--- /dev/null
+From 2279948735609d0d17d7384e776b674619f792ef Mon Sep 17 00:00:00 2001
+From: Frank Schaefer <fschaefer.oss@googlemail.com>
+Date: Mon, 29 Sep 2014 15:17:35 -0300
+Subject: [media] af9005: fix kernel panic on init if compiled without
+ IR
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frank Schaefer <fschaefer.oss@googlemail.com>
+
+commit 2279948735609d0d17d7384e776b674619f792ef upstream.
+
+This patches fixes an ancient bug in the dvb_usb_af9005 driver, which
+has been reported at least in the following threads:
+https://lkml.org/lkml/2009/2/4/350
+https://lkml.org/lkml/2014/9/18/558
+
+If the driver is compiled in without any IR support (neither
+DVB_USB_AF9005_REMOTE nor custom symbols), the symbol_request calls in
+af9005_usb_module_init() return pointers != NULL although the IR
+symbols are not available.
+
+This leads to the following oops:
+...
+[ 8.529751] usbcore: registered new interface driver dvb_usb_af9005
+[ 8.531584] BUG: unable to handle kernel paging request at 02e00000
+[ 8.533385] IP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d
+[ 8.535613] *pde = 00000000
+[ 8.536416] Oops: 0000 [#1] PREEMPT PREEMPT DEBUG_PAGEALLOCDEBUG_PAGEALLOC
+[ 8.537863] CPU: 0 PID: 1 Comm: swapper Not tainted 3.15.0-rc6-00151-ga5c075c #1
+[ 8.539827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
+[ 8.541519] task: 89c9a670 ti: 89c9c000 task.ti: 89c9c000
+[ 8.541519] EIP: 0060:[<7d9d67c6>] EFLAGS: 00010206 CPU: 0
+[ 8.541519] EIP is at af9005_usb_module_init+0x6b/0x9d
+[ 8.541519] EAX: 02e00000 EBX: 00000000 ECX: 00000006 EDX: 00000000
+[ 8.541519] ESI: 00000000 EDI: 7da33ec8 EBP: 89c9df30 ESP: 89c9df2c
+[ 8.541519] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
+[ 8.541519] CR0: 8005003b CR2: 02e00000 CR3: 05a54000 CR4: 00000690
+[ 8.541519] Stack:
+[ 8.541519] 7d9d675b 89c9df90 7d992a49 7d7d5914 89c9df4c 7be3a800 7d08c58c 8a4c3968
+[ 8.541519] 89c9df80 7be3a966 00000192 00000006 00000006 7d7d3ff4 8a4c397a 00000200
+[ 8.541519] 7d6b1280 8a4c3979 00000006 000009a6 7da32db8 b13eec81 00000006 000009a6
+[ 8.541519] Call Trace:
+[ 8.541519] [<7d9d675b>] ? ttusb2_driver_init+0x16/0x16
+[ 8.541519] [<7d992a49>] do_one_initcall+0x77/0x106
+[ 8.541519] [<7be3a800>] ? parameqn+0x2/0x35
+[ 8.541519] [<7be3a966>] ? parse_args+0x113/0x25c
+[ 8.541519] [<7d992bc2>] kernel_init_freeable+0xea/0x167
+[ 8.541519] [<7cf01070>] kernel_init+0x8/0xb8
+[ 8.541519] [<7cf27ec0>] ret_from_kernel_thread+0x20/0x30
+[ 8.541519] [<7cf01068>] ? rest_init+0x10c/0x10c
+[ 8.541519] Code: 08 c2 c7 05 44 ed f9 7d 00 00 e0 02 c7 05 40 ed f9 7d 00 00 e0 02 c7 05 3c ed f9 7d 00 00 e0 02 75 1f b8 00 00 e0 02 85 c0 74 16 <a1> 00 00 e0 02 c7 05 54 84 8e 7d 00 00 e0 02 a3 58 84 8e 7d eb
+[ 8.541519] EIP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d SS:ESP 0068:89c9df2c
+[ 8.541519] CR2: 0000000002e00000
+[ 8.541519] ---[ end trace 768b6faf51370fc7 ]---
+
+The prefered fix would be to convert the whole IR code to use the kernel IR
+infrastructure (which wasn't available at the time this driver had been created).
+
+Until anyone who still has this old hardware steps up an does the conversion,
+fix it by not calling the symbol_request calls if the driver is compiled in
+without the default IR symbols (CONFIG_DVB_USB_AF9005_REMOTE).
+Due to the IR related pointers beeing NULL by default, IR support will then be disabled.
+
+The downside of this solution is, that it will no longer be possible to
+compile custom IR symbols (not using CONFIG_DVB_USB_AF9005_REMOTE) in.
+
+Please note that this patch has NOT been tested with all possible cases.
+I don't have the hardware and could only verify that it fixes the reported
+bug.
+
+Reported-by: Fengguag Wu <fengguang.wu@intel.com>
+Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Acked-by: Luca Olivetti <luca@ventoso.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/af9005.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init
+ err("usb_register failed. (%d)", result);
+ return result;
+ }
++#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
++ /* FIXME: convert to todays kernel IR infrastructure */
+ rc_decode = symbol_request(af9005_rc_decode);
+ rc_keys = symbol_request(rc_map_af9005_table);
+ rc_keys_size = symbol_request(rc_map_af9005_table_size);
++#endif
+ if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
+ err("af9005_rc_decode function not found, disabling remote");
+ af9005_properties.rc.legacy.rc_query = NULL;
--- /dev/null
+From 0145058c3d30b4319d747f64caa16a9cb15f0581 Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Fri, 16 Jan 2015 13:56:38 +0000
+Subject: arm64: partially revert "ARM: 8167/1: extend the reserved memory for initrd to be page aligned"
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 0145058c3d30b4319d747f64caa16a9cb15f0581 upstream.
+
+This patch partially reverts commit 421520ba98290a73b35b7644e877a48f18e06004
+(only the arm64 part). There is no guarantee that the boot-loader places other
+images like dtb in a different page than initrd start/end, especially when the
+kernel is built with 64KB pages. When this happens, such pages must not be
+freed. The free_reserved_area() already takes care of rounding up "start" and
+rounding down "end" to avoid freeing partially used pages.
+
+Reported-by: Peter Maydell <Peter.Maydell@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/init.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -333,14 +333,8 @@ static int keep_initrd;
+
+ void free_initrd_mem(unsigned long start, unsigned long end)
+ {
+- if (!keep_initrd) {
+- if (start == initrd_start)
+- start = round_down(start, PAGE_SIZE);
+- if (end == initrd_end)
+- end = round_up(end, PAGE_SIZE);
+-
++ if (!keep_initrd)
+ free_reserved_area((void *)start, (void *)end, 0, "initrd");
+- }
+ }
+
+ static int __init keepinitrd_setup(char *__unused)
--- /dev/null
+From 25906052d953d3fbdb7e19480b9de5e6bb949f3f Mon Sep 17 00:00:00 2001
+From: Mugunthan V N <mugunthanvnm@ti.com>
+Date: Tue, 13 Jan 2015 17:35:49 +0530
+Subject: drivers: net: cpsw: fix multicast flush in dual emac mode
+
+From: Mugunthan V N <mugunthanvnm@ti.com>
+
+commit 25906052d953d3fbdb7e19480b9de5e6bb949f3f upstream.
+
+Since ALE table is a common resource for both the interfaces in Dual EMAC
+mode and while bringing up the second interface in cpsw_ndo_set_rx_mode()
+all the multicast entries added by the first interface is flushed out and
+only second interface multicast addresses are added. Fixing this by
+flushing multicast addresses based on dual EMAC port vlans which will not
+affect the other emac port multicast addresses.
+
+Fixes: d9ba8f9 (driver: net: ethernet: cpsw: dual emac interface implementation)
+Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/cpsw.c | 11 +++++++++--
+ drivers/net/ethernet/ti/cpsw_ale.c | 10 +++++++++-
+ drivers/net/ethernet/ti/cpsw_ale.h | 2 +-
+ 3 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -610,7 +610,7 @@ static void cpsw_set_promiscious(struct
+
+ /* Clear all mcast from ALE */
+ cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS <<
+- priv->host_port);
++ priv->host_port, -1);
+
+ /* Flood All Unicast Packets to Host port */
+ cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
+@@ -634,6 +634,12 @@ static void cpsw_set_promiscious(struct
+ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
+ {
+ struct cpsw_priv *priv = netdev_priv(ndev);
++ int vid;
++
++ if (priv->data.dual_emac)
++ vid = priv->slaves[priv->emac_port].port_vlan;
++ else
++ vid = priv->data.default_vlan;
+
+ if (ndev->flags & IFF_PROMISC) {
+ /* Enable promiscuous mode */
+@@ -649,7 +655,8 @@ static void cpsw_ndo_set_rx_mode(struct
+ cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+
+ /* Clear all mcast from ALE */
+- cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
++ cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port,
++ vid);
+
+ if (!netdev_mc_empty(ndev)) {
+ struct netdev_hw_addr *ha;
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -234,7 +234,7 @@ static void cpsw_ale_flush_mcast(struct
+ cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
+ }
+
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
+ {
+ u32 ale_entry[ALE_ENTRY_WORDS];
+ int ret, idx;
+@@ -245,6 +245,14 @@ int cpsw_ale_flush_multicast(struct cpsw
+ if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR)
+ continue;
+
++ /* if vid passed is -1 then remove all multicast entry from
++ * the table irrespective of vlan id, if a valid vlan id is
++ * passed then remove only multicast added to that vlan id.
++ * if vlan id doesn't match then move on to next entry.
++ */
++ if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid)
++ continue;
++
+ if (cpsw_ale_get_mcast(ale_entry)) {
+ u8 addr[6];
+
+--- a/drivers/net/ethernet/ti/cpsw_ale.h
++++ b/drivers/net/ethernet/ti/cpsw_ale.h
+@@ -92,7 +92,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale)
+
+ int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout);
+ int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask);
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask);
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid);
+ int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port,
+ int flags, u16 vid);
+ int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port,
--- /dev/null
+From 7485058eea40783ac142a60c3e799fc66ce72583 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 13 Jan 2015 14:03:38 -0500
+Subject: ftrace: Check both notrace and filter for old hash
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 7485058eea40783ac142a60c3e799fc66ce72583 upstream.
+
+Using just the filter for checking for trampolines or regs is not enough
+when updating the code against the records that represent all functions.
+Both the filter hash and the notrace hash need to be checked.
+
+To trigger this bug (using trace-cmd and perf):
+
+ # perf probe -a do_fork
+ # trace-cmd start -B foo -e probe
+ # trace-cmd record -p function_graph -n do_fork sleep 1
+
+The trace-cmd record at the end clears the filter before it disables
+function_graph tracing and then that causes the accounting of the
+ftrace function records to become incorrect and causes ftrace to bug.
+
+Link: http://lkml.kernel.org/r/20150114154329.358378039@goodmis.org
+
+[ still need to switch old_hash_ops to old_ops_hash ]
+Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2308,12 +2308,14 @@ static void ftrace_run_update_code(int c
+ }
+
+ static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
+- struct ftrace_hash *old_hash)
++ struct ftrace_ops_hash *old_hash)
+ {
+ ops->flags |= FTRACE_OPS_FL_MODIFYING;
+- ops->old_hash.filter_hash = old_hash;
++ ops->old_hash.filter_hash = old_hash->filter_hash;
++ ops->old_hash.notrace_hash = old_hash->notrace_hash;
+ ftrace_run_update_code(command);
+ ops->old_hash.filter_hash = NULL;
++ ops->old_hash.notrace_hash = NULL;
+ ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
+ }
+
+@@ -3357,7 +3359,7 @@ static struct ftrace_ops trace_probe_ops
+
+ static int ftrace_probe_registered;
+
+-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
++static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
+ {
+ int ret;
+ int i;
+@@ -3415,6 +3417,7 @@ int
+ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ void *data)
+ {
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_func_probe *entry;
+ struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
+ struct ftrace_hash *old_hash = *orig_hash;
+@@ -3436,6 +3439,10 @@ register_ftrace_function_probe(char *glo
+
+ mutex_lock(&trace_probe_ops.func_hash->regex_lock);
+
++ old_hash_ops.filter_hash = old_hash;
++ /* Probes only have filters */
++ old_hash_ops.notrace_hash = NULL;
++
+ hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+ if (!hash) {
+ count = -ENOMEM;
+@@ -3496,7 +3503,7 @@ register_ftrace_function_probe(char *glo
+
+ ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+
+- __enable_ftrace_function_probe(old_hash);
++ __enable_ftrace_function_probe(&old_hash_ops);
+
+ if (!ret)
+ free_ftrace_hash_rcu(old_hash);
+@@ -3784,7 +3791,7 @@ ftrace_match_addr(struct ftrace_hash *ha
+ }
+
+ static void ftrace_ops_update_code(struct ftrace_ops *ops,
+- struct ftrace_hash *old_hash)
++ struct ftrace_ops_hash *old_hash)
+ {
+ struct ftrace_ops *op;
+
+@@ -3819,6 +3826,7 @@ ftrace_set_hash(struct ftrace_ops *ops,
+ unsigned long ip, int remove, int reset, int enable)
+ {
+ struct ftrace_hash **orig_hash;
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_hash *old_hash;
+ struct ftrace_hash *hash;
+ int ret;
+@@ -3855,9 +3863,11 @@ ftrace_set_hash(struct ftrace_ops *ops,
+
+ mutex_lock(&ftrace_lock);
+ old_hash = *orig_hash;
++ old_hash_ops.filter_hash = ops->func_hash->filter_hash;
++ old_hash_ops.notrace_hash = ops->func_hash->notrace_hash;
+ ret = ftrace_hash_move(ops, enable, orig_hash, hash);
+ if (!ret) {
+- ftrace_ops_update_code(ops, old_hash);
++ ftrace_ops_update_code(ops, &old_hash_ops);
+ free_ftrace_hash_rcu(old_hash);
+ }
+ mutex_unlock(&ftrace_lock);
+@@ -4066,6 +4076,7 @@ static void __init set_ftrace_early_filt
+ int ftrace_regex_release(struct inode *inode, struct file *file)
+ {
+ struct seq_file *m = (struct seq_file *)file->private_data;
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_iterator *iter;
+ struct ftrace_hash **orig_hash;
+ struct ftrace_hash *old_hash;
+@@ -4099,10 +4110,12 @@ int ftrace_regex_release(struct inode *i
+
+ mutex_lock(&ftrace_lock);
+ old_hash = *orig_hash;
++ old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash;
++ old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash;
+ ret = ftrace_hash_move(iter->ops, filter_hash,
+ orig_hash, iter->hash);
+ if (!ret) {
+- ftrace_ops_update_code(iter->ops, old_hash);
++ ftrace_ops_update_code(iter->ops, &old_hash_ops);
+ free_ftrace_hash_rcu(old_hash);
+ }
+ mutex_unlock(&ftrace_lock);
--- /dev/null
+From 8f86f83709c585742dea5dd7f0d2b79c43f992ec Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 13 Jan 2015 11:20:43 -0500
+Subject: ftrace: Fix updating of filters for shared global_ops filters
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 8f86f83709c585742dea5dd7f0d2b79c43f992ec upstream.
+
+As the set_ftrace_filter affects both the function tracer as well as the
+function graph tracer, the ops that represent each have a shared
+ftrace_ops_hash structure. This allows both to be updated when the filter
+files are updated.
+
+But if function graph is enabled and the global_ops (function tracing) ops
+is not, then it is possible that the filter could be changed without the
+update happening for the function graph ops. This will cause the changes
+to not take place and may even cause a ftrace_bug to occur as it could mess
+with the trampoline accounting.
+
+The solution is to check if the ops uses the shared global_ops filter and
+if the ops itself is not enabled, to check if there's another ops that is
+enabled and also shares the global_ops filter. In that case, the
+modification still needs to be executed.
+
+Link: http://lkml.kernel.org/r/20150114154329.055980438@goodmis.org
+
+Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3786,8 +3786,32 @@ ftrace_match_addr(struct ftrace_hash *ha
+ static void ftrace_ops_update_code(struct ftrace_ops *ops,
+ struct ftrace_hash *old_hash)
+ {
+- if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
++ struct ftrace_ops *op;
++
++ if (!ftrace_enabled)
++ return;
++
++ if (ops->flags & FTRACE_OPS_FL_ENABLED) {
+ ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
++ return;
++ }
++
++ /*
++ * If this is the shared global_ops filter, then we need to
++ * check if there is another ops that shares it, is enabled.
++ * If so, we still need to run the modify code.
++ */
++ if (ops->func_hash != &global_ops.local_hash)
++ return;
++
++ do_for_each_ftrace_op(op, ftrace_ops_list) {
++ if (op->func_hash == &global_ops.local_hash &&
++ op->flags & FTRACE_OPS_FL_ENABLED) {
++ ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash);
++ /* Only need to do this once */
++ return;
++ }
++ } while_for_each_ftrace_op(op);
+ }
+
+ static int
--- /dev/null
+From 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Mon, 12 Jan 2015 12:12:03 -0500
+Subject: ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc upstream.
+
+If the function graph tracer traces a jprobe callback, the system will
+crash. This can easily be demonstrated by compiling the jprobe
+sample module that is in the kernel tree, loading it and running the
+function graph tracer.
+
+ # modprobe jprobe_example.ko
+ # echo function_graph > /sys/kernel/debug/tracing/current_tracer
+ # ls
+
+The first two commands end up in a nice crash after the first fork.
+(do_fork has a jprobe attached to it, so "ls" just triggers that fork)
+
+The problem is caused by the jprobe_return() that all jprobe callbacks
+must end with. The way jprobes works is that the function a jprobe
+is attached to has a breakpoint placed at the start of it (or it uses
+ftrace if fentry is supported). The breakpoint handler (or ftrace callback)
+will copy the stack frame and change the ip address to return to the
+jprobe handler instead of the function. The jprobe handler must end
+with jprobe_return() which swaps the stack and does an int3 (breakpoint).
+This breakpoint handler will then put back the saved stack frame,
+simulate the instruction at the beginning of the function it added
+a breakpoint to, and then continue on.
+
+For function tracing to work, it hijakes the return address from the
+stack frame, and replaces it with a hook function that will trace
+the end of the call. This hook function will restore the return
+address of the function call.
+
+If the function tracer traces the jprobe handler, the hook function
+for that handler will not be called, and its saved return address
+will be used for the next function. This will result in a kernel crash.
+
+To solve this, pause function tracing before the jprobe handler is called
+and unpause it before it returns back to the function it probed.
+
+Some other updates:
+
+Used a variable "saved_sp" to hold kcb->jprobe_saved_sp. This makes the
+code look a bit cleaner and easier to understand (various tries to fix
+this bug required this change).
+
+Note, if fentry is being used, jprobes will change the ip address before
+the function graph tracer runs and it will not be able to trace the
+function that the jprobe is probing.
+
+Link: http://lkml.kernel.org/r/20150114154329.552437962@goodmis.org
+
+Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/kprobes/core.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1018,6 +1018,15 @@ int setjmp_pre_handler(struct kprobe *p,
+ regs->flags &= ~X86_EFLAGS_IF;
+ trace_hardirqs_off();
+ regs->ip = (unsigned long)(jp->entry);
++
++ /*
++ * jprobes use jprobe_return() which skips the normal return
++ * path of the function, and this messes up the accounting of the
++ * function graph tracer to get messed up.
++ *
++ * Pause function graph tracing while performing the jprobe function.
++ */
++ pause_graph_tracing();
+ return 1;
+ }
+ NOKPROBE_SYMBOL(setjmp_pre_handler);
+@@ -1046,24 +1055,25 @@ int longjmp_break_handler(struct kprobe
+ struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ u8 *addr = (u8 *) (regs->ip - 1);
+ struct jprobe *jp = container_of(p, struct jprobe, kp);
++ void *saved_sp = kcb->jprobe_saved_sp;
+
+ if ((addr > (u8 *) jprobe_return) &&
+ (addr < (u8 *) jprobe_return_end)) {
+- if (stack_addr(regs) != kcb->jprobe_saved_sp) {
++ if (stack_addr(regs) != saved_sp) {
+ struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
+ printk(KERN_ERR
+ "current sp %p does not match saved sp %p\n",
+- stack_addr(regs), kcb->jprobe_saved_sp);
++ stack_addr(regs), saved_sp);
+ printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
+ show_regs(saved_regs);
+ printk(KERN_ERR "Current registers\n");
+ show_regs(regs);
+ BUG();
+ }
++ /* It's OK to start function graph tracing again */
++ unpause_graph_tracing();
+ *regs = kcb->jprobe_saved_regs;
+- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+- kcb->jprobes_stack,
+- MIN_STACK_SIZE(kcb->jprobe_saved_sp));
++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
+ preempt_enable_no_resched();
+ return 1;
+ }
--- /dev/null
+From 776d4e9f5c0229037707f692b386b1f2a5bac054 Mon Sep 17 00:00:00 2001
+From: Vasu Dev <vasu.dev@intel.com>
+Date: Wed, 14 Jan 2015 05:14:07 -0800
+Subject: i40e: adds FCoE configure option
+
+From: Vasu Dev <vasu.dev@intel.com>
+
+commit 776d4e9f5c0229037707f692b386b1f2a5bac054 upstream.
+
+Adds FCoE config option I40E_FCOE, so that FCoE can be enabled
+as needed but otherwise have it disabled by default.
+
+This also eliminate multiple FCoE config checks, instead now just
+one config check for CONFIG_I40E_FCOE.
+
+The I40E FCoE was added with 3.17 kernel and therefore this patch
+shall be applied to stable 3.17 kernel also.
+
+Signed-off-by: Vasu Dev <vasu.dev@intel.com>
+Tested-by: Jim Young <jamesx.m.young@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
+index 5b8300a32bf5..4d61ef50b465 100644
+--- a/drivers/net/ethernet/intel/Kconfig
++++ b/drivers/net/ethernet/intel/Kconfig
+@@ -281,6 +281,17 @@ config I40E_DCB
+
+ If unsure, say N.
+
++config I40E_FCOE
++ bool "Fibre Channel over Ethernet (FCoE)"
++ default n
++ depends on I40E && DCB && FCOE
++ ---help---
++ Say Y here if you want to use Fibre Channel over Ethernet (FCoE)
++ in the driver. This will create new netdev for exclusive FCoE
++ use with XL710 FCoE offloads enabled.
++
++ If unsure, say N.
++
+ config I40EVF
+ tristate "Intel(R) XL710 X710 Virtual Function Ethernet support"
+ depends on PCI_MSI
+diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile
+index 4b94ddb29c24..c40581999121 100644
+--- a/drivers/net/ethernet/intel/i40e/Makefile
++++ b/drivers/net/ethernet/intel/i40e/Makefile
+@@ -44,4 +44,4 @@ i40e-objs := i40e_main.o \
+ i40e_virtchnl_pf.o
+
+ i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o
+-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o
++i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+index 045b5c4b98b3..ad802dd0f67a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+@@ -78,7 +78,7 @@ do { \
+ } while (0)
+
+ typedef enum i40e_status_code i40e_status;
+-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
++#ifdef CONFIG_I40E_FCOE
+ #define I40E_FCOE
+-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */
++#endif
+ #endif /* _I40E_OSDEP_H_ */
--- /dev/null
+From ea0de4ec5489da0fe738b274effac4f950e93d76 Mon Sep 17 00:00:00 2001
+From: Dylan Rajaratnam <dylan.rajaratnam@imgtec.com>
+Date: Mon, 17 Nov 2014 09:17:45 -0300
+Subject: [media] img-ir/hw: Always read data to clear buffer
+
+From: Dylan Rajaratnam <dylan.rajaratnam@imgtec.com>
+
+commit ea0de4ec5489da0fe738b274effac4f950e93d76 upstream.
+
+A problem was found on Polaris where if the unit it booted via the power
+button on the infrared remote then the next button press on the remote
+would return the key code used to power on the unit.
+
+The sequence is:
+ - The polaris powered off but with the powerdown controller (PDC) block
+ still powered.
+ - Press power key on remote, IR block receives the key.
+ - Kernel starts, IR code is in IMG_IR_DATA_x but neither IMG_IR_RXDVAL
+ or IMG_IR_RXDVALD2 are set.
+ - Wait any amount of time.
+ - Press any key.
+ - IMG_IR_RXDVAL or IMG_IR_RXDVALD2 is set but IMG_IR_DATA_x is
+ unchanged since the powerup key data was never read.
+
+This is worked around by always reading the IMG_IR_DATA_x in
+img_ir_set_decoder(), rather than only when the IMG_IR_RXDVAL or
+IMG_IR_RXDVALD2 bit is set.
+
+Signed-off-by: Dylan Rajaratnam <dylan.rajaratnam@imgtec.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/img-ir/img-ir-hw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/rc/img-ir/img-ir-hw.c
++++ b/drivers/media/rc/img-ir/img-ir-hw.c
+@@ -541,10 +541,12 @@ static void img_ir_set_decoder(struct im
+ if (ir_status & (IMG_IR_RXDVAL | IMG_IR_RXDVALD2)) {
+ ir_status &= ~(IMG_IR_RXDVAL | IMG_IR_RXDVALD2);
+ img_ir_write(priv, IMG_IR_STATUS, ir_status);
+- img_ir_read(priv, IMG_IR_DATA_LW);
+- img_ir_read(priv, IMG_IR_DATA_UP);
+ }
+
++ /* always read data to clear buffer if IR wakes the device */
++ img_ir_read(priv, IMG_IR_DATA_LW);
++ img_ir_read(priv, IMG_IR_DATA_UP);
++
+ /* stop the end timer and switch back to normal mode */
+ del_timer_sync(&hw->end_timer);
+ hw->mode = IMG_IR_M_NORMAL;
--- /dev/null
+From ac03086067a5524ae9e020ba5712a208c67b2736 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 1 Dec 2014 09:55:10 -0300
+Subject: [media] img-ir/hw: Fix potential deadlock stopping timer
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit ac03086067a5524ae9e020ba5712a208c67b2736 upstream.
+
+The end timer is used for switching back from repeat code timings when
+no repeat codes have been received for a certain amount of time. When
+the protocol is changed, the end timer is deleted synchronously with
+del_timer_sync(), however this takes place while holding the main spin
+lock, and the timer handler also needs to acquire the spin lock.
+
+This opens the possibility of a deadlock on an SMP system if the
+protocol is changed just as the repeat timer is expiring. One CPU could
+end up in img_ir_set_decoder() holding the lock and waiting for the end
+timer to complete, while the other CPU is stuck in the timer handler
+spinning on the lock held by the first CPU.
+
+Lockdep also spots a possible lock inversion in the same code, since
+img_ir_set_decoder() acquires the img-ir lock before the timer lock, but
+the timer handler will try and acquire them the other way around:
+
+=========================================================
+[ INFO: possible irq lock inversion dependency detected ]
+3.18.0-rc5+ #957 Not tainted
+---------------------------------------------------------
+swapper/0/0 just changed the state of lock:
+ (((&hw->end_timer))){+.-...}, at: [<4006ae5c>] _call_timer_fn+0x0/0xfc
+but this lock was taken by another, HARDIRQ-safe lock in the past:
+ (&(&priv->lock)->rlock#2){-.....}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(((&hw->end_timer)));
+ local_irq_disable();
+ lock(&(&priv->lock)->rlock#2);
+ lock(((&hw->end_timer)));
+ <Interrupt>
+ lock(&(&priv->lock)->rlock#2);
+
+ *** DEADLOCK ***
+
+This is fixed by releasing the main spin lock while performing the
+del_timer_sync() call. The timer is prevented from restarting before the
+lock is reacquired by a new "stopping" flag which img_ir_handle_data()
+checks before updating the timer.
+
+---------------------------------------------------------
+swapper/0/0 just changed the state of lock:
+ (((&hw->end_timer))){+.-...}, at: [<4006ae5c>] _call_timer_fn+0x0/0xfc
+but this lock was taken by another, HARDIRQ-safe lock in the past:
+ (&(&priv->lock)->rlock#2){-.....}
+and interrupts could create inverse lock ordering between them.
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+ CPU0 CPU1
+ ---- ----
+ lock(((&hw->end_timer)));
+ local_irq_disable();
+ lock(&(&priv->lock)->rlock#2);
+ lock(((&hw->end_timer)));
+ <Interrupt>
+ lock(&(&priv->lock)->rlock#2);
+ *** DEADLOCK ***
+This is fixed by releasing the main spin lock while performing the
+del_timer_sync() call. The timer is prevented from restarting before the
+lock is reacquired by a new "stopping" flag which img_ir_handle_data()
+checks before updating the timer.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/img-ir/img-ir-hw.c | 22 +++++++++++++++++++---
+ drivers/media/rc/img-ir/img-ir-hw.h | 3 +++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/rc/img-ir/img-ir-hw.c
++++ b/drivers/media/rc/img-ir/img-ir-hw.c
+@@ -530,6 +530,22 @@ static void img_ir_set_decoder(struct im
+ u32 ir_status, irq_en;
+ spin_lock_irq(&priv->lock);
+
++ /*
++ * First record that the protocol is being stopped so that the end timer
++ * isn't restarted while we're trying to stop it.
++ */
++ hw->stopping = true;
++
++ /*
++ * Release the lock to stop the end timer, since the end timer handler
++ * acquires the lock and we don't want to deadlock waiting for it.
++ */
++ spin_unlock_irq(&priv->lock);
++ del_timer_sync(&hw->end_timer);
++ spin_lock_irq(&priv->lock);
++
++ hw->stopping = false;
++
+ /* switch off and disable interrupts */
+ img_ir_write(priv, IMG_IR_CONTROL, 0);
+ irq_en = img_ir_read(priv, IMG_IR_IRQ_ENABLE);
+@@ -547,8 +563,7 @@ static void img_ir_set_decoder(struct im
+ img_ir_read(priv, IMG_IR_DATA_LW);
+ img_ir_read(priv, IMG_IR_DATA_UP);
+
+- /* stop the end timer and switch back to normal mode */
+- del_timer_sync(&hw->end_timer);
++ /* switch back to normal mode */
+ hw->mode = IMG_IR_M_NORMAL;
+
+ /* clear the wakeup scancode filter */
+@@ -819,7 +834,8 @@ static void img_ir_handle_data(struct im
+ }
+
+
+- if (dec->repeat) {
++ /* we mustn't update the end timer while trying to stop it */
++ if (dec->repeat && !hw->stopping) {
+ unsigned long interval;
+
+ img_ir_begin_repeat(priv);
+--- a/drivers/media/rc/img-ir/img-ir-hw.h
++++ b/drivers/media/rc/img-ir/img-ir-hw.h
+@@ -214,6 +214,8 @@ enum img_ir_mode {
+ * @flags: IMG_IR_F_*.
+ * @filters: HW filters (derived from scancode filters).
+ * @mode: Current decode mode.
++ * @stopping: Indicates that decoder is being taken down and timers
++ * should not be restarted.
+ * @suspend_irqen: Saved IRQ enable mask over suspend.
+ */
+ struct img_ir_priv_hw {
+@@ -229,6 +231,7 @@ struct img_ir_priv_hw {
+ struct img_ir_filter filters[RC_FILTER_MAX];
+
+ enum img_ir_mode mode;
++ bool stopping;
+ u32 suspend_irqen;
+ };
+
--- /dev/null
+From c93edc639392df733c7d72db4376a9add775d18a Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Wed, 31 Dec 2014 19:30:15 +0200
+Subject: iwlwifi: mvm: fix Rx with both chains
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit c93edc639392df733c7d72db4376a9add775d18a upstream.
+
+commit 5c90422439d6
+"iwlwifi: mvm: don't allow diversity if BT Coex / TT forbid it"
+broke Rx with 2 chains for diversity.
+This had an impact on throughput where we're using only a single
+stream (11a/b/g APs, single stream APs, static SMPS).
+
+Fixes: 5c90422439d6 ("iwlwifi: mvm: don't allow diversity if BT Coex / TT forbid it")
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
+index e56e77ef5d2e..917431e30f74 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
+@@ -665,7 +665,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+ if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+ return false;
+
+- if (!mvm->cfg->rx_with_siso_diversity)
++ if (mvm->cfg->rx_with_siso_diversity)
+ return false;
+
+ ieee80211_iterate_active_interfaces_atomic(
--- /dev/null
+From 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 Mon Sep 17 00:00:00 2001
+From: Simon Guinot <simon.guinot@sequanux.org>
+Date: Tue, 2 Dec 2014 07:32:10 -0800
+Subject: leds: netxbig: fix oops at probe time
+
+From: Simon Guinot <simon.guinot@sequanux.org>
+
+commit 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 upstream.
+
+This patch fixes a NULL pointer dereference on led_dat->mode_val. Due to
+this bug, a kernel oops can be observed at probe time on the LaCie 2Big
+and 5Big v2 boards:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+[...]
+[<c03f244c>] (netxbig_led_probe) from [<c02c8c6c>] (platform_drv_probe+0x4c/0x9c)
+[<c02c8c6c>] (platform_drv_probe) from [<c02c72d0>] (driver_probe_device+0x98/0x25c)
+[<c02c72d0>] (driver_probe_device) from [<c02c7520>] (__driver_attach+0x8c/0x90)
+[<c02c7520>] (__driver_attach) from [<c02c5c24>] (bus_for_each_dev+0x68/0x94)
+[<c02c5c24>] (bus_for_each_dev) from [<c02c6408>] (bus_add_driver+0x124/0x1dc)
+[<c02c6408>] (bus_add_driver) from [<c02c7ac0>] (driver_register+0x78/0xf8)
+[<c02c7ac0>] (driver_register) from [<c000888c>] (do_one_initcall+0x80/0x1cc)
+[<c000888c>] (do_one_initcall) from [<c0733618>] (kernel_init_freeable+0xe4/0x1b4)
+[<c0733618>] (kernel_init_freeable) from [<c058db9c>] (kernel_init+0xc/0xec)
+[<c058db9c>] (kernel_init) from [<c0009850>] (ret_from_fork+0x14/0x24)
+[...]
+
+This bug was introduced by commit 588a6a99286ae30afb1339d8bc2163517b1b7dd1
+("leds: netxbig: fix attribute-creation race").
+
+Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Bryan Wu <cooloney@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
+index 26515c27ea8c..25e419752a7b 100644
+--- a/drivers/leds/leds-netxbig.c
++++ b/drivers/leds/leds-netxbig.c
+@@ -330,18 +330,18 @@ create_netxbig_led(struct platform_device *pdev,
+ led_dat->sata = 0;
+ led_dat->cdev.brightness = LED_OFF;
+ led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
+- /*
+- * If available, expose the SATA activity blink capability through
+- * a "sata" sysfs attribute.
+- */
+- if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
+- led_dat->cdev.groups = netxbig_led_groups;
+ led_dat->mode_addr = template->mode_addr;
+ led_dat->mode_val = template->mode_val;
+ led_dat->bright_addr = template->bright_addr;
+ led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1;
+ led_dat->timer = pdata->timer;
+ led_dat->num_timer = pdata->num_timer;
++ /*
++ * If available, expose the SATA activity blink capability through
++ * a "sata" sysfs attribute.
++ */
++ if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
++ led_dat->cdev.groups = netxbig_led_groups;
+
+ return led_classdev_register(&pdev->dev, &led_dat->cdev);
+ }
--- /dev/null
+From 52d304eb4eaced9ad04b64ba7cd6ceb5153bbf18 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 13 Jan 2015 15:17:43 +1300
+Subject: locks: fix NULL-deref in generic_delete_lease
+
+From: NeilBrown <neilb@suse.de>
+
+commit 52d304eb4eaced9ad04b64ba7cd6ceb5153bbf18 upstream.
+
+commit 0efaa7e82f02fe69c05ad28e905f31fc86e6f08e
+ locks: generic_delete_lease doesn't need a file_lock at all
+
+moves the call to fl->fl_lmops->lm_change() to a place in the
+code where fl might be a non-lease lock.
+When that happens, fl_lmops is NULL and an Oops ensures.
+
+So add an extra test to restore correct functioning.
+
+Reported-by: Linda Walsh <suse@tlinx.org>
+Link: https://bugzilla.suse.com/show_bug.cgi?id=912569
+Fixes: 0efaa7e82f02fe69c05ad28e905f31fc86e6f08e
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/locks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1702,7 +1702,7 @@ static int generic_delete_lease(struct f
+ break;
+ }
+ trace_generic_delete_lease(inode, fl);
+- if (fl)
++ if (fl && IS_LEASE(fl))
+ error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose);
+ spin_unlock(&inode->i_lock);
+ locks_dispose_list(&dispose);
--- /dev/null
+From b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Thu, 25 Dec 2014 00:37:46 +0200
+Subject: mei: clean reset bit before reset
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 upstream.
+
+H_RST bit in H_CSR register may be found lit before reset is started,
+for example if preceding reset flow hasn't completed.
+In that case asserting H_RST will be ignored, therefore we need to clean
+H_RST bit to start a successful reset sequence.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -234,6 +234,18 @@ static int mei_me_hw_reset(struct mei_de
+ struct mei_me_hw *hw = to_me_hw(dev);
+ u32 hcsr = mei_hcsr_read(hw);
+
++ /* H_RST may be found lit before reset is started,
++ * for example if preceding reset flow hasn't completed.
++ * In that case asserting H_RST will be ignored, therefore
++ * we need to clean H_RST bit to start a successful reset sequence.
++ */
++ if ((hcsr & H_RST) == H_RST) {
++ dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
++ hcsr &= ~H_RST;
++ mei_me_reg_write(hw, H_CSR, hcsr);
++ hcsr = mei_hcsr_read(hw);
++ }
++
+ hcsr |= H_RST | H_IG | H_IS;
+
+ if (intr_enable)
--- /dev/null
+From 3cbc6123a93dc91b99b58f7ea37d267fe93e1cad Mon Sep 17 00:00:00 2001
+From: Tim Kryger <tim.kryger@gmail.com>
+Date: Wed, 14 Jan 2015 07:24:12 +0100
+Subject: mmc: sdhci: Set SDHCI_POWER_ON with external vmmc
+
+From: Tim Kryger <tim.kryger@gmail.com>
+
+commit 3cbc6123a93dc91b99b58f7ea37d267fe93e1cad upstream.
+
+Host controllers lacking the required internal vmmc regulator may still
+follow the spec with regard to the LSB of SDHCI_POWER_CONTROL. Set the
+SDHCI_POWER_ON bit when vmmc is enabled to encourage the controller to
+to drive CMD, DAT, SDCLK.
+
+This fixes a regression observed on some Qualcomm and Nvidia boards
+caused by 5222161 mmc: sdhci: Improve external VDD regulator support.
+
+Fixes: 52221610dd84 (mmc: sdhci: Improve external VDD regulator support)
+Signed-off-by: Tim Kryger <tim.kryger@gmail.com>
+Tested-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1239,6 +1239,12 @@ static void sdhci_set_power(struct sdhci
+ spin_unlock_irq(&host->lock);
+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+ spin_lock_irq(&host->lock);
++
++ if (mode != MMC_POWER_OFF)
++ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
++ else
++ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
++
+ return;
+ }
+
--- /dev/null
+From 1fc0703af3143914a389bfa081c7acb09502ed5d Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 2 Jan 2015 16:25:08 -0500
+Subject: NFSv4.1: Fix client id trunking on Linux
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 1fc0703af3143914a389bfa081c7acb09502ed5d upstream.
+
+Currently, our trunking code will check for session trunking, but will
+fail to detect client id trunking. This is a problem, because it means
+that the client will fail to recognise that the two connections represent
+shared state, even if they do not permit a shared session.
+By removing the check for the server minor id, and only checking the
+major id, we will end up doing the right thing in both cases: we close
+down the new nfs_client and fall back to using the existing one.
+
+Fixes: 05f4c350ee02e ("NFS: Discover NFSv4 server trunking when mounting")
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4client.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -572,20 +572,14 @@ static bool nfs4_match_clientids(struct
+ }
+
+ /*
+- * Returns true if the server owners match
++ * Returns true if the server major ids match
+ */
+ static bool
+-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
++nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
+ {
+ struct nfs41_server_owner *o1 = a->cl_serverowner;
+ struct nfs41_server_owner *o2 = b->cl_serverowner;
+
+- if (o1->minor_id != o2->minor_id) {
+- dprintk("NFS: --> %s server owner minor IDs do not match\n",
+- __func__);
+- return false;
+- }
+-
+ if (o1->major_id_sz != o2->major_id_sz)
+ goto out_major_mismatch;
+ if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
+@@ -661,7 +655,12 @@ int nfs41_walk_client_list(struct nfs_cl
+ if (!nfs4_match_clientids(pos, new))
+ continue;
+
+- if (!nfs4_match_serverowners(pos, new))
++ /*
++ * Note that session trunking is just a special subcase of
++ * client id trunking. In either case, we want to fall back
++ * to using the existing nfs_client.
++ */
++ if (!nfs4_check_clientid_trunking(pos, new))
+ continue;
+
+ atomic_inc(&pos->cl_count);
--- /dev/null
+From bfe5fda8e7ced129716f5741cf7ed2592a338824 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Tue, 6 Jan 2015 21:12:08 +1100
+Subject: powernv: Fix OPAL tracepoint code
+
+From: Anton Blanchard <anton@samba.org>
+
+commit bfe5fda8e7ced129716f5741cf7ed2592a338824 upstream.
+
+Patch c49f63530bb6 ("powernv: Add OPAL tracepoints") has a spurious
+store to the stack:
+
+ ld r12,opal_tracepoint_refcount@toc(r2); \
+ std r12,32(r1); \
+
+The store was originally used to save the current tracepoint status
+so the entry and the exit tracepoints were always balanced. In the
+end I just created a separate path when tracepoints are enabled.
+
+The offset on the stack used for this store is not valid for ABIv2
+and it causes strange issues. I noticed it because OPAL console input
+was broken.
+
+Fixes: c49f63530bb6 ("powernv: Add OPAL tracepoints")
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/opal-wrappers.S | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
+@@ -40,7 +40,6 @@ BEGIN_FTR_SECTION; \
+ b 1f; \
+ END_FTR_SECTION(0, 1); \
+ ld r12,opal_tracepoint_refcount@toc(r2); \
+- std r12,32(r1); \
+ cmpdi r12,0; \
+ bne- LABEL; \
+ 1:
storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch
net-ethernet-cpsw-fix-hangs-with-interrupts.patch
x86-build-clean-auto-generated-processor-feature-files.patch
+video-logo-prevent-use-of-logos-after-they-have-been-freed.patch
+video-fbdev-fix-defio-s-fsync.patch
+smiapp-pll-correct-clock-debug-prints.patch
+af9005-fix-kernel-panic-on-init-if-compiled-without.patch
+smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch
+sound-simplify-au0828-quirk-table.patch
+sound-update-au0828-quirks-table.patch
+uvcvideo-fix-destruction-order-in-uvc_delete.patch
+img-ir-hw-always-read-data-to-clear-buffer.patch
+img-ir-hw-fix-potential-deadlock-stopping-timer.patch
+vivid-fix-crop_bounds-typo-for-video-output.patch
+vfio-pci-fix-the-check-on-pci-device-type-in.patch
+locks-fix-null-deref-in-generic_delete_lease.patch
+powernv-fix-opal-tracepoint-code.patch
+mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch
+arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch
+iwlwifi-mvm-fix-rx-with-both-chains.patch
+i40e-adds-fcoe-configure-option.patch
+drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch
+leds-netxbig-fix-oops-at-probe-time.patch
+ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch
+ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch
+ftrace-check-both-notrace-and-filter-for-old-hash.patch
+nfsv4.1-fix-client-id-trunking-on-linux.patch
+mei-clean-reset-bit-before-reset.patch
--- /dev/null
+From bc47150ab93988714d1fab7bc82fe5f505a107ad Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Tue, 1 Apr 2014 10:22:46 -0300
+Subject: [media] smiapp-pll: Correct clock debug prints
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit bc47150ab93988714d1fab7bc82fe5f505a107ad upstream.
+
+The PLL flags were not used correctly.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/smiapp-pll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/smiapp-pll.c
++++ b/drivers/media/i2c/smiapp-pll.c
+@@ -67,7 +67,7 @@ static void print_pll(struct device *dev
+ {
+ dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div);
+ dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier);
+- if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
+ dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
+ }
+@@ -77,7 +77,7 @@ static void print_pll(struct device *dev
+ dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
+ dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
+ dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
+- if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
+ pll->op_sys_clk_freq_hz);
+ dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
--- /dev/null
+From f85698cd296f08218a7750f321e94607da128600 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Tue, 16 Sep 2014 15:57:07 -0300
+Subject: [media] smiapp: Take mutex during PLL update in sensor initialisation
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit f85698cd296f08218a7750f321e94607da128600 upstream.
+
+The mutex does not serialise anything in this case but avoids a lockdep
+warning from the control framework.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2677,7 +2677,9 @@ static int smiapp_registered(struct v4l2
+ pll->flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS;
+ pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
+
++ mutex_lock(&sensor->mutex);
+ rval = smiapp_update_mode(sensor);
++ mutex_unlock(&sensor->mutex);
+ if (rval) {
+ dev_err(&client->dev, "update mode failed\n");
+ goto out_nvm_release;
--- /dev/null
+From 5d1f00a20d2d56ed480e64e938a2391353ee565b Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Thu, 30 Oct 2014 07:53:04 -0300
+Subject: [media] sound: simplify au0828 quirk table
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit 5d1f00a20d2d56ed480e64e938a2391353ee565b upstream.
+
+Add a macro to simplify au0828 quirk table. That makes easier
+to check it against the USB IDs at drivers/media/usb/au0828/au0828-cards.c.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/au0828/au0828-cards.c | 5 +
+ sound/usb/quirks-table.h | 158 ++++++--------------------------
+ 2 files changed, 36 insertions(+), 127 deletions(-)
+
+--- a/drivers/media/usb/au0828/au0828-cards.c
++++ b/drivers/media/usb/au0828/au0828-cards.c
+@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *p
+ au0828_clear(dev, REG_000, 0x10);
+ }
+
++/*
++ * WARNING: There's a quirks table at sound/usb/quirks-table.h
++ * that should also be updated every time a new device with V4L2 support
++ * is added here.
++ */
+ struct au0828_board au0828_boards[] = {
+ [AU0828_BOARD_UNKNOWN] = {
+ .name = "Unknown board",
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2804,133 +2804,37 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
+-/* Hauppauge HVR-950Q and HVR-850 */
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-850",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
++/*
++ * Auvitek au0828 devices with audio interface.
++ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c
++ * Please notice that some drivers are DVB only, and don't need to be
++ * here. That's the case, for example, of DVICO_FUSIONHDTV7.
++ */
++
++#define AU0828_DEVICE(vid, pid, vname, pname) { \
++ USB_DEVICE_VENDOR_SPEC(vid, pid), \
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
++ USB_DEVICE_ID_MATCH_INT_CLASS | \
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
++ .bInterfaceClass = USB_CLASS_AUDIO, \
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \
++ .vendor_name = vname, \
++ .product_name = pname, \
++ .ifnum = QUIRK_ANY_INTERFACE, \
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER, \
++ } \
++}
++
++AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
++AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
+
+ /* Digidesign Mbox */
+ {
--- /dev/null
+From 678fa12fb8e75c6dc1e781a02e3ddbbba7e1a904 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Thu, 30 Oct 2014 07:53:05 -0300
+Subject: [media] sound: Update au0828 quirks table
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit 678fa12fb8e75c6dc1e781a02e3ddbbba7e1a904 upstream.
+
+The au0828 quirks table is currently not in sync with the au0828
+media driver.
+
+Syncronize it and put them on the same order as found at au0828
+driver, as all the au0828 devices with analog TV need the
+same quirks.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks-table.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2827,14 +2827,22 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+
+ AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
+ AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
+-AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
+ AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+
+ /* Digidesign Mbox */
+ {
--- /dev/null
+From 2228d80dd05a4fc5a410fde847677b8fb3eb23d7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 24 Oct 2014 05:10:20 -0300
+Subject: [media] uvcvideo: Fix destruction order in uvc_delete()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2228d80dd05a4fc5a410fde847677b8fb3eb23d7 upstream.
+
+We've got a bug report at disconnecting a Webcam, where the kernel
+spews warnings like below:
+ WARNING: CPU: 0 PID: 8385 at ../fs/sysfs/group.c:219 sysfs_remove_group+0x87/0x90()
+ sysfs group c0b2350c not found for kobject 'event3'
+ CPU: 0 PID: 8385 Comm: queue2:src Not tainted 3.16.2-1.gdcee397-default #1
+ Hardware name: ASUSTeK Computer INC. A7N8X-E/A7N8X-E, BIOS ASUS A7N8X-E Deluxe ACPI BIOS Rev 1013 11/12/2004
+ c08d0705 ddc75cbc c0718c5b ddc75ccc c024b654 c08c6d44 ddc75ce8 000020c1
+ c08d0705 000000db c03d1ec7 c03d1ec7 00000009 00000000 c0b2350c d62c9064
+ ddc75cd4 c024b6a3 00000009 ddc75ccc c08c6d44 ddc75ce8 ddc75cfc c03d1ec7
+ Call Trace:
+ [<c0205ba6>] try_stack_unwind+0x156/0x170
+ [<c02046f3>] dump_trace+0x53/0x180
+ [<c0205c06>] show_trace_log_lvl+0x46/0x50
+ [<c0204871>] show_stack_log_lvl+0x51/0xe0
+ [<c0205c67>] show_stack+0x27/0x50
+ [<c0718c5b>] dump_stack+0x3e/0x4e
+ [<c024b654>] warn_slowpath_common+0x84/0xa0
+ [<c024b6a3>] warn_slowpath_fmt+0x33/0x40
+ [<c03d1ec7>] sysfs_remove_group+0x87/0x90
+ [<c05a2c54>] device_del+0x34/0x180
+ [<c05e3989>] evdev_disconnect+0x19/0x50
+ [<c05e06fa>] __input_unregister_device+0x9a/0x140
+ [<c05e0845>] input_unregister_device+0x45/0x80
+ [<f854b1d6>] uvc_delete+0x26/0x110 [uvcvideo]
+ [<f84d66f8>] v4l2_device_release+0x98/0xc0 [videodev]
+ [<c05a25bb>] device_release+0x2b/0x90
+ [<c04ad8bf>] kobject_cleanup+0x6f/0x1a0
+ [<f84d5453>] v4l2_release+0x43/0x70 [videodev]
+ [<c0372f31>] __fput+0xb1/0x1b0
+ [<c02650c1>] task_work_run+0x91/0xb0
+ [<c024d845>] do_exit+0x265/0x910
+ [<c024df64>] do_group_exit+0x34/0xa0
+ [<c025a76f>] get_signal_to_deliver+0x17f/0x590
+ [<c0201b6a>] do_signal+0x3a/0x960
+ [<c02024f7>] do_notify_resume+0x67/0x90
+ [<c071ebb5>] work_notifysig+0x30/0x3b
+ [<b7739e60>] 0xb7739e5f
+ ---[ end trace b1e56095a485b631 ]---
+
+The cause is that uvc_status_cleanup() is called after usb_put_*() in
+uvc_delete(). usb_put_*() removes the sysfs parent and eventually
+removes the children recursively, so the later device_del() can't find
+its sysfs. The fix is simply rearrange the call orders in
+uvc_delete() so that the child is removed before the parent.
+
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=897736
+Reported-and-tested-by: Martin Pluskal <mpluskal@suse.com>
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/uvc/uvc_driver.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1623,12 +1623,12 @@ static void uvc_delete(struct uvc_device
+ {
+ struct list_head *p, *n;
+
+- usb_put_intf(dev->intf);
+- usb_put_dev(dev->udev);
+-
+ uvc_status_cleanup(dev);
+ uvc_ctrl_cleanup_device(dev);
+
++ usb_put_intf(dev->intf);
++ usb_put_dev(dev->udev);
++
+ if (dev->vdev.dev)
+ v4l2_device_unregister(&dev->vdev);
+ #ifdef CONFIG_MEDIA_CONTROLLER
--- /dev/null
+From 7c2e211f3c95b91912a92a8c6736343690042e2e Mon Sep 17 00:00:00 2001
+From: Wei Yang <weiyang@linux.vnet.ibm.com>
+Date: Wed, 7 Jan 2015 10:29:11 -0700
+Subject: vfio-pci: Fix the check on pci device type in
+ vfio_pci_probe()
+
+From: Wei Yang <weiyang@linux.vnet.ibm.com>
+
+commit 7c2e211f3c95b91912a92a8c6736343690042e2e upstream.
+
+Current vfio-pci just supports normal pci device, so vfio_pci_probe() will
+return if the pci device is not a normal device. While current code makes a
+mistake. PCI_HEADER_TYPE is the offset in configuration space of the device
+type, but we use this value to mask the type value.
+
+This patch fixs this by do the check directly on the pci_dev->hdr_type.
+
+Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vfio/pci/vfio_pci.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -839,13 +839,11 @@ static const struct vfio_device_ops vfio
+
+ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+- u8 type;
+ struct vfio_pci_device *vdev;
+ struct iommu_group *group;
+ int ret;
+
+- pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
+- if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
++ if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
+ return -EINVAL;
+
+ group = iommu_group_get(&pdev->dev);
--- /dev/null
+From 30ea9c5218651bc11cbdba7820be78f04e2d83bc Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Fri, 19 Dec 2014 13:55:41 +0200
+Subject: video/fbdev: fix defio's fsync
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+commit 30ea9c5218651bc11cbdba7820be78f04e2d83bc upstream.
+
+fb_deferred_io_fsync() returns the value of schedule_delayed_work() as
+an error code, but schedule_delayed_work() does not return an error. It
+returns true/false depending on whether the work was already queued.
+
+Fix this by ignoring the return value of schedule_delayed_work().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/core/fb_defio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/core/fb_defio.c
++++ b/drivers/video/fbdev/core/fb_defio.c
+@@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *fi
+ cancel_delayed_work_sync(&info->deferred_work);
+
+ /* Run it immediately */
+- err = schedule_delayed_work(&info->deferred_work, 0);
++ schedule_delayed_work(&info->deferred_work, 0);
+ mutex_unlock(&inode->i_mutex);
+- return err;
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
+
--- /dev/null
+From 92b004d1aa9f367c372511ca0330f58216b25703 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 18 Dec 2014 13:40:06 +0200
+Subject: video/logo: prevent use of logos after they have been freed
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+commit 92b004d1aa9f367c372511ca0330f58216b25703 upstream.
+
+If the probe of an fb driver has been deferred due to missing
+dependencies, and the probe is later ran when a module is loaded, the
+fbdev framework will try to find a logo to use.
+
+However, the logos are __initdata, and have already been freed. This
+causes sometimes page faults, if the logo memory is not mapped,
+sometimes other random crashes as the logo data is invalid, and
+sometimes nothing, if the fbdev decides to reject the logo (e.g. the
+random value depicting the logo's height is too big).
+
+This patch adds a late_initcall function to mark the logos as freed. In
+reality the logos are freed later, and fbdev probe may be ran between
+this late_initcall and the freeing of the logos. In that case we will
+miss drawing the logo, even if it would be possible.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/logo/logo.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/logo/logo.c
++++ b/drivers/video/logo/logo.c
+@@ -21,6 +21,21 @@ static bool nologo;
+ module_param(nologo, bool, 0);
+ MODULE_PARM_DESC(nologo, "Disables startup logo");
+
++/*
++ * Logos are located in the initdata, and will be freed in kernel_init.
++ * Use late_init to mark the logos as freed to prevent any further use.
++ */
++
++static bool logos_freed;
++
++static int __init fb_logo_late_init(void)
++{
++ logos_freed = true;
++ return 0;
++}
++
++late_initcall(fb_logo_late_init);
++
+ /* logo's are marked __initdata. Use __init_refok to tell
+ * modpost that it is intended that this function uses data
+ * marked __initdata.
+@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok f
+ {
+ const struct linux_logo *logo = NULL;
+
+- if (nologo)
++ if (nologo || logos_freed)
+ return NULL;
+
+ if (depth >= 1) {
--- /dev/null
+From bb9ff078860f9d2f79d3a6bea3af9f48354ddb75 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Sat, 6 Dec 2014 07:30:03 -0300
+Subject: [media] vivid: fix CROP_BOUNDS typo for video output
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit bb9ff078860f9d2f79d3a6bea3af9f48354ddb75 upstream.
+
+An error was returned if composing was not supported, instead of if
+cropping was not supported.
+
+A classic copy-and-paste bug. Found with v4l2-compliance.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/vivid/vivid-vid-out.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -612,7 +612,7 @@ int vivid_vid_out_g_selection(struct fil
+ sel->r = dev->fmt_out_rect;
+ break;
+ case V4L2_SEL_TGT_CROP_BOUNDS:
+- if (!dev->has_compose_out)
++ if (!dev->has_crop_out)
+ return -EINVAL;
+ sel->r = vivid_max_rect;
+ break;
projects / thirdparty / kernel / stable-queue.git / commitdiff
