--- /dev/null
+From 0767e95bb96d7fdddcd590fb809e6975d93aebc5 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sun, 25 Jan 2015 14:34:29 +0100
+Subject: ALSA: seq-dummy: remove deadlock-causing events on close
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 0767e95bb96d7fdddcd590fb809e6975d93aebc5 upstream.
+
+When the last subscriber to a "Through" port has been removed, the
+subscribed destination ports might still be active, so it would be
+wrong to send "all sounds off" and "reset controller" events to them.
+The proper place for such a shutdown would be the closing of the actual
+MIDI port (and close_substream() in rawmidi.c already can do this).
+
+This also fixes a deadlock when dummy_unuse() tries to send events to
+its own port that is already locked because it is being freed.
+
+Reported-by: Peter Billam <peter@www.pjb.com.au>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_dummy.c | 31 -------------------------------
+ 1 file changed, 31 deletions(-)
+
+--- a/sound/core/seq/seq_dummy.c
++++ b/sound/core/seq/seq_dummy.c
+@@ -82,36 +82,6 @@ struct snd_seq_dummy_port {
+ static int my_client = -1;
+
+ /*
+- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
+- * to subscribers.
+- * Note: this callback is called only after all subscribers are removed.
+- */
+-static int
+-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+-{
+- struct snd_seq_dummy_port *p;
+- int i;
+- struct snd_seq_event ev;
+-
+- p = private_data;
+- memset(&ev, 0, sizeof(ev));
+- if (p->duplex)
+- ev.source.port = p->connect;
+- else
+- ev.source.port = p->port;
+- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
+- ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
+- for (i = 0; i < 16; i++) {
+- ev.data.control.channel = i;
+- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- }
+- return 0;
+-}
+-
+-/*
+ * event input callback - just redirect events to subscribers
+ */
+ static int
+@@ -175,7 +145,6 @@ create_port(int idx, int type)
+ | SNDRV_SEQ_PORT_TYPE_PORT;
+ memset(&pcb, 0, sizeof(pcb));
+ pcb.owner = THIS_MODULE;
+- pcb.unuse = dummy_unuse;
+ pcb.event_input = dummy_input;
+ pcb.private_free = dummy_free;
+ pcb.private_data = rec;
--- /dev/null
+From adc60298c80efef4c2d7a7860b91b450931a7cf8 Mon Sep 17 00:00:00 2001
+From: Aurelien BOUIN <a_bouin@yahoo.fr>
+Date: Mon, 29 Dec 2014 16:13:51 -0800
+Subject: ASoC: fsl_esai: Fix incorrect xDC field width of xCCR registers
+
+From: Aurelien BOUIN <a_bouin@yahoo.fr>
+
+commit adc60298c80efef4c2d7a7860b91b450931a7cf8 upstream.
+
+The xDC field should have 5 bit width according to Reference Manual.
+Thus this patch fixes it.
+
+Signed-off-by: Aurelien BOUIN <a_bouin@yahoo.fr>
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_esai.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/fsl/fsl_esai.h
++++ b/sound/soc/fsl/fsl_esai.h
+@@ -302,7 +302,7 @@
+ #define ESAI_xCCR_xFP_MASK (((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT)
+ #define ESAI_xCCR_xFP(v) ((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK)
+ #define ESAI_xCCR_xDC_SHIFT 9
+-#define ESAI_xCCR_xDC_WIDTH 4
++#define ESAI_xCCR_xDC_WIDTH 5
+ #define ESAI_xCCR_xDC_MASK (((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT)
+ #define ESAI_xCCR_xDC(v) ((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK)
+ #define ESAI_xCCR_xPSR_SHIFT 8
--- /dev/null
+From 20602e34cd33dd452bc1836fa7c9b59978f75db0 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 16 Jan 2015 11:20:25 +0200
+Subject: ASoC: omap-mcbsp: Correct CBM_CFS dai format configuration
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 20602e34cd33dd452bc1836fa7c9b59978f75db0 upstream.
+
+We should select FSR also to be driven by McBSP, not only FSX.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/omap/omap-mcbsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/omap/omap-mcbsp.c
++++ b/sound/soc/omap/omap-mcbsp.c
+@@ -434,7 +434,7 @@ static int omap_mcbsp_dai_set_dai_fmt(st
+ case SND_SOC_DAIFMT_CBM_CFS:
+ /* McBSP slave. FS clock as output */
+ regs->srgr2 |= FSGM;
+- regs->pcr0 |= FSXM;
++ regs->pcr0 |= FSXM | FSRM;
+ break;
+ case SND_SOC_DAIFMT_CBM_CFM:
+ /* McBSP slave */
--- /dev/null
+From 3a8e5019846736046c0af9dbee3f921c0456141a Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Thu, 8 Jan 2015 22:56:30 +0100
+Subject: ASoC: pcm512x: Fix DSP program selection
+
+From: Peter Rosin <peda@axentia.se>
+
+commit 3a8e5019846736046c0af9dbee3f921c0456141a upstream.
+
+The DSP programs are listed out of order.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/pcm512x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -188,8 +188,8 @@ static const DECLARE_TLV_DB_SCALE(boost_
+ static const char * const pcm512x_dsp_program_texts[] = {
+ "FIR interpolation with de-emphasis",
+ "Low latency IIR with de-emphasis",
+- "Fixed process flow",
+ "High attenuation with de-emphasis",
++ "Fixed process flow",
+ "Ringing-less low latency FIR",
+ };
+
--- /dev/null
+From 7ddfdb5c5a5b51bdd2cb749d8341d763b079d520 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 13 Jan 2015 21:03:37 +0100
+Subject: ASoC: simple-card: Fix crash in asoc_simple_card_unref()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 7ddfdb5c5a5b51bdd2cb749d8341d763b079d520 upstream.
+
+If asoc_simple_card_probe() fails, asoc_simple_card_unref() may be
+called before dev_set_drvdata(), causing a NULL pointer dereference in
+asoc_simple_card_unref():
+
+ Unable to handle kernel NULL pointer dereference at virtual address 000000d4
+ ...
+ PC is at asoc_simple_card_unref+0x14/0x48
+ LR is at asoc_simple_card_probe+0x3d4/0x40c
+
+This typically happens because asoc_simple_card_parse_of() returns
+-EPROBE_DEFER, but other failure modes are possible.
+devm_snd_soc_register_card()/snd_soc_register_card() may fail either
+before or after dev_set_drvdata().
+
+Pass a snd_soc_card pointer instead of a platform_device pointer to
+asoc_simple_card_unref() to fix this.
+
+Note that if CONFIG_OF_DYNAMIC=n, of_node_put() is a dummy, and gcc may
+optimize away the loop over card->dai_link, never actually dereferencing
+card, and thus avoiding the crash...
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: e512e001dafa54e5 ("ASoC: simple-card: Fix the reference count of device nodes")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/generic/simple-card.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -453,9 +453,8 @@ static int asoc_simple_card_parse_of(str
+ }
+
+ /* Decrease the reference count of the device nodes */
+-static int asoc_simple_card_unref(struct platform_device *pdev)
++static int asoc_simple_card_unref(struct snd_soc_card *card)
+ {
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+ struct snd_soc_dai_link *dai_link;
+ struct device_node *np;
+ int num_links;
+@@ -562,7 +561,7 @@ static int asoc_simple_card_probe(struct
+ return ret;
+
+ err:
+- asoc_simple_card_unref(pdev);
++ asoc_simple_card_unref(&priv->snd_card);
+ return ret;
+ }
+
+@@ -578,7 +577,7 @@ static int asoc_simple_card_remove(struc
+ snd_soc_jack_free_gpios(&simple_card_mic_jack, 1,
+ &simple_card_mic_jack_gpio);
+
+- return asoc_simple_card_unref(pdev);
++ return asoc_simple_card_unref(card);
+ }
+
+ static const struct of_device_id asoc_simple_of_match[] = {
--- /dev/null
+From d3268a40d4b19ff7bee23f52eabbc4e96bb685e8 Mon Sep 17 00:00:00 2001
+From: Qais Yousef <qais.yousef@imgtec.com>
+Date: Wed, 14 Jan 2015 08:47:29 +0000
+Subject: ASoC: soc-compress.c: fix NULL dereference
+
+From: Qais Yousef <qais.yousef@imgtec.com>
+
+commit d3268a40d4b19ff7bee23f52eabbc4e96bb685e8 upstream.
+
+In soc_new_compress() when rtd->dai_link->dynamic is set, we create the pcm
+substreams with this call:
+
+ ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
+ 1, 0, &be_pcm);
+
+which passes 0 as capture_count leading to
+
+ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream
+
+being NULL, hence when trying to set rtd a few lines below we get an oops.
+
+Fix by using rtd->dai_link->dpcm_playback and rtd->dai_link->dpcm_capture as
+playback_count and capture_count to snd_pcm_new_internal().
+
+Signed-off-by: Qais Yousef <qais.yousef@imgtec.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-compress.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -666,7 +666,8 @@ int soc_new_compress(struct snd_soc_pcm_
+ rtd->dai_link->stream_name);
+
+ ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
+- 1, 0, &be_pcm);
++ rtd->dai_link->dpcm_playback,
++ rtd->dai_link->dpcm_capture, &be_pcm);
+ if (ret < 0) {
+ dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n",
+ rtd->dai_link->name);
+@@ -675,8 +676,10 @@ int soc_new_compress(struct snd_soc_pcm_
+
+ rtd->pcm = be_pcm;
+ rtd->fe_compr = 1;
+- be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+- be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
++ if (rtd->dai_link->dpcm_playback)
++ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
++ else if (rtd->dai_link->dpcm_capture)
++ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+ memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
+ } else
+ memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops));
--- /dev/null
+From 22ee76daddb87f88d2336d1b4737ef27c4f307ac Mon Sep 17 00:00:00 2001
+From: Zidan Wang <b50113@freescale.com>
+Date: Wed, 31 Dec 2014 11:39:14 +0800
+Subject: ASoC: wm8960: Fix capture sample rate from 11250 to 11025
+
+From: Zidan Wang <b50113@freescale.com>
+
+commit 22ee76daddb87f88d2336d1b4737ef27c4f307ac upstream.
+
+wm8960 codec can't support sample rate 11250, it must be 11025.
+
+Signed-off-by: Zidan Wang <b50113@freescale.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -555,7 +555,7 @@ static struct {
+ { 22050, 2 },
+ { 24000, 2 },
+ { 16000, 3 },
+- { 11250, 4 },
++ { 11025, 4 },
+ { 12000, 4 },
+ { 8000, 5 },
+ };
--- /dev/null
+From ded5006667318c06df875609535176bd33f243a1 Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 26 Jan 2015 07:20:39 +0200
+Subject: can: kvaser_usb: Do not sleep in atomic context
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit ded5006667318c06df875609535176bd33f243a1 upstream.
+
+Upon receiving a hardware event with the BUS_RESET flag set,
+the driver kills all of its anchored URBs and resets all of
+its transmit URB contexts.
+
+Unfortunately it does so under the context of URB completion
+handler `kvaser_usb_read_bulk_callback()', which is often
+called in an atomic context.
+
+While the device is flooded with many received error packets,
+usb_kill_urb() typically sleeps/reschedules till the transfer
+request of each killed URB in question completes, leading to
+the sleep in atomic bug. [3]
+
+In v2 submission of the original driver patch [1], it was
+stated that the URBs kill and tx contexts reset was needed
+since we don't receive any tx acknowledgments later and thus
+such resources will be locked down forever. Fortunately this
+is no longer needed since an earlier bugfix in this patch
+series is now applied: all tx URB contexts are reset upon CAN
+channel close. [2]
+
+Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF
+event, which is the recommended handling method advised by
+the device manufacturer.
+
+[1] http://article.gmane.org/gmane.linux.network/239442
+ http://www.webcitation.org/6Vr2yagAQ
+
+[2] can: kvaser_usb: Reset all URB tx contexts upon channel close
+ 889b77f7fd2bcc922493d73a4c51d8a851505815
+
+[3] Stacktrace:
+
+ <IRQ> [<ffffffff8158de87>] dump_stack+0x45/0x57
+ [<ffffffff8158b60c>] __schedule_bug+0x41/0x4f
+ [<ffffffff815904b1>] __schedule+0x5f1/0x700
+ [<ffffffff8159360a>] ? _raw_spin_unlock_irqrestore+0xa/0x10
+ [<ffffffff81590684>] schedule+0x24/0x70
+ [<ffffffff8147d0a5>] usb_kill_urb+0x65/0xa0
+ [<ffffffff81077970>] ? prepare_to_wait_event+0x110/0x110
+ [<ffffffff8147d7d8>] usb_kill_anchored_urbs+0x48/0x80
+ [<ffffffffa01f4028>] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb]
+ [<ffffffffa01f45d0>] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb]
+ [<ffffffff8108b14a>] ? vprintk_default+0x1a/0x20
+ [<ffffffffa01f5241>] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb]
+ [<ffffffff8147a73e>] __usb_hcd_giveback_urb+0x5e/0xc0
+ [<ffffffff8147a8a1>] usb_hcd_giveback_urb+0x41/0x110
+ [<ffffffffa0008748>] finish_urb+0x98/0x180 [ohci_hcd]
+ [<ffffffff810cd1a7>] ? acct_account_cputime+0x17/0x20
+ [<ffffffff81069f65>] ? local_clock+0x15/0x30
+ [<ffffffffa000a36b>] ohci_work+0x1fb/0x5a0 [ohci_hcd]
+ [<ffffffff814fbb31>] ? process_backlog+0xb1/0x130
+ [<ffffffffa000cd5b>] ohci_irq+0xeb/0x270 [ohci_hcd]
+ [<ffffffff81479fc1>] usb_hcd_irq+0x21/0x30
+ [<ffffffff8108bfd3>] handle_irq_event_percpu+0x43/0x120
+ [<ffffffff8108c0ed>] handle_irq_event+0x3d/0x60
+ [<ffffffff8108ec84>] handle_fasteoi_irq+0x74/0x110
+ [<ffffffff81004dfd>] handle_irq+0x1d/0x30
+ [<ffffffff81004727>] do_IRQ+0x57/0x100
+ [<ffffffff8159482a>] common_interrupt+0x6a/0x6a
+
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const st
+ priv = dev->nets[channel];
+ stats = &priv->netdev->stats;
+
+- if (status & M16C_STATE_BUS_RESET) {
+- kvaser_usb_unlink_tx_urbs(priv);
+- return;
+- }
+-
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+ if (!skb) {
+ stats->rx_dropped++;
+@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const st
+
+ netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
+
+- if (status & M16C_STATE_BUS_OFF) {
++ if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
+ cf->can_id |= CAN_ERR_BUSOFF;
+
+ priv->can.can_stats.bus_off++;
--- /dev/null
+From e638642b08c170d2021b706f0b1c4f4ae93d8cbd Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 26 Jan 2015 07:25:43 +0200
+Subject: can: kvaser_usb: Fix state handling upon BUS_ERROR events
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit e638642b08c170d2021b706f0b1c4f4ae93d8cbd upstream.
+
+While being in an ERROR_WARNING state, and receiving further
+bus error events with error counters still in the ERROR_WARNING
+range of 97-127 inclusive, the state handling code erroneously
+reverts back to ERROR_ACTIVE.
+
+Per the CAN standard, only revert to ERROR_ACTIVE when the
+error counters are less than 96.
+
+Moreover, in certain Kvaser models, the BUS_ERROR flag is
+always set along with undefined bits in the M16C status
+register. Thus use bitwise operators instead of full equality
+for checking that register against bus errors.
+
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -698,9 +698,7 @@ static void kvaser_usb_rx_error(const st
+ }
+
+ new_state = CAN_STATE_ERROR_PASSIVE;
+- }
+-
+- if (status == M16C_STATE_BUS_ERROR) {
++ } else if (status & M16C_STATE_BUS_ERROR) {
+ if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
+ ((txerr >= 96) || (rxerr >= 96))) {
+ cf->can_id |= CAN_ERR_CRTL;
+@@ -710,7 +708,8 @@ static void kvaser_usb_rx_error(const st
+
+ priv->can.can_stats.error_warning++;
+ new_state = CAN_STATE_ERROR_WARNING;
+- } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
++ } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
++ ((txerr < 96) && (rxerr < 96))) {
+ cf->can_id |= CAN_ERR_PROT;
+ cf->data[2] = CAN_ERR_PROT_ACTIVE;
+
--- /dev/null
+From 14c10c2a1dd8eb8e00b750b521753260befa2789 Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 26 Jan 2015 07:24:06 +0200
+Subject: can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit 14c10c2a1dd8eb8e00b750b521753260befa2789 upstream.
+
+On some x86 laptops, plugging a Kvaser device again after an
+unplug makes the firmware always ignore the very first command.
+For such a case, provide some room for retries instead of
+completely exiting the driver init code.
+
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1588,7 +1588,7 @@ static int kvaser_usb_probe(struct usb_i
+ {
+ struct kvaser_usb *dev;
+ int err = -ENOMEM;
+- int i;
++ int i, retry = 3;
+
+ dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
+ if (!dev)
+@@ -1606,7 +1606,15 @@ static int kvaser_usb_probe(struct usb_i
+
+ usb_set_intfdata(intf, dev);
+
+- err = kvaser_usb_get_software_info(dev);
++ /* On some x86 laptops, plugging a Kvaser device again after
++ * an unplug makes the firmware always ignore the very first
++ * command. For such a case, provide some room for retries
++ * instead of completely exiting the driver.
++ */
++ do {
++ err = kvaser_usb_get_software_info(dev);
++ } while (--retry && err == -ETIMEDOUT);
++
+ if (err) {
+ dev_err(&intf->dev,
+ "Cannot get software infos, error %d\n", err);
--- /dev/null
+From 3803fa6977f1de15fda4e8646c8fec97c8045cae Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 26 Jan 2015 07:22:54 +0200
+Subject: can: kvaser_usb: Send correct context to URB completion
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit 3803fa6977f1de15fda4e8646c8fec97c8045cae upstream.
+
+Send expected argument to the URB completion hander: a CAN
+netdevice instead of the network interface private context
+`kvaser_usb_net_priv'.
+
+This was discovered by having some garbage in the kernel
+log in place of the netdevice names: can0 and can1.
+
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(s
+ usb_sndbulkpipe(dev->udev,
+ dev->bulk_out->bEndpointAddress),
+ buf, msg->len,
+- kvaser_usb_simple_msg_callback, priv);
++ kvaser_usb_simple_msg_callback, netdev);
+ usb_anchor_urb(urb, &priv->tx_submitted);
+
+ err = usb_submit_urb(urb, GFP_ATOMIC);
--- /dev/null
+From 34e81ad5f0b60007c95995eb7803da7e00c6c611 Mon Sep 17 00:00:00 2001
+From: Paul Osmialowski <p.osmialowsk@samsung.com>
+Date: Mon, 19 Jan 2015 17:03:33 +0100
+Subject: i2c: s3c2410: fix ABBA deadlock by keeping clock prepared
+
+From: Paul Osmialowski <p.osmialowsk@samsung.com>
+
+commit 34e81ad5f0b60007c95995eb7803da7e00c6c611 upstream.
+
+This patch solves deadlock between clock prepare mutex and regmap mutex reported
+by Tomasz Figa in [1] by implementing solution from [2]: "always leave the clock
+of the i2c controller in a prepared state".
+
+[1] https://lkml.org/lkml/2014/7/2/171
+[2] https://lkml.org/lkml/2014/7/2/207
+
+On each i2c transfer handled by s3c24xx_i2c_xfer(), clk_prepare_enable() was
+called, which calls clk_prepare() then clk_enable(). clk_prepare() takes
+prepare_lock mutex before proceeding. Note that i2c transfer functions are
+invoked from many places in kernel, typically with some other additional lock
+held.
+
+It may happen that function on CPU1 (e.g. regmap_update_bits()) has taken a
+mutex (i.e. regmap lock mutex) then it attempts i2c communication in order to
+proceed (so it needs to obtain clock related prepare_lock mutex during transfer
+preparation stage due to clk_prepare() call). At the same time other task on
+CPU0 wants to operate on clock (e.g. to (un)prepare clock for some other reason)
+so it has taken prepare_lock mutex.
+
+CPU0: CPU1:
+clk_disable_unused() regulator_disable()
+ clk_prepare_lock() map->lock(map->lock_arg)
+ regmap_read() s3c24xx_i2c_xfer()
+ map->lock(map->lock_arg) clk_prepare_lock()
+
+Implemented solution from [2] leaves i2c clock prepared. Preparation is done in
+s3c24xx_i2c_probe() function. Without this patch, it is immediately unprepared
+by clk_disable_unprepare() call. I've replaced this call with clk_disable() and
+I've added clk_unprepare() call in s3c24xx_i2c_remove().
+
+The s3c24xx_i2c_xfer() function now uses clk_enable() instead of
+clk_prepare_enable() (and clk_disable() instead of clk_unprepare_disable()).
+
+Signed-off-by: Paul Osmialowski <p.osmialowsk@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-s3c2410.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -778,14 +778,16 @@ static int s3c24xx_i2c_xfer(struct i2c_a
+ int ret;
+
+ pm_runtime_get_sync(&adap->dev);
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ for (retry = 0; retry < adap->retries; retry++) {
+
+ ret = s3c24xx_i2c_doxfer(i2c, msgs, num);
+
+ if (ret != -EAGAIN) {
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ pm_runtime_put(&adap->dev);
+ return ret;
+ }
+@@ -795,7 +797,7 @@ static int s3c24xx_i2c_xfer(struct i2c_a
+ udelay(100);
+ }
+
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ pm_runtime_put(&adap->dev);
+ return -EREMOTEIO;
+ }
+@@ -1174,7 +1176,7 @@ static int s3c24xx_i2c_probe(struct plat
+
+ clk_prepare_enable(i2c->clk);
+ ret = s3c24xx_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "I2C controller init failed\n");
+ return ret;
+@@ -1187,6 +1189,7 @@ static int s3c24xx_i2c_probe(struct plat
+ i2c->irq = ret = platform_get_irq(pdev, 0);
+ if (ret <= 0) {
+ dev_err(&pdev->dev, "cannot find IRQ\n");
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1195,6 +1198,7 @@ static int s3c24xx_i2c_probe(struct plat
+
+ if (ret != 0) {
+ dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+ }
+@@ -1202,6 +1206,7 @@ static int s3c24xx_i2c_probe(struct plat
+ ret = s3c24xx_i2c_register_cpufreq(i2c);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register cpufreq notifier\n");
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1218,6 +1223,7 @@ static int s3c24xx_i2c_probe(struct plat
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add bus to i2c core\n");
+ s3c24xx_i2c_deregister_cpufreq(i2c);
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1239,6 +1245,8 @@ static int s3c24xx_i2c_remove(struct pla
+ {
+ struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+
++ clk_unprepare(i2c->clk);
++
+ pm_runtime_disable(&i2c->adap.dev);
+ pm_runtime_disable(&pdev->dev);
+
+@@ -1267,10 +1275,13 @@ static int s3c24xx_i2c_resume_noirq(stru
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
++ int ret;
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+ s3c24xx_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ i2c->suspended = 0;
+
+ return 0;
--- /dev/null
+From e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 Mon Sep 17 00:00:00 2001
+From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+Date: Thu, 15 Jan 2015 18:23:47 +0100
+Subject: powerpc/xmon: Fix another endiannes issue in RTAS call from xmon
+
+From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+
+commit e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 upstream.
+
+The commit 3b8a3c010969 ("powerpc/pseries: Fix endiannes issue in RTAS
+call from xmon") was fixing an endianness issue in the call made from
+xmon to RTAS.
+
+However, as Michael Ellerman noticed, this fix was not complete, the
+token value was not byte swapped. This lead to call an unexpected and
+most of the time unexisting RTAS function, which is silently ignored by
+RTAS.
+
+This fix addresses this hole.
+
+Reported-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/xmon/xmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -293,6 +293,7 @@ static inline void disable_surveillance(
+ args.token = rtas_token("set-indicator");
+ if (args.token == RTAS_UNKNOWN_SERVICE)
+ return;
++ args.token = cpu_to_be32(args.token);
+ args.nargs = cpu_to_be32(3);
+ args.nret = cpu_to_be32(1);
+ args.rets = &args.args[3];
--- /dev/null
+From e69b8d414f948c242ad9f3eb2b7e24fba783dbbd Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@redhat.com>
+Date: Mon, 19 Jan 2015 12:06:14 +0300
+Subject: rbd: drop parent_ref in rbd_dev_unprobe() unconditionally
+
+From: Ilya Dryomov <idryomov@redhat.com>
+
+commit e69b8d414f948c242ad9f3eb2b7e24fba783dbbd upstream.
+
+This effectively reverts the last hunk of 392a9dad7e77 ("rbd: detect
+when clone image is flattened").
+
+The problem with parent_overlap != 0 condition is that it's possible
+and completely valid to have an image with parent_overlap == 0 whose
+parent state needs to be cleaned up on unmap. The next commit, which
+drops the "clone image now standalone" logic, opens up another window
+of opportunity to hit this, but even without it
+
+ # cat parent-ref.sh
+ #!/bin/bash
+ rbd create --image-format 2 --size 1 foo
+ rbd snap create foo@snap
+ rbd snap protect foo@snap
+ rbd clone foo@snap bar
+ rbd resize --allow-shrink --size 0 bar
+ rbd resize --size 1 bar
+ DEV=$(rbd map bar)
+ rbd unmap $DEV
+
+leaves rbd_device/rbd_spec/etc and rbd_client along with ceph_client
+hanging around.
+
+My thinking behind calling rbd_dev_parent_put() unconditionally is that
+there shouldn't be any requests in flight at that point in time as we
+are deep into unmap sequence. Hence, even if rbd_dev_unparent() caused
+by flatten is delayed by in-flight requests, it will have finished by
+the time we reach rbd_dev_unprobe() caused by unmap, thus turning
+unconditional rbd_dev_parent_put() into a no-op.
+
+Fixes: http://tracker.ceph.com/issues/10352
+
+Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
+Reviewed-by: Josh Durgin <jdurgin@redhat.com>
+Reviewed-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -5111,10 +5111,7 @@ static void rbd_dev_unprobe(struct rbd_d
+ {
+ struct rbd_image_header *header;
+
+- /* Drop parent reference unless it's already been done (or none) */
+-
+- if (rbd_dev->parent_overlap)
+- rbd_dev_parent_put(rbd_dev);
++ rbd_dev_parent_put(rbd_dev);
+
+ /* Free dynamic fields from the header, then zero it out */
+
--- /dev/null
+From ae43e9d05eb4bd324155292f889fbd001c4faea8 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@redhat.com>
+Date: Mon, 19 Jan 2015 18:13:43 +0300
+Subject: rbd: fix rbd_dev_parent_get() when parent_overlap == 0
+
+From: Ilya Dryomov <idryomov@redhat.com>
+
+commit ae43e9d05eb4bd324155292f889fbd001c4faea8 upstream.
+
+The comment for rbd_dev_parent_get() said
+
+ * We must get the reference before checking for the overlap to
+ * coordinate properly with zeroing the parent overlap in
+ * rbd_dev_v2_parent_info() when an image gets flattened. We
+ * drop it again if there is no overlap.
+
+but the "drop it again if there is no overlap" part was missing from
+the implementation. This lead to absurd parent_ref values for images
+with parent_overlap == 0, as parent_ref was incremented for each
+img_request and virtually never decremented.
+
+Fix this by leveraging the fact that refresh path calls
+rbd_dev_v2_parent_info() under header_rwsem and use it for read in
+rbd_dev_parent_get(), instead of messing around with atomics. Get rid
+of barriers in rbd_dev_v2_parent_info() while at it - I don't see what
+they'd pair with now and I suspect we are in a pretty miserable
+situation as far as proper locking goes regardless.
+
+Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
+Reviewed-by: Josh Durgin <jdurgin@redhat.com>
+Reviewed-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2098,32 +2098,26 @@ static void rbd_dev_parent_put(struct rb
+ * If an image has a non-zero parent overlap, get a reference to its
+ * parent.
+ *
+- * We must get the reference before checking for the overlap to
+- * coordinate properly with zeroing the parent overlap in
+- * rbd_dev_v2_parent_info() when an image gets flattened. We
+- * drop it again if there is no overlap.
+- *
+ * Returns true if the rbd device has a parent with a non-zero
+ * overlap and a reference for it was successfully taken, or
+ * false otherwise.
+ */
+ static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
+ {
+- int counter;
++ int counter = 0;
+
+ if (!rbd_dev->parent_spec)
+ return false;
+
+- counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+- if (counter > 0 && rbd_dev->parent_overlap)
+- return true;
+-
+- /* Image was flattened, but parent is not yet torn down */
++ down_read(&rbd_dev->header_rwsem);
++ if (rbd_dev->parent_overlap)
++ counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
++ up_read(&rbd_dev->header_rwsem);
+
+ if (counter < 0)
+ rbd_warn(rbd_dev, "parent reference overflow");
+
+- return false;
++ return counter > 0;
+ }
+
+ /*
+@@ -4236,7 +4230,6 @@ static int rbd_dev_v2_parent_info(struct
+ */
+ if (rbd_dev->parent_overlap) {
+ rbd_dev->parent_overlap = 0;
+- smp_mb();
+ rbd_dev_parent_put(rbd_dev);
+ pr_info("%s: clone image has been flattened\n",
+ rbd_dev->disk->disk_name);
+@@ -4282,7 +4275,6 @@ static int rbd_dev_v2_parent_info(struct
+ * treat it specially.
+ */
+ rbd_dev->parent_overlap = overlap;
+- smp_mb();
+ if (!overlap) {
+
+ /* A null parent_spec indicates it's the initial probe */
spi-dw-mid-fix-fifo-size.patch
vm-add-vm_fault_sigsegv-handling-support.patch
arc-mm-fix-build-failure.patch
+vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch
+asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch
+asoc-pcm512x-fix-dsp-program-selection.patch
+asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch
+asoc-soc-compress.c-fix-null-dereference.patch
+asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch
+asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch
+udf-release-preallocation-on-last-writeable-close.patch
+can-kvaser_usb-do-not-sleep-in-atomic-context.patch
+can-kvaser_usb-send-correct-context-to-urb-completion.patch
+can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch
+can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch
+powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch
+alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch
+rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch
+rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch
+usb-add-otg-pet-device-to-tpl.patch
+usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch
+uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch
+i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch
--- /dev/null
+From 8a870880bd6f17b7ccef69a6432ab8df8775fcf6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 12 Jan 2015 13:34:33 +0100
+Subject: uas: Add no-report-opcodes quirk for Simpletech devices with id 4971:8017
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 8a870880bd6f17b7ccef69a6432ab8df8775fcf6 upstream.
+
+Like some other uas devices these devices hang when a report-opcodes scsi
+command is send to them.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1124119
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_uas.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -138,3 +138,10 @@ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x99
+ "External HDD",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_UAS),
++
++/* Reported-by: Richard Henderson <rth@redhat.com> */
++UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999,
++ "SimpleTech",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
--- /dev/null
+From b07ef35244424cbeda9844198607c7077099c82c Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 28 Jan 2015 08:38:20 +0100
+Subject: udf: Release preallocation on last writeable close
+
+From: Jan Kara <jack@suse.cz>
+
+commit b07ef35244424cbeda9844198607c7077099c82c upstream.
+
+Commit 6fb1ca92a640 "udf: Fix race between write(2) and close(2)"
+changed the condition when preallocation is released. The idea was that
+we don't want to release the preallocation for an inode on close when
+there are other writeable file descriptors for the inode. However the
+condition was written in the opposite way so we released preallocation
+only if there were other writeable file descriptors. Fix the problem by
+changing the condition properly.
+
+Fixes: 6fb1ca92a6409a9d5b0696447cd4997bc9aaf5a2
+Reported-by: Fabian Frederick <fabf@skynet.be>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/udf/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -224,7 +224,7 @@ out:
+ static int udf_release_file(struct inode *inode, struct file *filp)
+ {
+ if (filp->f_mode & FMODE_WRITE &&
+- atomic_read(&inode->i_writecount) > 1) {
++ atomic_read(&inode->i_writecount) == 1) {
+ /*
+ * Grab i_mutex to avoid races with writes changing i_size
+ * while we are running.
--- /dev/null
+From e5dff0e80463cc3fa236e898ef1491b40be70b19 Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul@gmail.com>
+Date: Fri, 23 Jan 2015 14:39:02 +0800
+Subject: USB: Add OTG PET device to TPL
+
+From: Macpaul Lin <macpaul@gmail.com>
+
+commit e5dff0e80463cc3fa236e898ef1491b40be70b19 upstream.
+
+OTG device shall support this device for allowing compliance automated testing.
+The modification is derived from Pavankumar and Vijayavardhans' previous work.
+
+Signed-off-by: Macpaul Lin <macpaul@gmail.com>
+Cc: Pavankumar Kondeti <pkondeti@codeaurora.org>
+Cc: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/otg_whitelist.h | 5 +++++
+ drivers/usb/core/quirks.c | 4 ++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/usb/core/otg_whitelist.h
++++ b/drivers/usb/core/otg_whitelist.h
+@@ -55,6 +55,11 @@ static int is_targeted(struct usb_device
+ le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
+ return 0;
+
++ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
++ le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
++ return 1;
++
+ /* NOTE: can't use usb_match_id() since interface caches
+ * aren't set up yet. this is cut/paste from that code.
+ */
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -179,6 +179,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Protocol and OTG Electrical Test Device */
++ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
++
+ { } /* terminating entry must be last */
+ };
+
--- /dev/null
+From bf5c4136fa5ce471bdbf4cf59a813e32755fd014 Mon Sep 17 00:00:00 2001
+From: Dmitry Nezhevenko <dion@dion.org.ua>
+Date: Mon, 12 Jan 2015 19:13:01 +0200
+Subject: usb-storage/SCSI: blacklist FUA on JMicron 152d:2566 USB-SATA controller
+
+From: Dmitry Nezhevenko <dion@dion.org.ua>
+
+commit bf5c4136fa5ce471bdbf4cf59a813e32755fd014 upstream.
+
+It looks like FUA support is broken on JMicron 152d:2566 bridge:
+
+[223159.885704] sd 7:0:0:0: [sdc] Write Protect is off
+[223159.885706] sd 7:0:0:0: [sdc] Mode Sense: 47 00 10 08
+[223159.885942] sd 7:0:0:0: [sdc] Write cache: enabled, read cache: enabled, supports DPO and FUA
+
+[223283.691677] sd 7:0:0:0: [sdc]
+[223283.691680] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+[223283.691681] sd 7:0:0:0: [sdc]
+[223283.691682] Sense Key : Illegal Request [current]
+[223283.691684] sd 7:0:0:0: [sdc]
+[223283.691685] Add. Sense: Invalid field in cdb
+[223283.691686] sd 7:0:0:0: [sdc] CDB:
+[223283.691687] Write(10): 2a 08 15 d0 83 0d 00 00 01 00
+[223283.691690] blk_update_request: critical target error, dev sdc, sector 2927892584
+
+This patch adds blacklist flag so that sd will not use FUA
+
+Signed-off-by: Dmitry Nezhevenko <dion@dion.org.ua>
+Cc: Phil Dibowitz <phil@ipom.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1995,6 +1995,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
++/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
++UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BROKEN_FUA ),
++
+ /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
+ * and Mac USB Dock USB-SCSI */
+ UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
--- /dev/null
+From 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 29 Jan 2015 11:15:17 -0800
+Subject: vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than SIGBUS
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba upstream.
+
+The stack guard page error case has long incorrectly caused a SIGBUS
+rather than a SIGSEGV, but nobody actually noticed until commit
+fee7e49d4514 ("mm: propagate error from stack expansion even for guard
+page") because that error case was never actually triggered in any
+normal situations.
+
+Now that we actually report the error, people noticed the wrong signal
+that resulted. So far, only the test suite of libsigsegv seems to have
+actually cared, but there are real applications that use libsigsegv, so
+let's not wait for any of those to break.
+
+Reported-and-tested-by: Takashi Iwai <tiwai@suse.de>
+Tested-by: Jan Engelhardt <jengelh@inai.de>
+Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # "s390 still compiles and boots"
+Cc: linux-arch@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2645,7 +2645,7 @@ static int do_anonymous_page(struct mm_s
+
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+- return VM_FAULT_SIGBUS;
++ return VM_FAULT_SIGSEGV;
+
+ /* Use the zero-page for reads */
+ if (!(flags & FAULT_FLAG_WRITE)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
