Commit Graph

649779 Commits

Author SHA1 Message Date
Guillaume Nault
df90e68861 l2tp: fix lookup for sockets not bound to a device in l2tp_ip
When looking up an l2tp socket, we must consider a null netdevice id as
wild card. There are currently two problems caused by
__l2tp_ip_bind_lookup() not considering 'dif' as wild card when set to 0:

  * A socket bound to a device (i.e. with sk->sk_bound_dev_if != 0)
    never receives any packet. Since __l2tp_ip_bind_lookup() is called
    with dif == 0 in l2tp_ip_recv(), sk->sk_bound_dev_if is always
    different from 'dif' so the socket doesn't match.

  * Two sockets, one bound to a device but not the other, can be bound
    to the same address. If the first socket binding to the address is
    the one that is also bound to a device, the second socket can bind
    to the same address without __l2tp_ip_bind_lookup() noticing the
    overlap.

To fix this issue, we need to consider that any null device index, be
it 'sk->sk_bound_dev_if' or 'dif', matches with any other value.
We also need to pass the input device index to __l2tp_ip_bind_lookup()
on reception so that sockets bound to a device never receive packets
from other devices.

This patch fixes l2tp_ip6 in the same way.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 14:14:08 -05:00
Guillaume Nault
d5e3a19093 l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
It's not enough to check for sockets bound to same address at the
beginning of l2tp_ip{,6}_bind(): even if no socket is found at that
time, a socket with the same address could be bound before we take
the l2tp lock again.

This patch moves the lookup right before inserting the new socket, so
that no change can ever happen to the list between address lookup and
socket insertion.

Care is taken to avoid side effects on the socket in case of failure.
That is, modifications of the socket are done after the lookup, when
binding is guaranteed to succeed, and before releasing the l2tp lock,
so that concurrent lookups will always see fully initialised sockets.

For l2tp_ip, 'ret' is set to -EINVAL before checking the SOCK_ZAPPED
bit. Error code was mistakenly set to -EADDRINUSE on error by commit
32c231164b ("l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()").
Using -EINVAL restores original behaviour.

For l2tp_ip6, the lookup is now always done with the correct bound
device. Before this patch, when binding to a link-local address, the
lookup was done with the original sk->sk_bound_dev_if, which was later
overwritten with addr->l2tp_scope_id. Lookup is now performed with the
final sk->sk_bound_dev_if value.

Finally, the (addr_len >= sizeof(struct sockaddr_in6)) check has been
dropped: addr is a sockaddr_l2tpip6 not sockaddr_in6 and addr_len has
already been checked at this point (this part of the code seems to have
been copy-pasted from net/ipv6/raw.c).

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 14:14:08 -05:00
Guillaume Nault
a3c18422a4 l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
Socket must be held while under the protection of the l2tp lock; there
is no guarantee that sk remains valid after the read_unlock_bh() call.

Same issue for l2tp_ip and l2tp_ip6.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 14:14:07 -05:00
Guillaume Nault
0382a25af3 l2tp: lock socket before checking flags in connect()
Socket flags aren't updated atomically, so the socket must be locked
while reading the SOCK_ZAPPED flag.

This issue exists for both l2tp_ip and l2tp_ip6. For IPv6, this patch
also brings error handling for __ip6_datagram_connect() failures.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 14:14:07 -05:00
Hariprasad Shenai
bb83d62fa8 cxgb4: Add PCI device ID for new adapter
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 14:11:47 -05:00
Alexei Starovoitov
b634d30a79 cgroup, bpf: remove unnecessary #include
this #include is unnecessary and brings whole set of
other headers into cgroup-defs.h. Remove it.

Fixes: 3007098494 ("cgroup: add support for eBPF programs")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Rami Rosen <roszenrami@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 13:58:25 -05:00
Zhang Shengju
18502acd9a neigh: remove duplicate check for same neigh
Currently loop index 'idx' is used as the index in the neigh list of interest.
It's increased only when the neigh is dumped. It's not the absolute index in
the list. Because there is no info to record which neigh has already be scanned
by previous loop. This will cause the filtered out neighs to be scanned mulitple
times.

This patch make idx as the absolute index in the list, it will increase no matter
whether the neigh is filtered. This will prevent the above problem.

And this is in line with other dump functions.

v2:
 - take David Ahern's advice to do simple change

Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 13:46:16 -05:00
Mike Rapoport
a107bf8b39 isofs: add KERN_CONT to printing of ER records
The ER records are printed without explicit log level presuming line
continuation until "\n".  After the commit 4bcc595ccd (printk:
reinstate KERN_CONT for printing continuation lines), the ER records are
printed a character per line.

Adding KERN_CONT to appropriate printk statements restores the printout
behavior.

Signed-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-11-30 10:41:26 -08:00
Chen-Yu Tsai
4a15b24a65 ASoC: sun4i-codec: Add support for H3 codec
The codec on the H3 is similar to the one found on the A31. One key
difference is the analog path controls are routed through the PRCM
block. This is supported by the sun8i-codec-analog driver, and tied
into this codec driver with the audio card's aux_dev.

In addition, the H3 has no HP (headphone) and HBIAS support, and no
MIC3 input. The FIFO related registers are slightly rearranged.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:06:51 +00:00
Chen-Yu Tsai
dac5f86bc9 ASoC: sun4i-codec: Add support for A23 codec
The codec in the A23 is similar to the one found on the A31. One key
difference is the analog path controls are routed through the PRCM
block. This is supported by the sun8i-codec-analog driver, and tied
into this codec driver with the audio card's aux_dev.

In addition, the A23 does not have LINEOUT, and it does not support
headset jack detection or buttons.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:06:18 +00:00
Heiner Kallweit
d54ef0574a spi: fsl-espi: remove unused linearization code
After introducing direct transfers between hardware and transfer
buffers remove all code which is unused now.

This includes getting rid of the 64k linearization buffer.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:05:21 +00:00
Heiner Kallweit
dcb425f3ba spi: fsl-espi: eliminate need for linearization when reading from hardware
Eliminate need for linearization when reading from the hardware and
write to the transfer buffers directly.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:05:14 +00:00
Heiner Kallweit
0582343284 spi: fsl-espi: eliminate need for linearization when writing to hardware
Eliminate need for linearization when writing to the hardware and
read from the transfer buffers directly.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:04:24 +00:00
Heiner Kallweit
e1cdee73df spi: fsl-espi: determine need for byte swap only once
Determine need for byte swap only once and store it in new member
swab in struct fsl_espi.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:04:23 +00:00
Takashi Iwai
fee3244cd1 ASoC: cht_bsw_rt5672: Use HID translation unit
Instead of hard-coded "i2c-10EC5670:00", use the translation helper to
avoid the mismatch between i2c-codec and ACPI strings just like what
we've done for bytcr_rt5640.  This gives more robust binding on funky
devices like Dell Wyse 3040.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 18:00:59 +00:00
Takashi Iwai
2fc995a87f ASoC: intel: Fix crash at suspend/resume without card registration
When ASoC Intel SST Medfield driver is probed but without codec / card
assigned, it causes an Oops and freezes the kernel at suspend/resume,

 PM: Suspending system (freeze)
 Suspending console(s) (use no_console_suspend to debug)
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
 IP: [<ffffffffc09d9409>] sst_soc_prepare+0x19/0xa0 [snd_soc_sst_mfld_platform]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 0 PID: 1552 Comm: systemd-sleep Tainted: G W 4.9.0-rc6-1.g5f5c2ad-default #1
 Call Trace:
  [<ffffffffb45318f9>] dpm_prepare+0x209/0x460
  [<ffffffffb4531b61>] dpm_suspend_start+0x11/0x60
  [<ffffffffb40d3cc2>] suspend_devices_and_enter+0xb2/0x710
  [<ffffffffb40d462e>] pm_suspend+0x30e/0x390
  [<ffffffffb40d2eba>] state_store+0x8a/0x90
  [<ffffffffb43c670f>] kobj_attr_store+0xf/0x20
  [<ffffffffb42b0d97>] sysfs_kf_write+0x37/0x40
  [<ffffffffb42b02bc>] kernfs_fop_write+0x11c/0x1b0
  [<ffffffffb422be68>] __vfs_write+0x28/0x140
  [<ffffffffb43728a8>] ? apparmor_file_permission+0x18/0x20
  [<ffffffffb433b2ab>] ? security_file_permission+0x3b/0xc0
  [<ffffffffb422d095>] vfs_write+0xb5/0x1a0
  [<ffffffffb422e3d6>] SyS_write+0x46/0xa0
  [<ffffffffb4719fbb>] entry_SYSCALL_64_fastpath+0x1e/0xad

Add proper NULL checks in the PM code of mdfld driver.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org>
2016-11-30 17:58:53 +00:00
Gao Pan
b88a0deaaf spi: fsl-lpspi: read lpspi tx/rx fifo size in probe()
The lpspi tx/rx fifo size is a read only parameter resides
lpspi Parameter Register. It's better to read lpspi tx/rx
fifo size in probe().

Signed-off-by: Gao Pan <pandy.gao@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:55:27 +00:00
Gao Pan
d2ad0a62d4 spi: fsl-lpspi: use wait_for_completion_timeout() while waiting transfer done
It's a potential problem to use wait_for_completion() because the
completion condition may never come. Thus, it's better to repalce
wait_for_completion() with wait_for_completion_timeout().

Signed-off-by: Gao Pan <pandy.gao@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:45:51 +00:00
Nikita Yushchenko
80cca775cd net: fec: cache statistics while device is down
Execution 'ethtool -S' on fec device that is down causes OOPS on Vybrid
board:

Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0898200
pgd = ddecc000
[e0898200] *pgd=9e406811, *pte=400d1653, *ppte=400d1453
Internal error: : 1008 [#1] SMP ARM
...

Reason of OOPS is that fec_enet_get_ethtool_stats() accesses fec
registers while IPG clock is stopped by PM.

Fix that by caching statistics in fec_enet_private. Cache is initialized
at device probe time, and updated at statistics request time if device
is up, and also just before turning device off on down path.

Additional locking is not needed, since cached statistics is accessed
either before device is registered, or under rtnl_lock().

Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 12:44:40 -05:00
Charles Keepax
109c75afa1 regulator: core: Correct type of mode in regulator_mode_constrain
Every function handling the mode within the regulator core uses an unsigned
int for mode, except for regulator_mode_constrain. This patch changes the
type of mode within regulator_mode_constrain which fixes several instances
where we are passing pointers to unsigned ints then treating them as an int
within this function.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:44:16 +00:00
John Hsu
2263fddcd0 ASoC: nau8825: lock longer to avoid playback pop upon resume
There is an issue about pop noise in NAU88L25 as follows.
Issue 54078: Chell_headphone pop back from S3
(1)Play directly to hw, bypassing CRAS:
sox -b 16 -n -t alsa hw:0,0 synth sine 200 sine 200
(2)Close lid or powerd_dbus_suspend, then press a key to resume.
(3)no audio after resume
(4)Audio will be back after close then reopen the pcm device.

After verification, we find one defect is that semaphone lock is not
long enough and expired. In this situation, the playback comes back
early but pauses a while to wait for the crosstalk detection done.
But the detection spends too much time and lock time is up. Therefore,
the playback and jack detection sequence interfere to each other.
That breaks sequence and makes noise. The driver extends the lock
time for the issue.

Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:42:52 +00:00
Alexei Starovoitov
9bee294f53 samples/bpf: fix include path
Fix the following build error:
HOSTCC  samples/bpf/test_lru_dist.o
../samples/bpf/test_lru_dist.c:25:22: fatal error: bpf_util.h: No such file or directory

This is due to objtree != srctree.
Use srctree, since that's where bpf_util.h is located.

Fixes: e00c7b216f ("bpf: fix multiple issues in selftest suite and samples")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 12:42:28 -05:00
Takashi Iwai
786e1c3719 ASoC: intel: Replace kthread with work
The usage pattern of kthread worker in Intel SST drivers can be
replaced gracefully with the normal workqueue, which is more light-
weight and easier to manage in general.  Let's do it.

While in the replacement, move the schedule_work() call inside the
spinlock for excluding the race, too.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:41:13 +00:00
Zhang Shengju
763dfa276c macvtap: replace printk with netdev_err
This patch replaces printk() with netdev_err() for macvtap device.

Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 12:40:48 -05:00
Richard Fitzgerald
35f4403edb ASoC: arizona: Use component pin control functions
We need to modify the state of some of our own pins and are currently
not taking account that the pin name may have a name_prefix applied
to it.

Replace the snd_soc_dapm_x_pin functions with the equivalent
snd_soc_component_x_pin functions so that any name_prefix will be
handled automatically.

Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:24:11 +00:00
Mark Brown
19a113ae59 Merge branch 'topic/dapm-pin' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-arizona 2016-11-30 17:23:38 +00:00
Richard Fitzgerald
1b4d9c2219 ASoC: core: Add component pin control functions
It's often the case that a codec driver will need to control its
own pins. However, if a name_prefix has been applied to this codec it
must be included in the name passed to any of the snd_soc_dapm_x_pin()
functions.

The behaviour of the existing pin control functions is reasonable, since
you may want to search for a fully-specified name within the scope of an
entire card. This means that we can't apply the prefix in these functions
because it will break card-scope searches.

Constructing a prefixed string "manually" in codec drivers leads to a lot
of repetition of the same code.

To make this tidier in codec drivers this patch adds a new set of
equivalent functions that take a struct snd_soc_component instead of a
dapm context and automatically add the component's name_prefix to the
given name. This makes it a simple change in codec drivers to be
prefix-safe.

The new functions are not quite trivial enough to be inlines and the
compiler won't be able to compile-away any part of them.

Although it looks somewhat inefficient to have to allocate a temporary
buffer and combine strings, the current design of the widget list
doesn't lend itself to a more optimized implementation - it's a single
list of all widgets on a card and is searched linearly for a matching
string. As pin state changes are generally low-frequency events it's
unlikely to be a significant issue - at least not enough to rewrite the
widget list handling just for this.

Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 17:16:09 +00:00
Florian Vaussard
6473bbfd7e Input: drv2667 - fix misuse of regmap_update_bits
Using regmap_update_bits(..., mask, 1) with 'mask' following (1 << k)
and k greater than 0 is wrong. Indeed, _regmap_update_bits will perform
(mask & 1), which results in 0 if LSB of mask is 0. Thus the call
regmap_update_bits(..., mask, 1) is in reality equivalent to
regmap_update_bits(..., mask, 0).

In such a case, the correct use is regmap_update_bits(..., mask, mask).

This driver is performing such a mistake with the DRV2667_STANDBY mask,
which equals (1 << 6). Fix the driver to make it consistent with the
API, and fix the alignment problem at the same time. Please note that
this change is untested, as I do not have this piece of hardware.
Testers are welcome!

Signed-off-by: Florian Vaussard <florian.vaussard@heig-vd.ch>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 09:03:45 -08:00
Florian Vaussard
037b3af6bf Input: drv2665 - fix misuse of regmap_update_bits
Using regmap_update_bits(..., mask, 1) with 'mask' following (1 << k)
and k greater than 0 is wrong. Indeed, _regmap_update_bits will perform
(mask & 1), which results in 0 if LSB of mask is 0. Thus the call
regmap_update_bits(..., mask, 1) is in reality equivalent to
regmap_update_bits(..., mask, 0).

In such a case, the correct use is regmap_update_bits(..., mask, mask).

This driver is performing such a mistake with the DRV2665_STANDBY mask,
which equals BIT(6). Fix the driver to make it consistent with the API,
and fix the alignment problem at the same time. Please note that this
change is untested, as I do not have this piece of hardware. Testers
are welcome!

Signed-off-by: Florian Vaussard <florian.vaussard@heig-vd.ch>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 09:03:44 -08:00
Benjamin Tissoires
a64ea311f1 Input: synaptics-rmi4 - add rmi_enable/disable_irq
Set the .enabled boolean and trigger an event processing when enabling
for edge-triggered systems.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 09:03:13 -08:00
Benjamin Tissoires
0d37d63a00 Input: synaptics-rmi4 - remove unused fields in struct rmi_driver_data
These fields are not used anywhere, there is no point in carrying them.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 09:03:12 -08:00
Benjamin Tissoires
9e421b7c60 Input: synaptics-rmi4 - fix documentation of rmi_2d_sensor_platform_data
Typos...

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 09:03:11 -08:00
Haishuang Yan
17b463654f vxlan: fix a potential issue when create a new vxlan fdb entry.
vxlan_fdb_append may return error, so add the proper check,
otherwise it will cause memory leak.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

Changes in v2:
  - Unnecessary to initialize rc to zero.
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-30 12:02:49 -05:00
Ping Cheng
2425f18081 Input: change KEY_DATA from 0x275 to 0x277
0x275 is used by KEY_FASTREVERSE.

Fixes: 488326947c ("Input: add HDMI CEC specific keycodes")
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30 08:59:26 -08:00
Arnd Bergmann
7b88f1a489 Merge tag 'arm-soc/for-4.10/devicetree-arm64' of http://github.com/Broadcom/stblinux into next/dt64
Pull "Broadcom devicetree-arm64 changes for 4.10" from Florian Fainelli:

This pull request contains Broadcom ARM64 based SoC Device Tree changes for
4.10, please pull the following:

- Robin updates the Northstart 2 DTS to use the generic IOMMU binding

- Scott renames the Broadcom Northstar 2 binding document to use a standard name
  including the brcm vendor prefix

- Kamal adds the QSPI Device Tree node to the Northstar 2 SoC and updates the
  Northstar 2 SVK reference board DTS file with it enabled.

- Rob adds the Device Tree node for the Broadcom PDC (mailbox) hardware to the
  Northstar 2 SoC

- Jon enables the SDIO1 block and adds proper PCIe PHYs Device Tree nodes to the
  Northstar 2 SoC

- Ray adds required properties NAND controller properties to make NAND work on
  the Northstar 2 SVK board, this was submitted as a 4.9 fixes and is included
  here to resolve DTS file merges

- Andrea removes an incorrect power LED from the Raspberry Pi 3 DTS

- Andreas fixes the compatible string for the BCM2837 (Raspberry Pi 3)

- Eric defines standard pinctrl groups in the BCM2835 GPIO node

- Gerd adds definitions for the pinctrl groups and updates the PWM, I2C and SDHCI nodes
  to use their appropriate pinctrl functions

- Linus adds names for the Raspberry Pi GPIO lines based on the datasheet

- Martin adds the DT binding and nodes for the Raspberry Pi firmware thermal block

- Stefan fixes a few typos with respect to the BCM2835 mailbox binding example and
  Device Tree nodes he also uses the proper DTSI file to define the USB host mode
  for the USB Device Tree nodes

* tag 'arm-soc/for-4.10/devicetree-arm64' of http://github.com/Broadcom/stblinux: (23 commits)
  arm64: dts: NS2: Add PCI PHYs
  arm64: dts: NS2: enable sdio1
  ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED
  ARM64: bcm2835: dts: add thermal node to device-tree of bcm2837
  ARM: bcm2835: Add names for the Raspberry Pi GPIO lines
  ARM: bcm2835: dts: add thermal node to device-tree of bcm283x
  dt: bindings: add thermal device driver for bcm2835
  arm64: dts: Add Broadcom Northstar2 device tree entries for PDC driver.
  ARM: dts: bcm283x: fix typo in mailbox address
  DT: binding: bcm2835-mbox: fix address typo in example
  ARM64: dts: bcm2835: Fix bcm2837 compatible string
  arm64: dts: Update Broadcom NS2 to generic IOMMU binding
  arm64: dts: Updated NAND DT properties for NS2 SVK
  arm64: dts: rename ns2.txt to brcm,ns2.txt
  ARM64: dts: Add QSPI Device Tree node for NS2
  ARM64: dts: bcm283x: Use dtsi for USB host mode
  ARM: dts: bcm283x: drop alt3 from &gpio
  ARM: dts: bcm283x: add pinctrl group to &sdhci, drop pins from &gpio
  ARM: dts: bcm283x: add pinctrl group to &i2c1, drop pins from &gpio
  ARM: dts: bcm283x: add pinctrl group to &i2c0, drop pins from &gpio
  ...
2016-11-30 17:57:26 +01:00
Robbie Ko
2a7bf53f57 Btrfs: fix tree search logic when replaying directory entry deletes
If a log tree has a layout like the following:

leaf N:
        ...
        item 240 key (282 DIR_LOG_ITEM 0) itemoff 8189 itemsize 8
                dir log end 1275809046
leaf N + 1:
        item 0 key (282 DIR_LOG_ITEM 3936149215) itemoff 16275 itemsize 8
                dir log end 18446744073709551615
        ...

When we pass the value 1275809046 + 1 as the parameter start_ret to the
function tree-log.c:find_dir_range() (done by replay_dir_deletes()), we
end up with path->slots[0] having the value 239 (points to the last item
of leaf N, item 240). Because the dir log item in that position has an
offset value smaller than *start_ret (1275809046 + 1) we need to move on
to the next leaf, however the logic for that is wrong since it compares
the current slot to the number of items in the leaf, which is smaller
and therefore we don't lookup for the next leaf but instead we set the
slot to point to an item that does not exist, at slot 240, and we later
operate on that slot which has unexpected content or in the worst case
can result in an invalid memory access (accessing beyond the last page
of leaf N's extent buffer).

So fix the logic that checks when we need to lookup at the next leaf
by first incrementing the slot and only after to check if that slot
is beyond the last item of the current leaf.

Signed-off-by: Robbie Ko <robbieko@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Fixes: e02119d5a7 (Btrfs: Add a write ahead tree log to optimize synchronous operations)
Cc: stable@vger.kernel.org  # 2.6.29+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
[Modified changelog for clarity and correctness]
2016-11-30 16:56:12 +00:00
Arnd Bergmann
bb986384d1 Merge tag 'arm-soc/for-4.10/devicetree' of http://github.com/Broadcom/stblinux into next/dt
Pull "Broadcom devicetree changes for 4.10" from Florian Fainelli:

This pull request contains Broadcom ARM-based SoC Device Tree changes for 4.10,
please pull the following:

- Rafal adds support for the Netgear R8500 routers, adds basic support
  for the Tenda AC9 router which uses the new BCM53573 SoC (single core Cortex
  A7). He also enables the UART on the Netgear R8000 and restructures the
  include files a bit for the BCM47094 SoC, finally he adds USB 3.0 PHY nodes
  which enables USB 3.0 on BCM5301X devices that support it. Finally he adds
  support for the TP-LINK Archer C9 V1 router.

- Kamal adds support for the QSPI controller on the Northstar Plus SoCs and updates
  the bcm958625k reference board to have it enabled

- Dan adds support for the Luxul XAP-1510 (using a BCM4708) and XWR-3100 (using
  a BCM47094)

- Scott fixes the pinctrl names in the Cygnus DTS files

- Jonathan enables the Broadcom iProc mailbox controller for Broadcom Cygnus/iProc
  SoCs, he adds interrupt support for the GPIO CRMU hardware block and finally adds
  the node for the OTP controller found on Cygnus SoCs

- Dhananjay enables the GPIO B controller on Norstarh Plus SoCs

- Eric defines standard pinctrl groups in the BCM2835 GPIO node

- Gerd adds definitions for the pinctrl groups and updates the PWM, I2C and SDHCI nodes
  to use their appropriate pinctrl functions

- Linus adds names for the Raspberry Pi GPIO lines based on the datasheet

- Martin adds the DT binding and nodes for the Raspberry Pi firmware thermal block

- Stefan fixes a few typos with respect to the BCM2835 mailbox binding example and
  Device Tree nodes he also fixes the Raspberry Pi GPIO lines names and finally
  adds names for the Raspberry Zero GPIO lines

* tag 'arm-soc/for-4.10/devicetree' of http://github.com/Broadcom/stblinux: (29 commits)
  ARM: bcm2835: Add names for the RPi Zero GPIO lines
  ARM: bcm2835: Fix names for the Raspberry Pi GPIO lines
  ARM: dts: enable GPIO-b for Broadcom NSP
  ARM: BCM5301X: Add DT for TP-LINK Archer C9 V1
  ARM: dts: Add node for Broadcom OTP controller driver
  ARM: dts: Enable interrupt support for cygnus crmu gpio driver
  ARM: dts: Enable Broadcom iProc mailbox controller
  ARM: bcm2835: Add names for the Raspberry Pi GPIO lines
  ARM: bcm2835: dts: add thermal node to device-tree of bcm283x
  dt: bindings: add thermal device driver for bcm2835
  ARM: dts: bcm283x: fix typo in mailbox address
  DT: binding: bcm2835-mbox: fix address typo in example
  ARM: dts: cygnus: fix naming of pinctrl node
  ARM: BCM53573: Specify PMU and its ILP clock in the DT
  ARM: BCM5301X: Add DT for Luxul XWR-3100
  ARM: BCM5301X: Add DT for Luxul XAP-1510
  ARM: BCM5301X: Specify USB 3.0 PHY in DT
  ARM: BCM5301X: Enable UART on Netgear R8000
  ARM: BCM5301X: Add separated DTS include file for BCM47094
  ARM: dts: NSP: Add QSPI nodes to NSPI and bcm958625k DTSes
  ...
2016-11-30 17:53:03 +01:00
Arnd Bergmann
9442091ed0 Merge tag 'arm-soc/for-4.10/soc' of http://github.com/Broadcom/stblinux into next/soc
Merge "Broadcom soc changes for 4.10" from Florian Fainelli:

This pull request contains Broadcom ARM-based SoC changes for 4.10, please pull
the following:

- Rafal adds back the abort handler hook on BCM5301x which is required to silence
  errors forwared from the PCIe controller that cannot be silenced at the PCIe RC level

* tag 'arm-soc/for-4.10/soc' of http://github.com/Broadcom/stblinux:
  ARM: BCM5301X: Add back handler ignoring external imprecise aborts
2016-11-30 17:49:17 +01:00
Souptick Joarder
b4b22a012e scsi: lpfc: Replace pci_pool_alloc by pci_pool_zalloc
In lpfc_new_scsi_buf_s3() and lpfc_new_scsi_buf_s4() pci_pool_alloc
followed by memset will be replaced by pci_pool_zalloc()

Signed-off-by: Souptick joarder <jrdr.linux@gmail.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:40:20 -05:00
Cathy Avery
b0120d9906 scsi: storvsc: Payload buffer incorrectly sized for 32 bit kernels.
On a 32 bit kernel sizeof(void *) is not 64 bits as hv_mpb_array
requires. Also the buffer needs to be cleared or the upper bytes will
contain junk.

Suggested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Cathy Avery <cavery@redhat.com>
Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:38:24 -05:00
Quentin Lambert
338be07233 scsi: cxgb4i: Add a missing call to neigh_release
Most error branches following the call to dst_neigh_lookup contain a
call to neigh_release. This patch add these calls where they are
missing.

This issue was found with Hector.

Signed-off-by: Quentin Lambert <lambert.quentin@gmail.com>
Acked-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:36:31 -05:00
Uma Krishnan
11f7b1844a scsi: cxlflash: Avoid command room violation
During test, a command room violation interrupt is occasionally seen
for the master context when the CXL flash devices are stressed.

After studying the code, there could be gaps in the way command room
value is being cached in cxlflash. When the cached command room is zero
the thread attempting to send becomes burdened with updating the cached
value with the actual value from the AFU. Today, this is handled with an
atomic set operation of the raw value read. Following the atomic update,
the thread proceeds to send.

This behavior is incorrect on two counts:

   - The update fails to take into account the current thread and its
     consumption of one of the hardware commands.

   - The update does not take into account other threads also atomically
     updating. Per design, a worker thread updates the cached value when a
     send thread times out. By not protecting the update with a lock, the
     cached value can be incorrectly clobbered.

To correct these issues, the update of the cached command room has been
simplified and also protected using a spin lock which is held until the
MMIO is complete. This ensures the command room is properly consumed by
the same thread. Update of cached value also takes into account the
current thread consuming a hardware command.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:34:01 -05:00
Uma Krishnan
3d2f617d44 scsi: cxlflash: Improve context_reset() logic
Currently, the context reset routine waits for command room to
be available before sending the reset request. Per review of the
SISLite specification and clarifications from the CXL Flash AFU
designers, this wait is unnecessary. The reset request can be
sent anytime regardless of command room, so long as only a single
reset request is active at any one point in time.

This commit simplifies the reset routine by removing the wait for
command room. Additionally it adds a debug trace to help pinpoint
hardware errors when a context reset does not complete.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:34:01 -05:00
Uma Krishnan
8a2605430a scsi: cxlflash: Fix crash in cxlflash_restore_luntable()
During test, the following crash was observed:

[34538.981505] Faulting instruction address: 0xd000000007c9c870
cpu 0x9: Vector: 300 (Data Access) at [c0000007f1e8f590]
    pc: d000000007c9c870: cxlflash_restore_luntable+0x70/0x1d0 [cxlflash]
    lr: d000000007c9c84c: cxlflash_restore_luntable+0x4c/0x1d0 [cxlflash]
    sp: c0000007f1e8f810
   msr: 9000000100009033
   dar: c00000171d637438
 dsisr: 40000000
  current = 0xc0000007f1e43f90
  paca    = 0xc000000007b25100   softe: 0        irq_happened: 0x01
    pid   = 493, comm = eehd
enter ? for help
[c0000007f1e8f8a0] d000000007c940b0 init_afu+0xd60/0x1200 [cxlflash]
[c0000007f1e8f9a0] d000000007c945a8 cxlflash_pci_slot_reset+0x58/0xe0 [cxlflash]
[c0000007f1e8fa20] d00000000715f790 cxl_pci_slot_reset+0x230/0x340 [cxl]
[c0000007f1e8fae0] c000000000040dd4 eeh_report_reset+0x144/0x180
[c0000007f1e8fb20] c00000000003f708 eeh_pe_dev_traverse+0x98/0x170
[c0000007f1e8fbb0] c000000000041618 eeh_handle_normal_event+0x328/0x410
[c0000007f1e8fc30] c000000000041db8 eeh_handle_event+0x178/0x330
[c0000007f1e8fce0] c000000000042118 eeh_event_handler+0x1a8/0x1b0
[c0000007f1e8fd80] c00000000011420c kthread+0xec/0x100
[c0000007f1e8fe30] c00000000000a47c ret_from_kernel_thread+0x5c/0xe0

When superpipe mode is disabled for a LUN, the references for the
local lun are deleted but the LUN is still identified as being present
in the LUN table. This mismatched state can result in the above crash
when the LUN table is restored during an error recovery operation.

To fix this issue, the local LUN information structure is updated to
reflect the LUN is no longer in the LUN table once all references to
the LUN are gone.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:34:00 -05:00
Uma Krishnan
68ab2d76e4 scsi: cxlflash: Set sg_tablesize to 1 instead of SG_NONE
The following Oops is encountered when blk_mq is enabled with the
cxlflash driver:

[ 2960.817172] Oops: Kernel access of bad area, sig: 11 [#5]
[ 2960.817309] NIP  __blk_mq_run_hw_queue+0x278/0x4c0
[ 2960.817313] LR __blk_mq_run_hw_queue+0x2bc/0x4c0
[ 2960.817314] Call Trace:
[ 2960.817320] __blk_mq_run_hw_queue+0x2bc/0x4c0 (unreliable)
[ 2960.817324] blk_mq_run_hw_queue+0xd8/0x100
[ 2960.817329] blk_mq_insert_requests+0x14c/0x1f0
[ 2960.817333] blk_mq_flush_plug_list+0x150/0x190
[ 2960.817338] blk_flush_plug_list+0x11c/0x2b0
[ 2960.817344] blk_finish_plug+0x58/0x80
[ 2960.817348] __do_page_cache_readahead+0x1c0/0x2e0
[ 2960.817352] force_page_cache_readahead+0x68/0xd0
[ 2960.817356] generic_file_read_iter+0x43c/0x6a0
[ 2960.817359] blkdev_read_iter+0x68/0xa0
[ 2960.817361] __vfs_read+0x11c/0x180
[ 2960.817364] vfs_read+0xa4/0x1c0
[ 2960.817366] SyS_read+0x6c/0x110
[ 2960.817369] system_call+0x38/0xb4

The SCSI blk_mq stack assumes that sg_tablesize is always a non-zero
value with scsi_mq_setup_tags() allocating tags using sg_tablesize.
The cxlflash driver currently uses SG_NONE (0) for the sg_tablesize
as the devices it supports are not capable of scatter gather. This
mismatch of values results in the Oops above.

To resolve this issue, sg_tablesize for cxlflash can simply be set
to 1, a value which satisfies the constraints in cxlflash and the
lack of support of SG_NONE in SCSI blk_mq.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-11-30 11:34:00 -05:00
Takashi Iwai
d252800608 ASoC: rt5670: Add missing 10EC5072 ACPI ID
rt5670 driver supports also RT5672 codec, but its ACPI ID is missing.
This was found on Dell Wyse 3040 box.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 16:24:35 +00:00
Takashi Iwai
b4ff47d284 ASoC: rt5670: Enable Braswell platform workaround for Dell Wyse 3040
Dell Wyse 3040 requires the platform workaround for enabling dmic and
jack detection as defined for Braswell CRB.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 16:24:13 +00:00
Takashi Iwai
6648eb8666 ASoC: Intel: Add missing 10EC5672 ACPI ID matching for Cherry Trail
Add the missing ACPI ID 10EC5672 for Cherry Trail, which bounds with
cht-bsw-rt5672 driver.  This combination was found on Dell Wyse 3040.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 16:23:28 +00:00
Uwe Kleine-König
7348291058 spi: orion: fix comment to mention MVEBU
MVEBU chips (Armada XP, Armada 370 and others) are supported by this
driver. Mention this in the help text to make more obvious what is
already specified in the dependencies of this symbol.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-11-30 16:22:46 +00:00
Arnd Bergmann
ba9cb7b9ff Merge branch 'for-4.10-ti-sci-base' of https://github.com/t-kristo/linux-pm into next/drivers
Merge "ARM: keystone: add TI SCI protocol support for v4.10" from
Tero Kristo:

[description taken from http://processors.wiki.ti.com/index.php/TISCI

Texas Instruments' Keystone generation System on Chips (SoC) starting
with 66AK2G02, now include a dedicated SoC System Control entity called
PMMC(Power Management Micro Controller) in line with ARM architecture
recommendations. The function of this module is to integrate all system
operations in a centralized location. Communication with the SoC System
Control entity from various processing units like ARM/DSP occurs over
Message Manager hardware block.

...

Texas Instruments' System Control Interface defines the communication
protocol between various processing entities to the System Control Entity
on TI SoCs. This is a set of message formats and sequence of operations
required to communicate and get system services processed from System
Control entity in the SoC.]

* 'for-4.10-ti-sci-base' of https://github.com/t-kristo/linux-pm:
  firmware: ti_sci: Add support for reboot core service
  firmware: ti_sci: Add support for Clock control
  firmware: ti_sci: Add support for Device control
  firmware: Add basic support for TI System Control Interface (TI-SCI) protocol
  Documentation: Add support for TI System Control Interface (TI-SCI) protocol
2016-11-30 17:13:13 +01:00