--- /dev/null
+From 3b283f0893f55cb79e4507e5ec34e49c17d0a787 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 22 Oct 2014 10:51:18 +0200
+Subject: ASoC: adau1761: Fix input PGA volume
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 3b283f0893f55cb79e4507e5ec34e49c17d0a787 upstream.
+
+For the input PGA to work correctly the ALC clock needs to be active.
+Otherwise volume changes are not applied.
+
+Fixes: dab464b60b2 ("ASoC: Add ADAU1361/ADAU1761 audio CODEC support")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/adau1761.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/soc/codecs/adau1761.c
++++ b/sound/soc/codecs/adau1761.c
+@@ -405,6 +405,7 @@ static const struct snd_soc_dapm_widget
+ 2, 0, NULL, 0),
+
+ SND_SOC_DAPM_SUPPLY("Slew Clock", ADAU1761_CLK_ENABLE0, 6, 0, NULL, 0),
++ SND_SOC_DAPM_SUPPLY("ALC Clock", ADAU1761_CLK_ENABLE0, 5, 0, NULL, 0),
+
+ SND_SOC_DAPM_SUPPLY_S("Digital Clock 0", 1, ADAU1761_CLK_ENABLE1,
+ 0, 0, NULL, 0),
+@@ -436,6 +437,9 @@ static const struct snd_soc_dapm_route a
+ { "Right Playback Mixer", NULL, "Slew Clock" },
+ { "Left Playback Mixer", NULL, "Slew Clock" },
+
++ { "Left Input Mixer", NULL, "ALC Clock" },
++ { "Right Input Mixer", NULL, "ALC Clock" },
++
+ { "Digital Clock 0", NULL, "SYSCLK" },
+ { "Digital Clock 1", NULL, "SYSCLK" },
+ };
--- /dev/null
+From decc27b01d584c985c231e73d3b493de6ec07af8 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Tue, 7 Oct 2014 13:41:23 +0200
+Subject: ASoC: core: fix use after free in snd_soc_remove_platform()
+
+From: Daniel Mack <daniel@zonque.org>
+
+commit decc27b01d584c985c231e73d3b493de6ec07af8 upstream.
+
+Coverity spotted an use-after-free condition in snd_soc_remove_platform().
+Fix this by moving snd_soc_component_cleanup() after the debug print
+statement which uses the component's string.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -4315,10 +4315,10 @@ void snd_soc_remove_platform(struct snd_
+ snd_soc_component_del_unlocked(&platform->component);
+ mutex_unlock(&client_mutex);
+
+- snd_soc_component_cleanup(&platform->component);
+-
+ dev_dbg(platform->dev, "ASoC: Unregistered platform '%s'\n",
+ platform->component.name);
++
++ snd_soc_component_cleanup(&platform->component);
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_remove_platform);
+
--- /dev/null
+From 2ccf3bd4f8b120936cdfc796baf40c5d3dfab68d Mon Sep 17 00:00:00 2001
+From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Date: Thu, 16 Oct 2014 15:29:14 +0100
+Subject: ASoC: Intel: HSW/BDW only support S16 and S24 formats.
+
+From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+
+commit 2ccf3bd4f8b120936cdfc796baf40c5d3dfab68d upstream.
+
+Fix driver with correct formats.
+
+Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/sst-haswell-pcm.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/sound/soc/intel/sst-haswell-pcm.c
++++ b/sound/soc/intel/sst-haswell-pcm.c
+@@ -693,9 +693,7 @@ static int hsw_pcm_new(struct snd_soc_pc
+ }
+
+ #define HSW_FORMATS \
+- (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \
+- SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S8)
++ (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE)
+
+ static struct snd_soc_dai_driver hsw_dais[] = {
+ {
--- /dev/null
+From e5092c96c9c28f4d12811edcd02ca8eec16e748e Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Tue, 7 Oct 2014 13:41:24 +0200
+Subject: ASoC: soc-dapm: fix use after free
+
+From: Daniel Mack <daniel@zonque.org>
+
+commit e5092c96c9c28f4d12811edcd02ca8eec16e748e upstream.
+
+Coverity spotted the following possible use-after-free condition in
+dapm_create_or_share_mixmux_kcontrol():
+
+If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name)
+validates to true, 'name' will be set to an allocated string, and be
+freed a few lines later via the 'long_name' alias. 'name', however,
+is used by dev_err() in case snd_ctl_add() fails.
+
+Fix this by adding a jump label that frees 'long_name' at the end of
+the function.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -591,9 +591,9 @@ static int dapm_create_or_share_mixmux_k
+ int shared;
+ struct snd_kcontrol *kcontrol;
+ bool wname_in_long_name, kcname_in_long_name;
+- char *long_name;
++ char *long_name = NULL;
+ const char *name;
+- int ret;
++ int ret = 0;
+
+ prefix = soc_dapm_prefix(dapm);
+ if (prefix)
+@@ -652,15 +652,17 @@ static int dapm_create_or_share_mixmux_k
+
+ kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name,
+ prefix);
+- kfree(long_name);
+- if (!kcontrol)
+- return -ENOMEM;
++ if (!kcontrol) {
++ ret = -ENOMEM;
++ goto exit_free;
++ }
++
+ kcontrol->private_free = dapm_kcontrol_free;
+
+ ret = dapm_kcontrol_data_alloc(w, kcontrol);
+ if (ret) {
+ snd_ctl_free_one(kcontrol);
+- return ret;
++ goto exit_free;
+ }
+
+ ret = snd_ctl_add(card, kcontrol);
+@@ -668,17 +670,18 @@ static int dapm_create_or_share_mixmux_k
+ dev_err(dapm->dev,
+ "ASoC: failed to add widget %s dapm kcontrol %s: %d\n",
+ w->name, name, ret);
+- return ret;
++ goto exit_free;
+ }
+ }
+
+ ret = dapm_kcontrol_add_widget(kcontrol, w);
+- if (ret)
+- return ret;
++ if (ret == 0)
++ w->kcontrols[kci] = kcontrol;
+
+- w->kcontrols[kci] = kcontrol;
++exit_free:
++ kfree(long_name);
+
+- return 0;
++ return ret;
+ }
+
+ /* create new dapm mixer control */
--- /dev/null
+From 5e63dfccf34d4dbf21429c4919f33c028ff49991 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Tue, 7 Oct 2014 14:33:46 +0200
+Subject: ASoC: soc-pcm: fix sig_bits determination in soc_pcm_apply_msb()
+
+From: Daniel Mack <daniel@zonque.org>
+
+commit 5e63dfccf34d4dbf21429c4919f33c028ff49991 upstream.
+
+In the SNDRV_PCM_STREAM_CAPTURE branch in soc_pcm_apply_msb(), look at
+sig_bits of the capture stream, not the playback one.
+
+Spotted by coverity.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -352,7 +352,7 @@ static void soc_pcm_apply_msb(struct snd
+ } else {
+ for (i = 0; i < rtd->num_codecs; i++) {
+ codec_dai = rtd->codec_dais[i];
+- if (codec_dai->driver->playback.sig_bits == 0) {
++ if (codec_dai->driver->capture.sig_bits == 0) {
+ bits = 0;
+ break;
+ }
--- /dev/null
+From 31d9f8faf9a54c851e835af489c82f45105a442f Mon Sep 17 00:00:00 2001
+From: Dmitry Lavnikevich <d.lavnikevich@sam-solutions.com>
+Date: Fri, 3 Oct 2014 16:18:56 +0300
+Subject: ASoC: tlv320aic3x: fix PLL D configuration
+
+From: Dmitry Lavnikevich <d.lavnikevich@sam-solutions.com>
+
+commit 31d9f8faf9a54c851e835af489c82f45105a442f upstream.
+
+Current caching implementation during regcache_sync() call bypasses
+all register writes of values that are already known as default
+(regmap reg_defaults). Same time in TLV320AIC3x codecs register 5
+(AIC3X_PLL_PROGC_REG) write should be immediately followed by register
+6 write (AIC3X_PLL_PROGD_REG) even if it was not changed. Otherwise
+both registers will not be written.
+
+This brings to issue that appears particulary in case of 44.1kHz
+playback with 19.2MHz master clock. In this case AIC3X_PLL_PROGC_REG
+is 0x6e while AIC3X_PLL_PROGD_REG is 0x0 (same as register
+default). Thus AIC3X_PLL_PROGC_REG also remains not written and we get
+wrong playback speed.
+
+In this patch snd_soc_read() is used to get cached pll values and
+snd_soc_write() (unlike regcache_sync() this function doesn't bypasses
+hardware default values) to write them to registers.
+
+Signed-off-by: Dmitry Lavnikevich <d.lavnikevich@sam-solutions.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tlv320aic3x.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -1121,6 +1121,7 @@ static int aic3x_regulator_event(struct
+ static int aic3x_set_power(struct snd_soc_codec *codec, int power)
+ {
+ struct aic3x_priv *aic3x = snd_soc_codec_get_drvdata(codec);
++ unsigned int pll_c, pll_d;
+ int ret;
+
+ if (power) {
+@@ -1138,6 +1139,18 @@ static int aic3x_set_power(struct snd_so
+ /* Sync reg_cache with the hardware */
+ regcache_cache_only(aic3x->regmap, false);
+ regcache_sync(aic3x->regmap);
++
++ /* Rewrite paired PLL D registers in case cached sync skipped
++ * writing one of them and thus caused other one also not
++ * being written
++ */
++ pll_c = snd_soc_read(codec, AIC3X_PLL_PROGC_REG);
++ pll_d = snd_soc_read(codec, AIC3X_PLL_PROGD_REG);
++ if (pll_c == aic3x_reg[AIC3X_PLL_PROGC_REG].def ||
++ pll_d == aic3x_reg[AIC3X_PLL_PROGD_REG].def) {
++ snd_soc_write(codec, AIC3X_PLL_PROGC_REG, pll_c);
++ snd_soc_write(codec, AIC3X_PLL_PROGD_REG, pll_d);
++ }
+ } else {
+ /*
+ * Do soft reset to this codec instance in order to clear
--- /dev/null
+From 69a91c237ab0ebe4e9fdeaf6d0090c85275594ec Mon Sep 17 00:00:00 2001
+From: Eric Rannaud <e@nanocritical.com>
+Date: Thu, 30 Oct 2014 01:51:01 -0700
+Subject: fs: allow open(dir, O_TMPFILE|..., 0) with mode 0
+
+From: Eric Rannaud <e@nanocritical.com>
+
+commit 69a91c237ab0ebe4e9fdeaf6d0090c85275594ec upstream.
+
+The man page for open(2) indicates that when O_CREAT is specified, the
+'mode' argument applies only to future accesses to the file:
+
+ Note that this mode applies only to future accesses of the newly
+ created file; the open() call that creates a read-only file
+ may well return a read/write file descriptor.
+
+The man page for open(2) implies that 'mode' is treated identically by
+O_CREAT and O_TMPFILE.
+
+O_TMPFILE, however, behaves differently:
+
+ int fd = open("/tmp", O_TMPFILE | O_RDWR, 0);
+ assert(fd == -1);
+ assert(errno == EACCES);
+
+ int fd = open("/tmp", O_TMPFILE | O_RDWR, 0600);
+ assert(fd > 0);
+
+For O_CREAT, do_last() sets acc_mode to MAY_OPEN only:
+
+ if (*opened & FILE_CREATED) {
+ /* Don't check for write permission, don't truncate */
+ open_flag &= ~O_TRUNC;
+ will_truncate = false;
+ acc_mode = MAY_OPEN;
+ path_to_nameidata(path, nd);
+ goto finish_open_created;
+ }
+
+But for O_TMPFILE, do_tmpfile() passes the full op->acc_mode to
+may_open().
+
+This patch lines up the behavior of O_TMPFILE with O_CREAT. After the
+inode is created, may_open() is called with acc_mode = MAY_OPEN, in
+do_tmpfile().
+
+A different, but related glibc bug revealed the discrepancy:
+https://sourceware.org/bugzilla/show_bug.cgi?id=17523
+
+The glibc lazily loads the 'mode' argument of open() and openat() using
+va_arg() only if O_CREAT is present in 'flags' (to support both the 2
+argument and the 3 argument forms of open; same idea for openat()).
+However, the glibc ignores the 'mode' argument if O_TMPFILE is in
+'flags'.
+
+On x86_64, for open(), it magically works anyway, as 'mode' is in
+RDX when entering open(), and is still in RDX on SYSCALL, which is where
+the kernel looks for the 3rd argument of a syscall.
+
+But openat() is not quite so lucky: 'mode' is in RCX when entering the
+glibc wrapper for openat(), while the kernel looks for the 4th argument
+of a syscall in R10. Indeed, the syscall calling convention differs from
+the regular calling convention in this respect on x86_64. So the kernel
+sees mode = 0 when trying to use glibc openat() with O_TMPFILE, and
+fails with EACCES.
+
+Signed-off-by: Eric Rannaud <e@nanocritical.com>
+Acked-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namei.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3154,7 +3154,8 @@ static int do_tmpfile(int dfd, struct fi
+ if (error)
+ goto out2;
+ audit_inode(pathname, nd->path.dentry, 0);
+- error = may_open(&nd->path, op->acc_mode, op->open_flag);
++ /* Don't check for other permissions, the inode was just created */
++ error = may_open(&nd->path, MAY_OPEN, op->open_flag);
+ if (error)
+ goto out2;
+ file->f_path.mnt = nd->path.mnt;
--- /dev/null
+From 475d0db742e3755c6b267f48577ff7cbb7dfda0d Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sat, 17 May 2014 20:56:38 +0900
+Subject: fs: Fix theoretical division by 0 in super_cache_scan().
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream.
+
+total_objects could be 0 and is used as a denom.
+
+While total_objects is a "long", total_objects == 0 unlikely happens for
+3.12 and later kernels because 32-bit architectures would not be able to
+hold (1 << 32) objects. However, total_objects == 0 may happen for kernels
+between 3.1 and 3.11 because total_objects in prune_super() was an "int"
+and (e.g.) x86_64 architecture might be able to hold (1 << 32) objects.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -80,6 +80,8 @@ static unsigned long super_cache_scan(st
+ inodes = list_lru_count_node(&sb->s_inode_lru, sc->nid);
+ dentries = list_lru_count_node(&sb->s_dentry_lru, sc->nid);
+ total_objects = dentries + inodes + fs_objects + 1;
++ if (!total_objects)
++ total_objects = 1;
+
+ /* proportion the scan between the caches */
+ dentries = mult_frac(sc->nr_to_scan, dentries, total_objects);
--- /dev/null
+From c2ca0fcd202863b14bd041a7fece2e789926c225 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 27 Jul 2014 13:00:41 -0400
+Subject: fs: make cont_expand_zero interruptible
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream.
+
+This patch makes it possible to kill a process looping in
+cont_expand_zero. A process may spend a lot of time in this function, so
+it is desirable to be able to kill it.
+
+It happened to me that I wanted to copy a piece data from the disk to a
+file. By mistake, I used the "seek" parameter to dd instead of "skip". Due
+to the "seek" parameter, dd attempted to extend the file and became stuck
+doing so - the only possibility was to reset the machine or wait many
+hours until the filesystem runs out of space and cont_expand_zero fails.
+We need this patch to be able to terminate the process.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/buffer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2318,6 +2318,11 @@ static int cont_expand_zero(struct file
+ err = 0;
+
+ balance_dirty_pages_ratelimited(mapping);
++
++ if (unlikely(fatal_signal_pending(current))) {
++ err = -EINTR;
++ goto out;
++ }
+ }
+
+ /* page covers the boundary, find the boundary offset */
--- /dev/null
+From 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 Mon Sep 17 00:00:00 2001
+From: Ondrej Zary <linux@rainbow-software.org>
+Date: Sat, 27 Sep 2014 00:04:46 +0200
+Subject: libata-sff: Fix controllers with no ctl port
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 upstream.
+
+Currently, ata_sff_softreset is skipped for controllers with no ctl port.
+But that also skips ata_sff_dev_classify required for device detection.
+This means that libata is currently broken on controllers with no ctl port.
+
+No device connected:
+[ 1.872480] pata_isapnp 01:01.02: activated
+[ 1.889823] scsi2 : pata_isapnp
+[ 1.890109] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 6.888110] ata3.01: qc timeout (cmd 0xec)
+[ 6.888179] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 16.888085] ata3.01: qc timeout (cmd 0xec)
+[ 16.888147] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.888086] ata3.01: qc timeout (cmd 0xec)
+[ 46.888148] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 51.888100] ata3.00: qc timeout (cmd 0xec)
+[ 51.888160] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 61.888079] ata3.00: qc timeout (cmd 0xec)
+[ 61.888141] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 91.888089] ata3.00: qc timeout (cmd 0xec)
+[ 91.888152] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+
+ATAPI device connected:
+[ 1.882061] pata_isapnp 01:01.02: activated
+[ 1.893430] scsi2 : pata_isapnp
+[ 1.893719] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 6.892107] ata3.01: qc timeout (cmd 0xec)
+[ 6.892171] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 16.892079] ata3.01: qc timeout (cmd 0xec)
+[ 16.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.892079] ata3.01: qc timeout (cmd 0xec)
+[ 46.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.908586] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr
+[ 46.924570] ata3.00: configured for PIO0 (device error ignored)
+[ 46.926295] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5
+[ 46.984519] sr0: scsi3-mmc drive: 6x/6x xa/form2 tray
+[ 46.984592] cdrom: Uniform CD-ROM driver Revision: 3.20
+
+So don't skip ata_sff_softreset, just skip the reset part of ata_bus_softreset
+if the ctl port is not available.
+
+This makes IDE port on ES968 behave correctly:
+
+No device connected:
+[ 4.670888] pata_isapnp 01:01.02: activated
+[ 4.673207] scsi host2: pata_isapnp
+[ 4.673675] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 7.081840] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
+
+ATAPI device connected:
+[ 4.704362] pata_isapnp 01:01.02: activated
+[ 4.706620] scsi host2: pata_isapnp
+[ 4.706877] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 4.872782] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr
+[ 4.888673] ata3.00: configured for PIO0 (device error ignored)
+[ 4.893984] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5
+[ 7.015578] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-sff.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_
+
+ DPRINTK("ata%u: bus reset via SRST\n", ap->print_id);
+
+- /* software reset. causes dev0 to be selected */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- ap->last_ctl = ap->ctl;
++ if (ap->ioaddr.ctl_addr) {
++ /* software reset. causes dev0 to be selected */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ ap->last_ctl = ap->ctl;
++ }
+
+ /* wait the port to become ready */
+ return ata_sff_wait_after_reset(&ap->link, devmask, deadline);
+@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_po
+
+ spin_unlock_irqrestore(ap->lock, flags);
+
+- /* ignore ata_sff_softreset if ctl isn't accessible */
+- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr)
+- softreset = NULL;
+-
+ /* ignore built-in hardresets if SCR access is not available */
+ if ((hardreset == sata_std_hardreset ||
+ hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link))
--- /dev/null
+From 173b3afceebe76fa2205b2c8808682d5b541fe3c Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Tue, 23 Sep 2014 12:26:20 -0400
+Subject: lockd: Try to reconnect if statd has moved
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+commit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream.
+
+If rpc.statd is restarted, upcalls to monitor hosts can fail with
+ECONNREFUSED. In that case force a lookup of statd's new port and retry the
+upcall.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/lockd/mon.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_hand
+
+ msg.rpc_proc = &clnt->cl_procinfo[proc];
+ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN);
++ if (status == -ECONNREFUSED) {
++ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n",
++ status);
++ rpc_force_rebind(clnt);
++ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN);
++ }
+ if (status < 0)
+ dprintk("lockd: NSM upcall RPC failed, status=%d\n",
+ status);
--- /dev/null
+From dea67c4ec8218b301d7cac7ee6e63dac0bc566cb Mon Sep 17 00:00:00 2001
+From: Fu Zhonghui <zhonghui.fu@linux.intel.com>
+Date: Mon, 18 Aug 2014 10:48:14 +0800
+Subject: mmc: core: sdio: Fix unconditional wake_up_process() on sdio thread
+
+From: Fu Zhonghui <zhonghui.fu@linux.intel.com>
+
+commit dea67c4ec8218b301d7cac7ee6e63dac0bc566cb upstream.
+
+781e989cf59 ("mmc: sdhci: convert to new SDIO IRQ handling") and
+bf3b5ec66bd ("mmc: sdio_irq: rework sdio irq handling") disabled
+the use of our own custom threaded IRQ handler, but left in an
+unconditional wake_up_process() on that handler at resume-time.
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=80151
+
+In addition, the check for MMC_CAP_SDIO_IRQ capability is added
+before enable sdio IRQ.
+
+Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
+Signed-off-by: Chris Ball <chris@printf.net>
+Signed-off-by: Fu Zhonghui <zhonghui.fu@linux.intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/sdio.c | 12 ++++++++++--
+ drivers/mmc/core/sdio_irq.c | 4 ++--
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -992,8 +992,16 @@ static int mmc_sdio_resume(struct mmc_ho
+ }
+ }
+
+- if (!err && host->sdio_irqs)
+- wake_up_process(host->sdio_irq_thread);
++ if (!err && host->sdio_irqs) {
++ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) {
++ wake_up_process(host->sdio_irq_thread);
++ } else if (host->caps & MMC_CAP_SDIO_IRQ) {
++ mmc_host_clk_hold(host);
++ host->ops->enable_sdio_irq(host, 1);
++ mmc_host_clk_release(host);
++ }
++ }
++
+ mmc_release_host(host);
+
+ host->pm_flags &= ~MMC_PM_KEEP_POWER;
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -208,7 +208,7 @@ static int sdio_card_irq_get(struct mmc_
+ host->sdio_irqs--;
+ return err;
+ }
+- } else {
++ } else if (host->caps & MMC_CAP_SDIO_IRQ) {
+ mmc_host_clk_hold(host);
+ host->ops->enable_sdio_irq(host, 1);
+ mmc_host_clk_release(host);
+@@ -229,7 +229,7 @@ static int sdio_card_irq_put(struct mmc_
+ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) {
+ atomic_set(&host->sdio_irq_thread_abort, 1);
+ kthread_stop(host->sdio_irq_thread);
+- } else {
++ } else if (host->caps & MMC_CAP_SDIO_IRQ) {
+ mmc_host_clk_hold(host);
+ host->ops->enable_sdio_irq(host, 0);
+ mmc_host_clk_release(host);
--- /dev/null
+From d4d11449088ee9aca16fd1884b852b8b73a4bda1 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Mon, 22 Sep 2014 09:57:42 -0600
+Subject: mmc: don't request CD IRQ until mmc_start_host()
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit d4d11449088ee9aca16fd1884b852b8b73a4bda1 upstream.
+
+As soon as the CD IRQ is requested, it can trigger, since it's an
+externally controlled event. If it does, delayed_work host->detect will
+be scheduled.
+
+Many host controller probe()s are roughly structured as:
+
+*_probe() {
+ host = sdhci_pltfm_init();
+ mmc_of_parse(host->mmc);
+ rc = sdhci_add_host(host);
+ if (rc) {
+ sdhci_pltfm_free();
+ return rc;
+ }
+
+In 3.17, CD IRQs can are enabled quite early via *_probe() ->
+mmc_of_parse() -> mmc_gpio_request_cd() -> mmc_gpiod_request_cd_irq().
+
+Note that in linux-next, mmc_of_parse() calls mmc_gpio*d*_request_cd()
+rather than mmc_gpio_request_cd(), and mmc_gpio*d*_request_cd() doesn't
+call mmc_gpiod_request_cd_irq(). However, this issue still exists if
+mmc_gpio_request_cd() is called directly before mmc_start_host().
+
+sdhci_add_host() may fail part way through (e.g. due to deferred
+probe for a vmmc regulator), and sdhci_pltfm_free() does nothing to
+unrequest the CD IRQ nor cancel the delayed_work. sdhci_pltfm_free() is
+coded to assume that if sdhci_add_host() failed, then the delayed_work
+cannot (or should not) have been triggered.
+
+This can lead to the following with CONFIG_DEBUG_OBJECTS_* enabled, when
+kfree(host) is eventually called inside sdhci_pltfm_free():
+
+WARNING: CPU: 2 PID: 6 at lib/debugobjects.c:263 debug_print_object+0x8c/0xb4()
+ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x18
+
+The object being complained about is host->detect.
+
+There's no need to request the CD IRQ so early; mmc_start_host() already
+requests it. For most SDHCI hosts at least, the typical call path that
+does this is: *_probe() -> sdhci_add_host() -> mmc_add_host() ->
+mmc_start_host(). Therefore, remove the call to mmc_gpiod_request_cd_irq()
+from mmc_gpio_request_cd(). This also matches mmc_gpio*d*_request_cd(),
+which already doesn't call mmc_gpiod_request_cd_irq().
+
+However, some host controller drivers call mmc_gpio_request_cd() after
+mmc_start_host() has already been called, and assume that this will also
+call mmc_gpiod_request_cd_irq(). Update those drivers to explicitly call
+mmc_gpiod_request_cd_irq() themselves. Ideally, these drivers should be
+modified to move their call to mmc_gpio_request_cd() before their call
+to mmc_add_host(). However that's too large a change for stable.
+
+This solves the problem (eliminates the kernel error message above),
+since it guarantees that the IRQ can't trigger before mmc_start_host()
+is called.
+
+The critical point here is that once sdhci_add_host() calls
+mmc_add_host() -> mmc_start_host(), sdhci_add_host() is coded not to
+fail. In other words, if there's a chance that mmc_start_host() may have
+been called, and CD IRQs triggered, and the delayed_work scheduled,
+sdhci_add_host() won't fail, and so cleanup is no longer via
+sdhci_pltfm_free() (which doesn't free the IRQ or cancel the work queue)
+but instead must be via sdhci_remove_host(), which calls mmc_remove_host()
+-> mmc_stop_host(), which does free the IRQ and cancel the work queue.
+
+CC: Russell King <linux@arm.linux.org.uk>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexandre Courbot <acourbot@nvidia.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/slot-gpio.c | 2 --
+ drivers/mmc/host/mmc_spi.c | 1 +
+ drivers/mmc/host/sdhci-sirf.c | 1 +
+ drivers/mmc/host/tmio_mmc_pio.c | 1 +
+ 4 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/core/slot-gpio.c
++++ b/drivers/mmc/core/slot-gpio.c
+@@ -221,8 +221,6 @@ int mmc_gpio_request_cd(struct mmc_host
+ ctx->override_cd_active_level = true;
+ ctx->cd_gpio = gpio_to_desc(gpio);
+
+- mmc_gpiod_request_cd_irq(host);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(mmc_gpio_request_cd);
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -1436,6 +1436,7 @@ static int mmc_spi_probe(struct spi_devi
+ host->pdata->cd_debounce);
+ if (status != 0)
+ goto fail_add_host;
++ mmc_gpiod_request_cd_irq(mmc);
+ }
+
+ if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) {
+--- a/drivers/mmc/host/sdhci-sirf.c
++++ b/drivers/mmc/host/sdhci-sirf.c
+@@ -94,6 +94,7 @@ static int sdhci_sirf_probe(struct platf
+ ret);
+ goto err_request_cd;
+ }
++ mmc_gpiod_request_cd_irq(host->mmc);
+ }
+
+ return 0;
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -1103,6 +1103,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_
+ tmio_mmc_host_remove(_host);
+ return ret;
+ }
++ mmc_gpiod_request_cd_irq(mmc);
+ }
+
+ *host = _host;
--- /dev/null
+From d1419d50c1bf711e9fd27b516a739c86b23f7cf9 Mon Sep 17 00:00:00 2001
+From: Roger Tseng <rogerable@realtek.com>
+Date: Fri, 15 Aug 2014 14:06:00 +0800
+Subject: mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response
+
+From: Roger Tseng <rogerable@realtek.com>
+
+commit d1419d50c1bf711e9fd27b516a739c86b23f7cf9 upstream.
+
+Current code erroneously fill the last byte of R2 response with an undefined
+value. In addition, the controller actually 'offloads' the last byte
+(CRC7, end bit) while receiving R2 response and thus it's impossible to get the
+actual value. This could cause mmc stack to obtain inconsistent CID from the
+same card after resume and misidentify it as a different card.
+
+Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2.
+
+Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver")
+Signed-off-by: Roger Tseng <rogerable@realtek.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -412,6 +412,13 @@ static void sd_send_cmd_get_rsp(struct r
+ }
+
+ if (rsp_type == SD_RSP_TYPE_R2) {
++ /*
++ * The controller offloads the last byte {CRC-7, end bit 1'b1}
++ * of response type R2. Assign dummy CRC, 0, and end bit to the
++ * byte(ptr[16], goes into the LSB of resp[3] later).
++ */
++ ptr[16] = 1;
++
+ for (i = 0; i < 4; i++) {
+ cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4);
+ dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n",
--- /dev/null
+From 6f67cc6fd1cf339a0f19b9d4a998ec3c0123b1b6 Mon Sep 17 00:00:00 2001
+From: Roger Tseng <rogerable@realtek.com>
+Date: Fri, 15 Aug 2014 14:06:01 +0800
+Subject: mmc: rtsx_usb_sdmmc: fix incorrect last byte in R2 response
+
+From: Roger Tseng <rogerable@realtek.com>
+
+commit 6f67cc6fd1cf339a0f19b9d4a998ec3c0123b1b6 upstream.
+
+Current code erroneously fill the last byte of R2 response with an undefined
+value. In addition, the controller actually 'offloads' the last byte
+(CRC7, end bit) while receiving R2 response and thus it's impossible to get the
+actual value. This could cause mmc stack to obtain inconsistent CID from the
+same card after resume and misidentify it as a different card.
+
+Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2.
+
+Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver")
+Signed-off-by: Roger Tseng <rogerable@realtek.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/rtsx_usb_sdmmc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
+@@ -435,6 +435,13 @@ static void sd_send_cmd_get_rsp(struct r
+ }
+
+ if (rsp_type == SD_RSP_TYPE_R2) {
++ /*
++ * The controller offloads the last byte {CRC-7, end bit 1'b1}
++ * of response type R2. Assign dummy CRC, 0, and end bit to the
++ * byte(ptr[16], goes into the LSB of resp[3] later).
++ */
++ ptr[16] = 1;
++
+ for (i = 0; i < 4; i++) {
+ cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4);
+ dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n",
--- /dev/null
+From b315376573778b195e640a163675fb9f5937ddca Mon Sep 17 00:00:00 2001
+From: Peter Griffin <peter.griffin@linaro.org>
+Date: Fri, 15 Aug 2014 14:02:15 +0100
+Subject: mmc: sdhci-pxav3: set_uhs_signaling is initialized twice differently
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+commit b315376573778b195e640a163675fb9f5937ddca upstream.
+
+.set_uhs_signaling field is currently initialised twice once to the
+arch specific callback pxav3_set_uhs_signaling, and also to the generic
+sdhci_set_uhs_signaling callback.
+
+This means that uhs is currently broken for this platform currently, as pxav3
+has some special constriants which means it can't use the generic callback.
+
+This happened in
+commit 96d7b78cfc2f ("mmc: sdhci: convert sdhci_set_uhs_signaling() into a library function")
+commit a702c8abb2a9 ("mmc: host: split up sdhci-pxa, create sdhci-pxav3.c")'
+
+Fix this and hopefully prevent it happening in the future by ensuring named
+initialisers always follow the declaration order in the structure definition.
+
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pxav3.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -224,12 +224,11 @@ static void pxav3_set_uhs_signaling(stru
+
+ static const struct sdhci_ops pxav3_sdhci_ops = {
+ .set_clock = sdhci_set_clock,
+- .set_uhs_signaling = pxav3_set_uhs_signaling,
+ .platform_send_init_74_clocks = pxav3_gen_init_74_clocks,
+ .get_max_clock = sdhci_pltfm_clk_get_max_clock,
+ .set_bus_width = sdhci_set_bus_width,
+ .reset = pxav3_reset,
+- .set_uhs_signaling = sdhci_set_uhs_signaling,
++ .set_uhs_signaling = pxav3_set_uhs_signaling,
+ };
+
+ static struct sdhci_pltfm_data sdhci_pxav3_pdata = {
--- /dev/null
+From 221414db1934c1c883501998f510bb75acfbaa51 Mon Sep 17 00:00:00 2001
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Date: Thu, 7 Aug 2014 18:07:07 +0200
+Subject: mmc: sdhci-s3c: fix runtime PM handling on sdhci_add_host() failure
+
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+
+commit 221414db1934c1c883501998f510bb75acfbaa51 upstream.
+
+Runtime Power Management handling for the sdhci_add_host() failure
+case in sdhci_s3c_probe() should match the code in sdhci_s3c_remove()
+(which uses pm_runtime_disable() call which matches the earlier
+pm_runtime_enable() one). Fix it.
+
+This patch fixes "BUG: spinlock bad magic on CPU#0, swapper/0/1" and
+"Unbalanced pm_runtime_enable!" warnings.
+
+>From the kernel log:
+...
+[ 1.659631] s3c-sdhci 12530000.sdhci: sdhci_add_host() failed
+[ 1.665096] BUG: spinlock bad magic on CPU#0, swapper/0/1
+[ 1.670433] lock: 0xea01e484, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
+[ 1.677895] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.16.0-next-20140804-00008-ga59480f-dirty #707
+[ 1.687037] [<c0013ae4>] (unwind_backtrace) from [<c0010d70>] (show_stack+0x10/0x14)
+[ 1.694740] [<c0010d70>] (show_stack) from [<c04050c8>] (dump_stack+0x68/0xb8)
+[ 1.701948] [<c04050c8>] (dump_stack) from [<c0052558>] (do_raw_spin_lock+0x15c/0x1a4)
+[ 1.709848] [<c0052558>] (do_raw_spin_lock) from [<c040a630>] (_raw_spin_lock_irqsave+0x20/0x28)
+[ 1.718619] [<c040a630>] (_raw_spin_lock_irqsave) from [<c030d7d0>] (sdhci_do_set_ios+0x1c/0x5cc)
+[ 1.727464] [<c030d7d0>] (sdhci_do_set_ios) from [<c030ddfc>] (sdhci_runtime_resume_host+0x50/0x104)
+[ 1.736574] [<c030ddfc>] (sdhci_runtime_resume_host) from [<c02462dc>] (pm_generic_runtime_resume+0x2c/0x40)
+[ 1.746383] [<c02462dc>] (pm_generic_runtime_resume) from [<c0247898>] (__rpm_callback+0x34/0x70)
+[ 1.755233] [<c0247898>] (__rpm_callback) from [<c02478fc>] (rpm_callback+0x28/0x88)
+[ 1.762958] [<c02478fc>] (rpm_callback) from [<c02486f0>] (rpm_resume+0x384/0x4ec)
+[ 1.770511] [<c02486f0>] (rpm_resume) from [<c02488b0>] (pm_runtime_forbid+0x58/0x64)
+[ 1.778325] [<c02488b0>] (pm_runtime_forbid) from [<c030ea70>] (sdhci_s3c_probe+0x4a4/0x540)
+[ 1.786749] [<c030ea70>] (sdhci_s3c_probe) from [<c02429cc>] (platform_drv_probe+0x2c/0x5c)
+[ 1.795076] [<c02429cc>] (platform_drv_probe) from [<c02415f0>] (driver_probe_device+0x114/0x234)
+[ 1.803929] [<c02415f0>] (driver_probe_device) from [<c024179c>] (__driver_attach+0x8c/0x90)
+[ 1.812347] [<c024179c>] (__driver_attach) from [<c023ffb4>] (bus_for_each_dev+0x54/0x88)
+[ 1.820506] [<c023ffb4>] (bus_for_each_dev) from [<c0240df8>] (bus_add_driver+0xd8/0x1cc)
+[ 1.828665] [<c0240df8>] (bus_add_driver) from [<c0241db8>] (driver_register+0x78/0xf4)
+[ 1.836652] [<c0241db8>] (driver_register) from [<c00088a4>] (do_one_initcall+0x80/0x1d0)
+[ 1.844816] [<c00088a4>] (do_one_initcall) from [<c059ac94>] (kernel_init_freeable+0x108/0x1d4)
+[ 1.853503] [<c059ac94>] (kernel_init_freeable) from [<c0401300>] (kernel_init+0x8/0xe4)
+[ 1.861568] [<c0401300>] (kernel_init) from [<c000e538>] (ret_from_fork+0x14/0x3c)
+[ 1.869582] platform 12530000.sdhci: Driver s3c-sdhci requests probe deferral
+...
+[ 1.997047] s3c-sdhci 12530000.sdhci: Unbalanced pm_runtime_enable!
+...
+[ 2.027235] s3c-sdhci 12530000.sdhci: sdhci_add_host() failed
+[ 2.032884] platform 12530000.sdhci: Driver s3c-sdhci requests probe deferral
+...
+
+Tested on Hardkernel's Exynos4412 based ODROID-U3 board.
+
+Fixes: 9f4e8151dbbc ("mmc: sdhci-s3c: Enable runtime power management")
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Cc: Jaehoon Chung <jh80.chung@samsung.com>
+Cc: Ben Dooks <ben-linux@fluff.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-s3c.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-s3c.c
++++ b/drivers/mmc/host/sdhci-s3c.c
+@@ -606,8 +606,6 @@ static int sdhci_s3c_probe(struct platfo
+ ret = sdhci_add_host(host);
+ if (ret) {
+ dev_err(dev, "sdhci_add_host() failed\n");
+- pm_runtime_forbid(&pdev->dev);
+- pm_runtime_get_noresume(&pdev->dev);
+ goto err_req_regs;
+ }
+
+@@ -618,6 +616,8 @@ static int sdhci_s3c_probe(struct platfo
+ return 0;
+
+ err_req_regs:
++ pm_runtime_disable(&pdev->dev);
++
+ err_no_busclks:
+ clk_disable_unprepare(sc->clk_io);
+
--- /dev/null
+From 37017ac6849e772e67dd187ba2fbd056c4afa533 Mon Sep 17 00:00:00 2001
+From: Scott Carter <ccscott@funsoft.com>
+Date: Wed, 24 Sep 2014 18:13:09 -0700
+Subject: pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller
+
+From: Scott Carter <ccscott@funsoft.com>
+
+commit 37017ac6849e772e67dd187ba2fbd056c4afa533 upstream.
+
+The Broadcom OSB4 IDE Controller (vendor and device IDs: 1166:0211)
+does not support 64-KB DMA transfers.
+Whenever a 64-KB DMA transfer is attempted,
+the transfer fails and messages similar to the following
+are written to the console log:
+
+ [ 2431.851125] sr 0:0:0:0: [sr0] Unhandled sense code
+ [ 2431.851139] sr 0:0:0:0: [sr0] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+ [ 2431.851152] sr 0:0:0:0: [sr0] Sense Key : Hardware Error [current]
+ [ 2431.851166] sr 0:0:0:0: [sr0] Add. Sense: Logical unit communication time-out
+ [ 2431.851182] sr 0:0:0:0: [sr0] CDB: Read(10): 28 00 00 00 76 f4 00 00 40 00
+ [ 2431.851210] end_request: I/O error, dev sr0, sector 121808
+
+When the libata and pata_serverworks modules
+are recompiled with ATA_DEBUG and ATA_VERBOSE_DEBUG defined in libata.h,
+the 64-KB transfer size in the scatter-gather list can be seen
+in the console log:
+
+ [ 2664.897267] sr 9:0:0:0: [sr0] Send:
+ [ 2664.897274] 0xf63d85e0
+ [ 2664.897283] sr 9:0:0:0: [sr0] CDB:
+ [ 2664.897288] Read(10): 28 00 00 00 7f b4 00 00 40 00
+ [ 2664.897319] buffer = 0xf6d6fbc0, bufflen = 131072, queuecommand 0xf81b7700
+ [ 2664.897331] ata_scsi_dump_cdb: CDB (1:0,0,0) 28 00 00 00 7f b4 00 00 40
+ [ 2664.897338] ata_scsi_translate: ENTER
+ [ 2664.897345] ata_sg_setup: ENTER, ata1
+ [ 2664.897356] ata_sg_setup: 3 sg elements mapped
+ [ 2664.897364] ata_bmdma_fill_sg: PRD[0] = (0x66FD2000, 0xE000)
+ [ 2664.897371] ata_bmdma_fill_sg: PRD[1] = (0x65000000, 0x10000)
+ ------------------------------------------------------> =======
+ [ 2664.897378] ata_bmdma_fill_sg: PRD[2] = (0x66A10000, 0x2000)
+ [ 2664.897386] ata1: ata_dev_select: ENTER, device 0, wait 1
+ [ 2664.897422] ata_sff_tf_load: feat 0x1 nsect 0x0 lba 0x0 0x0 0xFC
+ [ 2664.897428] ata_sff_tf_load: device 0xA0
+ [ 2664.897448] ata_sff_exec_command: ata1: cmd 0xA0
+ [ 2664.897457] ata_scsi_translate: EXIT
+ [ 2664.897462] leaving scsi_dispatch_cmnd()
+ [ 2664.897497] Doing sr request, dev = sr0, block = 0
+ [ 2664.897507] sr0 : reading 64/256 512 byte blocks.
+ [ 2664.897553] ata_sff_hsm_move: ata1: protocol 7 task_state 1 (dev_stat 0x58)
+ [ 2664.897560] atapi_send_cdb: send cdb
+ [ 2666.910058] ata_bmdma_port_intr: ata1: host_stat 0x64
+ [ 2666.910079] __ata_sff_port_intr: ata1: protocol 7 task_state 3
+ [ 2666.910093] ata_sff_hsm_move: ata1: protocol 7 task_state 3 (dev_stat 0x51)
+ [ 2666.910101] ata_sff_hsm_move: ata1: protocol 7 task_state 4 (dev_stat 0x51)
+ [ 2666.910129] sr 9:0:0:0: [sr0] Done:
+ [ 2666.910136] 0xf63d85e0 TIMEOUT
+
+lspci shows that the driver used for the Broadcom OSB4 IDE Controller is
+pata_serverworks:
+
+ 00:0f.1 IDE interface: Broadcom OSB4 IDE Controller (prog-if 8e [Master SecP SecO PriP])
+ Flags: bus master, medium devsel, latency 64
+ [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
+ [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1]
+ I/O ports at 0170 [size=8]
+ I/O ports at 0374 [size=4]
+ I/O ports at 1440 [size=16]
+ Kernel driver in use: pata_serverworks
+
+The pata_serverworks driver supports five distinct device IDs,
+one being the OSB4 and the other four belonging to the CSB series.
+The CSB series appears to support 64-KB DMA transfers,
+as tests on a machine with an SAI2 motherboard
+containing a Broadcom CSB5 IDE Controller (vendor and device IDs: 1166:0212)
+showed no problems with 64-KB DMA transfers.
+
+This problem was first discovered when attempting to install openSUSE
+from a DVD on a machine with an STL2 motherboard.
+Using the pata_serverworks module,
+older releases of openSUSE will not install at all due to the timeouts.
+Releases of openSUSE prior to 11.3 can be installed by disabling
+the pata_serverworks module using the brokenmodules boot parameter,
+which causes the serverworks module to be used instead.
+Recent releases of openSUSE (12.2 and later) include better error recovery and
+will install, though very slowly.
+On all openSUSE releases, the problem can be recreated
+on a machine containing a Broadcom OSB4 IDE Controller
+by mounting an install DVD and running a command similar to the following:
+
+ find /mnt -type f -print | xargs cat > /dev/null
+
+The patch below corrects the problem.
+Similar to the other ATA drivers that do not support 64-KB DMA transfers,
+the patch changes the ata_port_operations qc_prep vector to point to a routine
+that breaks any 64-KB segment into two 32-KB segments and
+changes the scsi_host_template sg_tablesize element to reduce by half
+the number of scatter/gather elements allowed.
+These two changes affect only the OSB4.
+
+Signed-off-by: Scott Carter <ccscott@funsoft.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/pata_serverworks.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/pata_serverworks.c
++++ b/drivers/ata/pata_serverworks.c
+@@ -251,12 +251,18 @@ static void serverworks_set_dmamode(stru
+ pci_write_config_byte(pdev, 0x54, ultra_cfg);
+ }
+
+-static struct scsi_host_template serverworks_sht = {
++static struct scsi_host_template serverworks_osb4_sht = {
++ ATA_BMDMA_SHT(DRV_NAME),
++ .sg_tablesize = LIBATA_DUMB_MAX_PRD,
++};
++
++static struct scsi_host_template serverworks_csb_sht = {
+ ATA_BMDMA_SHT(DRV_NAME),
+ };
+
+ static struct ata_port_operations serverworks_osb4_port_ops = {
+ .inherits = &ata_bmdma_port_ops,
++ .qc_prep = ata_bmdma_dumb_qc_prep,
+ .cable_detect = serverworks_cable_detect,
+ .mode_filter = serverworks_osb4_filter,
+ .set_piomode = serverworks_set_piomode,
+@@ -265,6 +271,7 @@ static struct ata_port_operations server
+
+ static struct ata_port_operations serverworks_csb_port_ops = {
+ .inherits = &serverworks_osb4_port_ops,
++ .qc_prep = ata_bmdma_qc_prep,
+ .mode_filter = serverworks_csb_filter,
+ };
+
+@@ -404,6 +411,7 @@ static int serverworks_init_one(struct p
+ }
+ };
+ const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL };
++ struct scsi_host_template *sht = &serverworks_csb_sht;
+ int rc;
+
+ rc = pcim_enable_device(pdev);
+@@ -417,6 +425,7 @@ static int serverworks_init_one(struct p
+ /* Select non UDMA capable OSB4 if we can't do fixups */
+ if (rc < 0)
+ ppi[0] = &info[1];
++ sht = &serverworks_osb4_sht;
+ }
+ /* setup CSB5/CSB6 : South Bridge and IDE option RAID */
+ else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) ||
+@@ -433,7 +442,7 @@ static int serverworks_init_one(struct p
+ ppi[1] = &ata_dummy_port_info;
+ }
+
+- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0);
++ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From bb2e226b3bef596dd56be97df655d857b4603923 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 21 Sep 2014 15:04:53 -0700
+Subject: Revert "percpu: free percpu allocation info for uniprocessor system"
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit bb2e226b3bef596dd56be97df655d857b4603923 upstream.
+
+This reverts commit 3189eddbcafc ("percpu: free percpu allocation info for
+uniprocessor system").
+
+The commit causes a hang with a crisv32 image. This may be an architecture
+problem, but at least for now the revert is necessary to be able to boot a
+crisv32 image.
+
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Honggang Li <enjoymindful@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Fixes: 3189eddbcafc ("percpu: free percpu allocation info for uniprocessor system")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1932,8 +1932,6 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
+-
+- pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch
drivers-net-macvtap-and-tun-depend-on-inet.patch
stmmac-pci-set-default-of-the-filter-bins.patch
+lockd-try-to-reconnect-if-statd-has-moved.patch
+sunrpc-don-t-wake-tasks-during-connection-abort.patch
+sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch
+revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch
+pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch
+libata-sff-fix-controllers-with-no-ctl-port.patch
+asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch
+asoc-soc-dapm-fix-use-after-free.patch
+asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch
+asoc-tlv320aic3x-fix-pll-d-configuration.patch
+asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch
+asoc-adau1761-fix-input-pga-volume.patch
+mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch
+mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch
+mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch
+mmc-don-t-request-cd-irq-until-mmc_start_host.patch
+mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch
+mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch
+fs-make-cont_expand_zero-interruptible.patch
+fs-fix-theoretical-division-by-0-in-super_cache_scan.patch
+fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch
+ubifs-fix-a-race-condition.patch
+ubifs-fix-free-log-space-calculation.patch
--- /dev/null
+From 2aca5b869ace67a63aab895659e5dc14c33a4d6e Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Wed, 24 Sep 2014 22:35:58 -0400
+Subject: SUNRPC: Add missing support for RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 2aca5b869ace67a63aab895659e5dc14c33a4d6e upstream.
+
+The flag RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT was intended introduced in
+order to allow NFSv4 clients to disable resend timeouts. Since those
+cause the RPC layer to break the connection, they mess up the duplicate
+reply caches that remain indexed on the port number in NFSv4..
+
+This patch includes the code that was missing in the original to
+set the appropriate flag in struct rpc_clnt, when the caller of
+rpc_create() sets RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT.
+
+Fixes: 8a19a0b6cb2e (SUNRPC: Add RPC task and client level options to...)
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -461,6 +461,8 @@ struct rpc_clnt *rpc_create_xprt(struct
+
+ if (args->flags & RPC_CLNT_CREATE_AUTOBIND)
+ clnt->cl_autobind = 1;
++ if (args->flags & RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT)
++ clnt->cl_noretranstimeo = 1;
+ if (args->flags & RPC_CLNT_CREATE_DISCRTRY)
+ clnt->cl_discrtry = 1;
+ if (!(args->flags & RPC_CLNT_CREATE_QUIET))
+@@ -579,6 +581,7 @@ static struct rpc_clnt *__rpc_clone_clie
+ /* Turn off autobind on clones */
+ new->cl_autobind = 0;
+ new->cl_softrtry = clnt->cl_softrtry;
++ new->cl_noretranstimeo = clnt->cl_noretranstimeo;
+ new->cl_discrtry = clnt->cl_discrtry;
+ new->cl_chatty = clnt->cl_chatty;
+ return new;
--- /dev/null
+From a743419f420a64d442280845c0377a915b76644f Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Tue, 23 Sep 2014 12:26:19 -0400
+Subject: SUNRPC: Don't wake tasks during connection abort
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+commit a743419f420a64d442280845c0377a915b76644f upstream.
+
+When aborting a connection to preserve source ports, don't wake the task in
+xs_error_report. This allows tasks with RPC_TASK_SOFTCONN to succeed if the
+connection needs to be re-established since it preserves the task's status
+instead of setting it to the status of the aborting kernel_connect().
+
+This may also avoid a potential conflict on the socket's lock.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/sunrpc/xprt.h | 1 +
+ net/sunrpc/xprtsock.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -357,6 +357,7 @@ int xs_swapper(struct rpc_xprt *xprt,
+ #define XPRT_CONNECTION_ABORT (7)
+ #define XPRT_CONNECTION_CLOSE (8)
+ #define XPRT_CONGESTED (9)
++#define XPRT_CONNECTION_REUSE (10)
+
+ static inline void xprt_set_connected(struct rpc_xprt *xprt)
+ {
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -845,6 +845,8 @@ static void xs_error_report(struct sock
+ dprintk("RPC: xs_error_report client %p, error=%d...\n",
+ xprt, -err);
+ trace_rpc_socket_error(xprt, sk->sk_socket, err);
++ if (test_bit(XPRT_CONNECTION_REUSE, &xprt->state))
++ goto out;
+ xprt_wake_pending_tasks(xprt, err);
+ out:
+ read_unlock_bh(&sk->sk_callback_lock);
+@@ -2245,7 +2247,9 @@ static void xs_tcp_setup_socket(struct w
+ abort_and_exit = test_and_clear_bit(XPRT_CONNECTION_ABORT,
+ &xprt->state);
+ /* "close" the socket, preserving the local port */
++ set_bit(XPRT_CONNECTION_REUSE, &xprt->state);
+ xs_tcp_reuse_connection(transport);
++ clear_bit(XPRT_CONNECTION_REUSE, &xprt->state);
+
+ if (abort_and_exit)
+ goto out_eagain;
--- /dev/null
+From 052c28073ff26f771d44ef33952a41d18dadd255 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Sun, 29 Jun 2014 17:00:45 +0300
+Subject: UBIFS: fix a race condition
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit 052c28073ff26f771d44ef33952a41d18dadd255 upstream.
+
+Hu (hujianyang@huawei.com) discovered a race condition which may lead to a
+situation when UBIFS is unable to mount the file-system after an unclean
+reboot. The problem is theoretical, though.
+
+In UBIFS, we have the log, which basically a set of LEBs in a certain area. The
+log has the tail and the head.
+
+Every time user writes data to the file-system, the UBIFS journal grows, and
+the log grows as well, because we append new reference nodes to the head of the
+log. So the head moves forward all the time, while the log tail stays at the
+same position.
+
+At any time, the UBIFS master node points to the tail of the log. When we mount
+the file-system, we scan the log, and we always start from its tail, because
+this is where the master node points to. The only occasion when the tail of the
+log changes is the commit operation.
+
+The commit operation has 2 phases - "commit start" and "commit end". The former
+is relatively short, and does not involve much I/O. During this phase we mostly
+just build various in-memory lists of the things which have to be written to
+the flash media during "commit end" phase.
+
+During the commit start phase, what we do is we "clean" the log. Indeed, the
+commit operation will index all the data in the journal, so the entire journal
+"disappears", and therefore the data in the log become unneeded. So we just
+move the head of the log to the next LEB, and write the CS node there. This LEB
+will be the tail of the new log when the commit operation finishes.
+
+When the "commit start" phase finishes, users may write more data to the
+file-system, in parallel with the ongoing "commit end" operation. At this point
+the log tail was not changed yet, it is the same as it had been before we
+started the commit. The log head keeps moving forward, though.
+
+The commit operation now needs to write the new master node, and the new master
+node should point to the new log tail. After this the LEBs between the old log
+tail and the new log tail can be unmapped and re-used again.
+
+And here is the possible problem. We do 2 operations: (a) We first update the
+log tail position in memory (see 'ubifs_log_end_commit()'). (b) And then we
+write the master node (see the big lock of code in 'do_commit()').
+
+But nothing prevents the log head from moving forward between (a) and (b), and
+the log head may "wrap" now to the old log tail. And when the "wrap" happens,
+the contends of the log tail gets erased. Now a power cut happens and we are in
+trouble. We end up with the old master node pointing to the old tail, which was
+erased. And replay fails because it expects the master node to point to the
+correct log tail at all times.
+
+This patch merges the abovementioned (a) and (b) operations by moving the master
+node change code to the 'ubifs_log_end_commit()' function, so that it runs with
+the log mutex locked, which will prevent the log from being changed benween
+operations (a) and (b).
+
+Reported-by: hujianyang <hujianyang@huawei.com>
+Tested-by: hujianyang <hujianyang@huawei.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/commit.c | 8 +++-----
+ fs/ubifs/log.c | 11 ++++++++---
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -166,10 +166,6 @@ static int do_commit(struct ubifs_info *
+ err = ubifs_orphan_end_commit(c);
+ if (err)
+ goto out;
+- old_ltail_lnum = c->ltail_lnum;
+- err = ubifs_log_end_commit(c, new_ltail_lnum);
+- if (err)
+- goto out;
+ err = dbg_check_old_index(c, &zroot);
+ if (err)
+ goto out;
+@@ -202,7 +198,9 @@ static int do_commit(struct ubifs_info *
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+ else
+ c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS);
+- err = ubifs_write_master(c);
++
++ old_ltail_lnum = c->ltail_lnum;
++ err = ubifs_log_end_commit(c, new_ltail_lnum);
+ if (err)
+ goto out;
+
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -447,9 +447,9 @@ out:
+ * @ltail_lnum: new log tail LEB number
+ *
+ * This function is called on when the commit operation was finished. It
+- * moves log tail to new position and unmaps LEBs which contain obsolete data.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
++ * moves log tail to new position and updates the master node so that it stores
++ * the new log tail LEB number. Returns zero in case of success and a negative
++ * error code in case of failure.
+ */
+ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum)
+ {
+@@ -477,7 +477,12 @@ int ubifs_log_end_commit(struct ubifs_in
+ spin_unlock(&c->buds_lock);
+
+ err = dbg_check_bud_bytes(c);
++ if (err)
++ goto out;
+
++ err = ubifs_write_master(c);
++
++out:
+ mutex_unlock(&c->log_mutex);
+ return err;
+ }
--- /dev/null
+From ba29e721eb2df6df8f33c1f248388bb037a47914 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Wed, 16 Jul 2014 15:22:29 +0300
+Subject: UBIFS: fix free log space calculation
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream.
+
+Hu (hujianyang <hujianyang@huawei.com>) discovered an issue in the
+'empty_log_bytes()' function, which calculates how many bytes are left in the
+log:
+
+"
+If 'c->lhead_lnum + 1 == c->ltail_lnum' and 'c->lhead_offs == c->leb_size', 'h'
+would equalent to 't' and 'empty_log_bytes()' would return 'c->log_bytes'
+instead of 0.
+"
+
+At this point it is not clear what would be the consequences of this, and
+whether this may lead to any problems, but this patch addresses the issue just
+in case.
+
+Tested-by: hujianyang <hujianyang@huawei.com>
+Reported-by: hujianyang <hujianyang@huawei.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/log.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -106,10 +106,14 @@ static inline long long empty_log_bytes(
+ h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs;
+ t = (long long)c->ltail_lnum * c->leb_size;
+
+- if (h >= t)
++ if (h > t)
+ return c->log_bytes - h + t;
+- else
++ else if (h != t)
+ return t - h;
++ else if (c->lhead_lnum != c->ltail_lnum)
++ return 0;
++ else
++ return c->log_bytes;
+ }
+
+ /**
projects / thirdparty / kernel / stable-queue.git / commitdiff
