Commit graph

506,942 commits

Author SHA1 Message Date
Alex Deucher
7d5a33b071 drm/radeon: unify bpc handling
We were already storing the bpc (bits per color) information
in radeon_crtc, so just use that everywhere rather than
calculating it everywhere we use it.  This also allows us
to change it in one place if we ever want to override it.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-18 13:41:00 -05:00
Chao Bi
accb884b32 mei: set client's read_cb to NULL when flow control fails
In mei_cl_read_start(), if it fails to send flow control request, it
will release "cl->read_cb" but forget to set pointer to NULL, leaving
"cl->read_cb" still pointing to random memory, next time this client is
operated like mei_release(), it has chance to refer to this wrong pointer.

Fixes:  PANIC at kfree in mei_release()

[228781.826904] Call Trace:
[228781.829737]  [<c16249b8>] ? mei_cl_unlink+0x48/0xa0
[228781.835283]  [<c1624487>] mei_io_cb_free+0x17/0x30
[228781.840733]  [<c16265d8>] mei_release+0xa8/0x180
[228781.845989]  [<c135c610>] ? __fsnotify_parent+0xa0/0xf0
[228781.851925]  [<c1325a69>] __fput+0xd9/0x200
[228781.856696]  [<c1325b9d>] ____fput+0xd/0x10
[228781.861467]  [<c125cae1>] task_work_run+0x81/0xb0
[228781.866821]  [<c1242e53>] do_exit+0x283/0xa00
[228781.871786]  [<c1a82b36>] ? kprobe_flush_task+0x66/0xc0
[228781.877722]  [<c124eeb8>] ? __dequeue_signal+0x18/0x1a0
[228781.883657]  [<c124f072>] ? dequeue_signal+0x32/0x190
[228781.889397]  [<c1243744>] do_group_exit+0x34/0xa0
[228781.894750]  [<c12517b6>] get_signal_to_deliver+0x206/0x610
[228781.901075]  [<c12018d8>] do_signal+0x38/0x100
[228781.906136]  [<c1626d1c>] ? mei_read+0x42c/0x4e0
[228781.911393]  [<c12600a0>] ? wake_up_bit+0x30/0x30
[228781.916745]  [<c16268f0>] ? mei_poll+0x120/0x120
[228781.922001]  [<c1324be9>] ? vfs_read+0x89/0x160
[228781.927158]  [<c16268f0>] ? mei_poll+0x120/0x120
[228781.932414]  [<c133ca34>] ? fget_light+0x44/0xe0
[228781.937670]  [<c1324e58>] ? SyS_read+0x68/0x80
[228781.942730]  [<c12019f5>] do_notify_resume+0x55/0x70
[228781.948376]  [<c1a7de5d>] work_notifysig+0x29/0x30
[228781.953827]  [<c1a70000>] ? bad_area+0x5/0x3e

Cc: stable <stable@vger.kernel.org> # 3.9+
Signed-off-by: Chao Bi <chao.bi@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:07:36 -08:00
Tomas Winkler
e0270addae mei: txe: put pm callbacks under PM_SLEEP ifdef
PCI suspend resume callbacks should be defined
under CONFIG_PM_SLEEP

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:07:02 -08:00
Alexander Usyskin
16833257a1 mei: me: put pm callbacks under PM_SLEEP ifdef
This will eliminate compilation warning:

drivers/misc/mei/pci-me.c:303:12: warning: mei_me_pci_suspend defined but not used [-Wunused-function]
static int mei_me_pci_suspend(struct device *device)
drivers/misc/mei/pci-me.c:323:12: warning: mei_me_pci_resume defined but not used [-Wunused-function]
static int mei_me_pci_resume(struct device *device)

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:07:01 -08:00
Tomas Winkler
31f88f5739 mei: don't of list_for_each_entry_safe when not deleting
We can use simply list_for_each_entry if there is no
entry removal

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:06:08 -08:00
Alexander Usyskin
12d0066526 mei: use helper function to find me client by id
We already have a helper to find me client by id, let's
use it in all relevant places.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:05:33 -08:00
Alexander Usyskin
a27a76d3c0 mei: fix potential read outside of array bounds
Drop not-very-useful check and with this
fix read on index that can be after array end.
Cleanup search function as byproduct.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:05:07 -08:00
Tomas Winkler
64092858ac mei: wd and amthif use mei_cl_ api for dis/connection
Connect wd and amthif through regular mei_cl_connect API
as there is no reason to connect in asynchronous mode.
Also use mei_cl_is_connected in order to protect flows
instead of depending on wd_pending and amthif_timer

Now we can remove all the special handling in hbm layer

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:05:07 -08:00
Alexander Usyskin
285e299665 mei: hbm: revamp client connect and disconnection status
1. Return -ENOTTY on client connect if the requested client was not found
 on the enumeration list or the client was internally disabled, in the later
 case FW will return NOT_FOUND.
2. Return -EBUSY if the client cannot be connected because of resource
 contention
3. Change response status enum to have MEI_CL_ prefix
4. Add function to translate response status to a string
for more readable logging

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:05:07 -08:00
Tomas Winkler
487056932d mei: Remove all bus devices from the mei_dev list when stopping the MEI
When stopping the MEI, we should remove and potentially unregister
all bus devices queued on the mei_dev linked list.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 10:04:35 -08:00
Linus Torvalds
805937cf45 Miscellaneous ext4 bug fixes for v3.14
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJTA56tAAoJENNvdpvBGATwgrYQAKKWtbMT3xUHJE5Et4//0Pep
 Wn1c8icQDqz+Y1C0L6ELZbY8rQaYb2cQxuf6kJAa7KJHF4lVCa8LzW+VG6S+z+Fy
 +HSoi3eaS/IWzP+eZSE71u+MPN+tdURg5n305/YP40r7OH5lzsQT7LRKosifJwFc
 t+B7lz6XwpgPQ4ooDEMNAHwTaxcocSYlmQqRUgiMsEwqOvskm+CWswB+piPrOzaH
 kyNNIKwds6UH4hVhWEwPk7IrOS6VXe0IlgpkNZM1AOW6DWJ3SNF0qGeH5/e4pG+O
 xpv8UvVej7QJWMyLGPE8z1NBCZ7P57nFOfeiag3Xuvgl/q3WB+5Ye/UZk6DNUaAF
 h2SqS8D4rHuYB9n5izfIDtqJQZ69jbt2dDzTW9a88OVvN1UScaqh++2GeX2OJ/V8
 W6XkOE/g1atO7SyAOaH9RD3D/8+Dp3DZZxocZ4G+/SoKETF8/RboLxyeozoRima2
 FFPaqS105W7b9+QdG1avOlod+0E4wU8gw5kKKuFdAoAjFXaQ+u3R+87w5r8G5alU
 BO+Trf4CTWMLZQv40HEcgDEeF1Nggd48+3GG3oiUmch9qRAZjwyk6gxLvDo1673e
 CcAXpITLn3qPDVzWu/rba8uxRr95PFpXLQ9V8it8b9rWPogodoKg+A7v0Ro/n7bR
 MszulL/GyP1isllyO+Ku
 =XNON
 -----END PGP SIGNATURE-----

Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 fixes from Ted Ts'o:
 "Miscellaneous ext4 bug fixes for v3.14"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  jbd2: fix use after free in jbd2_journal_start_reserved()
  ext4: don't leave i_crtime.tv_sec uninitialized
  ext4: fix online resize with a non-standard blocks per group setting
  ext4: fix online resize with very large inode tables
  ext4: don't try to modify s_flags if the the file system is read-only
  ext4: fix error paths in swap_inode_boot_loader()
  ext4: fix xfstest generic/299 block validity failures
2014-02-18 10:04:09 -08:00
Fengguang Wu
00b28184b1 rtc: isl12057: use PTR_ERR_OR_ZERO to fix coccinelle warnings
drivers/rtc/rtc-isl12057.c:278:1-3: WARNING: PTR_RET can be used

 Use PTR_ERR_OR_ZERO rather than if(IS_ERR(...)) + PTR_ERR

Generated by: coccinelle/api/ptr_ret.cocci

CC: Arnaud Ebalard <arno@natisbad.org>
CC: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-02-18 18:00:21 +00:00
Andy Shevchenko
a735f9e224 Bluetooth: append new supported device to the list [0b05:17d0]
The device found on Asus Z87 Expert motherboard requires firmware to work
correctly.

T:  Bus=03 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0b05 ProdID=17d0 Rev=00.02
C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 09:54:20 -08:00
Andy Shevchenko
0b8800623d Bluetooth: sort the list of IDs in the source code
This will help to manage table of supported IDs.

There is no functional change.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 09:54:20 -08:00
Lucas De Marchi
b075dd40c9 Bluetooth: allocate static minor for vhci
Commit bfacbb9 (Bluetooth: Use devname:vhci module alias for virtual HCI
driver) added the module alias to hci_vhci module so it's possible to
create the /dev/vhci node. However creating an alias without
specifying the minor doesn't allow us to create the node ahead,
triggerring module auto-load when it's first accessed.

Starting with depmod from kmod 16 we started to warn if there's a
devname alias without specifying the major and minor.

Let's do the same done for uhid, kvm, fuse and others, specifying a
fixed minor. In systems with systemd as the init the following will
happen: on early boot systemd will call "kmod static-nodes" to read
/lib/modules/$(uname -r)/modules.devname and then create the nodes. When
first accessed these "dead" nodes will trigger the module loading.

Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 09:49:04 -08:00
Greg Kroah-Hartman
9d265649a8 Merge 3.14-rc3 into usb-next
We want the fixes in this branch as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 09:27:12 -08:00
J. R. Okajima
1406b916f4 nfsd: fix lost nfserrno() call in nfsd_setattr()
There is a regression in
	208d0ac 2014-01-07 nfsd4: break only delegations when appropriate
which deletes an nfserrno() call in nfsd_setattr() (by accident,
probably), and NFSD becomes ignoring an error from VFS.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2014-02-18 12:25:57 -05:00
Greg Kroah-Hartman
51d52b26e1 Merge 3.14-rc3 into tty-next
This is for the fixes in that release, we want them here too.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 09:09:09 -08:00
Johan Hedberg
2426f3a594 Bluetooth: Add convenience function for fetching IRKs
There are many situations where we need to check if an LE address is an
RPA and if so try to look up the IRK for it. To simplify such cases this
patch adds a convenience function for the job.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:21 -08:00
Johan Hedberg
a7ec73386c Bluetooth: Fix removing any IRKs when unpairing devices
When mgmt_unpair_device is called we should also remove any associated
IRKs. This patch adds a hci_remove_irk convenience function and ensures
that it's called when mgmt_unpair_device is called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:20 -08:00
Johan Hedberg
b7d448d74a Bluetooth: Fix completing SMP as peripheral when no keys are expected
When we're the acceptors (peripheral/slave) of an SMP procedure and
we've completed distributing our keys we should only stick around
waiting for keys from the remote side if any of the initiator
distribution bits were actually set. This patch fixes the
smp_distribute_keys function to clear the SMP context when this
situation occurs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:20 -08:00
Johan Hedberg
c51ffa0b2f Bluetooth: Fix hci_remove_ltk failure when no match is found
There is code (in mgmt.c) that depends on the hci_remove_ltk function to
fail if no match is found. This patch adds tracking of removed LTKs
(there can be up to two: one for master and another for slave) in the
hci_remove_ltk function and returns -ENOENT of no matches were found.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:20 -08:00
Johan Hedberg
35f7498a87 Bluetooth: Remove return values from functions that don't need them
There are many functions that never fail but still declare an integer
return value for no reason. This patch converts these functions to use a
void return value to avoid any confusion of whether they can fail or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:20 -08:00
Johan Hedberg
e0b2b27e62 Bluetooth: Fix missing address type check for removing LTKs
When removing Long Term Keys we should also be checking that the given
address type (public vs random) matches. This patch updates the
hci_remove_ltk function to take an extra parameter and uses it for
address type matching.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2014-02-18 08:58:20 -08:00
Greg Kroah-Hartman
91219a3b20 Merge 3.14-rc3 into driver-core-next
We want those fixes here for testing and development.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-18 08:57:10 -08:00
Kent Overstreet
85cbe1f88c bcache: Fix another compiler warning on m68k
Use a bigger hammer this time

Signed-off-by: Kent Overstreet <kmo@daterainc.com>
Cc: linux-stable <stable@vger.kernel.org>
2014-02-18 08:55:05 -08:00
Robert Baldyga
2e4c7553cd usb: gadget: f_fs: add aio support
This patch adds asynchronous I/O support for FunctionFS endpoint files.
It adds ffs_epfile_aio_write() and ffs_epfile_aio_read() functions responsible
for preparing AIO operations.

It also modifies ffs_epfile_io() function, adding aio handling code. Instead
of extending list of parameters of this function, there is new struct
ffs_io_data which contains all information needed to perform I/O operation.
Pointer to this struct replaces "buf" and "len" parameters of ffs_epfile_io()
function. Allocated buffer is freed immediately only after sync operation,
because in async IO it's freed in complete funcion. For each async operation
an USB request is allocated, because it allows to have more than one request
queued on single endpoint.

According to changes in ffs_epfile_io() function, functions ffs_epfile_write()
and ffs_epfile_read() are updated to use new API.

For asynchronous I/O operations there is new request complete function named
ffs_epfile_async_io_complete(), which completes AIO operation, and frees
used memory.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:02 -06:00
Robert Baldyga
23de91e970 usb: gadget: f_fs: add poll for endpoint 0
This patch adds poll function for file representing ep0.

Ability of read from or write to ep0 file is related with actual state of ffs:
- When desctiptors or strings are not written yet, POLLOUT flag is set.
- If there is any event to read, POLLIN flag is set.
- If setup request was read, POLLIN and POLLOUT flag is set, to allow
  send response (by performing I/O operation consistent with setup request
  direction) or set stall (by performing I/O operation opposite  setup
  request direction).

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Robert Baldyga
0a7b1f8a70 usb: gadget: f_fs: fix setup request handling
This patch fixes __ffs_ep0_queue_wait() function, which now returns number of
bytes transferred in USB request or error code in case of failure. This is
needed by ffs_ep0_read() function, when read data is copied to userspace.

It also cleans up code by removing usused variable ep0req_status.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Michal Nazarewicz
a7ecf0544f usb: gadget: functionfs: replace FFS_SETUP_STATUS with an inline function
The FFS_SETUP_STATUS macro could be trivialy replaced with an static
inline function but more importantly its name was tad confusing.
The name suggested it was a simple accessor macro but it actually
did change the state of the ffs_data structure perfomring
a FFS_SETUP_CANCELLED -> FFS_NO_SETUP transition.  The name of the
function -- ffs_setup_state_clear_cancelled -- should better
describe what the function actually does.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Michal Nazarewicz
e46318a000 usb: gadget: functionfs: fix typo in the enum variable
Since “cancelled” is spelled with two “l”s, rename FFS_SETUP_CANCELED
to FFS_SETUP_CANCELLED.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Andrzej Pietrasiewicz
da13a7738e usb: gadget: FunctionFS: use consistent naming with regard to ffs_lock
Consistently prefix function name with underscore if the function has to
be called with ffs_lock taken.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
10b69ce08c usb: gadget: FunctionFS: staticize functions used only in f_fs.c
ffs_alloc_dev and ffs_free_dev are used only in f_fs.c,
so make them static.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
ab13cb0c0d usb: gadget: code cleanup
Remove trailing whitespace

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Andrzej Pietrasiewicz
ea365922f9 usb: gadget: FunctionFS: dereference ffs_dev conditionally
ffs_dev->ffs_release_dev_callback should be accessed only if ffs_dev
is not NULL.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Markus Pargmann
de9db572fe usb: musb: dsps, use devm_kzalloc
Replace kzalloc by devm_kzalloc and remove the kfree() calls.

Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Wolfram Sang
30bbae9fad usb: dwc3: omap: don't check resource with devm_ioremap_resource
devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.

Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
Robert Baldyga
c9f721b2f3 usb: gadget: s3c-hsotg: stall ep0 in set_halt function
When s3c_hsotg_ep_sethalt() function is called for ep0 it should be stalled
in the same way that it is in s3c_hsotg_process_control() function, because
SET_HALT for ep0 is delayed response for setup request. Endpoint 0, if
halted, it doesn't need CLEAR_HALT because it clears "stalled" state
automatically when next setup request is received.

For this reason this patch moves code setting ep0 to "stalled" state to new
function named s3c_hsotg_stall_ep0() which is called in
s3c_hsotg_process_control() function as an immediate response for setup
request, and in s3c_hsotg_ep_sethalt() function as a delayed response for
setup request.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
7e98f60003 usb: gadget: printer: fix memory leak
When read data from g_printer, we see a Segmentation fault. eg:

Unable to handle kernel paging request at virtual address bf048000 pgd
= cf038000 [bf048000] *pgd=8e8cf811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM Modules linked in: bluetooth
rfcomm g_printer
CPU: 0    Not tainted  (3.4.43-WR5.0.1.9_standard #1)
PC is at __copy_to_user_std+0x310/0x3a8 LR is at 0x4c808010
pc : [<c036e990>]    lr : [<4c808010>]    psr: 20000013
sp : cf883ea8  ip : 80801018  fp : cf883f24
r10: bf04706c  r9 : 18a21205  r8 : 21953888
r7 : 201588aa  r6 : 5109aa16  r5 : 0705aaa2  r4 : 5140aa8a
r3 : 0000004c  r2 : 00000fdc  r1 : bf048000  r0 : bef5fc3c
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f038019  DAC: 00000015 Process
g_printer_test. (pid: 661, stack limit = 0xcf8822e8)
Stack: (0xcf883ea8 to 0xcf884000)
3ea0:                   bf047068 00001fff bef5ecb9 cf882000 00001fff bef5ecb9
3ec0: 00001fff 00000000 cf2e8724 bf044d3c 80000013 80000013 00000001
bf04706c
3ee0: cf883f24 cf883ef0 c012e5ac c0324388 c007c8ac c0046298 00008180
cf29b900
3f00: 00002000 bef5ecb8 cf883f68 00000003 cf882000 cf29b900 cf883f54
cf883f28
3f20: c012ea08 bf044b0c c000eb88 00000000 cf883f7c 00000000 00000000
00002000
3f40: bef5ecb8 00000003 cf883fa4 cf883f58 c012eae8 c012e960 00000001
bef60cb8
3f60: 000000a8 c000eb88 00000000 00000000 cf883fa4 00000000 c014329c
00000000
3f80: 000000d4 41af63f0 00000003 c000eb88 cf882000 00000000 00000000
cf883fa8
3fa0: c000e920 c012eaa4 00000000 000000d4 00000003 bef5ecb8 00002000
bef5ecb8
3fc0: 00000000 000000d4 41af63f0 00000003 b6f534c0 00000000 419f9000
00000000
3fe0: 00000000 bef5ecac 000086d9 41a986bc 60000010 00000003 0109608a
0088828a
Code: f5d1f07c e8b100f0 e1a03c2e e2522020 (e8b15300) ---[ end trace
97e2618e250e3377 ]--- Segmentation fault

The root cause is the dev->rx_buffers list has been broken.
When we call printer_read(), the following call tree is triggered:

printer_read()
	|
	+---setup_rx_reqs(req)
	|	|
	|	+---usb_ep_queue(req)
	|	|	|
	|	|	+---...
	|	|		|
	|	|		+---rx_complete(req).
	|	|
	|	+---add the req to dev->rx_reqs_active
	|
	+---while(!list_empty(&dev->rx_buffers)))

The route happens when we don't use DMA or fail to start DMA in USB
driver. We can see: in the case, in rx_complete() it will add the req
to dev->rx_buffers. meanwhile we see that we will also add the req to
dev->rx_reqs_active after usb_ep_queue() return, so this adding will
break the dev->rx_buffers out.

After, when we call list_empty() to check dev->rx_buffers in while(),
due to can't check correctly dev->rx_buffers, so the Segmentation fault
occurs when copy_to_user() is called.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
2c2b04253b usb: gadget: printer: fix possible deadlock
The problem occurs in follow path.

printer_read()
	|
	+---setup_rx_reqs()
		|
		+---usb_ep_queue()
			|
			+---...
				|
				+---rx_complete()

Although it is clear from code, we can't get it normally.
only when we enable some spin_lock debug config option, we can find it.
eg:
BUG: spinlock lockup on CPU#0, g_printer_test_/584
 lock: bf05e158, .magic: dead4ead, .owner: g_printer_test_/584, .owner_cpu: 0
[<c0016e1c>] (unwind_backtrace+0x0/0x104) from [<c067aef8>] (dump_stack+0x20/0x24)
[<c067aef8>] (dump_stack+0x20/0x24) from [<c0680bec>] (spin_dump+0x8c/0x94)
[<c0680bec>] (spin_dump+0x8c/0x94) from [<c039071c>] (do_raw_spin_lock+0x128/0x154)
[<c039071c>] (do_raw_spin_lock+0x128/0x154) from [<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70)
[<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70) from [<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer])
[<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer]) from [<c0480478>] (musb_g_giveback+0x78/0x88)
[<c0480478>] (musb_g_giveback+0x78/0x88) from [<c048060c>] (rxstate+0xa0/0x10c)
[<c048060c>] (rxstate+0xa0/0x10c) from [<c0480d50>] (musb_ep_restart+0x44/0x70)
[<c0480d50>] (musb_ep_restart+0x44/0x70) from [<c0480fe4>] (musb_gadget_queue+0xe8/0xf8)
[<c0480fe4>] (musb_gadget_queue+0xe8/0xf8) from [<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer])
[<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer]) from [<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer])
[<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer]) from [<c01387f0>] (vfs_read+0xb4/0x144)
[<c01387f0>] (vfs_read+0xb4/0x144) from [<c01388d0>] (sys_read+0x50/0x124)
[<c01388d0>] (sys_read+0x50/0x124) from [<c000e900>] (ret_fast_syscall+0x0/0x3c)

The root cause is that we use the same lock two time in a path, so to avoid
the deadlock, we need to unlock in setup_rx_reqs(), and only unlock.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
Sachin Kamat
236064c253 usb: gadget: s3c-hsudc: remove unused label
Fixes the following compilation warning:
drivers/usb/gadget/s3c-hsudc.c: In function ‘s3c_hsudc_probe’:
drivers/usb/gadget/s3c-hsudc.c:1347:1: warning: label ‘err_add_device’
defined but not used [-Wunused-label]

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Sachin Kamat
e362115a07 usb: gadget: s3c2410_udc: Fix build error
Pass value instead of address as expected by 'usb_ep_set_maxpacket_limit'.
Fixes the following compilation error introduced by commit e117e742d3
("usb: gadget: add "maxpacket_limit" field to struct usb_ep"):

drivers/usb/gadget/s3c2410_udc.c: In function ‘s3c2410_udc_reinit’:
drivers/usb/gadget/s3c2410_udc.c:1632:3: error:
cannot take address of bit-field ‘maxpacket’
   usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Julia Lawall
abcdcc29c6 usb: gadget: fix error return code
Set the return variable to an error code as done elsewhere in the function.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}

// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Jingoo Han
8b3bc14f2d usb: gadget: s3c-hsotg: use %pad for dma_addr_t
Use %pad for dma_addr_t to avoid the following build warnings
in printks.

drivers/usb/gadget/s3c-hsotg.c: In function 's3c_hsotg_start_req'
drivers/usb/gadget/s3c-hsotg.c:722:3: warning: format '%x' expects argument of type 'unsigned int' but argument 6 has type
'dma_addr_t' [-Wformat]
drivers/usb/gadget/s3c-hsotg.c:792:3: warning: format '%x' expects argument of type 'unsigned int' but argument 5 has type
'dma_addr_t' [-Wformat]

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:52 -06:00
Matt Porter
1a7ed5bec4 usb: gadget: s3c-hsotg: fix build on x86 and other architectures
The readsl and writesl I/O accessors are only defined on some
architectures. The driver currently depends on CONFIG_ARM because
the build breaks on x86, in particular. Switch to use of ioread32_rep
and iowrite32_rep to fix build on all architectures and remove the
CONFIG_ARM dependency.

Also update printk formatting to handle a long long dma_addr_t to avoid
warnings on !32-bit architectures.

Signed-off-by: Matt Porter <mporter@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:52 -06:00
Christian König
82dc62a31c drm/radeon: cleanup false positive lockup handling
Check always when we calculate the free dw, not just the first time.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-18 17:50:07 +01:00
Christian König
2d2fe3f9b6 drm/radeon: drop radeon_ring_force_activity
The reason for the false positives was fixed quite some time ago and since
most engines can still execute NOPs while being locked up it leads to false
negatives.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-18 17:50:00 +01:00
Christian König
ff212f25fe drm/radeon: drop drivers copy of the rptr
In all cases where it really matters we are using the read functions anyway.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-18 17:49:19 +01:00
Ivan Khoronzhuk
5a2abe192d ARM: dts: keystone: drop msmcsram clock node
At late init all unused clocks are disabled. So clocks that were not
get before will be gated. In Keysone 2 SoC we have at least one
necessary clock that is not used by any driver - "msmcsram". This
clock is necessary, because it supplies the Multicore Shared Memory
Controller (MSMC). MSMC is the coherency interconnect and all the
coherent masters are connected to it including devices which are not
under Linux OS control. MSMC clock should not be touched even in low
power states.

So drop the clock node, otherwise 'clk_ignore_unused' parameter will
disable the clock leading to system stall.

Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@ti.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
2014-02-18 11:40:42 -05:00
Florian Fainelli
2d1f7af3d6 usb: gadget: bcm63xx_udc: fix build failure on DMA channel code
Commit 3dc6475 ("bcm63xx_enet: add support Broadcom BCM6345 Ethernet")
changed the ENETDMA[CS] macros such that they are no longer macros, but
actual register offset definitions. The bcm63xx_udc driver was not
updated, and as a result, causes the following build error to pop up:

 CC      drivers/usb/gadget/u_ether.o
drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_write':
drivers/usb/gadget/bcm63xx_udc.c:642:24: error: called object '0' is not
a function
drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_reset_channel':
drivers/usb/gadget/bcm63xx_udc.c:698:46: error: called object '0' is not
a function
drivers/usb/gadget/bcm63xx_udc.c:700:49: error: called object '0' is not
a function

Fix this by updating usb_dmac_{read,write}l and usb_dmas_{read,write}l to
take an extra channel argument, and use the channel width
(ENETDMA_CHAN_WIDTH) to offset the register we want to access, hence
doing again what the macro implicitely did for us.

Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: Jonas Gorski <jogo@openwrt.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:34:54 -06:00