--- /dev/null
+From 6cad1376954e591c3c41500c4e586e183e7ffe6d Mon Sep 17 00:00:00 2001
+From: James Ralston <james.d.ralston@intel.com>
+Date: Wed, 27 Aug 2014 14:31:58 -0700
+Subject: ata_piix: Add Device IDs for Intel 9 Series PCH
+
+From: James Ralston <james.d.ralston@intel.com>
+
+commit 6cad1376954e591c3c41500c4e586e183e7ffe6d upstream.
+
+This patch adds the IDE mode SATA Device IDs for the Intel 9 Series PCH.
+
+Signed-off-by: James Ralston <james.d.ralston@intel.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ata_piix.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -340,6 +340,14 @@ static const struct pci_device_id piix_p
+ { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ /* SATA Controller IDE (Coleto Creek) */
+ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+
+ { } /* terminate list */
+ };
--- /dev/null
+From 2da78092dda13f1efd26edbbf99a567776913750 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Tue, 26 Aug 2014 09:05:36 -0600
+Subject: block: Fix dev_t minor allocation lifetime
+
+From: Keith Busch <keith.busch@intel.com>
+
+commit 2da78092dda13f1efd26edbbf99a567776913750 upstream.
+
+Releases the dev_t minor when all references are closed to prevent
+another device from acquiring the same major/minor.
+
+Since the partition's release may be invoked from call_rcu's soft-irq
+context, the ext_dev_idr's mutex had to be replaced with a spinlock so
+as not so sleep.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/genhd.c | 24 ++++++++++++++----------
+ block/partition-generic.c | 2 +-
+ 2 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -28,10 +28,10 @@ struct kobject *block_depr;
+ /* for extended dynamic devt allocation, currently only one major is used */
+ #define NR_EXT_DEVT (1 << MINORBITS)
+
+-/* For extended devt allocation. ext_devt_mutex prevents look up
++/* For extended devt allocation. ext_devt_lock prevents look up
+ * results from going away underneath its user.
+ */
+-static DEFINE_MUTEX(ext_devt_mutex);
++static DEFINE_SPINLOCK(ext_devt_lock);
+ static DEFINE_IDR(ext_devt_idr);
+
+ static struct device_type disk_type;
+@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *par
+ }
+
+ /* allocate ext devt */
+- mutex_lock(&ext_devt_mutex);
+- idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_KERNEL);
+- mutex_unlock(&ext_devt_mutex);
++ idr_preload(GFP_KERNEL);
++
++ spin_lock(&ext_devt_lock);
++ idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT);
++ spin_unlock(&ext_devt_lock);
++
++ idr_preload_end();
+ if (idx < 0)
+ return idx == -ENOSPC ? -EBUSY : idx;
+
+@@ -447,9 +451,9 @@ void blk_free_devt(dev_t devt)
+ return;
+
+ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+ }
+
+@@ -665,7 +669,6 @@ void del_gendisk(struct gendisk *disk)
+ sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
+ pm_runtime_set_memalloc_noio(disk_to_dev(disk), false);
+ device_del(disk_to_dev(disk));
+- blk_free_devt(disk_to_dev(disk)->devt);
+ }
+ EXPORT_SYMBOL(del_gendisk);
+
+@@ -690,13 +693,13 @@ struct gendisk *get_gendisk(dev_t devt,
+ } else {
+ struct hd_struct *part;
+
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ if (part && get_disk(part_to_disk(part))) {
+ *partno = part->partno;
+ disk = part_to_disk(part);
+ }
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+
+ return disk;
+@@ -1098,6 +1101,7 @@ static void disk_release(struct device *
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+
++ blk_free_devt(dev->devt);
+ disk_release_events(disk);
+ kfree(disk->random);
+ disk_replace_part_tbl(disk, NULL);
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -211,6 +211,7 @@ static const struct attribute_group *par
+ static void part_release(struct device *dev)
+ {
+ struct hd_struct *p = dev_to_part(dev);
++ blk_free_devt(dev->devt);
+ free_part_stats(p);
+ free_part_info(p);
+ kfree(p);
+@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *di
+ rcu_assign_pointer(ptbl->last_lookup, NULL);
+ kobject_put(part->holder_dir);
+ device_del(part_to_dev(part));
+- blk_free_devt(part_devt(part));
+
+ hd_struct_put(part);
+ }
--- /dev/null
+From d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 28 Aug 2014 11:09:31 -0400
+Subject: dm crypt: fix access beyond the end of allocated space
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.
+
+The DM crypt target accesses memory beyond allocated space resulting in
+a crash on 32 bit x86 systems.
+
+This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm
+crypt: use async crypto"). However, this bug was masked by the fact
+that kmalloc rounds the size up to the next power of two. This bug
+wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio
+data"). By switching to using per-bio data there was no longer any
+padding beyond the end of a dm-crypt allocated memory block.
+
+To minimize allocation overhead dm-crypt puts several structures into one
+block allocated with kmalloc. The block holds struct ablkcipher_request,
+cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),
+struct dm_crypt_request and an initialization vector.
+
+The variable dmreq_start is set to offset of struct dm_crypt_request
+within this memory block. dm-crypt allocates the block with this size:
+cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.
+
+When accessing the initialization vector, dm-crypt uses the function
+iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
++ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).
+
+dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request
+structure. However, when dm-crypt accesses the initialization vector, it
+takes a pointer to the end of dm_crypt_request, aligns it, and then uses
+it as the initialization vector. If the end of dm_crypt_request is not
+aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the
+alignment causes the initialization vector to point beyond the allocated
+space.
+
+Fix this bug by calculating the variable iv_size_padding and adding it
+to the allocated size.
+
+Also correct the alignment of dm_crypt_request. struct dm_crypt_request
+is specific to dm-crypt (it isn't used by the crypto subsystem at all),
+so it is aligned on __alignof__(struct dm_crypt_request).
+
+Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is
+aligned as if the block was allocated with kmalloc.
+
+Reported-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
+Tested-by: Milan Broz <gmazyland@gmail.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1506,6 +1506,7 @@ static int crypt_ctr(struct dm_target *t
+ unsigned int key_size, opt_params;
+ unsigned long long tmpll;
+ int ret;
++ size_t iv_size_padding;
+ struct dm_arg_set as;
+ const char *opt_string;
+ char dummy;
+@@ -1542,12 +1543,23 @@ static int crypt_ctr(struct dm_target *t
+
+ cc->dmreq_start = sizeof(struct ablkcipher_request);
+ cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
+- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
+- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
+- ~(crypto_tfm_ctx_alignment() - 1);
++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
++
++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
++ /* Allocate the padding exactly */
++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
++ & crypto_ablkcipher_alignmask(any_tfm(cc));
++ } else {
++ /*
++ * If the cipher requires greater alignment than kmalloc
++ * alignment, we don't know the exact position of the
++ * initialization vector. We must assume worst case.
++ */
++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
++ }
+
+ cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
+- sizeof(struct dm_crypt_request) + cc->iv_size);
++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
+ if (!cc->req_pool) {
+ ti->error = "Cannot allocate crypt request mempool";
+ goto bad;
--- /dev/null
+From c01206796139e2b1feb7539bc72174fef1c6dc6e Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 10 Sep 2014 13:50:37 -0700
+Subject: Input: atkbd - do not try 'deactivate' keyboard on any LG laptops
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit c01206796139e2b1feb7539bc72174fef1c6dc6e upstream.
+
+We are getting more and more reports about LG laptops not having
+functioning keyboard if we try to deactivate keyboard during probe.
+Given that having keyboard deactivated is merely "nice to have"
+instead of a hard requirement for probing, let's disable it on all
+LG boxes instead of trying to hunt down particular models.
+
+This change is prompted by patches trying to add "LG Electronics"/"ROCKY"
+and "LG Electronics"/"LW60-F27B" to the DMI list.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=77051
+
+Reported-by: Jaime Velasco Juan <jsagarribay@gmail.com>
+Reported-by: Georgios Tsalikis <georgios@tsalikis.net>
+Tested-by: Jaime Velasco Juan <jsagarribay@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/atkbd.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
+- },
+- .callback = atkbd_deactivate_fixup,
+- },
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
+ },
+ .callback = atkbd_deactivate_fixup,
+ },
--- /dev/null
+From 271329b3c798b2102120f5df829071c211ef00ed Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 8 Sep 2014 14:39:52 -0700
+Subject: Input: elantech - fix detection of touchpad on ASUS s301l
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 271329b3c798b2102120f5df829071c211ef00ed upstream.
+
+Adjust Elantech signature validation to account fo rnewer models of
+touchpads.
+
+Reported-and-tested-by: Màrius Monton <marius.monton@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1223,6 +1223,13 @@ static bool elantech_is_signature_valid(
+ if (param[1] == 0)
+ return true;
+
++ /*
++ * Some models have a revision higher then 20. Meaning param[2] may
++ * be 10 or 20, skip the rates check for these.
++ */
++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ return true;
++
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+ if (param[2] == rates[i])
+ return false;
--- /dev/null
+From cc18a69c92d0972bc2fc5a047ee3be1e8398171b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Sep 2014 13:53:37 -0700
+Subject: Input: i8042 - add Fujitsu U574 to no_timeout dmi table
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=69731
+
+Reported-by: Jason Robinson <mail@jasonrobinson.me>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -601,6 +601,14 @@ static const struct dmi_system_id __init
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Fujitsu U574 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From d2682118f4bb3ceb835f91c1a694407a31bb7378 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 11 Sep 2014 10:10:26 -0700
+Subject: Input: i8042 - add nomux quirk for Avatar AVIU-145A6
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit d2682118f4bb3ceb835f91c1a694407a31bb7378 upstream.
+
+The sys_vendor / product_name are somewhat generic unfortunately, so this
+may lead to some false positives. But nomux usually does no harm, where as
+not having it clearly is causing problems on the Avatar AVIU-145A6.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=77391
+
+Reported-by: Hugo P <saurosii@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -458,6 +458,13 @@ static const struct dmi_system_id __init
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Avatar AVIU-145A6 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From a80d8b02751060a178bb1f7a6b7a93645a7a308b Mon Sep 17 00:00:00 2001
+From: John Sung <penmount.touch@gmail.com>
+Date: Tue, 9 Sep 2014 10:06:51 -0700
+Subject: Input: serport - add compat handling for SPIOCSTYPE ioctl
+
+From: John Sung <penmount.touch@gmail.com>
+
+commit a80d8b02751060a178bb1f7a6b7a93645a7a308b upstream.
+
+When running a 32-bit inputattach utility in a 64-bit system, there will be
+error code "inputattach: can't set device type". This is caused by the
+serport device driver not supporting compat_ioctl, so that SPIOCSTYPE ioctl
+fails.
+
+Signed-off-by: John Sung <penmount.touch@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/serport.c | 45 +++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 38 insertions(+), 7 deletions(-)
+
+--- a/drivers/input/serio/serport.c
++++ b/drivers/input/serio/serport.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/serio.h>
+ #include <linux/tty.h>
++#include <linux/compat.h>
+
+ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
+ MODULE_DESCRIPTION("Input device TTY line discipline");
+@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct
+ return 0;
+ }
+
++static void serport_set_type(struct tty_struct *tty, unsigned long type)
++{
++ struct serport *serport = tty->disc_data;
++
++ serport->id.proto = type & 0x000000ff;
++ serport->id.id = (type & 0x0000ff00) >> 8;
++ serport->id.extra = (type & 0x00ff0000) >> 16;
++}
++
+ /*
+ * serport_ldisc_ioctl() allows to set the port protocol, and device ID
+ */
+
+-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file,
++ unsigned int cmd, unsigned long arg)
+ {
+- struct serport *serport = (struct serport*) tty->disc_data;
+- unsigned long type;
+-
+ if (cmd == SPIOCSTYPE) {
++ unsigned long type;
++
+ if (get_user(type, (unsigned long __user *) arg))
+ return -EFAULT;
+
+- serport->id.proto = type & 0x000000ff;
+- serport->id.id = (type & 0x0000ff00) >> 8;
+- serport->id.extra = (type & 0x00ff0000) >> 16;
++ serport_set_type(tty, type);
++ return 0;
++ }
++
++ return -EINVAL;
++}
++
++#ifdef CONFIG_COMPAT
++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t)
++static long serport_ldisc_compat_ioctl(struct tty_struct *tty,
++ struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ if (cmd == COMPAT_SPIOCSTYPE) {
++ void __user *uarg = compat_ptr(arg);
++ compat_ulong_t compat_type;
++
++ if (get_user(compat_type, (compat_ulong_t __user *)uarg))
++ return -EFAULT;
+
++ serport_set_type(tty, compat_type);
+ return 0;
+ }
+
+ return -EINVAL;
+ }
++#endif
+
+ static void serport_ldisc_write_wakeup(struct tty_struct * tty)
+ {
+@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldis
+ .close = serport_ldisc_close,
+ .read = serport_ldisc_read,
+ .ioctl = serport_ldisc_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = serport_ldisc_compat_ioctl,
++#endif
+ .receive_buf = serport_ldisc_receive,
+ .write_wakeup = serport_ldisc_write_wakeup
+ };
--- /dev/null
+From 5715fc764f7753d464dbe094b5ef9cffa6e479a4 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Sat, 30 Aug 2014 13:51:06 -0700
+Subject: Input: synaptics - add support for ForcePads
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 5715fc764f7753d464dbe094b5ef9cffa6e479a4 upstream.
+
+ForcePads are found on HP EliteBook 1040 laptops. They lack any kind of
+physical buttons, instead they generate primary button click when user
+presses somewhat hard on the surface of the touchpad. Unfortunately they
+also report primary button click whenever there are 2 or more contacts
+on the pad, messing up all multi-finger gestures (2-finger scrolling,
+multi-finger tapping, etc). To cope with this behavior we introduce a
+delay (currently 50 msecs) in reporting primary press in case more
+contacts appear.
+
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 68 ++++++++++++++++++++++++++++++----------
+ drivers/input/mouse/synaptics.h | 11 ++++++
+ 2 files changed, 63 insertions(+), 16 deletions(-)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -549,10 +549,61 @@ static int synaptics_parse_hw_state(cons
+ ((buf[0] & 0x04) >> 1) |
+ ((buf[3] & 0x04) >> 2));
+
++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
++ hw->w == 2) {
++ synaptics_parse_agm(buf, priv, hw);
++ return 1;
++ }
++
++ hw->x = (((buf[3] & 0x10) << 8) |
++ ((buf[1] & 0x0f) << 8) |
++ buf[4]);
++ hw->y = (((buf[3] & 0x20) << 7) |
++ ((buf[1] & 0xf0) << 4) |
++ buf[5]);
++ hw->z = buf[2];
++
+ hw->left = (buf[0] & 0x01) ? 1 : 0;
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+
+- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
++ /*
++ * ForcePads, like Clickpads, use middle button
++ * bits to report primary button clicks.
++ * Unfortunately they report primary button not
++ * only when user presses on the pad above certain
++ * threshold, but also when there are more than one
++ * finger on the touchpad, which interferes with
++ * out multi-finger gestures.
++ */
++ if (hw->z == 0) {
++ /* No contacts */
++ priv->press = priv->report_press = false;
++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) {
++ /*
++ * Single-finger touch with pressure above
++ * the threshold. If pressure stays long
++ * enough, we'll start reporting primary
++ * button. We rely on the device continuing
++ * sending data even if finger does not
++ * move.
++ */
++ if (!priv->press) {
++ priv->press_start = jiffies;
++ priv->press = true;
++ } else if (time_after(jiffies,
++ priv->press_start +
++ msecs_to_jiffies(50))) {
++ priv->report_press = true;
++ }
++ } else {
++ priv->press = false;
++ }
++
++ hw->left = priv->report_press;
++
++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ /*
+ * Clickpad's button is transmitted as middle button,
+ * however, since it is primary button, we will report
+@@ -571,21 +622,6 @@ static int synaptics_parse_hw_state(cons
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
+- hw->w == 2) {
+- synaptics_parse_agm(buf, priv, hw);
+- return 1;
+- }
+-
+- hw->x = (((buf[3] & 0x10) << 8) |
+- ((buf[1] & 0x0f) << 8) |
+- buf[4]);
+- hw->y = (((buf[3] & 0x20) << 7) |
+- ((buf[1] & 0xf0) << 4) |
+- buf[5]);
+- hw->z = buf[2];
+-
+ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+ switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -78,6 +78,11 @@
+ * 2 0x08 image sensor image sensor tracks 5 fingers, but only
+ * reports 2.
+ * 2 0x20 report min query 0x0f gives min coord reported
++ * 2 0x80 forcepad forcepad is a variant of clickpad that
++ * does not have physical buttons but rather
++ * uses pressure above certain threshold to
++ * report primary clicks. Forcepads also have
++ * clickpad bit set.
+ */
+ #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
+ #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
+@@ -86,6 +91,7 @@
+ #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000)
+ #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
+ #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800)
++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000)
+
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
+@@ -177,6 +183,11 @@ struct synaptics_data {
+ */
+ struct synaptics_hw_state agm;
+ bool agm_pending; /* new AGM packet received */
++
++ /* ForcePad handling */
++ unsigned long press_start;
++ bool press;
++ bool report_press;
+ };
+
+ void synaptics_module_init(void);
--- /dev/null
+From 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Fri, 29 Aug 2014 16:25:50 -0400
+Subject: lockd: fix rpcbind crash on lockd startup failure
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.
+
+Nikita Yuschenko reported that booting a kernel with init=/bin/sh and
+then nfs mounting without portmap or rpcbind running using a busybox
+mount resulted in:
+
+ # mount -t nfs 10.30.130.21:/opt /mnt
+ svc: failed to register lockdv1 RPC service (errno 111).
+ lockd_up: makesock failed, error=-111
+ Unable to handle kernel paging request for data at address 0x00000030
+ Faulting instruction address: 0xc055e65c
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ MPC85xx CDS
+ Modules linked in:
+ CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117
+ task: cf29cea0 ti: cf35c000 task.ti: cf35c000
+ NIP: c055e65c LR: c0566490 CTR: c055e648
+ REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge)
+ MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000
+ DEAR: 00000030, ESR: 00000000
+
+ GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086
+ 00000000
+ GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000
+ 10090ae8
+ GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000
+ bfa46ef0
+ GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000
+ cf0ded80
+ NIP [c055e65c] call_start+0x14/0x34
+ LR [c0566490] __rpc_execute+0x70/0x250
+ Call Trace:
+ [cf35db80] [00000080] 0x80 (unreliable)
+ [cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4
+ [cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8
+ [cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84
+ [cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c
+ [cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108
+ [cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30
+ [cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0
+ [cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8
+ [cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec
+ [cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4
+ [cf35dd90] [c0171590] nfs3_create_server+0x10/0x44
+ [cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4
+ [cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8
+ [cf35de70] [c00cd3bc] mount_fs+0x20/0xbc
+ [cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104
+ [cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0
+ [cf35df10] [c00e75ac] SyS_mount+0x90/0xd0
+ [cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c
+
+The addition of svc_shutdown_net() resulted in two calls to
+svc_rpcb_cleanup(); the second is no longer necessary and crashes when
+it calls rpcb_register_call with clnt=NULL.
+
+Reported-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
+Fixes: 679b033df484 "lockd: ensure we tear down any live sockets when socket creation fails during lockd_up"
+Acked-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/lockd/svc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv
+
+ error = make_socks(serv, net);
+ if (error < 0)
+- goto err_socks;
++ goto err_bind;
+ set_grace_period(net);
+ dprintk("lockd_up_net: per-net data created; net=%p\n", net);
+ return 0;
+
+-err_socks:
+- svc_rpcb_cleanup(serv, net);
+ err_bind:
+ ln->nlmsvc_users--;
+ return error;
--- /dev/null
+From f0d279654dea22b7a6ad34b9334aee80cda62cde Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 15 Aug 2014 16:06:06 -0400
+Subject: percpu: fix pcpu_alloc_pages() failure path
+
+From: Tejun Heo <tj@kernel.org>
+
+commit f0d279654dea22b7a6ad34b9334aee80cda62cde upstream.
+
+When pcpu_alloc_pages() fails midway, pcpu_free_pages() is invoked to
+free what has already been allocated. The invocation is across the
+whole requested range and pcpu_free_pages() will try to free all
+non-NULL pages; unfortunately, this is incorrect as
+pcpu_get_pages_and_bitmap(), unlike what its comment suggests, doesn't
+clear the pages array and thus the array may have entries from the
+previous invocations making the partial failure path free incorrect
+pages.
+
+Fix it by open-coding the partial freeing of the already allocated
+pages.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu-vm.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_
+ int page_start, int page_end)
+ {
+ const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
+- unsigned int cpu;
++ unsigned int cpu, tcpu;
+ int i;
+
+ for_each_possible_cpu(cpu) {
+@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_
+ struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+
+ *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+- if (!*pagep) {
+- pcpu_free_pages(chunk, pages, populated,
+- page_start, page_end);
+- return -ENOMEM;
+- }
++ if (!*pagep)
++ goto err;
+ }
+ }
+ return 0;
++
++err:
++ while (--i >= page_start)
++ __free_page(pages[pcpu_page_idx(cpu, i)]);
++
++ for_each_possible_cpu(tcpu) {
++ if (tcpu == cpu)
++ break;
++ for (i = page_start; i < page_end; i++)
++ __free_page(pages[pcpu_page_idx(tcpu, i)]);
++ }
++ return -ENOMEM;
+ }
+
+ /**
--- /dev/null
+From 3189eddbcafcc4d827f7f19facbeddec4424eba8 Mon Sep 17 00:00:00 2001
+From: Honggang Li <enjoymindful@gmail.com>
+Date: Tue, 12 Aug 2014 21:36:15 +0800
+Subject: percpu: free percpu allocation info for uniprocessor system
+
+From: Honggang Li <enjoymindful@gmail.com>
+
+commit 3189eddbcafcc4d827f7f19facbeddec4424eba8 upstream.
+
+Currently, only SMP system free the percpu allocation info.
+Uniprocessor system should free it too. For example, one x86 UML
+virtual machine with 256MB memory, UML kernel wastes one page memory.
+
+Signed-off-by: Honggang Li <enjoymindful@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1910,6 +1910,8 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
++
++ pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
--- /dev/null
+From 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 15 Aug 2014 16:06:10 -0400
+Subject: percpu: perform tlb flush after pcpu_map_pages() failure
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream.
+
+If pcpu_map_pages() fails midway, it unmaps the already mapped pages.
+Currently, it doesn't flush tlb after the partial unmapping. This may
+be okay in most cases as the established mapping hasn't been used at
+that point but it can go wrong and when it goes wrong it'd be
+extremely difficult to track down.
+
+Flush tlb after the partial unmapping.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu-vm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -272,6 +272,7 @@ err:
+ __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
+ page_end - page_start);
+ }
++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
+ return err;
+ }
+
--- /dev/null
+From c66517165610b911e4c6d268f28d8c640832dbd1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 24 Aug 2014 17:49:43 -0500
+Subject: rtlwifi: rtl8192cu: Add new ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream.
+
+The Sitecom WLA-2102 adapter uses this driver.
+
+Reported-by: Nico Baggus <nico-linux@noci.xs4all.nl>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Nico Baggus <nico-linux@noci.xs4all.nl>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
+ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
scsi-libiscsi-fix-potential-buffer-overrun-in-__iscsi_conn_send_pdu.patch
revert-iwlwifi-dvm-don-t-enable-cts-to-self.patch
workqueue-apply-__wq_ordered-to-create_singlethread_workqueue.patch
+block-fix-dev_t-minor-allocation-lifetime.patch
+dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch
+input-serport-add-compat-handling-for-spiocstype-ioctl.patch
+input-synaptics-add-support-for-forcepads.patch
+input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch
+input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch
+input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch
+input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch
+ata_piix-add-device-ids-for-intel-9-series-pch.patch
+percpu-free-percpu-allocation-info-for-uniprocessor-system.patch
+percpu-fix-pcpu_alloc_pages-failure-path.patch
+percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch
+rtlwifi-rtl8192cu-add-new-id.patch
+lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
