Commit graph

560,913 commits

Author SHA1 Message Date
Olof Johansson
3eb52a06d5 ARM: tegra: Devicetree changes for v4.4-rc1
Mostly a bunch of updates to the Toradex Apalis and Colibri platforms
 along with a couple of cleanup patches.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWJjUyAAoJEN0jrNd/PrOhSTUP/30KgnjyQI5SvMoj5brg5nHW
 NPAHVYoi8PtjFhf5vMUllgfTbU/nh+Q+AdXT2Hg6Fo9xRcNNquGGj+Ek2pLUg4Gn
 4L14EMDzJX9IR6uxEKSsRdG6W7Gw4hGWtyGVJATXxzA9OF0Ovte09cBZ9wYqhLU5
 y+cio34Jd3C/l91b+ywvrUhaCutAvtlAS+z0zZXEazA/Znjo1iKC0fIOARYOOBpi
 YuGaJ/Zo9AlFnkriD/Bkx6rHPjO8qL56mCVpGcOfalGMq4BIBF1y68R8oJ+zGPHz
 Cn5Gw1kAy5SAUM33yFbyl/pZbrKtWvn+omYQCJmYjRocW8brOr+k+LVXdB/PFCLG
 DI6Lgq/QuIkIwyrISmVD1lRDtDK2vObcsAD3J1No3GvmYtMIqMG2hIjsU7ZzMw0b
 5OtMrpcbgBtk91d+KsFdZv0ARAeg3dpHSvd1655kexBTZoMLgODOHP/pOHdltHTz
 zYK+Hc7XulaRxRiXCJGKYwGcCPL9iLMQdiN4dTCnMVSCysSgzX7KtXSlrTH4MPXr
 ZWZfqw/P4OiUFuwyPPaMq+l/Nr1AK18UJb4E1ZkmnLZ9ruObKHtV3/Y6Kf0ApgLW
 XQLQG/nY3QpIZVP9qKG6Tc+RV/aH3cTXD2Vb2ZG4EC6OVONr4USLERRVkDVXTd5h
 VaDZKW1rpb+WCxL5o3Uh
 =1DQA
 -----END PGP SIGNATURE-----

Merge tag 'tegra-for-4.4-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into next/dt

ARM: tegra: Devicetree changes for v4.4-rc1

Mostly a bunch of updates to the Toradex Apalis and Colibri platforms
along with a couple of cleanup patches.

* tag 'tegra-for-4.4-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (25 commits)
  ARM: tegra: Use consistent indentation for SATA node
  ARM: tegra: colibri-eval: Fix power/wakeup key
  ARM: tegra: colibri-eval: Add comment concerning SD/MMC
  ARM: tegra: colibri-eval: Fix vendor string of M41T0M6 RTC
  ARM: tegra: colibri: Properly align pin names
  ARM: tegra: colibri: Replace eMMC label by comment
  ARM: tegra: colibri: Activate STMPE811 touch controller
  ARM: tegra: colibri: Add touch pen interrupt pin muxing
  ARM: tegra: colibri: Fix comment about 3v3 fixed supply
  ARM: tegra: colibri: Add pin muxing for on-module power I2C
  ARM: tegra: colibri: Improve comment about thermal alert pin
  ARM: tegra: colibri: Fix HDMI supplies
  ARM: tegra: colibri: Update hardware revisions compatibility
  ARM: tegra: apalis-eval: Fix power/wakeup key
  ARM: tegra: apalis-eval: Fix backlight PWM comment
  ARM: tegra: apalis-eval: Set OTG dr_mode
  ARM: tegra: apalis-eval: Enable HDA controller
  ARM: tegra: apalis: Properly align pin names
  ARM: tegra: apalis: Add digital audio pin muxing
  ARM: tegra: apalis: Add comment concerning eMMC
  ...

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-10-26 09:53:14 +09:00
Olof Johansson
a83e682ee2 ARM: tegra: Default configuration updates for v4.4-rc1
Enable touchscreen and audio support on Toradex Colibri platforms.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWJj4RAAoJEN0jrNd/PrOhO9YP/Rr5wwioLC1/jjipyUueeU05
 jw70ngx5UpHexK7zeqdbPn+E80iVggqyTRhxav6fwTbcXNHkrVa1tpxy5aLTZyNJ
 GGjWOiHicEhapZZyh10A3/r9SL5vKaIjXGlKxFwEiraT1eEeO/H4yTSSBPGeMVEz
 ZfKNypWBpJmkzWaPMjcWeaCQyxuhQDwpwVbURnVVWN3ONik6OgTnr6clOQww2sVp
 rwNw+Cz57gSJU9+udtH5b34ugg24tgblLYoh6JYPZomkc8nhGgaLFCBXsC1cdwwJ
 fV/NvW/qlw2JU4tv7O7L2amO/n0CmcS6iZFqhRykj5wA0oOyHYJp1fsiV9tdmk2p
 ywn4wVwRhnHXnYwmydtylmW2AZSrncHK1KcuI5ZAOq6/C7KK/mJJJ6ROMNJr8jz2
 72YFOuRBw2zSNKKfNGa/97vJvk8kWdOzkz7P0SXj6F9CrgVGtTSUHMBhTJbQFyX0
 LqHEyFmnVmCzGRyEQbZwGsxQs23kekG+qKeWRCS+0c3PJn5G01XcK/n0ZWgwraiz
 cM1U5TmebRuZSKHybZfy1/WqAO7MOUJ+4knTPZcdERaxc3SClFnBRHXNOzaTe2VL
 vFYU6gvvGT8Yc5ZkjIaTdDZXdZM0YfKLIDKQjU992LXg/dgYNt//UU+DKFG/5daR
 6DBlbNBCQNRAxlAsYX0o
 =sAW5
 -----END PGP SIGNATURE-----

Merge tag 'tegra-for-4.4-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into next/defconfig

ARM: tegra: Default configuration updates for v4.4-rc1

Enable touchscreen and audio support on Toradex Colibri platforms.

* tag 'tegra-for-4.4-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
  ARM: tegra: Update multi_v7_defconfig
  ARM: tegra: Update default configuration
  ARM: tegra: Rebuild default configuration on v4.3-rc1

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-10-26 09:47:19 +09:00
Olof Johansson
c2c2b3d357 ARM: tegra: Core SoC changes for v4.4-rc1
A single patch to restore rfkill support on AC100.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJWJjTwAAoJEN0jrNd/PrOhZoAP/RProYcLUmaeegpue3lnEUVe
 Zl1RnuuDX0y/LKshB+eRm2TYJo5ihPqkRXigcWqbN6Z03dgXhMql3gU/bllt6eDq
 7PjT8znRbmqfapKlMHgQAoaM0ZhbkczNHDK9exITx98twxqy2+hhgUocIbQnZE4A
 VtS8bPzfBt623lqbynhHPYtZcZSInMxoL3gefzneQ/Hb80Ys6dkhP8pmn3JZsElB
 rRgNKmFddNmLVRxNCZ0HUPPK6+WyBC/tzVy2yMGzQufzmELxwjgnzk5/f0gjf9oJ
 oB0yedgOfrENEN75rUxfgwcNXyg6et3GoNdzQ69pBPZoi7ODD6lu8lDb6hEXbfdV
 imt0Wcplf6J4KdQcxnEuY9pluM7nJGVEiA75RC+fJt8jUS5LIgguc6Aj/lkeOEGw
 U7oWbHGzi6K1gIZKXQuGw/2alTJ3XFTZmBROndsaGzvdD2GKKSsUHOGng6tAYaV2
 S1VapoPZY62V51hW02ujF/5F3s4Iuu/Ysi9lF6aplX1RZmk0Oo4GR40JgYSSkH8u
 kk3YISVNA15EusbSOU9zSBNvwWeNDYzadiKoS5llTPB27IhL7avvAZWTEhOjGrr5
 AMndFT0ihTOwIoBNx+P2t+Hk5cwcNBlw57MSiQUlLvBIPDzS2Xc6kb8medaMfTcR
 j++5q15wBgxfiAAQ1MRM
 =5xhD
 -----END PGP SIGNATURE-----

Merge tag 'tegra-for-4.4-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into next/soc

ARM: tegra: Core SoC changes for v4.4-rc1

A single patch to restore rfkill support on AC100.

* tag 'tegra-for-4.4-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
  ARM: tegra: paz00: use con_id's to refer GPIO's in gpiod_lookup table

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-10-26 09:45:56 +09:00
Olof Johansson
44024ce036 More SoC changes for 4.4:
- a great fix for PM/suspend/resume
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJWJV2aAAoJEKbNnwlvZCyzXLQQAIKTqxfAmatF5jkWUbqgxZiz
 1F9PDJ3Vt6Wnw5vVMMs0MVOBMIahEz+2wx7F35IMS22VCNn4VBcfZdrzBg+/iofT
 faLP23emmEKeprLKp56ct6utDQJoiu5f5X2KT+YL+iXfW27MBRhr7iqA6c2oJ0Vh
 9u8ilVUOesg8ZMCom6ftIqPMxIfYssZQbb6D6Dx4N9UhT7IEBEm19GuYRAPqoBo3
 TnAHn/8PIO3/4SaMvlZIOmgqihxDYeBVVIsXGOS+NN/7/mcsmGHxsdWuI1JQNhHt
 RwmLX8FdI5dqO/I06h+e7Bt0cQRudJiXM9iH0yLNttFjPQP5XDOzp0b42alQ0cyG
 Qfc5r98rg7NSWsz1+xIrA0kuVE2G8lNxNbdIiC9RiCCNVc7gMetkQdZVeoxrTs20
 ekwLkRFaz2uj53x7Q4RK+TyCB39PruTgy0wWJZER7Dezqww3Nw99enjMi7MecsM+
 N+MMUAVlSxHlZAZze7jyRab97bORF7GGqR2msFvJI+pNyuhZZhZ9KeaE05XM+Pzj
 lvortvGYW2IwByy7tK3j1foOwm4pNuc1ubw5NKBoKKg53algwn5t25AwfHpMmIiO
 zJrSqbTqphqvznOJzSO4Hg+/zSESNLdjglCo49ITwNBeTc/Vg0urq3zAnCvNwB0P
 scarMY6dHcz0c7mNoGCm
 =Zjpj
 -----END PGP SIGNATURE-----

Merge tag 'at91-ab-soc2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into next/soc

More SoC changes for 4.4:
 - a great fix for PM/suspend/resume

* tag 'at91-ab-soc2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
  ARM: at91: pm: at91_pm_suspend_in_sram() must be 8-byte aligned

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-10-26 09:44:48 +09:00
Olof Johansson
98376f6af8 defconfig update for 4.4:
- Add sama5d2 and its peripherals to sama5_defconfig and multi_v7_defconfig
 - Trivial savedefconfig updates to at91_dt_defconfig and sama5_defconfig
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJWJUqOAAoJEKbNnwlvZCyzn8MQAMRloaLeoQVRkfBhixdRI3Pr
 FMUl/fbQJQib/tWytsSIXktEy67MesHeOxI0kSeN1zeuqzEUswvsuShV7ibuoBl9
 r+mE9lJqp7B3qJu4mD+yfH39v79zmGyCkop9wWkdiSSmxZinBc6JipfeH5k4U97/
 3965uRnI5+mKz4UKyEAxnOz6OKVjkOc5ZwR9X1VGpaVJBjl7hYHQOVTVzR3s4phg
 +b51+hzVdBMaIBgPaE56Nqzn0ZecR9aLV2hCTpL4Avkqx7A/TiQdmtrjpOivMFYK
 OracOxjTk2yAmDGaibMYDy7l67uTY/jBW5z40LVfSNa/W4y+/t2JfocAbW04Eete
 MVvGfaBFG1lvrlBDy0+q4HzqnkKFGvyG3OaFinL+CgSXOOQ2o3nD89WWZIY9rUXa
 EZhTkz0f+cPs5pPJjY4hFwtMvuSYSt/qRBpTeBtRM5A8GIHYroCNv9Ng1pJPCIlh
 YM1mqMSGWE20Navf17QfVKoJW7zLZ5THWeGAo/bWXYp4y/PRtQNQ1/mr43nBuYe9
 o4B5QELGgLkoFp1NTyfR+I4TwRFux7Oy1Cg17F2J2Lr1FxY4foVtW91+0UP/pg4g
 I7zUzIa8khqWcK92uLRX3ayicuRPP8cTJd4Bwe2A2PEV8h8ap7AK6K2ZcQHqTKs6
 3Ee/qG3jNzVdLROLerlK
 =urST
 -----END PGP SIGNATURE-----

Merge tag 'at91-ab-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into next/defconfig

defconfig update for 4.4:
- Add sama5d2 and its peripherals to sama5_defconfig and multi_v7_defconfig
- Trivial savedefconfig updates to at91_dt_defconfig and sama5_defconfig

* tag 'at91-ab-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
  ARM: multi_v7_defconfig: Add Atmel SDHCI device
  ARM: multi_v7_defconfig: Add Atmel Flexcom device
  ARM: multi_v7_defconfig: Add Atmel SAMA5D2 SoC
  ARM: at91/defconfig: add sama5d2 and its new devices to sama5 defconfig
  ARM: at91/defconfig: update at91_dt defconfig
  ARM: at91/defconfig: update sama5 defconfig

Signed-off-by: Olof Johansson <olof@lixom.net>
2015-10-26 09:44:07 +09:00
Lucas Stach
209da39154 irqchip/tegra: Propagate IRQ type setting to parent
The LIC doesn't deal with the different types of interrupts itself
but needs to forward calls to set the appropriate type to its parent
IRQ controller.

Without this fix all IRQs routed through the LIC will stay at the
initial EDGE type, while most of them should actually be level triggered.

Fixes: 1eec582158 "irqchip: tegra: Add Tegra210 support"
Signed-off-by: Lucas Stach <dev@lynxeye.de>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Alexandre Courbot <gnurou@gmail.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: <stable@vger.kernel.org> # 4.1
Link: http://lkml.kernel.org/r/1445787552-13062-1-git-send-email-dev@lynxeye.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-10-26 09:20:59 +09:00
Thomas Petazzoni
353d6d6c82 irqchip/armada-370-xp: Fix regression by clearing IRQ_NOAUTOEN
Commit d17cab4451 ("irqchip: Kill off set_irq_flags usage") changed
the code of armada_370_xp_mpic_irq_map() from using set_irq_flags() to
irq_set_probe().

While the commit log seems to imply that there are no functional
changes, there are indeed functional changes introduced by this
commit: the IRQ_NOAUTOEN flag is no longer cleared. This functional
change causes a regression on Armada XP, which no longer works
properly after suspend/resume because per-CPU interrupts remain
disabled.

Due to how the hardware registers work, the irq-armada-370-xp cannot
simply save/restore a bunch of registers at suspend/resume to make
sure that the interrupts remain in the same state after
resuming. Therefore, it relies on the kernel to say whether the
interrupt is disabled or not, using the irqd_irq_disabled()
function. This was all working fine while the IRQ_NOAUTOEN flag was
cleared.

With the change introduced by Rob Herring in d17cab4451, the
IRQ_NOAUTOEN flag is now set for all interrupts. irqd_irq_disabled()
returns false for per-CPU interrupts, and therefore our per-CPU
interrupts are no longer re-enabled after resume.

This commit works around this problem by clearing again the
IRQ_NOAUTOEN flags, so that we are back to the situation we had before
commit d17cab4451. This work around is proposed as a minimal fix
for the problem, while a better long-term solution is being worked on.

Fixes: d17cab4451 "irqchip: Kill off set_irq_flags usage"
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1445435295-19956-1-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-10-26 09:19:06 +09:00
Rich Felker
4ac3131110 fs/binfmt_elf_fdpic.c: fix brk area overlap with stack on NOMMU
On NOMMU archs, the FDPIC ELF loader sets up the usable brk range to
overlap with all but the last PAGE_SIZE bytes of the stack. This leads
to catastrophic memory reuse/corruption if brk is used. Fix by setting
the brk area to zero size to disable its use.

Signed-off-by: Rich Felker <dalias@libc.org>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2015-10-26 09:02:32 +10:00
Rafael J. Wysocki
ba210f5de4 Merge branch 'acpi-pci'
* acpi-pci:
  ia64/PCI/ACPI: Use common interface to support PCI host bridge
  x86/PCI/ACPI: Use common interface to support PCI host bridge
  ACPI/PCI: Reset acpi_root_dev->domain to 0 when pci_ignore_seg is set
  PCI/ACPI: Add interface acpi_pci_root_create()
  ia64/PCI: Use common struct resource_entry to replace struct iospace_resource
  ia64/PCI/ACPI: Use common ACPI resource parsing interface for host bridge
  ACPI/PCI: Enhance ACPI core to support sparse IO space
2015-10-25 22:55:31 +01:00
Rafael J. Wysocki
e3ed766b49 Merge branch 'acpi-init'
* acpi-init:
  clocksource: cosmetic: Drop OF 'dependency' from symbols
  clocksource / arm_arch_timer: Convert to ACPI probing
  clocksource: Add new CLKSRC_{PROBE,ACPI} config symbols
  clocksource / ACPI: Add probing infrastructure for ACPI-based clocksources
  irqchip / GIC: Convert the GIC driver to ACPI probing
  irqchip / ACPI: Add probing infrastructure for ACPI-based irqchips
  ACPI: Add early device probing infrastructure
2015-10-25 22:55:14 +01:00
Rafael J. Wysocki
343ccb040e Merge branches 'acpi-scan', 'acpi-tables', 'acpi-ec' and 'acpi-assorted'
* acpi-scan:
  ACPI / scan: use kstrdup_const() in acpi_add_id()
  ACPI / scan: constify struct acpi_hardware_id::id
  ACPI / scan: constify first argument of struct acpi_scan_handler::match

* acpi-tables:
  ACPI / tables: test the correct variable
  x86, ACPI: Handle apic/x2apic entries in MADT in correct order
  ACPI / tables: Add acpi_subtable_proc to ACPI table parsers

* acpi-ec:
  ACPI / EC: Fix a race issue in acpi_ec_guard_event()
  ACPI / EC: Fix query handler related issues

* acpi-assorted:
  ACPI: change acpi_sleep_proc_init() to return void
  ACPI: change init_acpi_device_notify() to return void
2015-10-25 22:54:46 +01:00
Rafael J. Wysocki
ab736d7dc1 Merge branch 'device-properties'
* device-properties:
  ACPI / property: Fix subnode lookup scope for data-only subnodes
  acpi-dma: Add support for "dma-names" device property
  device property: Add fwnode_property_match_string()
  ACPI / property: Extend device_get_next_child_node() to data-only nodes
  ACPI / gpio: Split acpi_get_gpiod_by_index()
  ACPI / property: Extend fwnode_property_* to data-only subnodes
  ACPI / property: Expose data-only subnodes via sysfs
  ACPI / property: Add support for data-only subnodes
  ACPI / property: Add routine for extraction of _DSD properties
2015-10-25 22:51:48 +01:00
Greg Kroah-Hartman
0bbc367e21 Merge 4.3-rc7 into usb-next
We want the USB and other fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 06:39:46 +09:00
Kuba Pawlak
1da5537ecc Bluetooth: Fix locking issue during fast SCO reconnection.
When SCO connection is requested and disconnected fast, there is a change
that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm.
When this happens struct sock sk may be removed but a pointer to it is still
held in sco_conn_ready, where embedded spinlock is used. If it is used, but
struct sock has been removed, it will crash.

Block connection object, which will prevent struct sock from being removed
and give connection process chance to finish.

BUG: spinlock bad magic on CPU#0, kworker/u:2H/319
 lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160
Pid: 319, comm: kworker/u:2H Tainted: G           O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
Call Trace:
 [<c1155659>] ? do_raw_spin_lock+0x19/0xe9
 [<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth]
 [<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
 [<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
 [<c1041095>] ? finish_task_switch+0x50/0x89
 [<c1349a2e>] ? __schedule+0x638/0x6b8
 [<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
 [<c103760a>] ? queue_delayed_work_on+0x21/0x2a
 [<c1035df9>] ? process_one_work+0x157/0x21b
 [<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
 [<c1036217>] ? worker_thread+0x16e/0x20a
 [<c10360a9>] ? manage_workers+0x1cf/0x1cf
 [<c103a0ef>] ? kthread+0x8d/0x92
 [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
 [<c103a062>] ? __init_kthread_worker+0x24/0x24
BUG: unable to handle kernel NULL pointer dereference at   (null)
IP: [<  (null)>]   (null)
*pdpt = 00000000244e1001 *pde = 0000000000000000
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e
Pid: 319, comm: kworker/u:2H Tainted: G           O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000
ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000)
Stack:
 fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a
 e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c
 e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7
Call Trace:
 [<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth]
 [<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
 [<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
 [<c1041095>] ? finish_task_switch+0x50/0x89
 [<c1349a2e>] ? __schedule+0x638/0x6b8
 [<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
 [<c103760a>] ? queue_delayed_work_on+0x21/0x2a
 [<c1035df9>] ? process_one_work+0x157/0x21b
 [<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
 [<c1036217>] ? worker_thread+0x16e/0x20a
 [<c10360a9>] ? manage_workers+0x1cf/0x1cf
 [<c103a0ef>] ? kthread+0x8d/0x92
 [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
 [<c103a062>] ? __init_kthread_worker+0x24/0x24
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14
CR2: 0000000000000000
---[ end trace 942a6577c0abd725 ]---

Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25 21:06:39 +01:00
Kuba Pawlak
435c513369 Bluetooth: Fix locking issue on SCO disconnection
Thread handling SCO disconnection may get preempted in '__sco_sock_close'
after dropping a reference to hci_conn but before marking this as NULL
in associated struct sco_conn. When execution returs to this thread,
this connection will possibly be released, resulting in kernel crash

Lock connection before this point.

BUG: unable to handle kernel NULL pointer dereference at   (null)
IP: [<fb770ab9>] __sco_sock_close+0x194/0x1ff [bluetooth]
*pdpt = 0000000023da6001 *pde = 0000000000000000
Oops: 0002 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid iwlmvm(O) hide
Pid: 984, comm: bluetooth Tainted: G           O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<fb770ab9>] EFLAGS: 00010282 CPU: 2
EIP is at __sco_sock_close+0x194/0x1ff [bluetooth]
EAX: 00000000 EBX: e49d7600 ECX: ef1ec3c2 EDX: 000000c3
ESI: e4c12000 EDI: 00000000 EBP: ef1edf5c ESP: ef1edf4c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
CR0: 80050033 CR2: 00000000 CR3: 23da7000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process bluetooth (pid: 984, ti=ef1ec000 task=e47f2550 task.ti=ef1ec000)
Stack:
 e4c120d0 e49d7600 00000000 08421a40 ef1edf70 fb770b7a 00000002 e8a4cc80
 08421a40 ef1ec000 c12966b1 00000001 00000000 0000000b 084954c8 c1296b6c
 0000001b 00000002 0000001b 00000002 00000000 00000002 b2524880 00000046
Call Trace:
 [<fb770b7a>] ? sco_sock_shutdown+0x56/0x95 [bluetooth]
 [<c12966b1>] ? sys_shutdown+0x37/0x53
 [<c1296b6c>] ? sys_socketcall+0x12e/0x1be
 [<c134ae7e>] ? sysenter_do_call+0x12/0x26
 [<c1340000>] ? ip_vs_control_net_cleanup+0x46/0xb1
Code: e8 90 6b 8c c5 f6 05 72 5d 78 fb 04 74 17 8b 46 08 50 56 68 0a fd 77 fb 68 60 5d 78 fb e8 68 95 9e c5 83 c4 10 8b 83 fc 01 00 00 <c7> 00 00 00 00 00 eb 32 ba 68 00 00 0b
EIP: [<fb770ab9>] __sco_sock_close+0x194/0x1ff [bluetooth] SS:ESP 0068:ef1edf4c
CR2: 0000000000000000
---[ end trace 47fa2f55a9544e69 ]---

Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25 21:06:39 +01:00
Kuba Pawlak
75e34f5cf6 Bluetooth: Fix crash on SCO disconnect
When disconnecting audio from the phone's side, it may happen, that
a thread handling HCI message 'disconnection complete' will get preempted
in 'sco_conn_del' before calling 'sco_sock_kill', still holding a pointer
to struct sock sk. Interrupting thread started in 'sco_sock_shutdown' will
carry on releasing resources and will eventually release struct sock.
When execution goes back to first thread it will call sco_sock_kill using
now invalid pointer to already destroyed socket.

Fix is to grab a reference to the socket a release it after calling
'sco_sock_kill'.

[  166.358213] BUG: unable to handle kernel paging request at 7541203a
[  166.365228] IP: [<fb6e8bfb>] bt_sock_unlink+0x1a/0x38 [bluetooth]
[  166.372068] *pdpt = 0000000024b19001 *pde = 0000000000000000
[  166.378483] Oops: 0002 [#1] PREEMPT SMP
[  166.382871] Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) btintel(O) cdc_acm bluetooth(O) arc4 uinput hid_multitouch iwlmvm(O) usbhid hide
[  166.424233] Pid: 338, comm: kworker/u:2H Tainted: G           O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
[  166.435112] EIP: 0060:[<fb6e8bfb>] EFLAGS: 00010206 CPU: 0
[  166.441259] EIP is at bt_sock_unlink+0x1a/0x38 [bluetooth]
[  166.447382] EAX: 632e6563 EBX: e4bfc600 ECX: e466d4d3 EDX: 7541203a
[  166.454369] ESI: fb7278ac EDI: e4d52000 EBP: e4669e20 ESP: e4669e0c
[  166.461366]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[  166.467391] CR0: 8005003b CR2: 7541203a CR3: 24aba000 CR4: 001007f0
[  166.474387] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[  166.481375] DR6: ffff0ff0 DR7: 00000400
[  166.485654] Process kworker/u:2H (pid: 338, ti=e4668000 task=e466e030 task.ti=e4668000)
[  166.494591] Stack:
[  166.496830]  e4bfc600 e4bfc600 fb715c28 e4717ee0 e4d52000 e4669e3c fb715cf3 e4bfc634
[  166.505518]  00000068 e4d52000 e4c32000 fb7277c0 e4669e6c fb6f2019 0000004a 00000216
[  166.514205]  e4660101 e4c32008 02000001 00000013 e4d52000 e4c32000 e3dc9240 00000005
[  166.522891] Call Trace:
[  166.525654]  [<fb715c28>] ? sco_sock_kill+0x73/0x9a [bluetooth]
[  166.532295]  [<fb715cf3>] ? sco_conn_del+0xa4/0xbf [bluetooth]
[  166.538836]  [<fb6f2019>] ? hci_disconn_complete_evt.clone.55+0x1bd/0x205 [bluetooth]
[  166.547609]  [<fb6f73d3>] ? hci_event_packet+0x297/0x223c [bluetooth]
[  166.554805]  [<c10416da>] ? dequeue_task+0xaf/0xb7
[  166.560154]  [<c1041095>] ? finish_task_switch+0x50/0x89
[  166.566086]  [<c1349a2e>] ? __schedule+0x638/0x6b8
[  166.571460]  [<fb6eb906>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[  166.577975]  [<c1035df9>] ? process_one_work+0x157/0x21b
[  166.583933]  [<fb6eb84d>] ? hci_cmd_work+0xef/0xef [bluetooth]
[  166.590448]  [<c1036217>] ? worker_thread+0x16e/0x20a
[  166.596088]  [<c10360a9>] ? manage_workers+0x1cf/0x1cf
[  166.601826]  [<c103a0ef>] ? kthread+0x8d/0x92
[  166.606691]  [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[  166.613010]  [<c103a062>] ? __init_kthread_worker+0x24/0x24
[  166.619230] Code: 85 63 ff ff ff 31 db 8d 65 f4 89 d8 5b 5e 5f 5d c3 56 8d 70 04 53 89 f0 89 d3 e8 7e 17 c6 c5 8b 53 28 85 d2 74 1a 8b 43 24 85 c0 <89> 02 74 03 89 50 04 c7 43 28 00 00 00
[  166.640501] EIP: [<fb6e8bfb>] bt_sock_unlink+0x1a/0x38 [bluetooth] SS:ESP 0068:e4669e0c
[  166.649474] CR2: 000000007541203a
[  166.653420] ---[ end trace 0181ff2c9e42d51e ]---
[  166.658609] note: kworker/u:2H[338] exited with preempt_count 1

Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25 21:06:39 +01:00
Julia Lawall
c0859e2f4c Bluetooth: btmrvl: add missing of_node_put
for_each_compatible_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression e;
local idexpression n;
@@

 for_each_compatible_node(n, ...) {
   ... when != of_node_put(n)
       when != e = n
(
   return n;
|
+  of_node_put(n);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25 21:03:29 +01:00
Filipe Manana
b06c4bf5c8 Btrfs: fix regression running delayed references when using qgroups
In the kernel 4.2 merge window we had a big changes to the implementation
of delayed references and qgroups which made the no_quota field of delayed
references not used anymore. More specifically the no_quota field is not
used anymore as of:

  commit 0ed4792af0 ("btrfs: qgroup: Switch to new extent-oriented qgroup mechanism.")

Leaving the no_quota field actually prevents delayed references from
getting merged, which in turn cause the following BUG_ON(), at
fs/btrfs/extent-tree.c, to be hit when qgroups are enabled:

  static int run_delayed_tree_ref(...)
  {
     (...)
     BUG_ON(node->ref_mod != 1);
     (...)
  }

This happens on a scenario like the following:

  1) Ref1 bytenr X, action = BTRFS_ADD_DELAYED_REF, no_quota = 1, added.

  2) Ref2 bytenr X, action = BTRFS_DROP_DELAYED_REF, no_quota = 0, added.
     It's not merged with Ref1 because Ref1->no_quota != Ref2->no_quota.

  3) Ref3 bytenr X, action = BTRFS_ADD_DELAYED_REF, no_quota = 1, added.
     It's not merged with the reference at the tail of the list of refs
     for bytenr X because the reference at the tail, Ref2 is incompatible
     due to Ref2->no_quota != Ref3->no_quota.

  4) Ref4 bytenr X, action = BTRFS_DROP_DELAYED_REF, no_quota = 0, added.
     It's not merged with the reference at the tail of the list of refs
     for bytenr X because the reference at the tail, Ref3 is incompatible
     due to Ref3->no_quota != Ref4->no_quota.

  5) We run delayed references, trigger merging of delayed references,
     through __btrfs_run_delayed_refs() -> btrfs_merge_delayed_refs().

  6) Ref1 and Ref3 are merged as Ref1->no_quota = Ref3->no_quota and
     all other conditions are satisfied too. So Ref1 gets a ref_mod
     value of 2.

  7) Ref2 and Ref4 are merged as Ref2->no_quota = Ref4->no_quota and
     all other conditions are satisfied too. So Ref2 gets a ref_mod
     value of 2.

  8) Ref1 and Ref2 aren't merged, because they have different values
     for their no_quota field.

  9) Delayed reference Ref1 is picked for running (select_delayed_ref()
     always prefers references with an action == BTRFS_ADD_DELAYED_REF).
     So run_delayed_tree_ref() is called for Ref1 which triggers the
     BUG_ON because Ref1->red_mod != 1 (equals 2).

So fix this by removing the no_quota field, as it's not used anymore as
of commit 0ed4792af0 ("btrfs: qgroup: Switch to new extent-oriented
qgroup mechanism.").

The use of no_quota was also buggy in at least two places:

1) At delayed-refs.c:btrfs_add_delayed_tree_ref() - we were setting
   no_quota to 0 instead of 1 when the following condition was true:
   is_fstree(ref_root) || !fs_info->quota_enabled

2) At extent-tree.c:__btrfs_inc_extent_ref() - we were attempting to
   reset a node's no_quota when the condition "!is_fstree(root_objectid)
   || !root->fs_info->quota_enabled" was true but we did it only in
   an unused local stack variable, that is, we never reset the no_quota
   value in the node itself.

This fixes the remainder of problems several people have been having when
running delayed references, mostly while a balance is running in parallel,
on a 4.2+ kernel.

Very special thanks to Stéphane Lesimple for helping debugging this issue
and testing this fix on his multi terabyte filesystem (which took more
than one day to balance alone, plus fsck, etc).

Also, this fixes deadlock issue when using the clone ioctl with qgroups
enabled, as reported by Elias Probst in the mailing list. The deadlock
happens because after calling btrfs_insert_empty_item we have our path
holding a write lock on a leaf of the fs/subvol tree and then before
releasing the path we called check_ref() which did backref walking, when
qgroups are enabled, and tried to read lock the same leaf. The trace for
this case is the following:

  INFO: task systemd-nspawn:6095 blocked for more than 120 seconds.
  (...)
  Call Trace:
    [<ffffffff86999201>] schedule+0x74/0x83
    [<ffffffff863ef64c>] btrfs_tree_read_lock+0xc0/0xea
    [<ffffffff86137ed7>] ? wait_woken+0x74/0x74
    [<ffffffff8639f0a7>] btrfs_search_old_slot+0x51a/0x810
    [<ffffffff863a129b>] btrfs_next_old_leaf+0xdf/0x3ce
    [<ffffffff86413a00>] ? ulist_add_merge+0x1b/0x127
    [<ffffffff86411688>] __resolve_indirect_refs+0x62a/0x667
    [<ffffffff863ef546>] ? btrfs_clear_lock_blocking_rw+0x78/0xbe
    [<ffffffff864122d3>] find_parent_nodes+0xaf3/0xfc6
    [<ffffffff86412838>] __btrfs_find_all_roots+0x92/0xf0
    [<ffffffff864128f2>] btrfs_find_all_roots+0x45/0x65
    [<ffffffff8639a75b>] ? btrfs_get_tree_mod_seq+0x2b/0x88
    [<ffffffff863e852e>] check_ref+0x64/0xc4
    [<ffffffff863e9e01>] btrfs_clone+0x66e/0xb5d
    [<ffffffff863ea77f>] btrfs_ioctl_clone+0x48f/0x5bb
    [<ffffffff86048a68>] ? native_sched_clock+0x28/0x77
    [<ffffffff863ed9b0>] btrfs_ioctl+0xabc/0x25cb
  (...)

The problem goes away by eleminating check_ref(), which no longer is
needed as its purpose was to get a value for the no_quota field of
a delayed reference (this patch removes the no_quota field as mentioned
earlier).

Reported-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Tested-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Reported-by: Elias Probst <mail@eliasprobst.eu>
Reported-by: Peter Becker <floyd.net@gmail.com>
Reported-by: Malte Schröder <malte@tnxip.de>
Reported-by: Derek Dongray <derek@valedon.co.uk>
Reported-by: Erkki Seppala <flux-btrfs@inside.org>
Cc: stable@vger.kernel.org  # 4.2+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
2015-10-25 19:53:26 +00:00
Filipe Manana
2c3cf7d5f6 Btrfs: fix regression when running delayed references
In the kernel 4.2 merge window we had a refactoring/rework of the delayed
references implementation in order to fix certain problems with qgroups.
However that rework introduced one more regression that leads to the
following trace when running delayed references for metadata:

[35908.064664] kernel BUG at fs/btrfs/extent-tree.c:1832!
[35908.065201] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[35908.065201] Modules linked in: dm_flakey dm_mod btrfs crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc psmouse i2
[35908.065201] CPU: 14 PID: 15014 Comm: kworker/u32:9 Tainted: G        W       4.3.0-rc5-btrfs-next-17+ #1
[35908.065201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[35908.065201] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs]
[35908.065201] task: ffff880114b7d780 ti: ffff88010c4c8000 task.ti: ffff88010c4c8000
[35908.065201] RIP: 0010:[<ffffffffa04928b5>]  [<ffffffffa04928b5>] insert_inline_extent_backref+0x52/0xb1 [btrfs]
[35908.065201] RSP: 0018:ffff88010c4cbb08  EFLAGS: 00010293
[35908.065201] RAX: 0000000000000000 RBX: ffff88008a661000 RCX: 0000000000000000
[35908.065201] RDX: ffffffffa04dd58f RSI: 0000000000000001 RDI: 0000000000000000
[35908.065201] RBP: ffff88010c4cbb40 R08: 0000000000001000 R09: ffff88010c4cb9f8
[35908.065201] R10: 0000000000000000 R11: 000000000000002c R12: 0000000000000000
[35908.065201] R13: ffff88020a74c578 R14: 0000000000000000 R15: 0000000000000000
[35908.065201] FS:  0000000000000000(0000) GS:ffff88023edc0000(0000) knlGS:0000000000000000
[35908.065201] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[35908.065201] CR2: 00000000015e8708 CR3: 0000000102185000 CR4: 00000000000006e0
[35908.065201] Stack:
[35908.065201]  ffff88010c4cbb18 0000000000000f37 ffff88020a74c578 ffff88015a408000
[35908.065201]  ffff880154a44000 0000000000000000 0000000000000005 ffff88010c4cbbd8
[35908.065201]  ffffffffa0492b9a 0000000000000005 0000000000000000 0000000000000000
[35908.065201] Call Trace:
[35908.065201]  [<ffffffffa0492b9a>] __btrfs_inc_extent_ref+0x8b/0x208 [btrfs]
[35908.065201]  [<ffffffffa0497117>] ? __btrfs_run_delayed_refs+0x4d4/0xd33 [btrfs]
[35908.065201]  [<ffffffffa049773d>] __btrfs_run_delayed_refs+0xafa/0xd33 [btrfs]
[35908.065201]  [<ffffffffa04a976a>] ? join_transaction.isra.10+0x25/0x41f [btrfs]
[35908.065201]  [<ffffffffa04a97ed>] ? join_transaction.isra.10+0xa8/0x41f [btrfs]
[35908.065201]  [<ffffffffa049914d>] btrfs_run_delayed_refs+0x75/0x1dd [btrfs]
[35908.065201]  [<ffffffffa04992f1>] delayed_ref_async_start+0x3c/0x7b [btrfs]
[35908.065201]  [<ffffffffa04d4b4f>] normal_work_helper+0x14c/0x32a [btrfs]
[35908.065201]  [<ffffffffa04d4e93>] btrfs_extent_refs_helper+0x12/0x14 [btrfs]
[35908.065201]  [<ffffffff81063b23>] process_one_work+0x24a/0x4ac
[35908.065201]  [<ffffffff81064285>] worker_thread+0x206/0x2c2
[35908.065201]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb
[35908.065201]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb
[35908.065201]  [<ffffffff8106904d>] kthread+0xef/0xf7
[35908.065201]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24
[35908.065201]  [<ffffffff8147d10f>] ret_from_fork+0x3f/0x70
[35908.065201]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24
[35908.065201] Code: 6a 01 41 56 41 54 ff 75 10 41 51 4d 89 c1 49 89 c8 48 8d 4d d0 e8 f6 f1 ff ff 48 83 c4 28 85 c0 75 2c 49 81 fc ff 00 00 00 77 02 <0f> 0b 4c 8b 45 30 8b 4d 28 45 31
[35908.065201] RIP  [<ffffffffa04928b5>] insert_inline_extent_backref+0x52/0xb1 [btrfs]
[35908.065201]  RSP <ffff88010c4cbb08>
[35908.310885] ---[ end trace fe4299baf0666457 ]---

This happens because the new delayed references code no longer merges
delayed references that have different sequence values. The following
steps are an example sequence leading to this issue:

1) Transaction N starts, fs_info->tree_mod_seq has value 0;

2) Extent buffer (btree node) A is allocated, delayed reference Ref1 for
   bytenr A is created, with a value of 1 and a seq value of 0;

3) fs_info->tree_mod_seq is incremented to 1;

4) Extent buffer A is deleted through btrfs_del_items(), which calls
   btrfs_del_leaf(), which in turn calls btrfs_free_tree_block(). The
   later returns the metadata extent associated to extent buffer A to
   the free space cache (the range is not pinned), because the extent
   buffer was created in the current transaction (N) and writeback never
   happened for the extent buffer (flag BTRFS_HEADER_FLAG_WRITTEN not set
   in the extent buffer).
   This creates the delayed reference Ref2 for bytenr A, with a value
   of -1 and a seq value of 1;

5) Delayed reference Ref2 is not merged with Ref1 when we create it,
   because they have different sequence numbers (decided at
   add_delayed_ref_tail_merge());

6) fs_info->tree_mod_seq is incremented to 2;

7) Some task attempts to allocate a new extent buffer (done at
   extent-tree.c:find_free_extent()), but due to heavy fragmentation
   and running low on metadata space the clustered allocation fails
   and we fall back to unclustered allocation, which finds the
   extent at offset A, so a new extent buffer at offset A is allocated.
   This creates delayed reference Ref3 for bytenr A, with a value of 1
   and a seq value of 2;

8) Ref3 is not merged neither with Ref2 nor Ref1, again because they
   all have different seq values;

9) We start running the delayed references (__btrfs_run_delayed_refs());

10) The delayed Ref1 is the first one being applied, which ends up
    creating an inline extent backref in the extent tree;

10) Next the delayed reference Ref3 is selected for execution, and not
    Ref2, because select_delayed_ref() always gives a preference for
    positive references (that have an action of BTRFS_ADD_DELAYED_REF);

11) When running Ref3 we encounter alreay the inline extent backref
    in the extent tree at insert_inline_extent_backref(), which makes
    us hit the following BUG_ON:

        BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID);

    This is always true because owner corresponds to the level of the
    extent buffer/btree node in the btree.

For the scenario described above we hit the BUG_ON because we never merge
references that have different seq values.

We used to do the merging before the 4.2 kernel, more specifically, before
the commmits:

  c6fc245499 ("btrfs: delayed-ref: Use list to replace the ref_root in ref_head.")
  c43d160fcd ("btrfs: delayed-ref: Cleanup the unneeded functions.")

This issue became more exposed after the following change that was added
to 4.2 as well:

  cffc3374e5 ("Btrfs: fix order by which delayed references are run")

Which in turn fixed another regression by the two commits previously
mentioned.

So fix this by bringing back the delayed reference merge code, with the
proper adaptations so that it operates against the new data structure
(linked list vs old red black tree implementation).

This issue was hit running fstest btrfs/063 in a loop. Several people have
reported this issue in the mailing list when running on kernels 4.2+.

Very special thanks to Stéphane Lesimple for helping debugging this issue
and testing this fix on his multi terabyte filesystem (which took more
than one day to balance alone, plus fsck, etc).

Fixes: c6fc245499 ("btrfs: delayed-ref: Use list to replace the ref_root in ref_head.")
Reported-by: Peter Becker <floyd.net@gmail.com>
Reported-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Tested-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Reported-by: Malte Schröder <malte@tnxip.de>
Reported-by: Derek Dongray <derek@valedon.co.uk>
Reported-by: Erkki Seppala <flux-btrfs@inside.org>
Cc: stable@vger.kernel.org  # 4.2+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
2015-10-25 19:52:23 +00:00
Robert Dolca
a06347c04c NFC: Add Intel Fields Peak NFC solution driver
Fields Peak complies with the ISO/IEC 14443A/B, 15693, 18092,
and JIS X 6319-4. It is an NCI based controller.

RF Protocols supported:
 - NFC Forum Type 1 Tags (Jewel, Topaz)
 - NFC Forum Type 2 Tags (Mifare UL)
 - NFC Forum Type 3 Tags (FeliCa)
 - NFC Forum Type 4A (ISO/IEC 14443 A-4 106kbps to 848kbps)
 - NFC Forum Type 4B (ISO/IEC 14443 B-4 106kbps to 848kbps)
 - NFCIP in passive and active modes (ISO/IEC 18092 106kbps
   to 424kbps)
 - B’ (based on ISO/IEC 14443 B-2)
 - iCLASS (based on ISO/IEC 15693-2)
 - Vicinity cards (ISO/IEC 15693-3)
 - Kovio tags (NFC Forum Type 2)

The device can be enumerated using ACPI using the id INT339A.
The 1st GPIO is the IRQ and the 2nd is the RESET pin.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 20:29:16 +01:00
Robert Dolca
85b9ce9a21 NFC: nci: add nci_get_conn_info_by_id function
This functin takes as a parameter a pointer to the nci_dev
struct and the first byte from the values of the first domain
specific parameter that was used for the connection creation.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 20:29:11 +01:00
Robert Dolca
caa575a86e NFC: nci: fix possible crash in nci_core_conn_create
If the number of destination speific parameters supplied is 0
the call will fail. If the first destination specific parameter
does not have a value, curr_id will be set to 0.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 20:29:05 +01:00
Robert Dolca
22e4bd09c4 NFC: nci: rename nci_prop_ops to nci_driver_ops
Initially it was used to create hooks in the driver for
proprietary operations. Currently it is being used for hooks
for both proprietary and generic operations.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 20:28:59 +01:00
Punit Vara
047e664657 Staging: wilc1000: Remove boolean comparision
This patch is to the host_interface.c file that fixes up following
warning reported by coccicheck:

WARNING: Comparison to bool

Boolean tests do not need explicit comparison to true or false

Signed-off-by: Punit Vara <punitvara@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:12:54 +09:00
Amitoj Kaur Chawla
5e16d07501 staging: rdma: amso1100: Drop unnecessary goto
Deletes the jump to a label on the next line when the label isn't used
anywhere else.

The semantic patch used to find this is:

// <smpl>
@r@
identifier l;
@@

-if (...) goto l;
-l:
// </smpl>

Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Muhammad Falak R Wani
24523a9453 staging: rdma: hfi1: chip: Use setup_timer
Use the timer API function setup_timer instead of init_timer, removing
the structure field assignments.

<smpl>

@timer@
expression e1,e2,e3,fn_ptr;
@@
-init_timer(&e1);
+setup_timer(&e1, fn_ptr, e2);
... when != fn_ptr = e3
-e1.function = fn_ptr;
-e1.data = e2;

</smpl>

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Eva Rachel Retuya
6f663d5de5 Staging: mt29f_spinand: Prefer using the BIT macro
Replace all instances of bit shifting on 1 with the BIT(x) macro. In
addition, convert other non-1 shift operations with the equivalent
BIT(x) macro for uniformity. Issue pointed out by checkpatch.

CHECK: Prefer using the BIT macro

Signed-off-by: Eva Rachel Retuya <eraretuya@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Eva Rachel Retuya
c75e057744 Staging: mt29f_spinand: Replace udelay function with usleep_range
Use 'usleep_range' instead of 'udelay' to elapse time. For
spinand_reset, define the upper limit by a factor of 2 to keep the wait
short while still allowing a "good enough" range for wakeup. Define the
range 250us - 1ms for spinand_cmdfunc to provide enough leeway before
issuing spinand_reset. Checkpatch found this issue.

CHECK: usleep_range is preferred over udelay; see
Documentation/timers/timers-howto.txt

Signed-off-by: Eva Rachel Retuya <eraretuya@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Muhammad Falak R Wani
d6a0692bef staging: ipath: ipath_init_chip: Use setup_timer
Use of the timer API function setup_timer instead of init_timer, removing
the structure field assignments, and make the codeflow more readable.
The simplified sematic patch used is :-
<smpl>

@timer@
expression e1,e2,e3,fn_ptr;
@@
-init_timer(&e1);
+setup_timer(&e1, fn_ptr, e2);
... when != fn_ptr = e3
-e1.function = fn_ptr;
-e1.data = e2;

</smpl>

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Muhammad Falak R Wani
7cc918a856 staging: ipath: ipath_sdma: Use setup_timer
Use the timer API function setup_timer instead of init_timer, removing
the structure field assignments.

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Muhammad Falak R Wani
567ae32ad8 staging: ipath: ipath_verbs: Use setup_timer
Use the timer API function setup_timer instead of init_timer, removing
the structure field assignments.

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Muhammad Falak R Wani
6149e2e444 staging: ipath: ipath_driver: Use setup_timer
Use the timer API function setup_timer instead of init_timer, removing
the structure field assignments.
The simplified semantic patch used is :-
<smpl>

@timer@
expression e1,e2,e3,fn_ptr;
@@
-init_timer(&e1);
+setup_timer(&e1, fn_ptr, e2);
... when != fn_ptr = e3
-e1.function = fn_ptr;
-e1.data = e2;

</smpl>

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:09:16 +09:00
Jonas Hesselmann
ae416ba4e9 USB: core: Codestyle fix in urb.c
Delete braces around single statement block suggested by checkpatch.pl

Signed-off-by: Jonas Hesselmann <jonas.hesselmann@hotmail.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-26 04:04:48 +09:00
Robert Dolca
0a97a3cba2 NFC: nci: Allow the driver to set handler for core nci ops
The driver may be required to act when some responses or
notifications arrive. For example the NCI core does not have a
handler for NCI_OP_CORE_GET_CONFIG_RSP. The NFCC can send a
config response that has to be read by the driver and the packet
may contain vendor specific data.

The Fields Peak driver needs to take certain actions when a reset
notification arrives (packet also not handled by the nfc core).

The driver handlers do not interfere with the core and they are
called after the core processes the packet.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:12:57 +01:00
Robert Dolca
7bc4824ed5 NFC: nci: Introduce nci_core_cmd
This allows sending core commands from the driver. The driver
should be able to send NCI core commands like CORE_GET_CONFIG_CMD.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:12:13 +01:00
Robert Dolca
e4dbd62528 NFC: nci: Do not call post_setup when setup fails
The driver should know that it can continue with post setup where
setup left off. Being able to execute post_setup when setup fails
may force the developer to keep this state in the driver.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:11:58 +01:00
Robert Dolca
a9433c11b1 NFC: nci: Introduce new core opcodes
Add NCI_OP_CORE_GET_CONFIG_CMD, NCI_OP_CORE_GET_CONFIG_RSP
and NCI_OP_CORE_RESET_NTF.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:11:49 +01:00
Robert Dolca
2663589ce6 NFC: nci: Add function to get max packet size for conn
FDP driver needs to send the firmware as regular packets
(not fragmented). The driver should have a way to
get the max packet size for a given connection.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:11:42 +01:00
Robert Dolca
ea785c094d NFC: nci: Export nci data send API
For the firmware update the driver may use nci_send_data.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 19:11:35 +01:00
Samuel Ortiz
dc42143b84 NFC: st-nci: Rename st-nci_se.c
Rename it to se.c to keep the driver files namespace consistent.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2015-10-25 18:20:03 +01:00
Muhammad Falak R Wani
43e9f2aa77 i2c: pnx: Use setup_timer instead of open coding it
Use timer API function setup_timer instead of init_timer to
initialize the timer.

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2015-10-25 16:01:33 +01:00
Dustin Byford
8eb5c87a92 i2c: add ACPI support for I2C mux ports
Although I2C mux devices are easily enumerated using ACPI (_HID/_CID or
device property compatible string match), enumerating I2C client devices
connected through an I2C mux needs a little extra work.

This change implements a method for describing an I2C device hierarchy that
includes mux devices by using an ACPI Device() for each mux channel along
with an _ADR to set the channel number for the device.  See
Documentation/acpi/i2c-muxes.txt for a simple example.

To make this work the ismt, i801, and designware pci/platform devs now
share an ACPI companion with their I2C adapter dev similar to how it's done
in OF.  This is done on the assumption that power management functions will
not be called directly on the I2C dev that is sharing the ACPI node.

Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Dustin Byford <dustin@cumulusnetworks.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2015-10-25 15:49:46 +01:00
Dustin Byford
c0e5c44504 acpi: add acpi_preset_companion() stub
Add a stub for acpi_preset_companion().  Fixes build failures when
acpi_preset_companion() is used and CONFIG_ACPI is not set.

Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Dustin Byford <dustin@cumulusnetworks.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2015-10-25 15:46:28 +01:00
Lars-Peter Clausen
785171fd6c iio:ad7793: Fix ad7785 product ID
While the datasheet for the AD7785 lists 0xXB as the product ID the actual
product ID is 0xX3.

Fix the product ID otherwise the driver will reject the device due to non
matching IDs.

Fixes: e786cc26dc ("staging:iio:ad7793: Implement stricter id checking")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2015-10-25 13:39:42 +00:00
Eric Dumazet
1586a5877d af_unix: do not report POLLOUT on listeners
poll(POLLOUT) on a listener should not report fd is ready for
a write().

This would break some applications using poll() and pfd.events = -1,
as they would not block in poll()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Alan Burlison <Alan.Burlison@oracle.com>
Tested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-25 06:37:45 -07:00
Wu Fengguang
742e038330 tipc: link_is_bc_sndlink() can be static
TO: "David S. Miller" <davem@davemloft.net>
CC: netdev@vger.kernel.org
CC: Jon Maloy <jon.maloy@ericsson.com>
CC: Ying Xue <ying.xue@windriver.com>
CC: tipc-discussion@lists.sourceforge.net
CC: linux-kernel@vger.kernel.org

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-25 06:31:52 -07:00
Lars-Peter Clausen
5dcbe97bed iio: ad5064: Fix ad5629/ad5669 shift
The ad5629/ad5669 are the I2C variant of the ad5628/ad5668, which has a SPI
interface. They are mostly identical with the exception that the shift
factor is different. Currently the driver does not take care of this
difference which leads to incorrect DAC output values.

Fix this by introducing a custom channel spec for the ad5629/ad5669 with
the correct shift factor.

Fixes: commit 6a17a0768f ("iio:dac:ad5064: Add support for the ad5629r and ad5669r")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2015-10-25 12:30:42 +00:00
Michael Hennerich
03fe472ef3 iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success
i2c_master_send() returns the number of bytes transferred on success while
the ad5064 driver expects that the write() callback returns 0 on success.
Fix that by translating any non negative return value of i2c_master_send()
to 0.

Fixes: commit 6a17a0768f ("iio:dac:ad5064: Add support for the ad5629r and ad5669r")
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2015-10-25 12:29:31 +00:00
Vladimir Zapolskiy
01bb70ae0b iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock
If common clock framework is configured, the driver generates a warning,
which is fixed by this change:

    root@devkit3250:~# cat /sys/bus/iio/devices/iio\:device0/in_voltage0_raw
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 724 at drivers/clk/clk.c:727 clk_core_enable+0x2c/0xa4()
    Modules linked in: sc16is7xx snd_soc_uda1380
    CPU: 0 PID: 724 Comm: cat Not tainted 4.3.0-rc2+ #198
    Hardware name: LPC32XX SoC (Flattened Device Tree)
    Backtrace:
    [<>] (dump_backtrace) from [<>] (show_stack+0x18/0x1c)
    [<>] (show_stack) from [<>] (dump_stack+0x20/0x28)
    [<>] (dump_stack) from [<>] (warn_slowpath_common+0x90/0xb8)
    [<>] (warn_slowpath_common) from [<>] (warn_slowpath_null+0x24/0x2c)
    [<>] (warn_slowpath_null) from [<>] (clk_core_enable+0x2c/0xa4)
    [<>] (clk_core_enable) from [<>] (clk_enable+0x24/0x38)
    [<>] (clk_enable) from [<>] (lpc32xx_read_raw+0x38/0x80)
    [<>] (lpc32xx_read_raw) from [<>] (iio_read_channel_info+0x70/0x94)
    [<>] (iio_read_channel_info) from [<>] (dev_attr_show+0x28/0x4c)
    [<>] (dev_attr_show) from [<>] (sysfs_kf_seq_show+0x8c/0xf0)
    [<>] (sysfs_kf_seq_show) from [<>] (kernfs_seq_show+0x2c/0x30)
    [<>] (kernfs_seq_show) from [<>] (seq_read+0x1c8/0x440)
    [<>] (seq_read) from [<>] (kernfs_fop_read+0x38/0x170)
    [<>] (kernfs_fop_read) from [<>] (do_readv_writev+0x16c/0x238)
    [<>] (do_readv_writev) from [<>] (vfs_readv+0x50/0x58)
    [<>] (vfs_readv) from [<>] (default_file_splice_read+0x1a4/0x308)
    [<>] (default_file_splice_read) from [<>] (do_splice_to+0x78/0x84)
    [<>] (do_splice_to) from [<>] (splice_direct_to_actor+0xc8/0x1cc)
    [<>] (splice_direct_to_actor) from [<>] (do_splice_direct+0xa0/0xb8)
    [<>] (do_splice_direct) from [<>] (do_sendfile+0x1a8/0x30c)
    [<>] (do_sendfile) from [<>] (SyS_sendfile64+0x104/0x10c)
    [<>] (SyS_sendfile64) from [<>] (ret_fast_syscall+0x0/0x38)

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2015-10-25 12:21:59 +00:00
Arnd Bergmann
aea545fa90 staging: iio: select IRQ_WORK for IIO_DUMMY_EVGEN
The iio dummy code was recently changed to use irq_work_queue, but
that code is compiled into the kernel only if IRQ_WORK is set, so
we can get a link error here:

drivers/built-in.o: In function `iio_evgen_poke':
(.text+0x208a04): undefined reference to `irq_work_queue'

This changes the Kconfig file to match what other drivers do.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: fd2bb310ca ("Staging: iio: Move evgen interrupt generation to irq_work")
Acked-by: Daniel Baluta <daniel.baluta@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2015-10-25 12:15:36 +00:00