summaryrefslogtreecommitdiffstats
path: root/drivers (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Input: atmel_mxt_ts - initialise input slots with INPUT_MT_DIRECTNick Dyer2015-08-051-0/+2
| | | | | | | | | | | | This indicates the device coordinates should be directly mapped to screen. This is valid since scaling/flipping/rotation should be done by configuring the MXT device. It also flags to Android using INPUT_PROP_DIRECT that the device should be treated as a touch screen by default, and removes the necessity for a default IDC file. Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: atmel_mxt_ts - disable interrupt for 50ms after resetNick Dyer2015-08-051-1/+8
| | | | | | | | The CHG/interrupt line is momentarily set (approximately 100 ms) as an input after power-up or reset for diagnostic purposes. This may cause spurious interrupts, so disable interrupt handler during this period. Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: atmel_mxt_ts - improve device tree parsingNick Dyer2015-08-051-13/+9
| | | | | | Use function rather than loop, define np to reduce wrapping. Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: atmel_mxt_ts - suspend/resume causes panic if input_dev fails to initPan Xinhui2015-08-051-0/+6
| | | | | | | | | input_dev may be NULL if mxt_initialize_input_device fails. But pm ops is still available and suspend/resume assume input_dev is not NULL. To fix this issue, we add a check if (!input_dev). Signed-off-by: Pan Xinhui <xinhuix.pan@intel.com> Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: atmel_mxt_ts - remove unused definesNick Dyer2015-08-051-65/+1
| | | | | | | | | Many of these values are out of date and they aren't used in the driver - all they do is increase the size of the kernel source. Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Acked-by: Benson Leung <bleung@chromium.org> Acked-by: Yufeng Shen <miletus@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: atmel_mxt_ts - use deep sleep mode when stoppedNick Dyer2015-08-052-12/+111
| | | | | | | | | | | | | | | | | | | | | | | | The hardcoded 0x83 CTRL setting overrides other settings in that byte, enabling extra reporting that may not be useful on a particular platform. Implement improved suspend mechanism via deep sleep. By writing zero to both the active and idle cycle times the maXTouch device can be put into a deep sleep mode, using minimal power. It is necessary to issue a calibrate command after the chip has spent any time in deep sleep, however a soft reset is unnecessary. Use the old method on Chromebook Pixel via platform data option. This patch also deals with the situation where the power configuration is zero on probe, which would mean that the device never wakes up to execute commands. After a config download, the T7 power configuration may have changed so it is necessary to re-read it. Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk> Acked-by: Benson Leung <bleung@chromium.org> Acked-by: Yufeng Shen <miletus@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: Allow compile test of GPIO consumers if !GPIOLIBGeert Uytterhoeven2015-08-044-12/+13
| | | | | | | | | | | | The GPIO subsystem provides dummy GPIO consumer functions if GPIOLIB is not enabled. Hence drivers that depend on GPIOLIB, but use GPIO consumer functionality only, can still be compiled if GPIOLIB is not enabled. Relax the dependency on GPIOLIB if COMPILE_TEST is enabled, where appropriate. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: zforce - make the interrupt GPIO optionalDirk Behme2015-08-031-14/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for hardware which uses an I2C Serializer / Deserializer (SerDes) to communicate with the zFroce touch driver. In this case the SerDes will be configured as an interrupt controller and the zForce driver will have no access to poll the GPIO line. To support this, we add two dedicated new GPIOs in the device tree: reset-gpios and irq-gpios, with the irq-gpios being optional. To not break the existing device trees, the index based 'gpios' entries are still supported, but marked as deprecated. With this, if the interrupt GPIO is available, either via the old or new device tree style, the while loop will read and handle the packets as long as the GPIO indicates that the interrupt is asserted (existing, unchanged driver behavior). If the interrupt GPIO isn't available, i.e. not configured via the new device tree style, we are falling back to one read per ISR invocation (new behavior to support the SerDes). Note that the gpiod functions help to handle the optional GPIO: devm_gpiod_get_index_optional() will return NULL in case the interrupt GPIO isn't available. And gpiod_get_value_cansleep() does cover this, too, by returning 0 in this case. Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> Reviewed-by: Heiko Stuebner <heiko.stuebner@bq.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - do not try to enable proximity reporting on older devicesDudley Du2015-07-301-4/+7
| | | | | | | | | Avoid the driver generate warning message when the cyapa driver working with the old Gen5 trackpad device which does not support the proximity function. Those old Gen5 trackpad device all have the platform version less than 2. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - introduce device tree bindingDudley Du2015-07-301-0/+10
| | | | | | Add device tree support for Cypress trackpad devices. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - add regulator vcc supportDudley Du2015-07-302-0/+30
| | | | | | | | | We need to power up the chip before we can initialize it. On systems that delegate task of powering up regulators to firmware we assume that we'll be simply given a dummy regulator. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: touchscreen - export OF module alias informationJavier Martinez Canillas2015-07-302-0/+2
| | | | | | | | | | | | | | | | | | | | | | The I2C core always reports the MODALIAS uevent as "i2c:<client name" regardless if the driver was matched using the I2C id_table or the of_match_table. So technically there's no need for a driver to export the OF table since currently it's not used. In fact, the I2C device ID table is mandatory for I2C drivers since a i2c_device_id is passed to the driver's probe function even if the I2C core used the OF table to match the driver. And since the I2C core uses different tables, OF-only drivers needs to have duplicated data that has to be kept in sync and also the dev node compatible manufacturer prefix is stripped when reporting the MODALIAS. To avoid the above, the I2C core behavior may be changed in the future to not require an I2C device table for OF-only drivers and report the OF module alias. So, it's better to also export the OF table to prevent breaking module autoloading if that happens. Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: export I2C module alias information in missing driversJavier Martinez Canillas2015-07-302-0/+2
| | | | | | | | | | The I2C core always reports the MODALIAS uevent as "i2c:<client name" regardless if the driver was matched using the I2C id_table or the of_match_table. So the driver needs to export the I2C table and this be built into the module or udev won't have the necessary information to auto load the correct module when the device is added. Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tsc2005 - convert to gpiodSebastian Reichel2015-07-281-29/+18
| | | | | | | | | | | | The GPIOD API can be used from boardcode, so that the DT check can be removed. To avoid breaking existing boardcode, _optional() variant has been chosen. For completely removing the DT check, the regulator has also been made optional, so that it could be supplied from boardcode. As a side-effect the patch fixes the after-probe reset GPIO state, so that the device is not kept in reset state. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tsc2005 - simplify drvdata acquisitionSebastian Reichel2015-07-281-10/+6
| | | | | | | Using dev_*_drvdata() instead of spi_*_drvdata() reduces lines of code and prepares the driver for possible tsc2004 support, which is i2c based. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tsc2005 - convert to regmapSebastian Reichel2015-07-282-112/+60
| | | | | | | Convert driver so that it uses regmap instead of directly using spi_transfer for all register accesses. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tsc2005 - fix Kconfig indentationSebastian Reichel2015-07-281-4/+4
| | | | | | | Replace spaces with tab, so that the tsc2005 Kconfig entry matches the other entries in drivers/input/touchscreen/Kconfig. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tsc2005 - improve readability of register definesSebastian Reichel2015-07-281-10/+18
| | | | | | | | Improve defines for first control byte by removing 0x00 prefix (the defines are for 8 bit values and not for 16 bit values) and expose register structure by exposing the shift. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: arizona-haptic - convert to use managed input devicesDmitry Torokhov2015-07-241-22/+4
| | | | | | | Using managed input device (via devm_input_allocate_device) simplifies error handling and driver removal paths and also silences CID# 712569. Reviewed-by: Joshua Clayton <stillcompiling@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - add ACPI HID CYAP0002 for Gen6 devicesDudley Du2015-07-241-0/+1
| | | | | | Add CYTP0002 to the list of ACPI HIDs recognized by the driver. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - fully support runtime suspend power managementDudley Du2015-07-245-34/+70
| | | | | | | | Fix the the runtime suspend power management not working issue when system starts up and before user touches the trackpad device. TEST=test on Chromebook. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - add proximity support for gen5 and gen6 modulesDudley Du2015-07-245-2/+101
| | | | | | | | Gen5 and Gen6 trackpad devices are able to detect and report object proximity data/events, add this function support in the cyapa driver through the ABS_DISTANCE event. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - add gen6 device module supportDudley Du2015-07-245-4/+834
| | | | | | | | Based on the cyapa core, add support for basic functionality of the gen6 trackpad devices. The driver can automatically determine what protocol (gen3, gen5, or gen6) should be used with the attached trackpad device. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: cyapa - rename 'gen5' to 'pip' for chared codeDudley Du2015-07-244-604/+673
| | | | | | | | | | Change 'gen5' to 'pip' for all macros, variables and functions that are shared between gen5 and gen6 modules to make naming more clear and readable. Also fix a few spelling errors. Signed-off-by: Dudley Du <dudl@cypress.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tc3589x-keypad - switch to using managed resourcesHimangi Saraogi2015-07-241-38/+20
| | | | | | | Let's switch the driver to use managed resources, this will simplify error handling and driver unbinding logic. Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: tc3589x-keypad - change name of wakeup propertyDmitry Torokhov2015-07-241-1/+4
| | | | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: samsung-keypad - change name of wakeup propertyDmitry Torokhov2015-07-241-2/+4
| | | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: gpio_keys[_polled] - change name of wakeup propertyDmitry Torokhov2015-07-242-2/+7
| | | | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: pmic8xxx-keypad - change name of wakeup propertyDmitry Torokhov2015-07-241-4/+6
| | | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Acked-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: ads7846 - change name of wakeup property to "wakeup-source"Dmitry Torokhov2015-07-241-1/+2
| | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: matrix_keypad - change name of wakeup property to "wakeup-source"Dmitry Torokhov2015-07-241-2/+4
| | | | | | | | | | | Wakeup property of device is not Linux-specific, it describes intended system behavior regardless of the OS being used. Therefore let's drop "linux," prefix, and, while at it, use the same name as I2C bus does: "wakeup-source". We keep parsing old name to keep compatibility with old DTSes. Cc: Lothar Waßmann <LW@KARO-electronics.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Input: pmic8xxx-pwrkey - support shutdownStephen Boyd2015-07-231-2/+266
| | | | | | | | | | On pm8xxx PMICs, shutdown and restart are signaled to the PMIC via a pin called PS_HOLD. When this pin goes low, the PMIC performs a configurable power sequence. Add a .shutdown hook so that we can properly configure this power sequence for shutdown or restart depending on the system state. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@sonymobile.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* Merge tag 'v4.2-rc3' into nextDmitry Torokhov2015-07-207264-234270/+1018132
|\ | | | | | | Sync up with Linux 4.2-rc3 to bring in infrastructure (OF) pieces.
| * Merge tag 'scsi-fixes' of ↵Linus Torvalds2015-07-192-2/+2
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two fairly simple fixes: one is a change that causes us to have a very low queue depth leading to performance issues and the other is a null deref occasionally in tapes thanks to use after put" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: fix host max depth checking for the 'queue_depth' sysfs interface st: null pointer dereference panic caused by use after kref_put by st_open
| | * scsi: fix host max depth checking for the 'queue_depth' sysfs interfaceJens Axboe2015-07-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 1e6f2416044c0 changed the scsi sysfs 'queue_depth' code to rejects depths higher than the scsi host template setting. But lots of hosts set this to 1, and update the settings in the scsi host when the controller/devices probing happens. This breaks (at least) mpt2sas and mpt3sas runtime setting of queue depth, returning EINVAL for all settings but '1'. And once it's set to 1, there's no way to go back up. Cc: stable@vger.kernel.org Fixes: 1e6f2416044c0 "scsi: don't allow setting of queue_depth bigger than can_queue" Signed-off-by: Jens Axboe <axboe@fb.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Odin.com>
| | * st: null pointer dereference panic caused by use after kref_put by st_openSeymour, Shane M2015-07-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two SLES11 SP3 servers encountered similar crashes simultaneously following some kind of SAN/tape target issue: ... qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 -- 1 2002. qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 -- 1 2002. qla2xxx [0000:81:00.0]-8009:3: DEVICE RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800f:3: DEVICE RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-8009:3: TARGET RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800f:3: TARGET RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-8012:3: BUS RESET ISSUED nexus=3:0:2. qla2xxx [0000:81:00.0]-802b:3: BUS RESET SUCCEEDED nexus=3:0:2. qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps). qla2xxx [0000:81:00.0]-8018:3: ADAPTER RESET ISSUED nexus=3:0:2. qla2xxx [0000:81:00.0]-00af:3: Performing ISP error recovery - ha=ffff88bf04d18000. rport-3:0-0: blocked FC remote port time out: removing target and saving binding qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps). qla2xxx [0000:81:00.0]-8017:3: ADAPTER RESET SUCCEEDED nexus=3:0:2. rport-2:0-0: blocked FC remote port time out: removing target and saving binding sg_rq_end_io: device detached BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8 IP: [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90 PGD 7e6586f067 PUD 7e5af06067 PMD 0 [1739975.390354] Oops: 0002 [#1] SMP CPU 0 ... Supported: No, Proprietary modules are loaded [1739975.390463] Pid: 27965, comm: ABCD Tainted: PF X 3.0.101-0.29-default #1 HP ProLiant DL580 Gen8 RIP: 0010:[<ffffffff8133b268>] [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90 RSP: 0018:ffff8839dc1e7c68 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff883f0592fc00 RCX: 0000000000000090 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000138 RBP: 0000000000000138 R08: 0000000000000010 R09: ffffffff81bd39d0 R10: 00000000000009c0 R11: ffffffff81025790 R12: 0000000000000001 R13: ffff883022212b80 R14: 0000000000000004 R15: ffff883022212b80 FS: 00007f8e54560720(0000) GS:ffff88407f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00000000000002a8 CR3: 0000007e6ced6000 CR4: 00000000001407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ABCD (pid: 27965, threadinfo ffff8839dc1e6000, task ffff883592e0c640) Stack: ffff883f0592fc00 00000000fffffffa 0000000000000001 ffff883022212b80 ffff883eff772400 ffffffffa03fa309 0000000000000000 0000000000000000 ffffffffa04003a0 ffff883f063196c0 ffff887f0379a930 ffffffff8115ea1e Call Trace: [<ffffffffa03fa309>] st_open+0x129/0x240 [st] [<ffffffff8115ea1e>] chrdev_open+0x13e/0x200 [<ffffffff811588a8>] __dentry_open+0x198/0x310 [<ffffffff81167d74>] do_last+0x1f4/0x800 [<ffffffff81168fe9>] path_openat+0xd9/0x420 [<ffffffff8116946c>] do_filp_open+0x4c/0xc0 [<ffffffff8115a00f>] do_sys_open+0x17f/0x250 [<ffffffff81468d92>] system_call_fastpath+0x16/0x1b [<00007f8e4f617fd0>] 0x7f8e4f617fcf Code: eb d3 90 48 83 ec 28 40 f6 c6 04 48 89 6c 24 08 4c 89 74 24 20 48 89 fd 48 89 1c 24 4c 89 64 24 10 41 89 f6 4c 89 6c 24 18 74 11 <f0> ff 8f 70 01 00 00 0f 94 c0 45 31 ed 84 c0 74 2b 4c 8d a5 a0 RIP [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90 RSP <ffff8839dc1e7c68> CR2: 00000000000002a8 Analysis reveals the cause of the crash to be due to STp->device being NULL. The pointer was NULLed via scsi_tape_put(STp) when it calls scsi_tape_release(). In st_open() we jump to err_out after scsi_block_when_processing_errors() completes and returns the device as offline (sdev_state was SDEV_DEL): 1180 /* Open the device. Needs to take the BKL only because of incrementing the SCSI host 1181 module count. */ 1182 static int st_open(struct inode *inode, struct file *filp) 1183 { 1184 int i, retval = (-EIO); 1185 int resumed = 0; 1186 struct scsi_tape *STp; 1187 struct st_partstat *STps; 1188 int dev = TAPE_NR(inode); 1189 char *name; ... 1217 if (scsi_autopm_get_device(STp->device) < 0) { 1218 retval = -EIO; 1219 goto err_out; 1220 } 1221 resumed = 1; 1222 if (!scsi_block_when_processing_errors(STp->device)) { 1223 retval = (-ENXIO); 1224 goto err_out; 1225 } ... 1264 err_out: 1265 normalize_buffer(STp->buffer); 1266 spin_lock(&st_use_lock); 1267 STp->in_use = 0; 1268 spin_unlock(&st_use_lock); 1269 scsi_tape_put(STp); <-- STp->device = 0 after this 1270 if (resumed) 1271 scsi_autopm_put_device(STp->device); 1272 return retval; The ref count for the struct scsi_tape had already been reduced to 1 when the .remove method of the st module had been called. The kref_put() in scsi_tape_put() caused scsi_tape_release() to be called: 0266 static void scsi_tape_put(struct scsi_tape *STp) 0267 { 0268 struct scsi_device *sdev = STp->device; 0269 0270 mutex_lock(&st_ref_mutex); 0271 kref_put(&STp->kref, scsi_tape_release); <-- calls this 0272 scsi_device_put(sdev); 0273 mutex_unlock(&st_ref_mutex); 0274 } In scsi_tape_release() the struct scsi_device in the struct scsi_tape gets set to NULL: 4273 static void scsi_tape_release(struct kref *kref) 4274 { 4275 struct scsi_tape *tpnt = to_scsi_tape(kref); 4276 struct gendisk *disk = tpnt->disk; 4277 4278 tpnt->device = NULL; <<<---- where the dev is nulled 4279 4280 if (tpnt->buffer) { 4281 normalize_buffer(tpnt->buffer); 4282 kfree(tpnt->buffer->reserved_pages); 4283 kfree(tpnt->buffer); 4284 } 4285 4286 disk->private_data = NULL; 4287 put_disk(disk); 4288 kfree(tpnt); 4289 return; 4290 } Although the problem was reported on SLES11.3 the problem appears in linux-next as well. The crash is fixed by reordering the code so we no longer access the struct scsi_tape after the kref_put() is done on it in st_open(). Signed-off-by: Shane Seymour <shane.seymour@hp.com> Signed-off-by: Darren Lavender <darren.lavender@hp.com> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.com> Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi> Cc: stable@vger.kernel.org Signed-off-by: James Bottomley <JBottomley@Odin.com>
| * | Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds2015-07-191-9/+0
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull MIPS fixes from Ralf Baechle: "Another round of MIPS fixes for 4.2. Things are looking quite decent at this stage but the recent work on the FPU support took its toll: - fix an incorrect overly restrictive ifdef - select O32 64-bit FP support for O32 binary compatibility - remove workarounds for Sibyte SB1250 Pass1 parts. There are rare fixing the workarounds is not worth the effort. - patch up an outdated and now incorrect comment" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: fpu.h: Allow 64-bit FPU on a 64-bit MIPS R6 CPU MIPS: SB1: Remove support for Pass 1 parts. MIPS: Require O32 FP64 support for MIPS64 with O32 compat MIPS: asm-offset.c: Patch up various comments refering to the old filename.
| | * | MIPS: SB1: Remove support for Pass 1 parts.Ralf Baechle2015-07-141-9/+0
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pass 1 parts had a number of significant erratas and were only available in small numbers and under NDA. Full support also required the use of a special toolchain that kept branches properly aligned. These workarounds were never upstreamed and the only toolchain known to have them is Montavista's GCC 3.0-based toolchain which completly obsoleted if not useless these days. So now that automated testing has tripped over the user of the -msb1-pass1-workarounds option, rather than fixing it remove support for pass 1 parts. Probably nobody will notice. I seem to own the last know pass 1 board and I haven't noticed another one in the wild in the past decade, at least. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds2015-07-182-40/+77
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Misc irq fixes: - two driver fixes - a Xen regression fix - a nested irq thread crash fix" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gicv3-its: Fix mapping of LPIs to collections genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD genirq: Revert sparse irq locking around __cpu_up() and move it to x86 for now gpio/davinci: Fix race in installing chained irq handler
| | * | irqchip/gicv3-its: Fix mapping of LPIs to collectionsMarc Zyngier2015-07-171-36/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GICv3 ITS architecture allows a given [DevID, EventID] pair to be translated to a [LPI, Collection] pair, where DevID is the device writing the MSI, EventID is the payload being written, LPI is the actual interrupt number, and Collection is roughly equivalent to a target CPU. Each LPI can be mapped to a separate collection, but the ITS driver insists on maintaining the collection on a device basis, instead of doing it on a per interrupt basis. This is obviously flawed, and this patch fixes it by adding a per interrupt index that indicates which collection number is in use. Reported-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Cc: <linux-arm-kernel@lists.infradead.org> Cc: Jason Cooper <jason@lakedaemon.net> Cc: stable@vger.kernel.org # 4.1, 4.0 Link: http://lkml.kernel.org/r/1437126402-11677-1-git-send-email-marc.zyngier@arm.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
| | * | gpio/davinci: Fix race in installing chained irq handlerThomas Gleixner2015-07-131-4/+2
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a race where a pending interrupt could be received and the handler called before the handler's data has been setup, by converting to irq_set_chained_handler_and_data(). Search and conversion was done with coccinelle. Reported-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Julia Lawall <Julia.Lawall@lip6.fr> Cc: Linus Walleij <linus.walleij@linaro.org> Cc: Alexandre Courbot <gnurou@gmail.com>
| * | Merge branch 'akpm' (patches from Andrew)Linus Torvalds2015-07-1827-36/+36
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge fixes from Andrew Morton: "25 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (25 commits) lib/decompress: set the compressor name to NULL on error mm/cma_debug: correct size input to bitmap function mm/cma_debug: fix debugging alloc/free interface mm/page_owner: set correct gfp_mask on page_owner mm/page_owner: fix possible access violation fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() /proc/$PID/cmdline: fixup empty ARGV case dma-debug: skip debug_dma_assert_idle() when disabled hexdump: fix for non-aligned buffers checkpatch: fix long line messages about patch context mm: clean up per architecture MM hook header files MAINTAINERS: uclinux-h8-devel is moderated for non-subscribers mailmap: update Sudeep Holla's email id Update Viresh Kumar's email address mm, meminit: suppress unused memory variable warning configfs: fix kernel infoleak through user-controlled format string include, lib: add __printf attributes to several function prototypes s390/hugetlb: add hugepages_supported define mm: hugetlb: allow hugepages_supported to be architecture specific revert "s390/mm: make hugepages_supported a boot time decision" ...
| | * | Update Viresh Kumar's email addressViresh Kumar2015-07-1826-35/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to my kernel.org alias instead of a badly named gmail address, which I rarely use. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| | * | configfs: fix kernel infoleak through user-controlled format stringNicolas Iooss2015-07-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some modules call config_item_init_type_name() and config_group_init_type_name() with parameter "name" directly controlled by userspace. These two functions call config_item_set_name() with this name used as a format string, which can be used to leak information such as content of the stack to userspace. For example, make_netconsole_target() in netconsole module calls config_item_init_type_name() with the name of a newly-created directory. This means that the following commands give some unexpected output, with configfs mounted in /sys/kernel/config/ and on a system with a configured eth0 ethernet interface: # modprobe netconsole # mkdir /sys/kernel/config/netconsole/target_%lx # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name # dmesg |tail -n1 [ 142.697668] netconsole: target (target_ffffffffc0ae8080) is enabled, disable to update parameters The directory name is correct but %lx has been interpreted in the internal item name, displayed here in the error message used by store_dev_name() in drivers/net/netconsole.c. To fix this, update every caller of config_item_set_name to use "%s" when operating on untrusted input. This issue was found using -Wformat-security gcc flag, once a __printf attribute has been added to config_item_set_name(). Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Felipe Balbi <balbi@ti.com> Acked-by: Joel Becker <jlbec@evilplan.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | Merge tag 'rtc-v4.2-2' of ↵Linus Torvalds2015-07-182-3/+3
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull rtc fixes from Alexandre Belloni: "A few fixes for the RTC susbsystem for 4.2. The mt6397 driver was introduce in 4.2 so it is worth fixing before the final release. I though the compilation warning for armada38x was fixed by akpm in commit f98b733e93e0 ("rtc-armada38x.c: remove unused local `flags'") but he actually missed some occurrences of the variables. Since I received 4 patches for that, I think we can include it now. Summary: - fix mt6397 wakealarm creation - remove a compilation warning for armada38x that was forgotten" * tag 'rtc-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: armada38x: Remove unused variable from armada38x_rtc_set_time() rtc: mt6397: enable wakeup before registering rtc device
| | * | | rtc: armada38x: Remove unused variable from armada38x_rtc_set_time()Fabio Estevam2015-07-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the 'flags' variable in order to fix the following warning: drivers/rtc/rtc-armada38x.c:91:22: warning: unused variable 'flags' [-Wunused-variable] Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
| | * | | rtc: mt6397: enable wakeup before registering rtc deviceWei-Ning Huang2015-07-181-2/+2
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rtc_sysfs_add_device checks if device can wakeup before creating the wakealarm file in sysfs. Thus the driver must set wakeup capability before registering the rtc device. Signed-off-by: Wei-Ning Huang <wnhuang@google.com> Acked-by: Eddie Huang <eddie.huang@mediatek.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
| * | | Merge tag 'dm-4.2-fixes-2' of ↵Linus Torvalds2015-07-185-34/+68
| |\ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - revert a request-based DM core change that caused IO latency to increase and adversely impact both throughput and system load - fix for a use after free bug in DM core's device cleanup - a couple DM btree removal fixes (used by dm-thinp) - a DM thinp fix for order-5 allocation failure - a DM thinp fix to not degrade to read-only metadata mode when in out-of-data-space mode for longer than the 'no_space_timeout' - fix a long-standing oversight in both dm-thinp and dm-cache by now exporting 'needs_check' in status if it was set in metadata - fix an embarrassing dm-cache busy-loop that caused worker threads to eat cpu even if no IO was actively being issued to the cache device * tag 'dm-4.2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache: avoid calls to prealloc_free_structs() if possible dm cache: avoid preallocation if no work in writeback_some_dirty_blocks() dm cache: do not wake_worker() in free_migration() dm cache: display 'needs_check' in status if it is set dm thin: display 'needs_check' in status if it is set dm thin: stay in out-of-data-space mode once no_space_timeout expires dm: fix use after free crash due to incorrect cleanup sequence Revert "dm: only run the queue on completion if congested or no requests pending" dm btree: silence lockdep lock inversion in dm_btree_del() dm thin: allocate the cell_sort_array dynamically dm btree remove: fix bug in redistribute3
| | * | dm cache: avoid calls to prealloc_free_structs() if possibleMike Snitzer2015-07-171-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If no work was performed then prealloc_data_structs() wasn't ever called so there isn't any need to call prealloc_free_structs(). Signed-off-by: Mike Snitzer <snitzer@redhat.com>
| | * | dm cache: avoid preallocation if no work in writeback_some_dirty_blocks()Mike Snitzer2015-07-171-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactor writeback_some_dirty_blocks() to avoid prealloc_data_structs() if the policy doesn't have any dirty blocks ready for writeback. Signed-off-by: Mike Snitzer <snitzer@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 02:04:28 +0100