ASoC: rsnd: call rsnd_dai_pointer_update() from outside of lock

rsnd_soc_dai_trigger() will be called
after rsnd_dai_pointer_update() function
which is using rsnd_lock().
Thus, it should be called from outside of rsnd_lock().
Kernel will be hangup without this patch.
Special thanks to Kataoka-san

Reported-by: Ryo Kataoka <ryo.kataoka.wt@renesas.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 836b31fe1a9791d84ed95783ed42ebd5719f7918)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: fix clock prepare/unprepare

As with the previous commit, before a clock can be used it must be prepared
for use. Change from clk_enable() and clk_disable() to the versions of the
calls which also prepare and un-prepare the clocks.

Will fix warnings from the clock code when this is used.

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 79861bbb759053a9b91026becc0915d0f1f8d37d)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rcar: bugfix: it cares about the non-src case

src might not exist.
kernel will be hung-up without this patch in such case.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit b1eac430b6a4bee6821273d9b41dd3593eb7830b)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add DeviceTree support

Support for loading the Renesas R-Car sound driver via DeviceTree.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 90e8e50fce3585d6f9902701de08389b027dadc6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rcar: fixup SND_SOC_DAIFMT_CBx_CFx flags

SND_SOC_DAIFMT_CBx_CFx means "codec" side master/slave mode.
Then, rcar will be master mode if it was SND_SOC_DAIFMT_CBS_CFS.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit e1508289404ab6ca28e0dc931612600f0441c417)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: rename scu to src

R-Car sound has SCU unit which has SRC/CTU/MIX/DVC,
and current rsnd driver has scu.c and scu module.
Current scu.c has SRC support only.
My first concept was control these feature on scu.c
but, it become difficult and un-understandable now.
This patch rename scu to src

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit ba9c949f797aa3af56303445812a452144c61c35)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove all rsnd_xxx_remove()

Now, rsnd_xxx_remove() do nothing.
remove these

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 9524be0e761edd9f3c020344677d914ed249d010)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: nothing to do on rsnd_dai_remove()

rsnd_dai_remove() called rsnd_path_exit(),
but these memory will be cleaned automatically.
Because it is created by devm_kzalloc().
nothing to do on rsnd_dai_remove()

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 4076220767416b8b65009dd57eeb317c38d41baa)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use mod probe method on SSI

Now, it can use .probe

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit ff8f30e688477beead6d1e648fb11f321220a4d7)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use mod probe method on SCU

Now, it can use .probe

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 76c6fb5c49790da44d553f655182b426ade2c599)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add probe/remove callback on rsnd_mod_ops

Each rsnd mod needs specific probe method,
and its best timing is DAI probe timing.
But current code runs it mod probe timing.
This patch adds new probe/remove callback to solve it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 7681f6ac6b6338932621f842d68e54f6267b785f)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: call rsnd_scu_ssi_mode_init() from SSI

Current R-Car sound driver is assuming that
SCU mod is used even though it is not needed.
Because scu.c is controlling SSIU too.
(it is Gen1 compatibility)
But, SCU mod will be really not used if new platform dai
feature was added.
Thus, rsnd_scu_ssi_mode_init() is called from SSI
directory by this patch.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 221bf523e31306c1095b28932e079950108e3887)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add rsnd_scu_enable_ssi_irq()

Current R-Car sound driver is assuming that
SCU mod is used even though it is not needed.
Because scu.c is controlling SSIU too.
(it is Gen1 compatibility)
But, SCU mod will be really not used if new platform dai
feature was used.
Thus, SSIU irq setting is called from SSI
directory by this patch.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit b8cc41e9e8cc5beec9dcbe044cfc44aa0325d9e6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: Get correct SCU ID

Current rsnd driver is assuming that SCU/SRU ID is
same as SSIU/SSI ID, because Gen1 can't select it.
But, Gen2 can select it.
The SCU/SRU/SSIU/SSI pair depends on the platform.
This patch get correct SCU ID from platform info.
To keep compatible, it still assuming SCU ID = SSI ID
if platform doesn't have info

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 389933d9f6e55a1ef3a71549c36f6283b9f8c145)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add struct rsnd_dai_platform_info

R-Car sound DAI consists from SSI/SCU/SSIU/SRU...
Current R-Car sound DAI is decided from these settings,
but it is intuitively unclear, and is not good design for DT support.
This patch adds new rsnd_dai_platform_info to solve this issue.

But now, many platform is using this driver without
rsnd_dai_platform_info.
So, this patch still supports DAI settings via SSI to keep compatible.
It will be removed in next Linux version.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 78f13d0c5a2888564b2bed7f8433c8ec889997ff)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: share reg_field and reduce memory

Gen1/Gen2 code never be used in same time.
Thus, driver can share Gen1 only register and Gen2 only register.
It can reduce memory too.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit c82e1c8874e5abaf52f9ed886386cbe08ec98a5b)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: modify rsnd_adg_ssi_ws_timing_gen2() parameter

rsnd_adg_ssi_ws_timing_gen2() returns SSI WS timing,
and it used "mod" as parameter.
but, this "mod" is sometimes not ssi mod.
Get SSI mod from rsnd_dai_stream

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 8467dedc9dae3630a2ede49a43120af3ed54ba19)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove unused SSI_CONTROL

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 685fb3eb31445bd872ab30ae301404b2cac7cd75)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use function pointer for each probe

R-Car sound consists of many devices.
It will have more device support in the future.
Thus, for each probe become now function pointer array.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit d1ac970f5de94bef9e094b46f016899d04e8178b)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use devm_clk_get() instead of clk_get()

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 468be93eb4e28c5710ed8acc1b938937707e537c)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: get ssi/scu from rsnd_dai_stream

Current driver is assuming that SSI id = SCU id.
But, now, it can get correct SSI/SCU from
rsnd_dai_stream. use it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 374e5426377604a94d672650ef22dd2b4285de17)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use mod array instead of list on rdai

struct rsnd_dai_stream used list for mod list.
It added only odd flexibility to current driver, and
it is a factor which makes extendibility difficult.
rsnd use mod array instead of list from now.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit a126021d144bae88a563db2b57b0ad5eb1ee66d9)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: run rsnd_path_init() when probe() timing

Current rsnd SSIU/SSI/SCU/SRU path is set
when playback/capture starts up.
But it is meaningless method, since the path is based
on platform and can be set in probe() timing.
This patch sets the path on probe() timing.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 9bfed6cf4fa2cd2c5e80431244348b0c5d933cf5)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: tidyup RSND_SSI_xxx flags

6f3ab6c1c022e7a4877d38940cd45ae7804a15e2
(ASoC: rsnd: remove pin sync option)
added unused RSND_SSI_CLK_FROM_ADG flag.
It should remove RSND_SSI_SYNC.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 697dce94ed37e0653e5bba593f11e2b14877cd63)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: unify rdai naming

struct rsnd_dai is called as "rdai",
but its size has been called as "dai_nr".
Unify these as "rdai"

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit ecba9e724c5775aebd3a28e831643160c7146e83)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove verbose debug message from scu/ssi

scu/ssi probe() already have more detail debug message.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 98455ed5ddbfbcbcd0adb300c6cb1964ed0a6931)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove verbose function parameter

priv has rcar_snd_info pointer.
having priv and info in same time is verbose.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 5da39cf30454bbf3e92f56935e7d137e5bd2c830)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: move rsnd_mod_call() macro

core.c is the only user of rsnd_mod_call() macro.
Move it to core.c from rsnd.h

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit d870a91e9d0eae524ac2da7cbdc7e399a71b86c4)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: move priv member settings to upper side

There is no big meaning, but preparation for platform dai support

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 498480731e232d7c9a96a338924b5a275121e091)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: print error if there is SRC settings mismatch

rsnd request clock master if SRC is used

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit a2070feede404484296aace813b6c518582a3f8e)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: set DIV_EN register on rsnd_adg_set_convert_clk_gen2()

DIV_EN register enable bit is required when you use Gen2 SRC

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit ee2c828d21b2381c813df257235d3c635269e435)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: tidyup original for_each_rsnd_xxx macro

Current for_each_rsnd_xxx macro will read out-of-array's
memory after last loop operation.
It was not good C language operation, and the binary which was
compiled by (at least) gcc 4.8.1 is broken
This patch tidyup these issues

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 00463c113b6ba6506b4f1ebb9b3c5dd249f8750f)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: use device dependency clock

Current R-Car sound driver is using device
independent audio clock, but it is not good
design for DT support.
This patch adds device dependent clock support.
But, there are some platform which is using
independent audio clock.
It is still supported at this point,
but it will be removed soon.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 8691d0748e566f8708f7a9139e760134f5dc3130)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add Gen2 SRC and DMAEngine support

Renesas sound Gen2 has SRC (= Sampling Rate Converter)
which needs 2 DMAC.
The data path image when you use SRC on Gen2 is

[mem] -> Audio-DMAC -> SRC -> Audio-DMAC-peri-peri -> SSIU -> SSI

This patch support SRC and DMAEnine.
It is tested on R-Car H2 Lager board

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 629509c5bc478c0343d94c8c70812396f44447fb)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: rsnd_ssi_probe() goes forwarder than rsnd_scu_probe()

rsnd_ssi_probe() goes forwarder than rsnd_scu_probe(),
since scu will need ssi information on Gen2

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit eb854f6dff24a59378acc8d8eda57a3543a25acc)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove SSI dependent DMAEngine callback

Renesas Gen2 sound will use 2 DMAC
which are Audio-DMAC, and Audio-DMAC-peri-peri.
Current driver has callback function for each DMAC,
because it assumed each DMAC needs special settings.
But it became clear that these can share settings.
This patch removes unnecessary callback

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 4686a0ad9aaee89495f181e5755d153e7fe7ffe6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: extracts Gen1/Gen2 common parts

Renesas sound IP Gen1/Gen2 are similar, but different.
This patch extracts Gen1/Gen2 common and dependency parts,
and create Gen1/Gen2 ops to control it.

According to this structure, SSIU setup which
has been implemented on ssi.c can be moved to scu.c
(SRU/SSIU/SCU should be implemented on scu.c)

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 1b7b08efbe7419cc3e082f2b5ec8ae89f7af43d1)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add rsnd_ssi_is_play()

SCU needs SSI direction if Gen2.
Add rsnd_ssi_is_play() function for it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 32f27ebf9b625df610c12408ea15bae37be75eaf)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: merge SRC clock timing/setting

SRC clock and timing setting register
exist in SRU and ADG on Gen1.
But, these are merged into ADG on Gen2.
Current driver is supporting Gen1 SRC only
at this point, but, above settings are
set as different function.
This patch merges these as preparation of Gen2 support.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 28dc4b63cdb96f2448a677320fcc0eb112e13e3f)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: rsnd_scu_hpbif_is_enable() become macro

rsnd_scu_hpbif_is_enable() is used only scu.c now.
It can be local macro

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 96c7c0d6f8c6e09e9123f0518130c047c5de40f6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: Merge macros in scu.c

Merge #define lines, since these are defined
in the scattering place

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 39cf3c4064b8db25efe501fec8e3c48a578b4b58)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: clarify scu.c area

scu.c cares SRU(Gen1) / SCU(Gen2) / SSIU(Gen2)

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit c926b746055adfd915936c67244e635e9c7a3d84)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: SCU should be called before SSI

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit be213ac1af893410eb8256010edf136b4099e827)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: don't use schedule_work() when rsnd_dma_start()

rsnd_dma_start() is the function to start DMAEngine.
Current code is using schedule_work() for it,
but it breaks DMAC/SSI register setting timing.
Don't use schedule_work() on it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit f5cab3b8976d59c6166228874a5af3d87c94c723)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: fixup Gen2 module naming

Gen2 has SCU, not SRU

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 64de62b38641dec05905930024133726c540040e)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: non 0 is error on probe

Some xxx_probe() returns not only -Exx, but also PTR_ERR().

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 106d2eff563b2abdb34872cb8ec7b19766edaffc)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove duplicate *priv from rsnd_dma

*priv pointer exists under rsnd_mod,
and, it can get rsnd_mod pointer from rsnd_dma.
remove duplicate rsnd_dma :: priv

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 9b5ab573a81b9ac0df90b74d732651fdf8b24525)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: explain SRC bypass mode settings in comment

SRC bypass mode is useful for debugging.
This patch explains SRC bypass mode settings in comment

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 41c6221c39accdc4fe2b0c0fa196b6302b704e57)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: rename rsnd_scu_convert_rate_ctrl()

rsnd_scu_convert_rate_ctrl() is unclear naming,
and there is "rsnd_scu_convert_rate" variable.
These are confusable.
it renamed to rsnd_scu_set_convert_rate()

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit f80e1c96339a45992b5dded0474288e52bd3b18d)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove ssiu from ssi.c

Now, SSI_MODE0/1 are controlled under scu.c
ssiu is no longer needed on ssi.c

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit dd27d808f9e084e7e9c4719c17f17d1fa35c45a6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: SSI_MODE0/1 settings goes to scu.c

SRU (Gen1) / SCU (Gen2) / SSIU (Gen2) are controlled under scu.c.
(SCU + SSIU (Gen2) was SRU (Gen1))
And register of SSI_MODE0/1 are mapped on these IP.
But these have been implemented under ssi.c on this driver.
The naming is very confusable,
but it should be implemented under scu.c

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 7b5ce9759a60ebdffa1e76224ccb3d85bd06e4ac)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove pin sync option

Renesas Chip is supporting multi pin sound,
but the HW setting is very difficult and confusable.
But driver is supporting it halfway.
Remove SYNC option at this point.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 6f3ab6c1c022e7a4877d38940cd45ae7804a15e2)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: rsnd_dai_is_clk_master() can be shared

Current rsnd driver is using ssi local
rsnd_rdai_is_clk_master() for checking clock master.
But it can be rsnd_dai_is_clk_master(), and share in each file

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit e779a20da90b12d17af74fe544fafd814b66dc63)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: merge rsnd_scu_start/stop() and rsnd_scu_transfer_start/stop()

rsnd_scu_transfer_start/stop() are no longer needed.
merge into rsnd_scu_start/stop()

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit e7ce74eaa76591e5a4905d0fc07a278533447b80)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove meaningless function parameter

struct rsnd_priv *priv on rsnd_scu_init/start/stop()
are no longer needed

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 47718dc7d8ca5f5509ac9beb13486642306bb36b)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: add rsnd_scu_init(), and separate init/start

Current scu.c has rsnd_scu_start(),
and, operation of initialization/start
are implemented in this function.
This patch adds new rsnd_scu_init() and separates
rsnd_scu_start(), since rsnd_mod_ops has .init/.start callbacks.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit a204d90c91208d9b63ba309a1c44f582751e58c9)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: control SCU ops in probe timing

SCU will be used if platform requested to use.
Current driver is checking it in runtime,
but, it can be decided in probe timing.
This patch do it

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 013f38fe260af6f505ad5da5f6b0db3e42ca1fbb)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: remove meaningless rsnd_ssi_non()

rsnd_ssi_non_ops callback functions are never called.
remove these meaningless callback

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 6acef1721c1046be8b5f44b839c28817cfbd66c6)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: cleanup debug information method

rsnd_mod debug information is implemented
in each callback functions now.
But, it can be implemented in rsnd_mod_call(),
and share this code.
This patch adds it

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 92d9587ede108a7e73f80d0767aedf2c4edb47d8)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ASoC: rsnd: tidyup register naming of BUSIF_MODE

Gen1:SRU has only 1 BUSIF_MODE,
but Gen2:SSIU/SCU has SRCm_BUSIF_MODE, and SSIn_BUSIF_MODE.
This patch rename current BUSIF_MODE to SRC_BUSIF_MODE.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 0290d2a42cb476358303d05fbe2475dd50889907)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

drm/rcar-du: Handle encoder initialization failures

The rcar_du_encoder_init() function can fail and return an error code.
Don't ignore it.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit d9961b22716ddf59ca307fe862f93ff0ea919952)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

pinctrl: Quiet logging about missing DT nodes when not using DT

On systems which were not booted using DT it is entirely unsurprising that
device nodes don't have any DT information and this is going to happen for
every single device in the system. Make pinctrl be less chatty about this
situation by only logging in the case where we have DT.

Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from commit 5d88dceac736a779fdf6208bbd0a06e81fe25300)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: m25p80: add Macronix mx66l1g55g 1Gbit SPI flash

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Marek Vasut <marex@denx.de>
(cherry picked from commit 6f7db7f3203a0bd48170807adeb53dd401d29110)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: m25p80: add support for the Spansion s25fl008k chip

Signed-off-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(cherry picked from commit bec44c45c245b38662f1e61bf0bde95fac1e7fb5)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: m25p80: Use positive logic to check JEDEC ID

For slightly better readability.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(cherry picked from commit b2fda1296bb8e213a6bad3937326ae98c4c4773c)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: delete non-required instances of include <linux/init.h>

None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Brian Norris <computersforpeace@gmail.com>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
[Brian: dropped one incorrect hunk]
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(cherry picked from commit 3ea5b037e750274659648b58fb97426566a90373)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: m25p80: Enable Dual SPI read transfers for s25fl256s1 and s25fl512s

Spansion s25fl256s1 and s25fl512s support Dual SPI transfers, hence set the
M25P80_DUAL_READ flag.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(cherry picked from commit f5e00838e83f6fc93f42c7a01b0c612031955b31)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

mtd: m25p80: Add dual read support

Add support for Dual SPI read transfers, which is supported by some
Spansion SPI FLASHes.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(cherry picked from commit dbbafb74239e8296bc20f86366b3f38e13650900)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

gpio: rcar: Add helper variable dev = &pdev->dev

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: linux-gpio@vger.kernel.org
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from commit b22978fc33dec72e5f8e17f90eb63ea9137aafd5)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

clk: shmobile: clk-mstp: change to using clock-indices

With the addition of clock-indices, we need to change the renesas
clock implementation to use these instead of the local definition
of "renesas,clock-indices".

Since this will break booting with older device trees, we add a
simple auto-detection of which properties are present.

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
(cherry picked from commit 8e33f91a0b84ae1964bef77cb92f5d41d97530c8)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

clk: shmobile: fix setting paretn clock rate

If the driver needs to change a clock rate, then it must be propogated
through the MSTP clock to the parent clock (such as shdi0 -> sd0). Without
this we cannot up-rate default clocks which are really slow (such as the
mmcif1 which defaults to 12MHz where it could be running at 97MHz)

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
(cherry picked from commit e44df332f30bf3040c60c1ed6674d1431fdb48b9)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

clk: shmobile: rcar-gen2: fix lb/sd0/sd1/sdh clock parent to pll1

The clock generator for rcar-gen2 has the lb, sdh, sd0 and sd1 clocks
parented to pll1_div2 where the hardware diagram shows these to be
directly fed from pll1.

This fixes the initial rate for sdh0 clock to be 97.5MHz instead of
the reported 48MHz where the manual says the default register values
are for 97.5MHz.

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
(cherry picked from commit 365b01869bca1c9d5ecb05be7857739fa18a9b8c)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

clk: shmobile: add CPG driver for rz-platforms

Signed-off-by: Wolfram Sang <wsa@sang-engineering.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
(cherry picked from commit a665962e8f4484647e7a19b4d6329d42ed8bc804)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

clk: shmobile: div6: use proper description in kernel doc

These variable clocks have nothing to do with MSTP gating, probably a
copy&paste leftover.

Signed-off-by: Wolfram Sang <wsa@sang-engineering.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
(cherry picked from commit 95aa4f9b5fe577de902aa780e91140c6e89c73a2)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ARM: shmobile: wait for MSTP clock status to toggle, when enabling it

On r-/sh-mobile SoCs MSTP clocks are used by the runtime PM to dynamically
enable and disable peripheral clocks. To make sure the clock has really
started we have to read back its status register until it confirms success.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski+renesas@gmail.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
(cherry picked from commit a028c6da34d434e35ba8322568c756ea97ff3c18)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

v4l: vsp1: Update copyright notice

The "Renesas Corporation" listed in the copyright notice doesn't exist.
Replace it with "Renesas Electronics Corporation" and update the
copyright years.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
(cherry picked from commit 8a1edc55c1ec1ff3624c25b4ac6c1ce776d872b8)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

ktap-0.4

LTSI Makefile addition

Change the extra version to have -ltsi to have a chance to realize what
kernel version we are using.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Linux 3.14.28

Btrfs: fix fs corruption on transaction abort if device supports discard

commit 678886bdc6378c1cbd5072da2c5a3035000214e3 upstream.

When we abort a transaction we iterate over all the ranges marked as dirty
in fs_info->freed_extents[0] and fs_info->freed_extents[1], clear them
from those trees, add them back (unpin) to the free space caches and, if
the fs was mounted with "-o discard", perform a discard on those regions.
Also, after adding the regions to the free space caches, a fitrim ioctl call
can see those ranges in a block group's free space cache and perform a discard
on the ranges, so the same issue can happen without "-o discard" as well.

This causes corruption, affecting one or multiple btree nodes (in the worst
case leaving the fs unmountable) because some of those ranges (the ones in
the fs_info->pinned_extents tree) correspond to btree nodes/leafs that are
referred by the last committed super block - breaking the rule that anything
that was committed by a transaction is untouched until the next transaction
commits successfully.

I ran into this while running in a loop (for several hours) the fstest that
I recently submitted:

  [PATCH] fstests: add btrfs test to stress chunk allocation/removal and fstrim

The corruption always happened when a transaction aborted and then fsck complained
like this:

   _check_btrfs_filesystem: filesystem on /dev/sdc is inconsistent
   *** fsck.btrfs output ***
   Check tree block failed, want=94945280, have=0
   Check tree block failed, want=94945280, have=0
   Check tree block failed, want=94945280, have=0
   Check tree block failed, want=94945280, have=0
   Check tree block failed, want=94945280, have=0
   read block failed check_tree_block
   Couldn't open file system

In this case 94945280 corresponded to the root of a tree.
Using frace what I observed was the following sequence of steps happened:

   1) transaction N started, fs_info->pinned_extents pointed to
      fs_info->freed_extents[0];

   2) node/eb 94945280 is created;

   3) eb is persisted to disk;

   4) transaction N commit starts, fs_info->pinned_extents now points to
      fs_info->freed_extents[1], and transaction N completes;

   5) transaction N + 1 starts;

   6) eb is COWed, and btrfs_free_tree_block() called for this eb;

   7) eb range (94945280 to 94945280 + 16Kb) is added to
      fs_info->pinned_extents (fs_info->freed_extents[1]);

   8) Something goes wrong in transaction N + 1, like hitting ENOSPC
      for example, and the transaction is aborted, turning the fs into
      readonly mode. The stack trace I got for example:

      [112065.253935]  [<ffffffff8140c7b6>] dump_stack+0x4d/0x66
      [112065.254271]  [<ffffffff81042984>] warn_slowpath_common+0x7f/0x98
      [112065.254567]  [<ffffffffa0325990>] ? __btrfs_abort_transaction+0x50/0x10b [btrfs]
      [112065.261674]  [<ffffffff810429e5>] warn_slowpath_fmt+0x48/0x50
      [112065.261922]  [<ffffffffa032949e>] ? btrfs_free_path+0x26/0x29 [btrfs]
      [112065.262211]  [<ffffffffa0325990>] __btrfs_abort_transaction+0x50/0x10b [btrfs]
      [112065.262545]  [<ffffffffa036b1d6>] btrfs_remove_chunk+0x537/0x58b [btrfs]
      [112065.262771]  [<ffffffffa033840f>] btrfs_delete_unused_bgs+0x1de/0x21b [btrfs]
      [112065.263105]  [<ffffffffa0343106>] cleaner_kthread+0x100/0x12f [btrfs]
      (...)
      [112065.264493] ---[ end trace dd7903a975a31a08 ]---
      [112065.264673] BTRFS: error (device sdc) in btrfs_remove_chunk:2625: errno=-28 No space left
      [112065.264997] BTRFS info (device sdc): forced readonly

   9) The clear kthread sees that the BTRFS_FS_STATE_ERROR bit is set in
      fs_info->fs_state and calls btrfs_cleanup_transaction(), which in
      turn calls btrfs_destroy_pinned_extent();

   10) Then btrfs_destroy_pinned_extent() iterates over all the ranges
       marked as dirty in fs_info->freed_extents[], and for each one
       it calls discard, if the fs was mounted with "-o discard", and
       adds the range to the free space cache of the respective block
       group;

   11) btrfs_trim_block_group(), invoked from the fitrim ioctl code path,
       sees the free space entries and performs a discard;

   12) After an umount and mount (or fsck), our eb's location on disk was full
       of zeroes, and it should have been untouched, because it was marked as
       dirty in the fs_info->pinned_extents tree, and therefore used by the
       trees that the last committed superblock points to.

Fix this by not performing a discard and not adding the ranges to the free space
caches - it's useless from this point since the fs is now in readonly mode and
we won't write free space caches to disk anymore (otherwise we would leak space)
nor any new superblock. By not adding the ranges to the free space caches, it
prevents other code paths from allocating that space and write to it as well,
therefore being safer and simpler.

This isn't a new problem, as it's been present since 2011 (git commit
acce952b0263825da32cf10489413dec78053347).

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Btrfs: do not move em to modified list when unpinning

commit a28046956c71985046474283fa3bcd256915fb72 upstream.

We use the modified list to keep track of which extents have been modified so we
know which ones are candidates for logging at fsync() time.  Newly modified
extents are added to the list at modification time, around the same time the
ordered extent is created.  We do this so that we don't have to wait for ordered
extents to complete before we know what we need to log.  The problem is when
something like this happens

log extent 0-4k on inode 1
copy csum for 0-4k from ordered extent into log
sync log
commit transaction
log some other extent on inode 1
ordered extent for 0-4k completes and adds itself onto modified list again
log changed extents
see ordered extent for 0-4k has already been logged
at this point we assume the csum has been copied
sync log
crash

On replay we will see the extent 0-4k in the log, drop the original 0-4k extent
which is the same one that we are replaying which also drops the csum, and then
we won't find the csum in the log for that bytenr.  This of course causes us to
have errors about not having csums for certain ranges of our inode.  So remove
the modified list manipulation in unpin_extent_cache, any modified extents
should have been added well before now, and we don't want them re-logged.  This
fixes my test that I could reliably reproduce this problem with.  Thanks,

Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

eCryptfs: Remove buggy and unnecessary write in file name decode routine

commit 942080643bce061c3dd9d5718d3b745dcb39a8bc upstream.

Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the
end of the allocated buffer during encrypted filename decoding. This
fix corrects the issue by getting rid of the unnecessary 0 write when
the current bit offset is 2.

Signed-off-by: Michael Halcrow <mhalcrow@google.com>
Reported-by: Dmitry Chernenkov <dmitryc@google.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

eCryptfs: Force RO mount when encrypted view is enabled

commit 332b122d39c9cbff8b799007a825d94b2e7c12f2 upstream.

The ecryptfs_encrypted_view mount option greatly changes the
functionality of an eCryptfs mount. Instead of encrypting and decrypting
lower files, it provides a unified view of the encrypted files in the
lower filesystem. The presence of the ecryptfs_encrypted_view mount
option is intended to force a read-only mount and modifying files is not
supported when the feature is in use. See the following commit for more
information:

  e77a56d [PATCH] eCryptfs: Encrypted passthrough

This patch forces the mount to be read-only when the
ecryptfs_encrypted_view mount option is specified by setting the
MS_RDONLY flag on the superblock. Additionally, this patch removes some
broken logic in ecryptfs_open() that attempted to prevent modifications
of files when the encrypted view feature was in use. The check in
ecryptfs_open() was not sufficient to prevent file modifications using
system calls that do not operate on a file descriptor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Priya Bansal <p.bansal@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

udf: Verify symlink size before loading it

commit a1d47b262952a45aae62bd49cfaf33dd76c11a2c upstream.

UDF specification allows arbitrarily large symlinks. However we support
only symlinks at most one block large. Check the length of the symlink
so that we don't access memory beyond end of the symlink block.

Reported-by: Carl Henrik Lunde <chlunde@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

exit: pidns: alloc_pid() leaks pid_namespace if child_reaper is exiting

commit 24c037ebf5723d4d9ab0996433cee4f96c292a4d upstream.

alloc_pid() does get_pid_ns() beforehand but forgets to put_pid_ns() if it
fails because disable_pid_allocation() was called by the exiting
child_reaper.

We could simply move get_pid_ns() down to successful return, but this fix
tries to be as trivial as possible.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Aaron Tomlin <atomlin@redhat.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Sterling Alexander <stalexan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ncpfs: return proper error from NCP_IOC_SETROOT ioctl

commit a682e9c28cac152e6e54c39efcf046e0c8cfcf63 upstream.

If some error happens in NCP_IOC_SETROOT ioctl, the appropriate error
return value is then (in most cases) just overwritten before we return.
This can result in reporting success to userspace although error happened.

This bug was introduced by commit 2e54eb96e2c8 ("BKL: Remove BKL from
ncpfs").  Propagate the errors correctly.

Coverity id: 1226925.

Fixes: 2e54eb96e2c80 ("BKL: Remove BKL from ncpfs")
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Petr Vandrovec <petr@vandrovec.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: af_alg - fix backlog handling

commit 7e77bdebff5cb1e9876c561f69710b9ab8fa1f7e upstream.

If a request is backlogged, it's complete() handler will get called
twice: once with -EINPROGRESS, and once with the final error code.

af_alg's complete handler, unlike other users, does not handle the
-EINPROGRESS but instead always completes the completion that recvmsg()
is waiting on.  This can lead to a return to user space while the
request is still pending in the driver.  If userspace closes the sockets
before the requests are handled by the driver, this will lead to
use-after-frees (and potential crashes) in the kernel due to the tfm
having been freed.

The crashes can be easily reproduced (for example) by reducing the max
queue length in cryptod.c and running the following (from
http://www.chronox.de/libkcapi.html) on AES-NI capable hardware:

 $ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \
    -k 00000000000000000000000000000000 \
    -p 00000000000000000000000000000000 >/dev/null & done

Signed-off-by: Rabin Vincent <rabin.vincent@axis.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

audit: restore AUDIT_LOGINUID unset ABI

commit 041d7b98ffe59c59fdd639931dea7d74f9aa9a59 upstream.

A regression was caused by commit 780a7654cee8:
 audit: Make testing for a valid loginuid explicit.
(which in turn attempted to fix a regression caused by e1760bd)

When audit_krule_to_data() fills in the rules to get a listing, there was a
missing clause to convert back from AUDIT_LOGINUID_SET to AUDIT_LOGINUID.

This broke userspace by not returning the same information that was sent and
expected.

The rule:
auditctl -a exit,never -F auid=-1
gives:
auditctl -l
LIST_RULES: exit,never f24=0 syscall=all
when it should give:
LIST_RULES: exit,never auid=-1 (0xffffffff) syscall=all

Tag it so that it is reported the same way it was set.  Create a new
private flags audit_krule field (pflags) to store it that won't interact with
the public one from the API.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Unbreak the unprivileged remount tests

commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream.

A security fix in caused the way the unprivileged remount tests were
using user namespaces to break.  Tweak the way user namespaces are
being used so the test works again.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Allow setting gid_maps without privilege when setgroups is disabled

commit 66d2f338ee4c449396b6f99f5e75cd18eb6df272 upstream.

Now that setgroups can be disabled and not reenabled, setting gid_map
without privielge can now be enabled when setgroups is disabled.

This restores most of the functionality that was lost when unprivileged
setting of gid_map was removed.  Applications that use this functionality
will need to check to see if they use setgroups or init_groups, and if they
don't they can be fixed by simply disabling setgroups before writing to
gid_map.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Add a knob to disable setgroups on a per user namespace basis

commit 9cc46516ddf497ea16e8d7cb986ae03a0f6b92f8 upstream.

- Expose the knob to user space through a proc file /proc/<pid>/setgroups

  A value of "deny" means the setgroups system call is disabled in the
  current processes user namespace and can not be enabled in the
  future in this user namespace.

  A value of "allow" means the segtoups system call is enabled.

- Descendant user namespaces inherit the value of setgroups from
  their parents.

- A proc file is used (instead of a sysctl) as sysctls currently do
  not allow checking the permissions at open time.

- Writing to the proc file is restricted to before the gid_map
  for the user namespace is set.

  This ensures that disabling setgroups at a user namespace
  level will never remove the ability to call setgroups
  from a process that already has that ability.

  A process may opt in to the setgroups disable for itself by
  creating, entering and configuring a user namespace or by calling
  setns on an existing user namespace with setgroups disabled.
  Processes without privileges already can not call setgroups so this
  is a noop.  Prodcess with privilege become processes without
  privilege when entering a user namespace and as with any other path
  to dropping privilege they would not have the ability to call
  setgroups.  So this remains within the bounds of what is possible
  without a knob to disable setgroups permanently in a user namespace.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Rename id_map_mutex to userns_state_mutex

commit f0d62aec931e4ae3333c797d346dc4f188f454ba upstream.

Generalize id_map_mutex so it can be used for more state of a user namespace.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Only allow the creator of the userns unprivileged mappings

commit f95d7918bd1e724675de4940039f2865e5eec5fe upstream.

If you did not create the user namespace and are allowed
to write to uid_map or gid_map you should already have the necessary
privilege in the parent user namespace to establish any mapping
you want so this will not affect userspace in practice.

Limiting unprivileged uid mapping establishment to the creator of the
user namespace makes it easier to verify all credentials obtained with
the uid mapping can be obtained without the uid mapping without
privilege.

Limiting unprivileged gid mapping establishment (which is temporarily
absent) to the creator of the user namespace also ensures that the
combination of uid and gid can already be obtained without privilege.

This is part of the fix for CVE-2014-8989.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Check euid no fsuid when establishing an unprivileged uid mapping

commit 80dd00a23784b384ccea049bfb3f259d3f973b9d upstream.

setresuid allows the euid to be set to any of uid, euid, suid, and
fsuid.  Therefor it is safe to allow an unprivileged user to map
their euid and use CAP_SETUID privileged with exactly that uid,
as no new credentials can be obtained.

I can not find a combination of existing system calls that allows setting
uid, euid, suid, and fsuid from the fsuid making the previous use
of fsuid for allowing unprivileged mappings a bug.

This is part of a fix for CVE-2014-8989.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Don't allow unprivileged creation of gid mappings

commit be7c6dba2332cef0677fbabb606e279ae76652c3 upstream.

As any gid mapping will allow and must allow for backwards
compatibility dropping groups don't allow any gid mappings to be
established without CAP_SETGID in the parent user namespace.

For a small class of applications this change breaks userspace
and removes useful functionality.  This small class of applications
includes tools/testing/selftests/mount/unprivilged-remount-test.c

Most of the removed functionality will be added back with the addition
of a one way knob to disable setgroups.  Once setgroups is disabled
setting the gid_map becomes as safe as setting the uid_map.

For more common applications that set the uid_map and the gid_map
with privilege this change will have no affect.

This is part of a fix for CVE-2014-8989.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Don't allow setgroups until a gid mapping has been setablished

commit 273d2c67c3e179adb1e74f403d1e9a06e3f841b5 upstream.

setgroups is unique in not needing a valid mapping before it can be called,
in the case of setgroups(0, NULL) which drops all supplemental groups.

The design of the user namespace assumes that CAP_SETGID can not actually
be used until a gid mapping is established.  Therefore add a helper function
to see if the user namespace gid mapping has been established and call
that function in the setgroups permission check.

This is part of the fix for CVE-2014-8989, being able to drop groups
without privilege using user namespaces.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

userns: Document what the invariant required for safe unprivileged mappings.

commit 0542f17bf2c1f2430d368f44c8fcf2f82ec9e53e upstream.

The rule is simple.  Don't allow anything that wouldn't be allowed
without unprivileged mappings.

It was previously overlooked that establishing gid mappings would
allow dropping groups and potentially gaining permission to files and
directories that had lesser permissions for a specific group than for
all other users.

This is the rule needed to fix CVE-2014-8989 and prevent any other
security issues with new_idmap_permitted.

The reason for this rule is that the unix permission model is old and
there are programs out there somewhere that take advantage of every
little corner of it.  So allowing a uid or gid mapping to be
established without privielge that would allow anything that would not
be allowed without that mapping will result in expectations from some
code somewhere being violated.  Violated expectations about the
behavior of the OS is a long way to say a security issue.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

groups: Consolidate the setgroups permission checks

commit 7ff4d90b4c24a03666f296c3d4878cd39001e81e upstream.

Today there are 3 instances of setgroups and due to an oversight their
permission checking has diverged.  Add a common function so that
they may all share the same permission checking code.

This corrects the current oversight in the current permission checks
and adds a helper to avoid this in the future.

A user namespace security fix will update this new helper, shortly.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

umount: Disallow unprivileged mount force

commit b2f5d4dc38e034eecb7987e513255265ff9aa1cf upstream.

Forced unmount affects not just the mount namespace but the underlying
superblock as well.  Restrict forced unmount to the global root user
for now.  Otherwise it becomes possible a user in a less privileged
mount namespace to force the shutdown of a superblock of a filesystem
in a more privileged mount namespace, allowing a DOS attack on root.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mnt: Update unprivileged remount test

commit 4a44a19b470a886997d6647a77bb3e38dcbfa8c5 upstream.

- MNT_NODEV should be irrelevant except when reading back mount flags,
  no longer specify MNT_NODEV on remount.

- Test MNT_NODEV on devpts where it is meaningful even for unprivileged mounts.

- Add a test to verify that remount of a prexisting mount with the same flags
  is allowed and does not change those flags.

- Cleanup up the definitions of MS_REC, MS_RELATIME, MS_STRICTATIME that are used
  when the code is built in an environment without them.

- Correct the test error messages when tests fail.  There were not 5 tests
  that tested MS_RELATIME.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>