424f5ad3ce4973505a357212b2e2282b3f upstream.

The driver failed to take the dynamic ids into account when determining
the device type and therefore all devices were detected as 2-port
devices when using the dynamic-id interface.

Match on the usb-serial-driver field instead of doing redundant id-table
searches.

Reported-by: Anders Hammarquist <iko@iko.pp.se>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agousb: dwc3: gadget: don't prevent gadget from being probed if we fail
Felipe Balbi [Mon, 15 Jul 2013 09:36:35 +0000]
usb: dwc3: gadget: don't prevent gadget from being probed if we fail

commit cdcedd6981194e511cc206887db661d016069d68 upstream.

In case we fail our ->udc_start() callback, we
should be ready to accept another modprobe following
the failed one.

We had forgotten to clear dwc->gadget_driver back
to NULL and, because of that, we were preventing
gadget driver modprobe from being retried.

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agousb: dwc3: fix wrong bit mask in dwc3_event_type
Huang Rui [Wed, 26 Jun 2013 17:08:11 +0000]
usb: dwc3: fix wrong bit mask in dwc3_event_type

commit 1974d494dea05ea227cb42f5e918828801e237aa upstream.

Per dwc3 2.50a spec, the is_devspec bit is used to distinguish the
Device Endpoint-Specific Event or Device-Specific Event (DEVT). If the
bit is 1, the event is represented Device-Specific Event, then use
[7:1] bits as Device Specific Event to marked the type. It has 7 bits,
and we can see the reserved8_31 variable name which means from 8 to 31
bits marked reserved, actually there are 24 bits not 25 bits between
that. And 1 + 7 + 24 = 32, the event size is 4 byes.

So in dwc3_event_type, the bit mask should be:
is_devspec [0] 1  bit
type [7:1] 7  bits
reserved8_31 [31:8] 24 bits

This patch should be backported to kernels as old as 3.2, that contain
the commit 72246da40f3719af3bfd104a2365b32537c27d83 "usb: Introduce
DesignWare USB3 DRD Driver".

Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoxhci: Avoid NULL pointer deref when host dies.
Sarah Sharp [Wed, 24 Jul 2013 17:27:13 +0000]
xhci: Avoid NULL pointer deref when host dies.

commit 203a86613fb3bf2767335659513fa98563a3eb71 upstream.

When the host controller fails to respond to an Enable Slot command, and
the host fails to respond to the register write to abort the command
ring, the xHCI driver will assume the host is dead, and call
usb_hc_died().

The USB device's slot_id is still set to zero, and the pointer stored at
xhci->devs[0] will always be NULL.  The call to xhci_check_args in
xhci_free_dev should have caught the NULL virt_dev pointer.

However, xhci_free_dev is designed to free the xhci_virt_device
structures, even if the host is dead, so that we don't leak kernel
memory.  xhci_free_dev checks the return value from the generic
xhci_check_args function.  If the return value is -ENODEV, it carries on
trying to free the virtual device.

The issue is that xhci_check_args looks at the host controller state
before it looks at the xhci_virt_device pointer.  It will return -ENIVAL
because the host is dead, and xhci_free_dev will ignore the return
value, and happily dereference the NULL xhci_virt_device pointer.

The fix is to make sure that xhci_check_args checks the xhci_virt_device
pointer before it checks the host state.

See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1203453 for
further details.  This patch doesn't solve the underlying issue, but
will ensure we don't see any more NULL pointer dereferences because of
the issue.

This patch should be backported to kernels as old as 3.1, that
contain the commit 7bd89b4017f46a9b92853940fd9771319acb578a "xhci: Don't
submit commands or URBs to halted hosts."

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Vincent Thiele <vincentthiele@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoxhci: fix null pointer dereference on ring_doorbell_for_active_rings
Oleksij Rempel [Sun, 21 Jul 2013 13:36:19 +0000]
xhci: fix null pointer dereference on ring_doorbell_for_active_rings

commit d66eaf9f89502971fddcb0de550b01fa6f409d83 upstream.

in some cases where device is attched to xhci port and do not responding,
for example ath9k_htc with stalled firmware, kernel will
crash on ring_doorbell_for_active_rings.
This patch check if pointer exist before it is used.

This patch should be backported to kernels as old as 2.6.35, that
contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci:
Correct assumptions about number of rings per endpoint"

Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agousb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0
George Cherian [Mon, 1 Jul 2013 05:29:12 +0000]
usb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0

commit 07f3cb7c28bf3f4dd80bfb136cf45810c46ac474 upstream.

Xhci controllers with hci_version > 0.96 gives spurious success
events on short packet completion. During webcam capture the
"ERROR Transfer event TRB DMA ptr not part of current TD" was observed.
The same application works fine with synopsis controllers hci_version 0.96.
The same issue is seen with Intel Pantherpoint xhci controller. So enabling
this quirk in xhci_gen_setup if controller verion is greater than 0.96.
For xhci-pci move the quirk to much generic place xhci_gen_setup.

Note from Sarah:

The xHCI 1.0 spec changed how hardware handles short packets.  The HW
will notify SW of the TRB where the short packet occurred, and it will
also give a successful status for the last TRB in a TD (the one with the
IOC flag set).  On the second successful status, that warning will be
triggered in the driver.

Software is now supposed to not assume the TD is not completed until it
gets that last successful status.  That means we have a slight race
condition, although it should have little practical impact.  This patch
papers over that issue.

It's on my long-term to-do list to fix this race condition, but it is a
much more involved patch that will probably be too big for stable.  This
patch is needed for stable to avoid serious log spam.

This patch should be backported to kernels as old as 3.0, that
contain the commit ad808333d8201d53075a11bc8dd83b81f3d68f0b "Intel xhci:
Ignore spurious successful event."

The patch will have to be modified for kernels older than 3.2, since
that kernel added the xhci_gen_setup function for xhci platform devices.
The correct conflict resolution for kernels older than 3.2 is to set
XHCI_SPURIOUS_SUCCESS in xhci_pci_quirks for all xHCI 1.0 hosts.

Signed-off-by: George Cherian <george.cherian@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agotracing: Fix irqs-off tag display in syscall tracing
zhangwei(Jovi) [Mon, 29 Jul 2013 01:33:58 +0000]
tracing: Fix irqs-off tag display in syscall tracing

commit 11034ae9c20f4057a6127fc965906417978e69b2 upstream

Initialization of variable irq_flags and pc was missed when backport
11034ae9c to linux-3.0.y and linux-3.4.y, my fault.

Signed-off-by: zhangwei(Jovi) <jovi.zhangwei@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoSCSI: qla2xxx: Properly set the tagging for commands.
Saurav Kashyap [Fri, 12 Jul 2013 18:47:51 +0000]
SCSI: qla2xxx: Properly set the tagging for commands.

commit c3ccb1d7cf4c4549151876dd37c0944a682fd9e1 upstream.

This fixes a regression where Xyratex controllers and disks were lost by the
driver:

https://bugzilla.kernel.org/show_bug.cgi?id=59601

Reported-by: Jack Hill <jackhill@jackhill.us>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoSCSI: sd: fix crash when UA received on DIF enabled device
Ewan D. Milne [Fri, 2 Nov 2012 13:38:34 +0000]
SCSI: sd: fix crash when UA received on DIF enabled device

commit 085b513f97d8d799d28491239be4b451bcd8c2c5 upstream.

sd_prep_fn will allocate a larger CDB for the command via mempool_alloc
for devices using DIF type 2 protection.  This CDB was being freed
in sd_done, which results in a kernel crash if the command is retried
due to a UNIT ATTENTION.  This change moves the code to free the larger
CDB into sd_unprep_fn instead, which is invoked after the request is
complete.

It is no longer necessary to call scsi_print_command separately for
this case as the ->cmnd will no longer be NULL in the normal code path.

Also removed conditional test for DIF type 2 when freeing the larger
CDB because the protection_type could have been changed via sysfs while
the command was executing.

Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoASoC: wm8962: Remove remaining direct register cache accesses
Nicolin Chen [Fri, 14 Jun 2013 04:34:50 +0000]
ASoC: wm8962: Remove remaining direct register cache accesses

commit 2e7ee15ced914e109a1a5b6dfcd463d846a13bd5 upstream.

Also fix return values for headphone switch updates.

Signed-off-by: Nicolin Chen <b42378@freescale.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoASoC: max98088 - fix element type of the register cache.
Chih-Chung Chang [Mon, 15 Jul 2013 16:38:46 +0000]
ASoC: max98088 - fix element type of the register cache.

commit cb6f66a2d278e57a6c9d8fb59bd9ebd8ab3965c2 upstream.

The registers of max98088 are 8 bits, not 16 bits. This bug causes the
contents of registers to be overwritten with bad values when the codec
is suspended and then resumed.

Signed-off-by: Chih-Chung Chang <chihchung@chromium.org>
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoUSB: storage: Add MicroVault Flash Drive to unusual_devs
Ren Bigcren [Tue, 2 Jul 2013 11:34:30 +0000]
USB: storage: Add MicroVault Flash Drive to unusual_devs

commit e7a6121f4929c17215f0cdca3726f4bf3e4e9529 upstream.

The device report an error capacity when read_capacity_16().
Using read_capacity_10() can get the correct capacity.

Signed-off-by: Ren Bigcren <bigcren.ren@sonymobile.com>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Oskar Andero <oskar.andero@sonymobile.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agoiscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
Joern Engel [Wed, 3 Jul 2013 15:35:11 +0000]
iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow

commit 0fbfc46fb0b2f543a8b539e94c6c293ebc0b05a6 upstream.

This patch fixes a potential buffer overflow while processing
iscsi_node_auth input for configfs attributes within NodeACL
tfc_tpg_nacl_auth_cit context.

Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 years agommc: tegra: cardhu: set correct parent
Bibek Basu [Fri, 5 Jul 2013 05:27:33 +0000]
mmc: tegra: cardhu: set correct parent

sdhci can have parent as pll_p only as pll_c is
scalable and not available in T30 for sdhci

Bug 1306032

Change-Id: I3c5dfbfd554ca54a2dd48997828378e9f8a107b9
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/245261
Reviewed-by: Aleksandr Frid <afrid@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Kiran Adduri <kadduri@nvidia.com>
Reviewed-by: Venu Byravarasu <vbyravarasu@nvidia.com>

5 years agoARM: tegra: pluto: adjust core voltage
Andy Carman [Fri, 2 Aug 2013 01:02:50 +0000]
ARM: tegra: pluto: adjust core voltage

use tegra_dvfs_rail_get_boot_level

bug 1329659

Signed-off-by: Andy Carman <acarman@nvidia.com>
Change-Id: I9c24b25fcb7216575a710d5fb775de6c96182e3b
Reviewed-on: http://git-master/r/257193
Reviewed-by: Automatic_Commit_Validation_User
Tested-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Pavan Kunapuli <pkunapuli@nvidia.com>

5 years agomfd: tps65090: do not provide num_reg_defaults_raw for regmap init
Laxman Dewangan [Thu, 1 Aug 2013 13:32:38 +0000]
mfd: tps65090: do not provide num_reg_defaults_raw for regmap init

There is no default data for tps65090 which is provided during
regmap init and hence it is not require to provide the information
about .num_reg_defaults_raw for caching. Cachign of register will
be done during access of registers.

This will avoid the warning
tps65090 4-0048: No cache defaults, reading back from HW

bug 1249589

Change-Id: Ida19a1fe8bdb9958db993f5506d92fb1655a03fb
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-on: http://git-master/r/256858
GVS: Gerrit_Virtual_Submit

5 years agoarm: pluto: power: AP40X add sysedp corecap table
Rick Song [Wed, 31 Jul 2013 18:02:10 +0000]
arm: pluto: power: AP40X add sysedp corecap table

For AP40x, use alternate corecap table for
gpu favor mode

Bug 1339878
Bug 1329643

Change-Id: Iceca82b36a4d17dc00d8e63c45591f0020f385ab
Signed-off-by: Rick Song <ricks@nvidia.com>
Reviewed-on: http://git-master/r/256432
Reviewed-by: Andy Carman <acarman@nvidia.com>
Tested-by: Andy Carman <acarman@nvidia.com>
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
Tested-by: Venkata (Muni) Anda <vanda@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Vandana Bansal <vandanab@nvidia.com>

5 years agoEDP: tegra: AP40X add option for core cap table
Rick Song [Wed, 31 Jul 2013 05:54:19 +0000]
EDP: tegra: AP40X add option for core cap table

ap40x, add option to select different sysedp core cap table

SYS_EDP_PROFILE_NORMAL: sysedp core cap table
SYS_EDP_PROFILE_FAVOR_GPU: sysedp core cap alternate

Bug 1329643
Bug 1339878

Change-Id: I3226205f0ad5a53d7985d351fbb8e5b26272bad9
Signed-off-by: Rick Song <ricks@nvidia.com>
Signed-off-by: Sivaram Nair <sivaramn@nvidia.com>
Reviewed-on: http://git-master/r/256138
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Andy Carman <acarman@nvidia.com>
Tested-by: Andy Carman <acarman@nvidia.com>
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>
Reviewed-by: Vandana Bansal <vandanab@nvidia.com>

5 years agoinput: misc: Fix self-test
Erik Lilliebjerg [Mon, 29 Jul 2013 18:42:18 +0000]
input: misc: Fix self-test

- Fix self-test HW restore after test.
- Fix register write failures due to PM cycle mode.

Bug 1327608
Bug 1313284
Bug 1311053
Bug 1315609

Change-Id: I9b9fb1afc8b9a10309e0224e56813bc9e400598c
Signed-off-by: Erik Lilliebjerg <elilliebjerg@nvidia.com>
Reviewed-on: http://git-master/r/255171
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Xiaohui Tao <xtao@nvidia.com>
Tested-by: Xiaohui Tao <xtao@nvidia.com>
Reviewed-by: Robert Collins <rcollins@nvidia.com>
Reviewed-by: Jon Mayo <jmayo@nvidia.com>

5 years agoarm: pluto: power: update sysedp core cap table to support ap40x
Rick Song [Wed, 31 Jul 2013 18:00:00 +0000]
arm: pluto: power: update sysedp core cap table to support ap40x

Update sysedp core cap table for ap40x.

Bug 1339878

Change-Id: I165d76afdedd7c20f753e6a9ab814f4dbe5323d4
Signed-off-by: Rick Song <ricks@nvidia.com>
Reviewed-on: http://git-master/r/256429
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Venkata (Muni) Anda <vanda@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Sivaram Nair <sivaramn@nvidia.com>

5 years agovideo: tegra: nvmap: enable iwb page pool if outer cache is present
Krishna Reddy [Wed, 20 Mar 2013 23:03:06 +0000]
video: tegra: nvmap: enable iwb page pool if outer cache is present

If outer cache is not present, wb and iwb refer to same memory type
and page pool is not necessary.

Bug 1328248

Change-Id: I86713ccb4eb8d41b8129dd241dc72218039bbd26
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/256270
Reviewed-by: Ahung Cheng <ahcheng@nvidia.com>
Tested-by: Ahung Cheng <ahcheng@nvidia.com>
Reviewed-by: Kirill Artamonov <kartamonov@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit

5 years agoARM: tegra: pluto: e1823 camera board support
Charlie Huang [Tue, 30 Jul 2013 17:46:19 +0000]
ARM: tegra: pluto: e1823 camera board support

add imx135 detection method, also enable dw9718 once detected.

bug 1307389

Change-Id: If38a478a5dd68fcc7453cb03917221a38d30a800
Signed-off-by: Charlie Huang <chahuang@nvidia.com>
Reviewed-on: http://git-master/r/255673
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Frank Chen <frankc@nvidia.com>
Reviewed-by: Thomas Cherry <tcherry@nvidia.com>

5 years agoASoC: Tegra: Use modem clock to driver codec
Lei Fan [Wed, 31 Jul 2013 09:01:52 +0000]
ASoC: Tegra: Use modem clock to driver codec

If modem is working as master device for T114, we need to use modem clock
to drive codec, otherwise vioce will be discontinuous. And The flow control
should be enabled to avoid losting voice in UL.

Bug 1299544

Change-Id: I7b60258e14bc0fae4d9d4fc9ca248cd6f6378faa
Signed-off-by: Lei Fan <leif@nvidia.com>
Reviewed-on: http://git-master/r/249603
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Scott Peterson <speterson@nvidia.com>

5 years agoARM: tegra: Assert reset when power ungating
Terje Bergstrom [Wed, 31 Jul 2013 05:34:10 +0000]
ARM: tegra: Assert reset when power ungating

Ensure unit is in reset when powering it back on.

Bug 1329416
Bug 1331777
Bug 1322046

Change-Id: I8ef6646a8fe2ae85fdb836f3222678e5f77a784c
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/256139
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mayuresh Kulkarni <mkulkarni@nvidia.com>
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>

5 years agoARM: tegra: macallan: update sys EDP data
Sivaram Nair [Thu, 25 Jul 2013 06:27:37 +0000]
ARM: tegra: macallan: update sys EDP data

(1) Changed system cap to 22W to address stability issues at lower
battery levels (<25%)
(2) Limited battery depletion states to 9W for performance fixes
(3) Added a OCV lut for emulating battery depletion when AC adaptor is
used (for performance measurements)

Bug 1331521
Bug 1306298

Change-Id: I0ae07c217b2e3c43dd786bfb93a5503a5c644ee2
Signed-off-by: Sivaram Nair <sivaramn@nvidia.com>
Reviewed-on: http://git-master/r/254902
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
Reviewed-by: Vandana Bansal <vandanab@nvidia.com>

5 years agousb: host: tegra: reduce delay in driver remove
Rohith Seelaboyina [Thu, 25 Jul 2013 11:51:56 +0000]
usb: host: tegra: reduce delay in driver remove

Following are taken care:
1. Add check conditions before updating the pm_qos nodes
2. Reduce delay in driver remove path to sync
ehci_bus_resume, ehci_bus_suspend, ehci_remove

Bug 1316354
Bug 1331078

Change-Id: I51e251474a9def65286e7a6f8099ad9cdc40d0ea
Signed-off-by: Rohith Seelaboyina <rseelaboyina@nvidia.com>
Reviewed-on: http://git-master/r/253427
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Venkat Moganty <vmoganty@nvidia.com>

5 years agovideo: tegra: dsi: Fix mipi_cal sequence
Ken Chang [Tue, 30 Jul 2013 09:14:27 +0000]
video: tegra: dsi: Fix mipi_cal sequence

remove the code specific to DSI_VS_0 from DSI auto cal sequence.

Bug 1329416

Change-Id: Ib0380b1f44ec7ed3c601b55833fc8a3e2e2d5648
Signed-off-by: Ken Chang <kenc@nvidia.com>
Reviewed-on: http://git-master/r/255544
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-by: Animesh Kishore <ankishore@nvidia.com>

5 years agoMedia: video: tegra: Fix Error message
Jeetesh Burman [Tue, 21 May 2013 08:46:18 +0000]
Media: video: tegra: Fix Error message

CAM_RSTN gpio line is acquired by ov9772 prior to imx091, hence while
kernel booting imx091 throws error EBUSY, since CAM_RSTN gpio line
is shared between ov9772 and imx091, therefore message appearing in
the log is not error, hence changing dev_err to dev_info.

Bug 1199045

Change-Id: I8353e56d8a16e8843d399b1cdd9a385806f8408d
Signed-off-by: Jeetesh Burman <jburman@nvidia.com>
Reviewed-on: http://git-master/r/231069
Reviewed-by: Riham Haidar <rhaidar@nvidia.com>
Tested-by: Riham Haidar <rhaidar@nvidia.com>

5 years agomedia: video: tegra: replace 12.6MP with 13MP mode
David Wang [Thu, 25 Jul 2013 21:03:37 +0000]
media: video: tegra: replace 12.6MP with 13MP mode

Update imx091 full resolution from 12.6MP to true
4:3 13MP (4208x3120) mode.

Bug 1182690

Change-Id: Ieaf67efe59f6bb02401affedbd2fcb1c7d6181b3
Signed-off-by: David Wang <davidw@nvidia.com>
Reviewed-on: http://git-master/r/253873
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Frank Chen <frankc@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bhushan Rayrikar <brayrikar@nvidia.com>
Reviewed-by: David Schalig <dschalig@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>