Add a helper function to check if an opcode is a sd-io-rw-* opcode.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Certain eMMC devices allow vendor specific device information to be read
via a sequence of vendor commands. These vendor commands must be issued
in sequence and an atomic fashion. One way to support this would be to
add an ioctl function for sending a sequence of commands to the device
atomically as proposed here. These multi commands are simple array of
the existing mmc_ioc_cmd structure.

The structure passed via the ioctl uses a __u64 type to specify the number
of commands (so that the structure is aligned on a 64-bit boundary) and a
zero length array as a header for list of commands to be issued. The
maximum number of commands that can be sent is determined by
MMC_IOC_MAX_CMDS (which defaults to 255 and should be more than
sufficient).

This based upon work by Seshagiri Holi <sholi@nvidia.com>.
Signed-off-by: NSeshagiri Holi <sholi@nvidia.com>
Signed-off-by: NJon Hunter <jonathanh@nvidia.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Enable interrupt mode to detect card instead of polling mode for
ls1021a by removing the quirk SDHCI_QUIRK_BROKEN_CARD_DETECTION.
This could improve data transferring performance and avoid the call
trace caused by polling card status sometime.
Signed-off-by: NYangbo Lu <yangbo.lu@freescale.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The simple power sequence provider sets a value for multiple GPIOs in one
go so it is better to use the API already provided by the GPIO descriptor
API instead of open coding the same logic.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Add MMC_CAP_RUNTIME_RESUME support to save resume time
Drop unnecessary SDC_ARG write
Signed-off-by: NChaotian Jing <chaotian.jing@mediatek.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This patch add ios->drv_type for mmc_ios_show to show the
card's driver type.
Signed-off-by: NShawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This platform driver has a OF device ID table but the OF module
alias information is not created so module autoloading won't work.
Signed-off-by: NLuis de Bethencourt <luisbg@osg.samsung.com>
Acked-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This platform driver has a OF device ID table but the OF module
alias information is not created so module autoloading won't work.
Signed-off-by: NLuis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Use of_property_read_u32 instead of of_get_property with return value
checks and endianness conversion.
Signed-off-by: NTobias Klauser <tklauser@distanz.ch>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Drivers needs to export the OF id table and this be built into
the module or udev won't have the necessary information to autoload
the driver module when the device is registered via OF.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The goto is correct and the unreachable "return -EINVAL" should be
removed.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

sdhci_init() will clear all irqs and set the needed irqs. So
logically sdhci_init() should be called before request irq.

If not, some irqs may be triggled and handled wrongly. Take
the following into consideration, after request irq, if
SDIO card interrupt enabled, a sd card in the sd slot will
trigger a mass of interrupt(SDHCI_INT_CARD_INT), because at
this time, the vmmc-regulator still not restore, no voltage
supply for the sd card, so the pin of data0~data3 change and
keep low, interrupt(SDHCI_INT_CARD_INT) will rise up ceaselessly.
Due to we already reguest irq, system will be busy in handling
this endless irq, can't response to other event.

So we should call sdhci_init() before request irq in sd resume.
Signed-off-by: NHaibo Chen <haibo.chen@freescale.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The driver prints if the data width is 8-bit but it's using a
binary OR instead of a binary AND so it will always report as
"is_8bit=Y" regardless of the flags in host->mmc->caps.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Reviewed-by: NRay Jui <rjui@broadcom.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The gpiod_get() function expands to gpiod_get_index() with index 0
so it's better to use it since is easier to read and more concise.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

As there are no users of the __mmc_switch() API, except for the mmc core
itself, let's convert it from an exported function into an internal.
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

They aren't needed and are just creating null statements so remove it.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

It's not needed an is just creating a null statement, so remove it.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Signed-off-by: NYousong Zhou <yszhou4tech@gmail.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

As mmc_claim_host() invokes pm_runtime_get_sync() for the mmc host device,
it's important that the host is kept claimed for *all* accesses to it via
the host_ops callbacks.

In some code paths for SDIO, particularly related to the PM support,
mmc_power_off|up() is invoked without keeping the host claimed. Let's fix
these.

Moreover, mmc_start|stop_host() also invokes mmc_power_off|up() without
claiming the host, let's fix these as well.
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Acked-by: NKishon Vijay Abraham I <kishon@ti.com>

Add an entry to the sdhci_acpi_uids list to detect the SD card
reader on the Asus X205Ta laptop.

dstd table:

Device (SDHC)
{
    Name (_ADR, Zero)  // _ADR: Address
    Name (_HID, "PNP0FFF")  // _HID: Hardware ID
    Name (_CID, "PNP0D40" /* SDA Standard Compliant SD Host Controller */)
    Name (_DDN, "Intel(R) SD Card Controller - 80860F16")  // _DDN: DOS Dev
    Name (_UID, 0x03)  // _UID: Unique ID
    Name (RDEP, Package (0x02)
Signed-off-by: NMichele Curti <michele.curti@gmail.com>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

If the CLEAN_SHUTDOWN flag is not set when a cache is loaded then all cache
blocks are marked as dirty and a full writeback occurs.

__commit_transaction() is responsible for setting/clearing
CLEAN_SHUTDOWN (based the flags_mutator that is passed in).

Fix this issue, of the cache's on-disk flags being wrong, by making sure
__commit_transaction() does not reset the flags after the mutator has
altered the flags in preparation for them being serialized to disk.

before:

sb_flags = mutator(le32_to_cpu(disk_super->flags));
disk_super->flags = cpu_to_le32(sb_flags);
disk_super->flags = cpu_to_le32(cmd->flags);

after:

disk_super->flags = cpu_to_le32(cmd->flags);
sb_flags = mutator(le32_to_cpu(disk_super->flags));
disk_super->flags = cpu_to_le32(sb_flags);
Reported-by: NBogdan Vasiliev <bogdan.vasiliev@gmail.com>
Signed-off-by: NJoe Thornber <ejt@redhat.com>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

btree_split_beneath()'s error path had an outstanding FIXME that speaks
directly to the potential for _not_ cleaning up a previously allocated
bufio-backed block.

Fix this by releasing the previously allocated bufio block using
unlock_block().
Reported-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Acked-by: NJoe Thornber <thornber@redhat.com>
Cc: stable@vger.kernel.org

Commit 4c7e3093 ("dm btree remove: fix bug in redistribute3") wasn't
a complete fix for redistribute3().

The redistribute3 function takes 3 btree nodes and shares out the entries
evenly between them.  If the three nodes in total contained
(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
the center.

Fix this issue by being more careful about calculating the target number
of entries for the left and right nodes.

Unit tested in userspace using this program:
https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.cSigned-off-by: NJoe Thornber <ejt@redhat.com>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

Mapping an image with a long parent chain (e.g. image foo, whose parent
is bar, whose parent is baz, etc) currently leads to a kernel stack
overflow, due to the following recursion in the reply path:

  rbd_osd_req_callback()
    rbd_obj_request_complete()
      rbd_img_obj_callback()
        rbd_img_parent_read_callback()
          rbd_obj_request_complete()
            ...

Limit the parent chain to 16 images, which is ~5K worth of stack.  When
the above recursion is eliminated, this limit can be lifted.

Fixes: http://tracker.ceph.com/issues/12538

Cc: stable@vger.kernel.org # 3.10+, needs backporting for < 4.2
Signed-off-by: NIlya Dryomov <idryomov@gmail.com>
Reviewed-by: NJosh Durgin <jdurgin@redhat.com>

Currently we leak parent_spec and trigger a "parent reference
underflow" warning if rbd_dev_create() in rbd_dev_probe_parent() fails.
The problem is we take the !parent out_err branch and that only drops
refcounts; parent_spec that would've been freed had we called
rbd_dev_unparent() remains and triggers rbd_warn() in
rbd_dev_parent_put() - at that point we have parent_spec != NULL and
parent_ref == 0, so counter ends up being -1 after the decrement.

Redo rbd_dev_probe_parent() to fix this.

Cc: stable@vger.kernel.org # 3.10+, needs backporting for < 4.2
Signed-off-by: NIlya Dryomov <idryomov@gmail.com>
Reviewed-by: NAlex Elder <elder@linaro.org>

This was found during userspace fuzzing test when a large size dma cma
allocation is made by driver(like ion) through userspace.

  show_stack+0x10/0x1c
  dump_stack+0x74/0xc8
  kasan_report_error+0x2b0/0x408
  kasan_report+0x34/0x40
  __asan_storeN+0x15c/0x168
  memset+0x20/0x44
  __dma_alloc_coherent+0x114/0x18c
Signed-off-by: NRohit Vaswani <rvaswani@codeaurora.org>
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Device stopped to tuning some channels after regmap conversion.
Reason is that regmap_update_bits() works a bit differently for
partially volatile registers than old homemade routine. Return
back to old routine in order to fix issue.

Fixes: 478932b1

Cc: <stable@kernel.org> # 4.2+
Reported-by: NMark Clarkstone <hello@markclarkstone.co.uk>
Tested-by: NMark Clarkstone <hello@markclarkstone.co.uk>
Signed-off-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6 ("[media] rtl28xxu: move usb buffers to state")

Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: NAntti Palosaari <crope@iki.fi>

Fixes the following randconfig problem:

drivers/built-in.o: In function `v4l2_flash_release':
(.text+0x12204f): undefined reference to `v4l2_async_unregister_subdev'
drivers/built-in.o: In function `v4l2_flash_release':
(.text+0x122057): undefined reference to `v4l2_ctrl_handler_free'
drivers/built-in.o: In function `v4l2_flash_close':
v4l2-flash-led-class.c:(.text+0x12208f): undefined reference to `v4l2_fh_is_singular'
v4l2-flash-led-class.c:(.text+0x1220c8): undefined reference to `__v4l2_ctrl_s_ctrl'
drivers/built-in.o: In function `v4l2_flash_open':
v4l2-flash-led-class.c:(.text+0x12227f): undefined reference to `v4l2_fh_is_singular'
drivers/built-in.o: In function `v4l2_flash_init_controls':
v4l2-flash-led-class.c:(.text+0x12274e): undefined reference to `v4l2_ctrl_handler_init_class'
v4l2-flash-led-class.c:(.text+0x122797): undefined reference to `v4l2_ctrl_new_std_menu'
v4l2-flash-led-class.c:(.text+0x1227e0): undefined reference to `v4l2_ctrl_new_std'
v4l2-flash-led-class.c:(.text+0x122826): undefined reference to `v4l2_ctrl_handler_setup'
v4l2-flash-led-class.c:(.text+0x122839): undefined reference to `v4l2_ctrl_handler_free'
drivers/built-in.o: In function `v4l2_flash_init':
(.text+0x1228e2): undefined reference to `v4l2_subdev_init'
drivers/built-in.o: In function `v4l2_flash_init':
(.text+0x12293b): undefined reference to `v4l2_async_register_subdev'
drivers/built-in.o: In function `v4l2_flash_init':
(.text+0x122949): undefined reference to `v4l2_ctrl_handler_free'
drivers/built-in.o:(.rodata+0x20ef8): undefined reference to `v4l2_subdev_queryctrl'
drivers/built-in.o:(.rodata+0x20f10): undefined reference to `v4l2_subdev_querymenu'
Signed-off-by: NJacek Anaszewski <j.anaszewski@samsung.com>
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Cc: Sakari Ailus <sakari.ailus@iki.fi>
Cc: Hans Verkuil <hans.verkuil@cisco.com>

Signed-off-by: NAbylay Ospan <aospan@netup.ru>
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:

si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f

Add the proper check.

Cc: stable@kernel.org
Reported-by: NStuart Auchterlonie <sauchter@redhat.com>
Reviewed-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NLaura Abbott <labbott@fedoraproject.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

When reading the firmware and sending commands, the length
must be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the
expected format. Add the proper check.

Cc: stable@kernel.org
Signed-off-by: NLaura Abbott <labbott@fedoraproject.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This driver doesn't claim the IR transmitter to be wakeup source. It
even disables the clock and the IR during suspend-resume cycle.

This patch removes yet another misuse of IRQF_NO_SUSPEND.

Cc: Patrice Chotard <patrice.chotard@st.com>
Cc: Fabio Estevam <fabio.estevam@freescale.com>
Cc: Guoxiong Yan <yanguoxiong@huawei.com>
Signed-off-by: NSudeep Holla <sudeep.holla@arm.com>
Acked-by: NZhangfei Gao <zhangfei.gao@linaro.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

The variable err was never initialized, that means we had been checking
a garbage value in the for loop. Moreover if the segment is not outside
the firmware file then also we have been returning the garbage.
Initialize it to 0 so that on success we return the value and no need to
check in the for loop also as it is initially 0 and whenever that value
changes we have done a break from the loop.
Signed-off-by: NSudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

static analysis with cppcheck detected the following error:

[drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c:1210]:
  (error) Uninitialized variable: ret

ret is never initialised, so garbage is being returned. Instead
return the error return from the call of request_firmware_nowait
Signed-off-by: NColin Ian King <colin.king@canonical.com>

If CONFIG_DVB_LNBH25 is disabled, a stub static inline function is
defined that just prints a warning about the driver being disabled
but the function return type was wrong which caused a build error.

Fixes: e025273b ("[media] lnbh25: LNBH25 SEC controller driver")
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>

If CONFIG_DVB_HORUS3A is disabled a stub static inline function is
defined that just prints a warning about the driver being disabled
but the function parameters were wrong which caused a build error.

Fixes: a5d32b35 ("[media] horus3a: Sony Horus3A DVB-S/S2 tuner driver")
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>

On nv50+, we restrict the valid domains to just the one where the buffer
was originally created. However after the buffer is evicted to system
memory, we might move it back to a different domain that was not
originally valid. When sharing the buffer and retrieving its GEM_INFO
data, we still want the domain that will be valid for this buffer in a
pushbuf, not the one where it currently happens to be.

This resolves fdo#92504 and several others. These are due to suspend
evicting all buffers, making it more likely that they temporarily end up
in the wrong place.

Cc: stable@vger.kernel.org
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92504Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

In Linux 4.3-rc5, there is an error case in drm_dp_get_branch_device
that returns without releasing mgr->lock, resulting a spew of kernel
messages about a kernel work function possibly having leaked a mutex
and presumably more serious adverse consequences later.  This patch
changes the error to "goto out" to unlock the mutex before returning.

[airlied: grabbed from drm-next as it fixes something we've seen]
Signed-off-by: NAdam J. Richter <adam_richter2004@yahoo.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NDave Airlie <airlied@redhat.com>

ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049d ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: NDoron Tsur <doront@mellanox.com>
Signed-off-by: NMatan Barak <matanb@mellanox.com>
Signed-off-by: NDoug Ledford <dledford@redhat.com>