linux-toradex.git/drivers, branch v4.2.6

pinctrl: baytrail: Use raw_spinlock for locking

2015-11-09T22:37:40+00:00

commit 78e1c896932df5b8bcdff7bf5417d8e72a4d0d6b upstream.

The Intel Baytrail pinctrl driver implements irqchip callbacks which are
called with desc->lock raw_spinlock held. In mainline this is fine because
spinlock resolves to raw_spinlock. However, running the same code in -rt we
get:

 BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:917
 in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/0
 Preemption disabled at:[] cpu_startup_entry+0x17f/0x480

 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.1.5-rt5 #13
  ...
 Call Trace:
    [] dump_stack+0x4a/0x61
  [] ___might_sleep+0xe7/0x170
  [] rt_spin_lock+0x1f/0x50
  [] byt_gpio_clear_triggering+0x38/0x60
  [] byt_irq_mask+0x11/0x20
  [] handle_level_irq+0x83/0x150
  [] generic_handle_irq+0x27/0x40
  [] byt_gpio_irq_handler+0x7f/0xc0
  [] handle_irq+0xaa/0x190
  ...

This is because in -rt spinlocks are preemptible so taking the driver
private spinlock in irqchip callbacks causes might_sleep() to trigger.

In order to keep -rt happy but at the same time make sure that register
accesses get serialized, convert the driver to use raw_spinlock instead.

Also shorten the critical section a bit in few places.

Suggested-by: Linus Walleij 
Signed-off-by: Mika Westerberg 
Signed-off-by: Linus Walleij 
Cc: Lucas De Marchi 
Signed-off-by: Greg Kroah-Hartman

pinctrl: baytrail: Serialize all register access

2015-11-09T22:37:40+00:00

commit 39ce8150a079e3ae6ed9abf26d7918a558ef7c19 upstream.

There is a hardware issue in Intel Baytrail where concurrent GPIO register
access might result reads of 0xffffffff and writes might get dropped
completely.

Prevent this from happening by taking the serializing lock in all places
where it is possible that more than one thread might be accessing the
hardware concurrently.

Signed-off-by: Mika Westerberg 
Signed-off-by: Linus Walleij 
Cc: Lucas De Marchi 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Fix up user_dmabuf refcounting

2015-11-09T22:37:39+00:00

commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream.

If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.

Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Brian Paul 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

NVMe: Fix memory leak on retried commands

2015-11-09T22:37:39+00:00

commit 0dfc70c33409afc232ef0b9ec210535dfbf9bc61 upstream.

Resources are reallocated for requeued commands, so unmap and release
the iod for the failed command.

It's a pretty bad memory leak and causes a kernel hang if you remove a
drive because of a busy dma pool. You'll get messages spewing like this:

  nvme 0000:xx:xx.x: dma_pool_destroy prp list 256, ffff880420dec000 busy

and lock up pci and the driver since removal never completes while
holding a lock.

Signed-off-by: Keith Busch 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL)

2015-11-09T22:37:39+00:00

commit 8e601a9f97a00bab031980de34f9a81891c1f82f upstream.

This is a workaround for KNL platform, where in some cases MPERF counter
will not have updated value before next read of MSR_IA32_MPERF. In this
case divide by zero will occur. This change ignores current sample for
busy calculation in this case.

Fixes: b34ef932d79a (intel_pstate: Knights Landing support)
Signed-off-by: Srinivas Pandruvada 
Acked-by: Kristen Carlson Accardi 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

IB/cm: Fix rb-tree duplicate free and use-after-free

2015-11-09T22:37:39+00:00

commit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.

ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur 
Signed-off-by: Matan Barak 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

thermal: exynos: Fix register read in TMU

2015-11-09T22:37:39+00:00

commit b28fec1324bf8f5010d2c3c5d57db4115bda66d4 upstream.

The value of emul_con was getting overwritten if the selected soc is
SOC_ARCH_EXYNOS5260. And so as a result we were reading from the wrong
register in the case of SOC_ARCH_EXYNOS5260.

Fixes: 488c7455d74c ("thermal: exynos: Add the support for Exynos5433 TMU")
Signed-off-by: Sudip Mukherjee 
Reviewed-by: Krzysztof Kozlowski 
Reviewed-by: Chanwoo Choi 
Acked-by: Lukasz Majewski 
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Kukjin Kim 
Signed-off-by: Greg Kroah-Hartman

mvsas: Fix NULL pointer dereference in mvs_slot_task_free

2015-11-09T22:37:38+00:00

commit 2280521719e81919283b82902ac24058f87dfc1b upstream.

When pci_pool_alloc fails in mvs_task_prep then task->lldd_task stays
NULL but it's later used in mvs_abort_task as slot which is passed
to mvs_slot_task_free causing NULL pointer dereference.

Just return from mvs_slot_task_free when passed with NULL slot.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101891
Signed-off-by: Dāvis Mosāns 
Reviewed-by: Tomas Henzl 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

irqchip/tegra: Propagate IRQ type setting to parent

2015-11-09T22:37:38+00:00

commit 209da39154837ec1b69fb34f438041939911e4b4 upstream.

The LIC doesn't deal with the different types of interrupts itself
but needs to forward calls to set the appropriate type to its parent
IRQ controller.

Without this fix all IRQs routed through the LIC will stay at the
initial EDGE type, while most of them should actually be level triggered.

Fixes: 1eec582158e2 "irqchip: tegra: Add Tegra210 support"
Signed-off-by: Lucas Stach 
Cc: Stephen Warren 
Cc: Thierry Reding 
Cc: Alexandre Courbot 
Cc: Jason Cooper 
Cc: Marc Zyngier 
Link: http://lkml.kernel.org/r/1445787552-13062-1-git-send-email-dev@lynxeye.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs()

2015-11-09T22:37:38+00:00

commit 2900ea609616c2651dec65312beeb2a6e536bc50 upstream.

In commit

  7d375bffa524 ("sb_edac: Fix support for systems with two home agents per socket")

NUM_CHANNELS was changed to 8 and the channel space was renumerated to
handle EN, EP, and EX configurations.

The *_mci_bind_devs() functions - except for sbridge_mci_bind_devs() -
got a new device presence check in the form of saw_chan_mask. However,
sbridge_mci_bind_devs() still uses the NUM_CHANNELS for loop.

With the increase in NUM_CHANNELS, this loop fails at index 4 since
SB only has 4 TADs.  This results in the following error on SB machines:

  EDAC sbridge: Some needed devices are missing
  EDAC sbridge: Couldn't find mci handler
  EDAC sbridge: Couldn't find mci handle

This patch adapts the saw_chan_mask logic for sbridge_mci_bind_devs() as
well.

After this patch:

  EDAC MC0: Giving out device to module sbridge_edac.c controller Sandy Bridge Socket#0: DEV 0000:3f:0e.0 (POLLED)
  EDAC MC1: Giving out device to module sbridge_edac.c controller Sandy Bridge Socket#1: DEV 0000:7f:0e.0 (POLLED)

Signed-off-by: Seth Jennings 
Acked-by: Aristeu Rozanski 
Acked-by: Tony Luck 
Tested-by: Borislav Petkov 
Cc: Mauro Carvalho Chehab 
Cc: linux-edac 
Link: http://lkml.kernel.org/r/1438798561-10180-1-git-send-email-sjenning@redhat.com
Signed-off-by: Borislav Petkov 
Signed-off-by: Greg Kroah-Hartman