CMY [Tue, 25 Feb 2014 07:31:10 +0000 (15:31 +0800)]
rk: ion: support shared buffer between processes without Binder
xbw [Tue, 25 Feb 2014 05:16:10 +0000 (13:16 +0800)]
SDMMC:
continuse with the commit-
9401f2e4feea8c884418f3c5821e83aee7b313b0 .
Delete those code which will never be used in the future.
xbw [Tue, 25 Feb 2014 05:09:26 +0000 (13:09 +0800)]
SDMMC: Delete those code which will never be used in the future.
xbw [Tue, 25 Feb 2014 04:59:48 +0000 (12:59 +0800)]
SDMMC: select SDcard module configuration in kernel-3.10 project
xbw [Tue, 25 Feb 2014 04:43:01 +0000 (12:43 +0800)]
continue with the privous Commit. Complete submission SDMMC driver in kernel-3.10.Currently,Only the sdcard can be used.
xbw [Tue, 25 Feb 2014 04:41:17 +0000 (12:41 +0800)]
SDMMC: Complete submission SDMMC driver in kernel-3.10.Currently,Only the sdcard can be used.
xbw [Tue, 25 Feb 2014 04:35:25 +0000 (12:35 +0800)]
Merge branch 'develop-3.10' of ssh://10.10.10.29/rk/kernel into develop-3.10
xbw [Tue, 25 Feb 2014 04:34:50 +0000 (12:34 +0800)]
SDMMC:
revert the modify in file dw_mmc.c,Keep it to its original version.
yxj [Tue, 25 Feb 2014 01:24:56 +0000 (09:24 +0800)]
add dts for rk3188 LR097
yxj [Fri, 21 Feb 2014 10:36:47 +0000 (18:36 +0800)]
rk fb:add more screen property
yxj [Fri, 21 Feb 2014 10:32:08 +0000 (18:32 +0800)]
port edp anx6345 to linux 3.10
yxj [Wed, 19 Feb 2014 09:40:36 +0000 (17:40 +0800)]
rk32 edp: base version
qjb [Mon, 24 Feb 2014 10:00:14 +0000 (18:00 +0800)]
audio pcm kernel 3.10 : support
CMY [Mon, 24 Feb 2014 09:51:23 +0000 (17:51 +0800)]
rk: ion: fixed bug for ION_IOC_GET_PHYS
dkl [Mon, 24 Feb 2014 06:51:59 +0000 (14:51 +0800)]
clk: rk: add aclk_lcdc init, fix dclk_lcdc/i2s clk ops
1. Init aclk_lcdc 300M.
2. Fix dclk_lcdc clk ops to set even div only.
3. Repeatly write i2s clk reg, to fix rk3188 problem.
CMY [Mon, 24 Feb 2014 03:31:49 +0000 (11:31 +0800)]
rk: ion: add system heap
xbw [Sat, 22 Feb 2014 08:03:46 +0000 (16:03 +0800)]
SDMMC: add the sdmmc driver to kernel_3.10
zwl [Fri, 21 Feb 2014 09:33:24 +0000 (17:33 +0800)]
1.hdmi: fix cat66121 driver run error 2. rkfb: fix some code error
dkl [Fri, 21 Feb 2014 09:09:10 +0000 (17:09 +0800)]
clk: rk: fix clk dts info analysis and clk register
1. Fix the way to get info from rk clk dts.
2. Fix rk clk register.
3. Draw out rk_clk_dump_info func.
4. Add more debug.
CMY [Fri, 21 Feb 2014 01:23:35 +0000 (09:23 +0800)]
rk: ion: change heap id
黄涛 [Thu, 20 Feb 2014 11:39:44 +0000 (19:39 +0800)]
rk: proc: fix slub warning when call setup_irq
BUG: sleeping function called from invalid context at mm/slub.c:926
in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/3
INFO: lockdep is turned off.
irq event stamp: 45900
hardirqs last enabled at (45899): [<
c009fe18>] rcu_preempt_note_context_switch+0x174/0x18c
hardirqs last disabled at (45900): [<
c0605a64>] _raw_spin_lock_irq+0x18/0x50
softirqs last enabled at (45744): [<
c002c424>] irq_enter+0x50/0x78
softirqs last disabled at (45743): [<
c002c418>] irq_enter+0x44/0x78
CPU: 3 PID: 0 Comm: swapper/3 Tainted: G O 3.10.0 #405
[<
c0013fe8>] (unwind_backtrace+0x0/0xe0) from [<
c0011930>] (show_stack+0x10/0x14)
[<
c0011930>] (show_stack+0x10/0x14) from [<
c00fa3dc>] (__kmalloc+0x70/0x228)
[<
c00fa3dc>] (__kmalloc+0x70/0x228) from [<
c0148d2c>] (__proc_create+0x94/0xf0)
[<
c0148d2c>] (__proc_create+0x94/0xf0) from [<
c0149000>] (proc_mkdir_data+0x30/0x74)
[<
c0149000>] (proc_mkdir_data+0x30/0x74) from [<
c009babc>] (register_handler_proc+0xe8/0x114)
[<
c009babc>] (register_handler_proc+0xe8/0x114) from [<
c00982b0>] (__setup_irq+0x334/0x3fc)
[<
c00982b0>] (__setup_irq+0x334/0x3fc) from [<
c0098558>] (setup_irq+0x58/0x80)
[<
c0098558>] (setup_irq+0x58/0x80) from [<
c05ef51c>] (rk_timer_init_clockevent+0x98/0xcc)
[<
c05ef51c>] (rk_timer_init_clockevent+0x98/0xcc) from [<
c05ed0dc>] (percpu_timer_setup+0x54/0xa8)
[<
c05ed0dc>] (percpu_timer_setup+0x54/0xa8) from [<
c05ed4d8>] (secondary_start_kernel+0x128/0x160)
[<
c05ed4d8>] (secondary_start_kernel+0x128/0x160) from [<
600081bc>] (0x600081bc)
黄涛 [Thu, 20 Feb 2014 11:12:23 +0000 (19:12 +0800)]
ts: rk29_i2c_goodix: fix resume with enable wrong irq
wdc [Thu, 20 Feb 2014 11:49:55 +0000 (19:49 +0800)]
keys: depend on rockchip adc config
qjb [Thu, 20 Feb 2014 10:29:18 +0000 (18:29 +0800)]
Audio codec rt5631: add support
qjb [Thu, 20 Feb 2014 10:01:26 +0000 (18:01 +0800)]
Audio codec: add i2c scl_rate,default 100k.
wdc [Thu, 20 Feb 2014 09:34:36 +0000 (17:34 +0800)]
saradc: rm drivers/iio/adc/rk_adc.c
wdc [Thu, 20 Feb 2014 09:30:44 +0000 (17:30 +0800)]
saradc filename changed: rk_adc.c => rockchip_adc.c
黄涛 [Thu, 20 Feb 2014 08:05:27 +0000 (16:05 +0800)]
ARM: rockchip: support cpu hotplug and basic PM
黄涛 [Thu, 20 Feb 2014 06:28:36 +0000 (14:28 +0800)]
ARM: rockchip: rk3188-cpufreq only avaliable on rk3188
wdc [Thu, 20 Feb 2014 06:30:02 +0000 (14:30 +0800)]
linux3.10: support saradc key driver
黄涛 [Thu, 20 Feb 2014 06:22:23 +0000 (14:22 +0800)]
irqchip: gic: fix fiq debugger support when resume
ljf [Thu, 20 Feb 2014 05:07:35 +0000 (13:07 +0800)]
Port VPU driver to kernel 3.10
陈金泉 [Thu, 20 Feb 2014 03:50:57 +0000 (11:50 +0800)]
audio: update rockchip_defconfig
CMY [Thu, 20 Feb 2014 03:21:40 +0000 (11:21 +0800)]
rk: ion: add custom ioctl: ION_IOC_GET_PHYS
dkl [Wed, 19 Feb 2014 12:37:01 +0000 (20:37 +0800)]
clk: rk: fix clk add provider and cache parents
陈金泉 [Wed, 19 Feb 2014 08:00:17 +0000 (16:00 +0800)]
Audio: add dts property(i2s format) and delete them from menuconfig, add sound card info parsing, fix i2s lock error.
黄涛 [Tue, 18 Feb 2014 10:34:00 +0000 (18:34 +0800)]
ARM: rockchip: iomap.h add more rk3288 define
zwl [Tue, 18 Feb 2014 07:51:42 +0000 (15:51 +0800)]
hdmi: add cat66121 hdmi driver dts property
黄涛 [Tue, 18 Feb 2014 07:56:57 +0000 (15:56 +0800)]
ARM: rockchip: grf.h add rk3288 support
黄涛 [Mon, 17 Feb 2014 12:03:41 +0000 (20:03 +0800)]
ARM: rockchip: rk3188-tb set memory size to 1G for support sdk board
zwl [Mon, 17 Feb 2014 10:03:48 +0000 (18:03 +0800)]
RK616: add dts property and fix some compile error
黄涛 [Fri, 14 Feb 2014 02:32:22 +0000 (10:32 +0800)]
ARM: rockchip: rk3188: fix dma irq define
zwl [Thu, 13 Feb 2014 12:41:03 +0000 (20:41 +0800)]
move driver/video/display/display-sys.c to driver/video/rockchip/display-sys.c
黄涛 [Thu, 13 Feb 2014 10:12:15 +0000 (18:12 +0800)]
ARM: rockchip: rk3188-tb add ts support
黄涛 [Thu, 13 Feb 2014 10:11:01 +0000 (18:11 +0800)]
ts: rk29_i2c_goodix: porting to 3.10
wlf [Thu, 13 Feb 2014 07:45:30 +0000 (15:45 +0800)]
USB: support usb otg and host20 functions
陈金泉 [Thu, 13 Feb 2014 02:24:41 +0000 (10:24 +0800)]
Audio: use sound DMA engine for pcm, update i2s, spdif and machine driver, add dts property for i2s and spdif.
黄涛 [Wed, 12 Feb 2014 12:01:56 +0000 (20:01 +0800)]
ARM: rockchip: fix rk3188 i2c dts setup again
黄涛 [Wed, 12 Feb 2014 11:55:51 +0000 (19:55 +0800)]
i2c: rockchip: fix check idle init, disable clk control to make dvfs happy, fix rk3188 i2c dts setup
yxj [Wed, 12 Feb 2014 02:41:34 +0000 (10:41 +0800)]
rk fb:fix dma_buf fd
CMY [Tue, 11 Feb 2014 09:14:56 +0000 (17:14 +0800)]
rk: ion: remove ^M character
CMY [Tue, 11 Feb 2014 08:48:16 +0000 (16:48 +0800)]
move rockchip_ion.h file to include/linux/
张晴 [Tue, 11 Feb 2014 08:37:30 +0000 (16:37 +0800)]
rk31:pmu:support pmu sleep voltage and sleep mode setting by dts
CMY [Tue, 11 Feb 2014 07:31:10 +0000 (15:31 +0800)]
enable rockchip ion by default
yxj [Tue, 11 Feb 2014 07:26:04 +0000 (15:26 +0800)]
rk fb:use ion interface export by rockchip ion
yxj [Tue, 11 Feb 2014 06:44:08 +0000 (14:44 +0800)]
rk fb: add ion dam_buf support
CMY [Mon, 10 Feb 2014 02:36:02 +0000 (10:36 +0800)]
Add rockchip ion
dkl [Tue, 11 Feb 2014 02:16:42 +0000 (10:16 +0800)]
clk: rk: change clk_core init-rate and the way to get cru&grf base
1. Change clk_core init-rate to 792 MHZ.
2. Use RK_CRU_VIRT & RK_GRF_VIRT to get cru&grf base.
3. Fix pll_wait_lock() func.
许盛飞 [Tue, 11 Feb 2014 03:19:03 +0000 (11:19 +0800)]
pwm: solve the bug sleeping function called from invalid context at kernel/mutex.c:413
zwl [Mon, 10 Feb 2014 14:11:43 +0000 (22:11 +0800)]
1.optimize the 'hdmi' global variables 2.fix some compile error
黄涛 [Mon, 10 Feb 2014 09:14:04 +0000 (17:14 +0800)]
ARM: rockchip: rockchip_defconfig merge android config
黄涛 [Mon, 10 Feb 2014 08:23:36 +0000 (16:23 +0800)]
Merge remote-tracking branch 'origin/upstream/linux-linaro-lsk-v3.10-android' into develop-3.10
黄涛 [Mon, 10 Feb 2014 06:19:24 +0000 (14:19 +0800)]
宋秀杰 [Mon, 10 Feb 2014 03:14:48 +0000 (11:14 +0800)]
dma pl330: add device tree mode support, memcpy function ok,
but clock is not used now.
dkl [Mon, 10 Feb 2014 02:52:33 +0000 (10:52 +0800)]
clk: rockchip: add clk_gpu init to rate 200M
zwl [Sat, 8 Feb 2014 09:40:40 +0000 (17:40 +0800)]
rk616: update rk616 driver,add dts property
黄涛 [Sat, 8 Feb 2014 08:39:23 +0000 (16:39 +0800)]
ARM: rockchip: update rockchip_defconfig to support mtd and rknand
Zhaoyifeng [Sat, 8 Feb 2014 08:13:02 +0000 (16:13 +0800)]
rknand:remove debug log.
陈亮 [Sat, 8 Feb 2014 06:17:36 +0000 (22:17 -0800)]
rockchip_defconfig : set default cpufreq governor to interactive
陈亮 [Sat, 8 Feb 2014 03:32:55 +0000 (19:32 -0800)]
rk3188 : add dvfs && cpufreq
Zhaoyifeng [Sat, 8 Feb 2014 02:23:40 +0000 (10:23 +0800)]
add rknand for debug
dkl [Fri, 7 Feb 2014 12:19:16 +0000 (20:19 +0800)]
ARM: rockchip: correct L2 latency setting
luowei [Fri, 7 Feb 2014 05:42:17 +0000 (13:42 +0800)]
close pinctrl debug log
dkl [Fri, 7 Feb 2014 03:30:51 +0000 (11:30 +0800)]
clk: rockchip: fix clk reg address description in dts
1.Descripe cru address mapping in clocks node's "ranges" property, and
change children nodes' "reg" property accordingly.
2.Get cru base from clock_regs node's "reg" property.
dkl [Fri, 7 Feb 2014 01:50:53 +0000 (09:50 +0800)]
Recommit "clk: rockchip: add clk init data and enable clk init"
This recommit commit
4673090895385ded057a23dcbdfff2ebe1f80f1b with
fix that lower clk_core init rate to 594 MHZ.
Mark Brown [Mon, 27 Jan 2014 14:57:42 +0000 (14:57 +0000)]
Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-android
Mark Brown [Mon, 27 Jan 2014 14:57:25 +0000 (14:57 +0000)]
Merge tag 'v3.10.28' into linux-linaro-lsk
This is the 3.10.28 stable release
yxj [Mon, 20 Jan 2014 22:39:28 +0000 (06:39 +0800)]
rk fb:rename layer to win, add iomux for rk3188 lcdc
陈金泉 [Sun, 26 Jan 2014 08:28:43 +0000 (16:28 +0800)]
update audio platform driver, add spdif codec dts property
黄涛 [Sun, 26 Jan 2014 07:58:50 +0000 (15:58 +0800)]
ARM: rockchip: set rk3188 machine name RK30board to keep android happy
张晴 [Sun, 26 Jan 2014 01:58:37 +0000 (09:58 +0800)]
rk:pmu:rk808&act8846:support dts for linux 3.1
dkl [Sun, 26 Jan 2014 01:34:30 +0000 (09:34 +0800)]
Revert "clk: rockchip: add clk init data and enable clk init"
This reverts commit
4673090895385ded057a23dcbdfff2ebe1f80f1b.
Greg Kroah-Hartman [Sat, 25 Jan 2014 16:27:55 +0000 (08:27 -0800)]
Linux 3.10.28
Taras Kondratiuk [Fri, 10 Jan 2014 00:27:08 +0000 (01:27 +0100)]
ARM: 7938/1: OMAP4/highbank: Flush L2 cache before disabling
commit
b25f3e1c358434bf850220e04f28eebfc45eb634 upstream.
Kexec disables outer cache before jumping to reboot code, but it doesn't
flush it explicitly. Flush is done implicitly inside of l2x0_disable().
But some SoC's override default .disable handler and don't flush cache.
This may lead to a corrupted memory during Kexec reboot on these
platforms.
This patch adds cache flush inside of OMAP4 and Highbank outer_cache.disable()
handlers to make it consistent with default l2x0_disable().
Acked-by: Rob Herring <rob.herring@calxeda.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Taras Kondratiuk <taras.kondratiuk@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Wang Nan <wangnan0@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ville Syrjälä [Tue, 7 Jan 2014 14:15:36 +0000 (16:15 +0200)]
drm/i915: Don't grab crtc mutexes in intel_modeset_gem_init()
commit
7ad228b11ec26a820291c9f5a1168d6176580dc1 upstream.
When the pipe A force quirk is applied the code will attempt to grab
a crtc mutex during intel_modeset_setup_hw_state(). If we're already
holding all crtc mutexes this will obviously deadlock every time.
So instead of using drm_modeset_lock_all() just grab the
mode_config.mutex. This is enough to avoid the unlocked mutex warnings
from certain lower level functions.
The regression was introduced in:
commit
027476642811f8559cbe00ef6cc54db230e48a20
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Mon Dec 2 11:08:06 2013 +0200
drm/i915: Take modeset locks around intel_modeset_setup_hw_state()
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[danvet: Add cc: stable since the offending commit has that, too.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jon Medhurst [Tue, 10 Dec 2013 10:18:58 +0000 (10:18 +0000)]
serial: amba-pl011: use port lock to guard control register access
commit
fe43390702a1b5741fdf217063b05c7612b38303 upstream.
When the pl011 is being used for a console, pl011_console_write forces
the control register (CR) to enable the UART for transmission and then
restores this to the original value afterwards. It does this while
holding the port lock.
Unfortunately, when the uart is started or shutdown - say in response to
userland using the serial device for a terminal - then this updates the
control register without any locking.
This means we can have
pl011_console_write Save CR
pl011_startup Initialise CR, e.g. enable receive
pl011_console_write Restore old CR with receive not enabled
this result is a serial port which doesn't respond to any input.
A similar race in reverse could happen when the device is shutdown.
We can fix these problems by taking the port lock when updating CR.
Signed-off-by: Jon Medhurst <tixy@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Geert Uytterhoeven [Tue, 21 Jan 2014 23:48:47 +0000 (15:48 -0800)]
mm: Make {,set}page_address() static inline if WANT_PAGE_VIRTUAL
commit
f92f455f67fef27929e6043499414605b0c94872 upstream.
{,set}page_address() are macros if WANT_PAGE_VIRTUAL. If
!WANT_PAGE_VIRTUAL, they're plain C functions.
If someone calls them with a void *, this pointer is auto-converted to
struct page * if !WANT_PAGE_VIRTUAL, but causes a build failure on
architectures using WANT_PAGE_VIRTUAL (arc, m68k and sparc64):
drivers/md/bcache/bset.c: In function `__btree_sort':
drivers/md/bcache/bset.c:1190: warning: dereferencing `void *' pointer
drivers/md/bcache/bset.c:1190: error: request for member `virtual' in something not a structure or union
Convert them to static inline functions to fix this. There are already
plenty of users of struct page members inside <linux/mm.h>, so there's
no reason to keep them as macros.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeilBrown [Mon, 6 Jan 2014 02:19:42 +0000 (13:19 +1100)]
md/raid5: Fix possible confusion when multiple write errors occur.
commit
1cc03eb93245e63b0b7a7832165efdc52e25b4e6 upstream.
commit
5d8c71f9e5fbdd95650be00294d238e27a363b5c
md: raid5 crash during degradation
Fixed a crash in an overly simplistic way which could leave
R5_WriteError or R5_MadeGood set in the stripe cache for devices
for which it is no longer relevant.
When those devices are removed and spares added the flags are still
set and can cause incorrect behaviour.
commit
14a75d3e07c784c004b4b44b34af996b8e4ac453
md/raid5: preferentially read from replacement device if possible.
Fixed the same bug if a more effective way, so we can now revert
the original commit.
Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
Fixes: 5d8c71f9e5fbdd95650be00294d238e27a363b5c
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeilBrown [Mon, 13 Jan 2014 23:38:09 +0000 (10:38 +1100)]
md/raid10: fix two bugs in handling of known-bad-blocks.
commit
b50c259e25d9260b9108dc0c2964c26e5ecbe1c1 upstream.
If we discover a bad block when reading we split the request and
potentially read some of it from a different device.
The code path of this has two bugs in RAID10.
1/ we get a spin_lock with _irq, but unlock without _irq!!
2/ The calculation of 'sectors_handled' is wrong, as can be clearly
seen by comparison with raid1.c
This leads to at least 2 warnings and a probable crash is a RAID10
ever had known bad blocks.
Fixes: 856e08e23762dfb92ffc68fd0a8d228f9e152160
Reported-by: Damian Nowak <spam@nowaker.net>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeilBrown [Sun, 5 Jan 2014 23:35:34 +0000 (10:35 +1100)]
md/raid10: fix bug when raid10 recovery fails to recover a block.
commit
e8b849158508565e0cd6bc80061124afc5879160 upstream.
commit
e875ecea266a543e643b19e44cf472f1412708f9
md/raid10 record bad blocks as needed during recovery.
added code to the "cannot recover this block" path to record a bad
block rather than fail the whole recovery.
Unfortunately this new case was placed *after* r10bio was freed rather
than *before*, yet it still uses r10bio.
This is will crash with a null dereference.
So move the freeing of r10bio down where it is safe.
Fixes: e875ecea266a543e643b19e44cf472f1412708f9
Reported-by: Damian Nowak <spam@nowaker.net>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeilBrown [Wed, 11 Dec 2013 23:13:33 +0000 (10:13 +1100)]
md: fix problem when adding device to read-only array with bitmap.
commit
8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97 upstream.
If an array is started degraded, and then the missing device
is found it can be re-added and a minimal bitmap-based recovery
will bring it fully up-to-date.
If the array is read-only a recovery would not be allowed.
But also if the array is read-only and the missing device was
present very recently, then there could be no need for any
recovery at all, so we simply include the device in the read-only
array without any recovery.
However... if the missing device was removed a little longer ago
it could be missing some updates, but if a bitmap is present it will
be conditionally accepted pending a bitmap-based update. We don't
currently detect this case properly and will include that old
device into the read-only array with no recovery even though it really
needs a recovery.
This patch keeps track of whether a bitmap-based-recovery is really
needed or not in the new Bitmap_sync rdev flag. If that is set,
then the device will not be added to a read-only array.
Cc: Andrei Warkentin <andreiw@vmware.com>
Fixes: d70ed2e4fafdbef0800e73942482bb075c21578b
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Paulo Zanoni [Wed, 8 Jan 2014 13:12:27 +0000 (11:12 -0200)]
drm/i915: fix DDI PLLs HW state readout code
commit
0882dae983707455e97479e5e904e37673517ebc upstream.
Properly zero the refcounts and crtc->ddi_pll_set so the previous HW
state doesn't affect the result of reading the current HW state.
This fixes WARNs about WRPLL refcount if we have an HDMI monitor on
HSW and then suspend/resume.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64379
Tested-by: Qingshuai Tian <qingshuai.tian@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Andreas Rohner [Wed, 15 Jan 2014 01:56:36 +0000 (17:56 -0800)]
nilfs2: fix segctor bug that causes file system corruption
commit
70f2fe3a26248724d8a5019681a869abdaf3e89a upstream.
There is a bug in the function nilfs_segctor_collect, which results in
active data being written to a segment, that is marked as clean. It is
possible, that this segment is selected for a later segment
construction, whereby the old data is overwritten.
The problem shows itself with the following kernel log message:
nilfs_sufile_do_cancel_free: segment 6533 must be clean
Usually a few hours later the file system gets corrupted:
NILFS: bad btree node (blocknr=
8748107): level = 0, flags = 0x0, nchildren = 0
NILFS error (device sdc1): nilfs_bmap_last_key: broken bmap (inode number=114660)
The issue can be reproduced with a file system that is nearly full and
with the cleaner running, while some IO intensive task is running.
Although it is quite hard to reproduce.
This is what happens:
1. The cleaner starts the segment construction
2. nilfs_segctor_collect is called
3. sc_stage is on NILFS_ST_SUFILE and segments are freed
4. sc_stage is on NILFS_ST_DAT current segment is full
5. nilfs_segctor_extend_segments is called, which
allocates a new segment
6. The new segment is one of the segments freed in step 3
7. nilfs_sufile_cancel_freev is called and produces an error message
8. Loop around and the collection starts again
9. sc_stage is on NILFS_ST_SUFILE and segments are freed
including the newly allocated segment, which will contain active
data and can be allocated at a later time
10. A few hours later another segment construction allocates the
segment and causes file system corruption
This can be prevented by simply reordering the statements. If
nilfs_sufile_cancel_freev is called before nilfs_segctor_extend_segments
the freed segments are marked as dirty and cannot be allocated any more.
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Reviewed-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Hugh Dickins [Sun, 12 Jan 2014 09:25:21 +0000 (01:25 -0800)]
thp: fix copy_page_rep GPF by testing is_huge_zero_pmd once only
commit
eecc1e426d681351a6026a7d3e7d225f38955b6c upstream.
We see General Protection Fault on RSI in copy_page_rep: that RSI is
what you get from a NULL struct page pointer.
RIP: 0010:[<
ffffffff81154955>] [<
ffffffff81154955>] copy_page_rep+0x5/0x10
RSP: 0000:
ffff880136e15c00 EFLAGS:
00010286
RAX:
ffff880000000000 RBX:
ffff880136e14000 RCX:
0000000000000200
RDX:
6db6db6db6db6db7 RSI:
db73880000000000 RDI:
ffff880dd0c00000
RBP:
ffff880136e15c18 R08:
0000000000000200 R09:
000000000005987c
R10:
000000000005987c R11:
0000000000000200 R12:
0000000000000001
R13:
ffffea00305aa000 R14:
0000000000000000 R15:
0000000000000000
FS:
00007f195752f700(0000) GS:
ffff880c7fc20000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000093010000 CR3:
00000001458e1000 CR4:
00000000000027e0
Call Trace:
copy_user_huge_page+0x93/0xab
do_huge_pmd_wp_page+0x710/0x815
handle_mm_fault+0x15d8/0x1d70
__do_page_fault+0x14d/0x840
do_page_fault+0x2f/0x90
page_fault+0x22/0x30
do_huge_pmd_wp_page() tests is_huge_zero_pmd(orig_pmd) four times: but
since shrink_huge_zero_page() can free the huge_zero_page, and we have
no hold of our own on it here (except where the fourth test holds
page_table_lock and has checked pmd_same), it's possible for it to
answer yes the first time, but no to the second or third test. Change
all those last three to tests for NULL page.
(Note: this is not the same issue as trinity's DEBUG_PAGEALLOC BUG
in copy_page_rep with RSI:
ffff88009c422000, reported by Sasha Levin
in https://lkml.org/lkml/2013/3/29/103. I believe that one is due
to the source page being split, and a tail page freed, while copy
is in progress; and not a problem without DEBUG_PAGEALLOC, since
the pmd_same check will prevent a miscopy from being made visible.)
Fixes: 97ae17497e99 ("thp: implement refcounting for huge zero page")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Steven Rostedt [Wed, 13 Nov 2013 20:20:04 +0000 (15:20 -0500)]
ftrace/x86: Load ftrace_ops in parameter not the variable holding it
commit
1739f09e33d8f66bf48ddbc3eca615574da6c4f6 upstream.
Function tracing callbacks expect to have the ftrace_ops that registered it
passed to them, not the address of the variable that holds the ftrace_ops
that registered it.
Use a mov instead of a lea to store the ftrace_ops into the parameter
of the function tracing callback.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Link: http://lkml.kernel.org/r/20131113152004.459787f9@gandalf.local.home
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Steven Rostedt [Fri, 10 Jan 2014 02:46:34 +0000 (21:46 -0500)]
SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()
commit
3dc91d4338d698ce77832985f9cb183d8eeaf6be upstream.
While running stress tests on adding and deleting ftrace instances I hit
this bug:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000020
IP: selinux_inode_permission+0x85/0x160
PGD
63681067 PUD
7ddbe067 PMD 0
Oops: 0000 [#1] PREEMPT
CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted
3.13.0-rc4-test-00033-gd2a6dde-dirty #20
Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
task:
ffff880078375800 ti:
ffff88007ddb0000 task.ti:
ffff88007ddb0000
RIP: 0010:[<
ffffffff812d8bc5>] [<
ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160
RSP: 0018:
ffff88007ddb1c48 EFLAGS:
00010246
RAX:
0000000000000000 RBX:
0000000000800000 RCX:
ffff88006dd43840
RDX:
0000000000000001 RSI:
0000000000000081 RDI:
ffff88006ee46000
RBP:
ffff88007ddb1c88 R08:
0000000000000000 R09:
ffff88007ddb1c54
R10:
6e6576652f6f6f66 R11:
0000000000000003 R12:
0000000000000000
R13:
0000000000000081 R14:
ffff88006ee46000 R15:
0000000000000000
FS:
00007f217b5b6700(0000) GS:
ffffffff81e21000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033^M
CR2:
0000000000000020 CR3:
000000006a0fe000 CR4:
00000000000007f0
Call Trace:
security_inode_permission+0x1c/0x30
__inode_permission+0x41/0xa0
inode_permission+0x18/0x50
link_path_walk+0x66/0x920
path_openat+0xa6/0x6c0
do_filp_open+0x43/0xa0
do_sys_open+0x146/0x240
SyS_open+0x1e/0x20
system_call_fastpath+0x16/0x1b
Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff
RIP selinux_inode_permission+0x85/0x160
CR2:
0000000000000020
Investigating, I found that the inode->i_security was NULL, and the
dereference of it caused the oops.
in selinux_inode_permission():
isec = inode->i_security;
rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
Note, the crash came from stressing the deletion and reading of debugfs
files. I was not able to recreate this via normal files. But I'm not
sure they are safe. It may just be that the race window is much harder
to hit.
What seems to have happened (and what I have traced), is the file is
being opened at the same time the file or directory is being deleted.
As the dentry and inode locks are not held during the path walk, nor is
the inodes ref counts being incremented, there is nothing saving these
structures from being discarded except for an rcu_read_lock().
The rcu_read_lock() protects against freeing of the inode, but it does
not protect freeing of the inode_security_struct. Now if the freeing of
the i_security happens with a call_rcu(), and the i_security field of
the inode is not changed (it gets freed as the inode gets freed) then
there will be no issue here. (Linus Torvalds suggested not setting the
field to NULL such that we do not need to check if it is NULL in the
permission check).
Note, this is a hack, but it fixes the problem at hand. A real fix is
to restructure the destroy_inode() to call all the destructor handlers
from the RCU callback. But that is a major job to do, and requires a
lot of work. For now, we just band-aid this bug with this fix (it
works), and work on a more maintainable solution in the future.
Link: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home
Link: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jan Kara [Fri, 13 Dec 2013 20:21:26 +0000 (04:21 +0800)]
writeback: Fix data corruption on NFS
commit
f9b0e058cbd04ada76b13afffa7e1df830543c24 upstream.
Commit
4f8ad655dbc8 "writeback: Refactor writeback_single_inode()" added
a condition to skip clean inode. However this is wrong in WB_SYNC_ALL
mode because there we also want to wait for outstanding writeback on
possibly clean inode. This was causing occasional data corruption issues
on NFS because it uses sync_inode() to make sure all outstanding writes
are flushed to the server before truncating the inode and with
sync_inode() returning prematurely file was sometimes extended back
by an outstanding write after it was truncated.
So modify the test to also check for pages under writeback in
WB_SYNC_ALL mode.
Fixes: 4f8ad655dbc82cf05d2edc11e66b78a42d38bf93
Reported-and-tested-by: Dan Duval <dan.duval@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jean Delvare [Tue, 14 Jan 2014 14:59:55 +0000 (15:59 +0100)]
hwmon: (coretemp) Fix truncated name of alarm attributes
commit
3f9aec7610b39521c7c69d754de7265f6994c194 upstream.
When the core number exceeds 9, the size of the buffer storing the
alarm attribute name is insufficient and the attribute name is
truncated. This causes libsensors to skip these attributes as the
truncated name is not recognized.
Reported-by: Andreas Hollmann <hollmann@in.tum.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric W. Biederman [Sat, 9 Nov 2013 00:31:29 +0000 (16:31 -0800)]
vfs: In d_path don't call d_dname on a mount point
commit
f48cfddc6729ef133933062320039808bafa6f45 upstream.
Aditya Kali (adityakali@google.com) wrote:
> Commit
bf056bfa80596a5d14b26b17276a56a0dcb080e5:
> "proc: Fix the namespace inode permission checks." converted
> the namespace files into symlinks. The same commit changed
> the way namespace bind mounts appear in /proc/mounts:
> $ mount --bind /proc/self/ns/ipc /mnt/ipc
> Originally:
> $ cat /proc/mounts | grep ipc
> proc /mnt/ipc proc rw,nosuid,nodev,noexec 0 0
>
> After commit
bf056bfa80596a5d14b26b17276a56a0dcb080e5:
> $ cat /proc/mounts | grep ipc
> proc ipc:[
4026531839] proc rw,nosuid,nodev,noexec 0 0
>
> This breaks userspace which expects the 2nd field in
> /proc/mounts to be a valid path.
The symlink /proc/<pid>/ns/{ipc,mnt,net,pid,user,uts} point to
dentries allocated with d_alloc_pseudo that we can mount, and
that have interesting names printed out with d_dname.
When these files are bind mounted /proc/mounts is not currently
displaying the mount point correctly because d_dname is called instead
of just displaying the path where the file is mounted.
Solve this by adding an explicit check to distinguish mounted pseudo
inodes and unmounted pseudo inodes. Unmounted pseudo inodes always
use mount of their filesstem as the mnt_root in their path making
these two cases easy to distinguish.
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Reported-by: Aditya Kali <adityakali@google.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
H Hartley Sweeten [Thu, 5 Dec 2013 20:43:28 +0000 (13:43 -0700)]
staging: comedi: adl_pci9111: fix incorrect irq passed to request_irq()
commit
48108fe3daa0d142f9b97178fdb23704ea3a407b upstream.
The dev->irq passed to request_irq() will always be 0 when the auto_attach
function is called. The pcidev->irq should be used instead to get the correct
irq number.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>