linux-toradex.git/drivers, branch v3.4.108

xen: netback: read hotplug script once at start of day.

2015-06-19T03:40:35+00:00

commit 31a418986a5852034d520a5bab546821ff1ccf3d upstream.

When we come to tear things down in netback_remove() and generate the
uevent it is possible that the xenstore directory has already been
removed (details below).

In such cases netback_uevent() won't be able to read the hotplug
script and will write a xenstore error node.

A recent change to the hypervisor exposed this race such that we now
sometimes lose it (where apparently we didn't ever before).

Instead read the hotplug script configuration during setup and use it
for the lifetime of the backend device.

The apparently more obvious fix of moving the transition to
state=Closed in netback_remove() to after the uevent does not work
because it is possible that we are already in state=Closed (in
reaction to the guest having disconnected as it shutdown). Being
already in Closed means the toolstack is at liberty to start tearing
down the xenstore directories. In principal it might be possible to
arrange to unregister the device sooner (e.g on transition to Closing)
such that xenstore would still be there but this state machine is
fragile and prone to anger...

A modern Xen system only relies on the hotplug uevent for driver
domains, when the backend is in the same domain as the toolstack it
will run the necessary setup/teardown directly in the correct sequence
wrt xenstore changes.

Signed-off-by: Ian Campbell 
Acked-by: Wei Liu 
Signed-off-by: David S. Miller 
Signed-off-by: Zefan Li

xen-pciback: Add name prefix to global 'permissive' variable

2015-06-19T03:40:35+00:00

commit 8014bcc86ef112eab9ee1db312dba4e6b608cf89 upstream.

The variable for the 'permissive' module parameter used to be static
but was recently changed to be extern.  This puts it in the kernel
global namespace if the driver is built-in, so its name should begin
with a prefix identifying the driver.

Signed-off-by: Ben Hutchings 
Fixes: af6fc858a35b ("xen-pciback: limit guest control of command register")
Signed-off-by: David Vrabel 
Signed-off-by: Zefan Li

IB/core: don't disallow registering region starting at 0x0

2015-06-19T03:40:34+00:00

commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream.

In a call to ib_umem_get(), if address is 0x0 and size is
already page aligned, check added in commit 8494057ab5e4
("IB/uverbs: Prevent integer overflow in ib_umem_get address
arithmetic") will refuse to register a memory region that
could otherwise be valid (provided vm.mmap_min_addr sysctl
and mmap_low_allowed SELinux knobs allow userspace to map
something at address 0x0).

This patch allows back such registration: ib_umem_get()
should probably don't care of the base address provided it
can be pinned with get_user_pages().

There's two possible overflows, in (addr + size) and in
PAGE_ALIGN(addr + size), this patch keep ensuring none
of them happen while allowing to pin memory at address
0x0. Anyway, the case of size equal 0 is no more (partially)
handled as 0-length memory region are disallowed by an
earlier check.

Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
Cc: Shachar Raindel 
Cc: Jack Morgenstein 
Cc: Or Gerlitz 
Signed-off-by: Yann Droneaud 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Haggai Eran 
Signed-off-by: Doug Ledford 
Signed-off-by: Zefan Li

cdc-acm: prevent infinite loop when parsing CDC headers.

2015-06-19T03:40:34+00:00

commit 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e upstream.

Phil and I found out a problem with commit:

  7e860a6e7aa6 ("cdc-acm: add sanity checks")

It added some sanity checks to ignore potential garbage in CDC headers but
also introduced a potential infinite loop.  This can happen at the first
loop iteration (elength = 0 in that case) if the description isn't a
DT_CS_INTERFACE or later if 'buffer[0]' is zero.

It should also be noted that the wrong length was being added to 'buffer'
in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was
assigned after that check in the loop.

A specially crafted USB device could be used to trigger this infinite loop.

Fixes: 7e860a6e7aa6 ("cdc-acm: add sanity checks")
Signed-off-by: Phil Turnbull 
Signed-off-by: Quentin Casasnovas 
CC: Sergei Shtylyov 
CC: Oliver Neukum 
CC: Adam Lee 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

PCI: Convert pcibios_resource_to_bus() to take a pci_bus, not a pci_dev

2015-06-19T03:40:34+00:00

commit fc2798502f860b18f3c7121e4dc659d3d9d28d74 upstream.

These interfaces:

  pcibios_resource_to_bus(struct pci_dev *dev, *bus_region, *resource)
  pcibios_bus_to_resource(struct pci_dev *dev, *resource, *bus_region)

took a pci_dev, but they really depend only on the pci_bus.  And we want to
use them in resource allocation paths where we have the bus but not a
device, so this patch converts them to take the pci_bus instead of the
pci_dev:

  pcibios_resource_to_bus(struct pci_bus *bus, *bus_region, *resource)
  pcibios_bus_to_resource(struct pci_bus *bus, *resource, *bus_region)

In fact, with standard PCI-PCI bridges, they only depend on the host
bridge, because that's the only place address translation occurs, but
we aren't going that far yet.

[bhelgaas: changelog]
Signed-off-by: Yinghai Lu 
Signed-off-by: Bjorn Helgaas 
Cc: Dirk Behme 
[lizf: Backported to 3.4:
 - make changes to pci_host_bridge() instead of find_pci_root_bus()
 - adjust context]
Signed-off-by: Zefan Li

UBI: fix soft lockup in ubi_check_volume()

2015-06-19T03:40:34+00:00

commit 9aa272b492e7551a9ee0e2c83c720ea013698485 upstream.

Running mtd-utils/tests/ubi-tests/io_basic.c could cause
soft lockup or watchdog reset. It is because *updatevol*
will perform ubi_check_volume() after updating finish
and this function will full scan the updated lebs if the
volume is initialized as STATIC_VOLUME.

This patch adds *cond_resched()* in the loop of lebs scan
to avoid soft lockup.

Helped by Richard Weinberger 

[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1}  (t=2101 jiffies g=1606 c=1605 q=56)
[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G           O 3.10.53 #21
[ 2158.172898] [] (unwind_backtrace+0x0/0x120) from [] (show_stack+0x10/0x14)
[ 2158.172918] [] (show_stack+0x10/0x14) from [] (rcu_check_callbacks+0x1c0/0x660)
[ 2158.172936] [] (rcu_check_callbacks+0x1c0/0x660) from [] (update_process_times+0x38/0x64)
[ 2158.172953] [] (update_process_times+0x38/0x64) from [] (tick_sched_handle+0x54/0x60)
[ 2158.172966] [] (tick_sched_handle+0x54/0x60) from [] (tick_sched_timer+0x44/0x74)
[ 2158.172978] [] (tick_sched_timer+0x44/0x74) from [] (__run_hrtimer+0xc8/0x1b8)
[ 2158.172992] [] (__run_hrtimer+0xc8/0x1b8) from [] (hrtimer_interrupt+0x128/0x2a4)
[ 2158.173007] [] (hrtimer_interrupt+0x128/0x2a4) from [] (arch_timer_handler_virt+0x28/0x30)
[ 2158.173022] [] (arch_timer_handler_virt+0x28/0x30) from [] (handle_percpu_devid_irq+0x9c/0x124)
[ 2158.173036] [] (handle_percpu_devid_irq+0x9c/0x124) from [] (generic_handle_irq+0x20/0x30)
[ 2158.173049] [] (generic_handle_irq+0x20/0x30) from [] (handle_IRQ+0x64/0x8c)
[ 2158.173060] [] (handle_IRQ+0x64/0x8c) from [] (gic_handle_irq+0x3c/0x60)
[ 2158.173074] [] (gic_handle_irq+0x3c/0x60) from [] (__irq_svc+0x40/0x50)
[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0)
[ 2158.173092] 3c80:                                                       c4043ce4 00000019
[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000
[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff
[ 2158.173130] [] (__irq_svc+0x40/0x50) from [] (read_current_timer+0x4/0x38)
[ 2158.173145] [] (read_current_timer+0x4/0x38) from [<1f8a865f>] (0x1f8a865f)
[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073]
[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash]

Signed-off-by: Wang Kai 
Signed-off-by: hujianyang 
Signed-off-by: Richard Weinberger 
Signed-off-by: Zefan Li

hpsa: fix memory leak in kdump hard reset

2015-06-19T03:40:33+00:00

commit 03741d956eaac31264952e0afa181b62713892a5 upstream.

There is a potential memory leak in hpsa_kdump_hard_reset_controller.

Reviewed-by: Don Brace 
Reviewed-by: Scott Teel 
Signed-off-by: Tomas Henzl 
Signed-off-by: Don Brace 
Signed-off-by: Christoph Hellwig 
Cc: Vinson Lee 
Signed-off-by: Zefan Li

hpsa: turn off interrupts when kdump starts

2015-06-19T03:40:33+00:00

commit 3b747298786355c6934b0892fc9ae4ca44105192 upstream.

Sometimes when the card is restarted it may cause -
"irq 16: nobody cared (try booting with the "irqpoll" option)"
that is likely caused so, that the card, after the hard reset
finishes, pulls on the irq. Disabling the ints before or after
the hpsa_kdump_hard_reset_controller fixes it.

At this point we can't know in which state the card is,
so using SA5_INTR_OFF + SA5_REPLY_INTR_MASK_OFFSET defines directly,
instead of the function the drivers provides, seems to be apropriate.

Reviewed-by: Scott Teel 
Signed-off-by: Don Brace 
Signed-off-by: Christoph Hellwig 
Cc: Vinson Lee 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

hpsa: add missing pci_set_master in kdump path

2015-06-19T03:40:33+00:00

commit 859c75aba20264d87dd026bab0d0ca3bff385955 upstream.

Add a call to pci_set_master(...)  missing in the previous
patch "hpsa: refine the pci enable/disable handling".
Found thanks to Rob Elliot.

Signed-off-by: Tomas Henzl 
Reviewed-by: Robert Elliott 
Tested-by: Robert Elliott 
Signed-off-by: Christoph Hellwig 
Cc: Vinson Lee 
Signed-off-by: Zefan Li

hpsa: refine the pci enable/disable handling

2015-06-19T03:40:32+00:00

commit 132aa220b45d60e9b20def1e9d8be9422eed9616 upstream.

When a second(kdump) kernel starts and the hard reset method is used
the driver calls pci_disable_device without previously enabling it,
so the kernel shows a warning -
[   16.876248] WARNING: at drivers/pci/pci.c:1431 pci_disable_device+0x84/0x90()
[   16.882686] Device hpsa
disabling already-disabled device
...
This patch fixes it, in addition to this I tried to balance also some other pairs
of enable/disable device in the driver.
Unfortunately I wasn't able to verify the functionality for the case of a sw reset,
because of a lack of proper hw.

Signed-off-by: Tomas Henzl 
Reviewed-by: Stephen M. Cameron 
Signed-off-by: Christoph Hellwig 
Cc: Vinson Lee 
Signed-off-by: Zefan Li