From: Greg Kroah-Hartman Date: Thu, 30 Jul 2015 00:25:13 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v4.1.4~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=38f8b34c9f4bac245ffe307e0a8348b9da559838;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: af9013-don-t-accept-invalid-bandwidth.patch asoc-arizona-fix-noise-generator-gain-tlv.patch asoc-imx-wm8962-add-a-missing-error-check.patch asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch asoc-qcom-remove-incorrect-dependencies.patch asoc-rt5645-init-jack_detect_work-before-registering-irq.patch asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch ath9k-fix-dma-stop-sequence-for-ar9003.patch ath9k_htc-memory-corruption-calling-set_bit.patch bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch bufferhead-add-_gfp-version-for-sb_getblk.patch cx18-add-missing-caps-for-the-pcm-video-device.patch cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch ext4-fix-fencepost-error-in-lazytime-optimization.patch ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch hid-sensor-fix-suspend-resume-delay.patch i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch i2c-use-parent-adapter-quirks-in-mux.patch ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch iio-abi-clarify-proximity-output-value.patch iio-accel-bmc150-accel-fix-counting-direction.patch iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch iio-adc-cc10001_adc-fix-kconfig-dependency.patch iio-adc-rockchip_saradc-add-missing-module_-data.patch iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch iio-light-cm3323-clear-bitmask-before-set.patch iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch iio-proximity-sx9500-fix-proximity-value.patch iio-tmp006-check-channel-info-on-write.patch iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch libata-add-ata_horkage_notrim.patch libata-do-not-blacklist-m510dc.patch libata-do-not-blacklist-micron-m500dc.patch libata-expose-trim-capability-in-sysfs.patch libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch libata-force-disable-trim-for-supersspeed-s238.patch libata-increase-the-timeout-when-setting-transfer-mode.patch media-fix-regression-in-some-more-dib0700-based-devices.patch nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch rc-core-fix-dib0700-scancode-generation-for-rc5.patch rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch saa7164-fix-querycap-warning.patch staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch --- diff --git a/queue-4.1/af9013-don-t-accept-invalid-bandwidth.patch b/queue-4.1/af9013-don-t-accept-invalid-bandwidth.patch new file mode 100644 index 00000000000..68a896c0aee --- /dev/null +++ b/queue-4.1/af9013-don-t-accept-invalid-bandwidth.patch @@ -0,0 +1,35 @@ +From d7b76c91f471413de9ded837bddeca2164786571 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Tue, 28 Apr 2015 19:02:19 -0300 +Subject: [media] af9013: Don't accept invalid bandwidth + +From: Mauro Carvalho Chehab + +commit d7b76c91f471413de9ded837bddeca2164786571 upstream. + +If userspace sends an invalid bandwidth, it should either return +EINVAL or switch to auto mode. + +This driver will go past an array and program the hardware on a +wrong way if this happens. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/af9013.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/dvb-frontends/af9013.c ++++ b/drivers/media/dvb-frontends/af9013.c +@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dv + } + } + ++ /* Return an error if can't find bandwidth or the right clock */ ++ if (i == ARRAY_SIZE(coeff_lut)) ++ return -EINVAL; ++ + ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val, + sizeof(coeff_lut[i].val)); + } diff --git a/queue-4.1/asoc-arizona-fix-noise-generator-gain-tlv.patch b/queue-4.1/asoc-arizona-fix-noise-generator-gain-tlv.patch new file mode 100644 index 00000000000..36cc9be7b12 --- /dev/null +++ b/queue-4.1/asoc-arizona-fix-noise-generator-gain-tlv.patch @@ -0,0 +1,56 @@ +From 15575ed544910464715df5c45a44b9732e415b93 Mon Sep 17 00:00:00 2001 +From: Richard Fitzgerald +Date: Thu, 28 May 2015 14:28:12 +0100 +Subject: ASoC: arizona: Fix noise generator gain TLV + +From: Richard Fitzgerald + +commit 15575ed544910464715df5c45a44b9732e415b93 upstream. + +The Arizona codec drivers had an incorrect dB scaling for the +noise generator gain that started at 0dB and went upwards. +Actually the highest setting is 0dB. + +Signed-off-by: Richard Fitzgerald +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm5102.c | 2 +- + sound/soc/codecs/wm5110.c | 2 +- + sound/soc/codecs/wm8997.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/wm5102.c ++++ b/sound/soc/codecs/wm5102.c +@@ -42,7 +42,7 @@ struct wm5102_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct wm_adsp_region wm5102_dsp1_regions[] = { +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_s + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + #define WM5110_NG_SRC(name, base) \ +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -40,7 +40,7 @@ struct wm8997_priv { + static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); + static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); + static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); +-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); ++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); + static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); + + static const struct reg_default wm8997_sysclk_reva_patch[] = { diff --git a/queue-4.1/asoc-imx-wm8962-add-a-missing-error-check.patch b/queue-4.1/asoc-imx-wm8962-add-a-missing-error-check.patch new file mode 100644 index 00000000000..be3329d45c9 --- /dev/null +++ b/queue-4.1/asoc-imx-wm8962-add-a-missing-error-check.patch @@ -0,0 +1,37 @@ +From 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 10 Jun 2015 18:37:23 +0300 +Subject: ASoC: imx-wm8962: Add a missing error check + +From: Dan Carpenter + +commit 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 upstream. + +My static checker complains that: + + sound/soc/fsl/imx-wm8962.c:196 imx_wm8962_probe() warn: + we tested 'ret' before and it was 'false' + +The intent was that we use "ret" to check imx_audmux_v2_configure_port(). + +Fixes: 8de2ae2a7f1f ('ASoC: fsl: add imx-wm8962 machine driver') +Signed-off-by: Dan Carpenter +Otherwise, Acked-by: Nicolin Chen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/imx-wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/fsl/imx-wm8962.c ++++ b/sound/soc/fsl/imx-wm8962.c +@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platf + dev_err(&pdev->dev, "audmux internal port setup failed\n"); + return ret; + } +- imx_audmux_v2_configure_port(ext_port, ++ ret = imx_audmux_v2_configure_port(ext_port, + IMX_AUDMUX_V2_PTCR_SYN, + IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)); + if (ret) { diff --git a/queue-4.1/asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch b/queue-4.1/asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch new file mode 100644 index 00000000000..7bdc89a99ac --- /dev/null +++ b/queue-4.1/asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch @@ -0,0 +1,32 @@ +From 0b51601d4504f46f585eed823485101390f0b588 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Tue, 26 May 2015 20:35:08 +0800 +Subject: ASoC: max98925: Fix mask for setting DAI invert mode + +From: Axel Lin + +commit 0b51601d4504f46f585eed823485101390f0b588 upstream. + +The M98925_DAI_WCI_MASK bit is not updated with current code. +To properly set the DAI invert mode, the mask should be +M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/max98925.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/max98925.c ++++ b/sound/soc/codecs/max98925.c +@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct s + } + + regmap_update_bits(max98925->regmap, MAX98925_FORMAT, +- M98925_DAI_BCI_MASK, invert); ++ M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert); + return 0; + } + diff --git a/queue-4.1/asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch b/queue-4.1/asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch new file mode 100644 index 00000000000..7ca0c711c73 --- /dev/null +++ b/queue-4.1/asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch @@ -0,0 +1,56 @@ +From 0574eab363ace70ef275d4caad6eadc458d33728 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 19 May 2015 14:47:32 +0200 +Subject: ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again + +From: Arnd Bergmann + +commit 0574eab363ace70ef275d4caad6eadc458d33728 upstream. + +I tried to fix this before and submitted a working patch, but after +some discussion we came up with what seemed to be a nicer solution, +resulting in commit 3d4cf65e2d ("ASoC: omap: fix up +SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency"). Unfortunately, that +version was incomplete, and we still get this build error: + +drivers/clk/clk-palmas.c:46:16: error: field 'hw' has incomplete type +drivers/clk/clk-palmas.c: In function 'to_palmas_clks_info': +drivers/clk/clk-palmas.c:54:74: warning: initialization from incompatible pointer type [-Winc + +This happens only in randconfig builds that turn on MFD_PALMAS +on a platform other than OMAP2+ when COMPILE_TEST is set +but COMMON_CLK is not. + +The new approach is only 'select COMMON_CLK_PALMAS' if we know +that we are on an OMAP5 platform and MFD_PALMAS is already set. +This patch has survived thousands of randconfig builds and I +don't see a remaining hole in the logic. + +Fixes: 3d4cf65e2d ("ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency") +Signed-off-by: Arnd Bergmann +Acked-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/omap/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/sound/soc/omap/Kconfig ++++ b/sound/soc/omap/Kconfig +@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030 + + config SND_OMAP_SOC_OMAP_ABE_TWL6040 + tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec" +- depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST) ++ depends on TWL6040_CORE && SND_OMAP_SOC ++ depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST + select SND_OMAP_SOC_DMIC + select SND_OMAP_SOC_MCPDM + select SND_SOC_TWL6040 + select SND_SOC_DMIC +- select COMMON_CLK_PALMAS if MFD_PALMAS ++ select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS) + help + Say Y if you want to add support for SoC audio on OMAP boards using + ABE and twl6040 codec. This driver currently supports: diff --git a/queue-4.1/asoc-qcom-remove-incorrect-dependencies.patch b/queue-4.1/asoc-qcom-remove-incorrect-dependencies.patch new file mode 100644 index 00000000000..112a5312528 --- /dev/null +++ b/queue-4.1/asoc-qcom-remove-incorrect-dependencies.patch @@ -0,0 +1,43 @@ +From a7310c496f376b945e7e61f64d69c9c0a93ee1ee Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 21 May 2015 11:07:08 +0200 +Subject: ASoC: qcom: remove incorrect dependencies + +From: Arnd Bergmann + +commit a7310c496f376b945e7e61f64d69c9c0a93ee1ee upstream. + +Compile-tests show a warning for the newly added SND_SOC_STORM +symbol: + +warning: (SND_SOC_STORM) selects SND_SOC_LPASS_CPU which has unmet direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && SND_SOC_QCOM) + +The problem is that it can be selected for COMPILE_TEST on non-QCOM +builds, but the symbols it selects have a dependency. +Dropping the dependencies makes it work without warnings and no +other side-effects, because these are not user-visible. + +Signed-off-by: Arnd Bergmann +Fixes: f380dd3f3cd ("ASoC: qcom: Add ability to build QCOM drivers") +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/qcom/Kconfig | 2 -- + 1 file changed, 2 deletions(-) + +--- a/sound/soc/qcom/Kconfig ++++ b/sound/soc/qcom/Kconfig +@@ -6,12 +6,10 @@ config SND_SOC_QCOM + + config SND_SOC_LPASS_CPU + tristate +- depends on SND_SOC_QCOM + select REGMAP_MMIO + + config SND_SOC_LPASS_PLATFORM + tristate +- depends on SND_SOC_QCOM + select REGMAP_MMIO + + config SND_SOC_STORM diff --git a/queue-4.1/asoc-rt5645-init-jack_detect_work-before-registering-irq.patch b/queue-4.1/asoc-rt5645-init-jack_detect_work-before-registering-irq.patch new file mode 100644 index 00000000000..4849fe32ae3 --- /dev/null +++ b/queue-4.1/asoc-rt5645-init-jack_detect_work-before-registering-irq.patch @@ -0,0 +1,41 @@ +From 7ea3470a7277380248135a592a849e1c27960b2f Mon Sep 17 00:00:00 2001 +From: Nicolas Boichat +Date: Fri, 5 Jun 2015 18:42:12 +0800 +Subject: ASoC: rt5645: Init jack_detect_work before registering irq + +From: Nicolas Boichat + +commit 7ea3470a7277380248135a592a849e1c27960b2f upstream. + +Prevents frequent panic on boot, if the irq handler rt5645_irq +gets called before the workqueue rt5645_jack_detect_work is +initialized. + +Signed-off-by: Nicolas Boichat +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5645.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_c + } + } + ++ INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); ++ + if (rt5645->i2c->irq) { + ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING +@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_c + dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n"); + } + +- INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); +- + return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645, + rt5645_dai, ARRAY_SIZE(rt5645_dai)); + } diff --git a/queue-4.1/asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch b/queue-4.1/asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch new file mode 100644 index 00000000000..9b5f958b5f2 --- /dev/null +++ b/queue-4.1/asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch @@ -0,0 +1,30 @@ +From 1cf0f44811b754b64283b11ef0e60cb0de07b29c Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Thu, 4 Jun 2015 16:04:15 +0300 +Subject: ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry + +From: Peter Ujfalusi + +commit 1cf0f44811b754b64283b11ef0e60cb0de07b29c upstream. + +SOC_DAPM_SINGLE("Playback AMP", ..) should not be under kcontrols. It +causes kernel crash (NULL pointer) when the mixers are listed. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tas2552.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/codecs/tas2552.c ++++ b/sound/soc/codecs/tas2552.c +@@ -338,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7, + static const struct snd_kcontrol_new tas2552_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Driver Playback Volume", + TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv), +- SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0), + }; + + static const struct reg_default tas2552_init_regs[] = { diff --git a/queue-4.1/asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch b/queue-4.1/asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch new file mode 100644 index 00000000000..c392c725487 --- /dev/null +++ b/queue-4.1/asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch @@ -0,0 +1,32 @@ +From 80ba2669ec8c3e6517aa935001f6cb8809bf3df4 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Thu, 4 Jun 2015 16:04:14 +0300 +Subject: ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card + +From: Peter Ujfalusi + +commit 80ba2669ec8c3e6517aa935001f6cb8809bf3df4 upstream. + +If the card is not part of any card the tas_data->codec is NULL since it is +set only during snd_soc_codec_driver.probe, which is not yet called. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tas2552.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/soc/codecs/tas2552.c ++++ b/sound/soc/codecs/tas2552.c +@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct t + { + u8 cfg1_reg; + ++ if (!tas_data->codec) ++ return; ++ + if (sw_shutdown) + cfg1_reg = 0; + else diff --git a/queue-4.1/asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch b/queue-4.1/asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch new file mode 100644 index 00000000000..627734710b0 --- /dev/null +++ b/queue-4.1/asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch @@ -0,0 +1,55 @@ +From 14ba3ec1de043260cecd9e828ea2e3a0ad302893 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Sun, 10 May 2015 11:35:06 +0800 +Subject: ASoC: wm8737: Fixup setting VMID Impedance control register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Axel Lin + +commit 14ba3ec1de043260cecd9e828ea2e3a0ad302893 upstream. + +According to the datasheet: +R10 (0Ah) VMID Impedance Control + +BIT 3:2 VMIDSEL DEFAULT 00 + +DESCRIPTION: VMID impedance selection control +00: 75kΩ output +01: 300kΩ output +10: 2.5kΩ output + +WM8737_VMIDSEL_MASK is 0xC (VMIDSEL - [3:2]), +so it needs to left shift WM8737_VMIDSEL_SHIFT bits for setting these bits. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8737.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -483,7 +483,8 @@ static int wm8737_set_bias_level(struct + + /* Fast VMID ramp at 2*2.5k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 0x4); ++ WM8737_VMIDSEL_MASK, ++ 2 << WM8737_VMIDSEL_SHIFT); + + /* Bring VMID up */ + snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, +@@ -497,7 +498,8 @@ static int wm8737_set_bias_level(struct + + /* VMID at 2*300k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 2); ++ WM8737_VMIDSEL_MASK, ++ 1 << WM8737_VMIDSEL_SHIFT); + + break; + diff --git a/queue-4.1/asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch b/queue-4.1/asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch new file mode 100644 index 00000000000..9bfacf18a69 --- /dev/null +++ b/queue-4.1/asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch @@ -0,0 +1,40 @@ +From ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 11 May 2015 09:04:06 +0800 +Subject: ASoC: wm8903: Fix define for WM8903_VMID_RES_250K +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Axel Lin + +commit ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 upstream. + +VMID Control 0 BIT[2:1] is VMID Divider Enable and Select + +00 = VMID disabled (for OFF mode) +01 = 2 x 50kΩ divider (for normal operation) +10 = 2 x 250kΩ divider (for low power standby) +11 = 2 x 5kΩ divider (for fast start-up) + +So WM8903_VMID_RES_250K should be 2 << 1, which is 4. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8903.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8903.h ++++ b/sound/soc/codecs/wm8903.h +@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_ + #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ + + #define WM8903_VMID_RES_50K 2 +-#define WM8903_VMID_RES_250K 3 ++#define WM8903_VMID_RES_250K 4 + #define WM8903_VMID_RES_5K 6 + + /* diff --git a/queue-4.1/asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch b/queue-4.1/asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch new file mode 100644 index 00000000000..4dd447fc38f --- /dev/null +++ b/queue-4.1/asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch @@ -0,0 +1,32 @@ +From 12c350050538c7dc779c083b7342bfd20f74949c Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Fri, 15 May 2015 09:15:16 +0800 +Subject: ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits + +From: Axel Lin + +commit 12c350050538c7dc779c083b7342bfd20f74949c upstream. + +WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than +WM8955_PLL_CONTROL_2. + +Signed-off-by: Axel Lin +Acked-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8955.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(str + snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, + WM8955_K_17_9_MASK, + (pll.k >> 9) & WM8955_K_17_9_MASK); +- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, ++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, + WM8955_K_8_0_MASK, + pll.k & WM8955_K_8_0_MASK); + if (pll.k) diff --git a/queue-4.1/asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch b/queue-4.1/asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch new file mode 100644 index 00000000000..3d4446865e1 --- /dev/null +++ b/queue-4.1/asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch @@ -0,0 +1,31 @@ +From a077e81ec61e07a7f86997d045109f06719fbffe Mon Sep 17 00:00:00 2001 +From: Zidan Wang +Date: Thu, 11 Jun 2015 19:14:36 +0800 +Subject: ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] + +From: Zidan Wang + +commit a077e81ec61e07a7f86997d045109f06719fbffe upstream. + +the enum of "DAC Polarity" should be wm8960_enum[1]. + +Signed-off-by: Zidan Wang +Acked-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", W + SOC_ENUM("ADC Polarity", wm8960_enum[0]), + SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), + +-SOC_ENUM("DAC Polarity", wm8960_enum[2]), ++SOC_ENUM("DAC Polarity", wm8960_enum[1]), + SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, + wm8960_get_deemph, wm8960_put_deemph), + diff --git a/queue-4.1/ath9k-fix-dma-stop-sequence-for-ar9003.patch b/queue-4.1/ath9k-fix-dma-stop-sequence-for-ar9003.patch new file mode 100644 index 00000000000..679f996be50 --- /dev/null +++ b/queue-4.1/ath9k-fix-dma-stop-sequence-for-ar9003.patch @@ -0,0 +1,42 @@ +From 300f77c08ded96d33f492aaa02549103852f0c12 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 2 Jun 2015 10:38:32 +0200 +Subject: ath9k: fix DMA stop sequence for AR9003+ + +From: Felix Fietkau + +commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream. + +AR93xx and newer needs to stop rx before tx to avoid getting the DMA +engine or MAC into a stuck state. +This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam. + +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/main.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath + ath_stop_ani(sc); + ath9k_hw_disable_interrupts(ah); + +- if (!ath_drain_all_txq(sc)) +- ret = false; +- +- if (!ath_stoprecv(sc)) +- ret = false; ++ if (AR_SREV_9300_20_OR_LATER(ah)) { ++ ret &= ath_stoprecv(sc); ++ ret &= ath_drain_all_txq(sc); ++ } else { ++ ret &= ath_drain_all_txq(sc); ++ ret &= ath_stoprecv(sc); ++ } + + return ret; + } diff --git a/queue-4.1/ath9k_htc-memory-corruption-calling-set_bit.patch b/queue-4.1/ath9k_htc-memory-corruption-calling-set_bit.patch new file mode 100644 index 00000000000..76fd295de87 --- /dev/null +++ b/queue-4.1/ath9k_htc-memory-corruption-calling-set_bit.patch @@ -0,0 +1,47 @@ +From 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 14 May 2015 11:34:48 +0300 +Subject: ath9k_htc: memory corruption calling set_bit() + +From: Dan Carpenter + +commit 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e upstream. + +In d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags') we +changed things like this: + +- if (priv->op_flags & OP_TSF_RESET) { ++ if (test_bit(OP_TSF_RESET, &priv->op_flags)) { + +The problem is that test_bit() takes a bit number and not a mask. It +means that when we do: + + set_bit(OP_TSF_RESET, &priv->op_flags); + +Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a +bit which is past the end of the unsigned long. + +Fixes: d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags') +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex + } + #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */ + +-#define OP_BT_PRIORITY_DETECTED BIT(3) +-#define OP_BT_SCAN BIT(4) +-#define OP_TSF_RESET BIT(6) ++#define OP_BT_PRIORITY_DETECTED 3 ++#define OP_BT_SCAN 4 ++#define OP_TSF_RESET 6 + + enum htc_op_flags { + HTC_FWFLAG_NO_RMW, diff --git a/queue-4.1/bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch b/queue-4.1/bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch new file mode 100644 index 00000000000..1723d08d647 --- /dev/null +++ b/queue-4.1/bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch @@ -0,0 +1,47 @@ +From 7bee8b08c428b63aa4a3765bb907602e36355378 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Tue, 14 Jul 2015 16:25:30 -0400 +Subject: Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple + +From: Chris Mason + +commit 7bee8b08c428b63aa4a3765bb907602e36355378 upstream. + +Commit 1c8ba6d013 moved around the setup code for broadcomm chips, +and also added btbcm_read_verbose_config() to read extra information +about the hardware. It's returning errors on some macbooks: + +Bluetooth: hci0: BCM: Read verbose config info failed (-16) + +Which makes us error out of the setup function. Since this +probe isn't critical to operate the chip, this patch just changes +things to carry on when it fails. + +Signed-off-by: Chris Mason +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btbcm.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hd + + /* Read Verbose Config Version Info */ + skb = btbcm_read_verbose_config(hdev); +- if (IS_ERR(skb)) +- return PTR_ERR(skb); +- +- BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1], +- get_unaligned_le16(skb->data + 5)); +- kfree_skb(skb); ++ if (!IS_ERR(skb)) { ++ BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1], ++ get_unaligned_le16(skb->data + 5)); ++ kfree_skb(skb); ++ } + + set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); + diff --git a/queue-4.1/bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch b/queue-4.1/bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch new file mode 100644 index 00000000000..37e3bf6e5fe --- /dev/null +++ b/queue-4.1/bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch @@ -0,0 +1,63 @@ +From 2eeac871697ac24a77b6d7953bd711b490e83ac7 Mon Sep 17 00:00:00 2001 +From: Aleksei Volkov +Date: Mon, 8 Jun 2015 12:02:10 +0300 +Subject: Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle + +From: Aleksei Volkov + +commit 2eeac871697ac24a77b6d7953bd711b490e83ac7 upstream. + +That patch corrects the typo in usb vendor id for Roper Class 1 Bluetooth +Dongle. Problem with typo is present since 4.0 kernel. + +Content /sys/kernel/debug/usb/devices for these dongle: + +T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1310 ProdID=0001 Rev=15.00 +S: Manufacturer=SiW +S: Product=SiW +S: SerialNumber=E7BB050D0B00 +C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr= 50mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Aleksei Volkov +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -268,7 +268,7 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, + + /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ +- { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE }, ++ { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, + + /* Digianswer devices */ + { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, diff --git a/queue-4.1/bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch b/queue-4.1/bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch new file mode 100644 index 00000000000..adc44549daf --- /dev/null +++ b/queue-4.1/bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch @@ -0,0 +1,31 @@ +From ecffc80478cdce122f0ecb6a4e4f909132dd5c47 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sun, 7 Jun 2015 09:42:19 +0200 +Subject: Bluetooth: btusb: Fix memory leak in Intel setup routine + +From: Marcel Holtmann + +commit ecffc80478cdce122f0ecb6a4e4f909132dd5c47 upstream. + +The SKB returned from the Intel specific version information command is +missing a kfree_skb. + +Signed-off-by: Marcel Holtmann +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_ + } + fw_ptr = fw->data; + ++ kfree_skb(skb); ++ + /* This Intel specific command enables the manufacturer mode of the + * controller. + * diff --git a/queue-4.1/bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch b/queue-4.1/bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch new file mode 100644 index 00000000000..d549248a4b5 --- /dev/null +++ b/queue-4.1/bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch @@ -0,0 +1,101 @@ +From e66890a96abbb746e1229c3067471be36dc49b34 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sun, 7 Jun 2015 09:47:08 +0200 +Subject: Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 + +From: Marcel Holtmann + +commit e66890a96abbb746e1229c3067471be36dc49b34 upstream. + +This patch fixes the command length alignment issue for Intel Bluetooth +8260. + +The length of parameters in the firmware downloading command must be +multiplication of 4. If not, the command must append Intel_NOP command +with extra parameters, zeros, at the end, and the firmware file is +already included Intel_NOP command for alignment. + +This patch checks the next command and if the next command is Intel_NOP +command, it reads the Intel_NOP command and send them together. + +For example, if the data from the firmware file looks like this: +8E FC 03 11 22 33 02 FC 03 00 00 00 + +Previously, btusb sends two commands: +09 FC 06 8E FC 03 11 22 33 +09 FC 06 02 FC 03 00 00 00 + +This won't work because the length of parameters are 6 which violates +the 4 byte alignment. + +This patch will append them together and send as one command: +09 FC 0C 8E FC 03 11 22 33 02 FC 03 00 00 00 + +Based on previous work from Tedd Ho-Jeong An + +Reported-by: Tedd Ho-Jeong An +Signed-off-by: Marcel Holtmann +Tested-by: Tedd Ho-Jeong An +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2336,6 +2336,7 @@ static int btusb_setup_intel_new(struct + struct intel_boot_params *params; + const struct firmware *fw; + const u8 *fw_ptr; ++ u32 frag_len; + char fwname[64]; + ktime_t calltime, delta, rettime; + unsigned long long duration; +@@ -2542,24 +2543,33 @@ static int btusb_setup_intel_new(struct + } + + fw_ptr = fw->data + 644; ++ frag_len = 0; + + while (fw_ptr - fw->data < fw->size) { +- struct hci_command_hdr *cmd = (void *)fw_ptr; +- u8 cmd_len; ++ struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); + +- cmd_len = sizeof(*cmd) + cmd->plen; ++ frag_len += sizeof(*cmd) + cmd->plen; + +- /* Send each command from the firmware data buffer as +- * a single Data fragment. ++ /* The paramter length of the secure send command requires ++ * a 4 byte alignment. It happens so that the firmware file ++ * contains proper Intel_NOP commands to align the fragments ++ * as needed. ++ * ++ * Send set of commands with 4 byte alignment from the ++ * firmware data buffer as a single Data fragement. + */ +- err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr); +- if (err < 0) { +- BT_ERR("%s: Failed to send firmware data (%d)", +- hdev->name, err); +- goto done; +- } ++ if (!(frag_len % 4)) { ++ err = btusb_intel_secure_send(hdev, 0x01, frag_len, ++ fw_ptr); ++ if (err < 0) { ++ BT_ERR("%s: Failed to send firmware data (%d)", ++ hdev->name, err); ++ goto done; ++ } + +- fw_ptr += cmd_len; ++ fw_ptr += frag_len; ++ frag_len = 0; ++ } + } + + set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); diff --git a/queue-4.1/bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch b/queue-4.1/bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch new file mode 100644 index 00000000000..28386e852bb --- /dev/null +++ b/queue-4.1/bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch @@ -0,0 +1,80 @@ +From 781f899f2f9d8b71e35225a087f90052059486c5 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sat, 6 Jun 2015 06:06:49 +0200 +Subject: Bluetooth: Fix race condition with user channel and setup stage + +From: Marcel Holtmann + +commit 781f899f2f9d8b71e35225a087f90052059486c5 upstream. + +During the initial setup stage of a controller, the low-level transport +is actually active. This means that HCI_UP is true. To avoid toggling +the transport off and back on again for normal operation the kernel +holds a grace period with HCI_AUTO_OFF that will turn the low-level +transport off in case no user is present. + +The idea of the grace period is important to avoid having to initialize +all of the controller twice. So legacy ioctl and the new management +interface knows how to clear this grace period and then start normal +operation. + +For the user channel operation this grace period has not been taken into +account which results in the problem that HCI_UP and HCI_AUTO_OFF are +set and the kernel will return EBUSY. However from a system point of +view the controller is ready to be grabbed by either the ioctl, the +management interface or the user channel. + +This patch brings the user channel to the same level as the other two +entries for operating a controller. + +Signed-off-by: Marcel Holtmann +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_sock.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket * + goto done; + } + +- if (test_bit(HCI_UP, &hdev->flags) || +- test_bit(HCI_INIT, &hdev->flags) || ++ if (test_bit(HCI_INIT, &hdev->flags) || + hci_dev_test_flag(hdev, HCI_SETUP) || +- hci_dev_test_flag(hdev, HCI_CONFIG)) { ++ hci_dev_test_flag(hdev, HCI_CONFIG) || ++ (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && ++ test_bit(HCI_UP, &hdev->flags))) { + err = -EBUSY; + hci_dev_put(hdev); + goto done; +@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket * + + err = hci_dev_open(hdev->id); + if (err) { +- hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); +- mgmt_index_added(hdev); +- hci_dev_put(hdev); +- goto done; ++ if (err == -EALREADY) { ++ /* In case the transport is already up and ++ * running, clear the error here. ++ * ++ * This can happen when opening an user ++ * channel and HCI_AUTO_OFF grace period ++ * is still active. ++ */ ++ err = 0; ++ } else { ++ hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); ++ mgmt_index_added(hdev); ++ hci_dev_put(hdev); ++ goto done; ++ } + } + + atomic_inc(&hdev->promisc); diff --git a/queue-4.1/bufferhead-add-_gfp-version-for-sb_getblk.patch b/queue-4.1/bufferhead-add-_gfp-version-for-sb_getblk.patch new file mode 100644 index 00000000000..429bb40033e --- /dev/null +++ b/queue-4.1/bufferhead-add-_gfp-version-for-sb_getblk.patch @@ -0,0 +1,41 @@ +From bd7ade3cd9b0850264306f5c2b79024a417b6396 Mon Sep 17 00:00:00 2001 +From: Nikolay Borisov +Date: Thu, 2 Jul 2015 01:32:44 -0400 +Subject: bufferhead: Add _gfp version for sb_getblk() + +From: Nikolay Borisov + +commit bd7ade3cd9b0850264306f5c2b79024a417b6396 upstream. + +sb_getblk() is used during ext4 (and possibly other FSes) writeback +paths. Sometimes such path require allocating memory and guaranteeing +that such allocation won't block. Currently, however, there is no way +to provide user flags for sb_getblk which could lead to deadlocks. + +This patch implements a sb_getblk_gfp with the only difference it can +accept user-provided GFP flags. + +Signed-off-by: Nikolay Borisov +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/buffer_head.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector + return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE); + } + ++ ++static inline struct buffer_head * ++sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp) ++{ ++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp); ++} ++ + static inline struct buffer_head * + sb_find_get_block(struct super_block *sb, sector_t block) + { diff --git a/queue-4.1/cx18-add-missing-caps-for-the-pcm-video-device.patch b/queue-4.1/cx18-add-missing-caps-for-the-pcm-video-device.patch new file mode 100644 index 00000000000..1a557b65e45 --- /dev/null +++ b/queue-4.1/cx18-add-missing-caps-for-the-pcm-video-device.patch @@ -0,0 +1,76 @@ +From 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Fri, 24 Apr 2015 03:55:07 -0300 +Subject: [media] cx18: add missing caps for the PCM video device + +From: Hans Verkuil + +commit 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 upstream. + +The cx18 PCM video device didn't have any capabilities set, which caused a warnings +in the v4l2 core: + +[ 6.229393] ------------[ cut here ]------------ +[ 6.229414] WARNING: CPU: 1 PID: 593 at +drivers/media/v4l2-core/v4l2-ioctl.c:1025 v4l_querycap+0x41/0x70 +[videodev]() +[ 6.229415] Modules linked in: cx18_alsa mxl5005s s5h1409 +tuner_simple tuner_types cs5345 tuner intel_rapl iosf_mbi +x86_pkg_temp_thermal coretemp raid1 snd_hda_codec_realtek kvm_intel +snd_hda_codec_generic snd_hda_codec_hdmi kvm snd_oxygen(+) snd_hda_intel +snd_oxygen_lib snd_hda_controller snd_hda_codec snd_mpu401_uart iTCO_wdt +snd_rawmidi iTCO_vendor_support snd_hwdep crct10dif_pclmul crc32_pclmul +crc32c_intel snd_seq cx18 snd_seq_device ghash_clmulni_intel +videobuf_vmalloc tveeprom cx2341x snd_pcm serio_raw videobuf_core vfat +dvb_core fat v4l2_common snd_timer videodev snd lpc_ich i2c_i801 joydev +mfd_core mei_me media soundcore tpm_infineon soc_button_array tpm_tis +mei shpchp tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc +i915 nouveau mxm_wmi wmi e1000e ttm i2c_algo_bit drm_kms_helper +[ 6.229444] drm ptp pps_core video +[ 6.229446] CPU: 1 PID: 593 Comm: v4l_id Not tainted +3.19.3-200.fc21.x86_64 #1 +[ 6.229447] Hardware name: Gigabyte Technology Co., Ltd. +Z87-D3HP/Z87-D3HP-CF, BIOS F6 01/20/2014 +[ 6.229448] 0000000000000000 00000000d12b1131 ffff88042dacfc28 +ffffffff8176e215 +[ 6.229449] 0000000000000000 0000000000000000 ffff88042dacfc68 +ffffffff8109bc1a +[ 6.229451] ffffffffa0594000 ffff88042dacfd90 0000000000000000 +ffffffffa04e2140 +[ 6.229452] Call Trace: +[ 6.229466] [] dump_stack+0x45/0x57 +[ 6.229469] [] warn_slowpath_common+0x8a/0xc0 +[ 6.229472] [] warn_slowpath_null+0x1a/0x20 +[ 6.229474] [] v4l_querycap+0x41/0x70 [videodev] +[ 6.229477] [] __video_do_ioctl+0x29c/0x320 [videodev] +[ 6.229479] [] ? do_last+0x2f1/0x1210 +[ 6.229491] [] video_usercopy+0x366/0x5d0 [videodev] +[ 6.229494] [] ? v4l_querycap+0x70/0x70 [videodev] +[ 6.229497] [] video_ioctl2+0x15/0x20 [videodev] +[ 6.229499] [] v4l2_ioctl+0x164/0x180 [videodev] +[ 6.229501] [] do_vfs_ioctl+0x2f8/0x500 +[ 6.229502] [] SyS_ioctl+0x81/0xa0 +[ 6.229505] [] system_call_fastpath+0x12/0x17 +[ 6.229506] ---[ end trace dacd80d4b19277ea ]--- + +Added the necessary capabilities to stop this warning. + +Signed-off-by: Hans Verkuil +Reported-by: Laura Abbott +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/cx18/cx18-streams.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/pci/cx18/cx18-streams.c ++++ b/drivers/media/pci/cx18/cx18-streams.c +@@ -90,6 +90,7 @@ static struct { + "encoder PCM audio", + VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET, + PCI_DMA_FROMDEVICE, ++ V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE, + }, + { /* CX18_ENC_STREAM_TYPE_IDX */ + "encoder IDX", diff --git a/queue-4.1/cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch b/queue-4.1/cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch new file mode 100644 index 00000000000..65d0649e46c --- /dev/null +++ b/queue-4.1/cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch @@ -0,0 +1,44 @@ +From 1fa2337a315a2448c5434f41e00d56b01a22283c Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Tue, 28 Apr 2015 18:51:17 -0300 +Subject: [media] cx24116: fix a buffer overflow when checking userspace params + +From: Mauro Carvalho Chehab + +commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream. + +The maximum size for a DiSEqC command is 6, according to the +userspace API. However, the code allows to write up much more values: + drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/cx24116.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struc + struct cx24116_state *state = fe->demodulator_priv; + int i, ret; + ++ /* Validate length */ ++ if (d->msg_len > sizeof(d->msg)) ++ return -EINVAL; ++ + /* Dump DiSEqC message */ + if (debug) { + printk(KERN_INFO "cx24116: %s(", __func__); +@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struc + printk(") toneburst=%d\n", toneburst); + } + +- /* Validate length */ +- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) +- return -EINVAL; +- + /* DiSEqC message */ + for (i = 0; i < d->msg_len; i++) + state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; diff --git a/queue-4.1/cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch b/queue-4.1/cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch new file mode 100644 index 00000000000..4713f946e9a --- /dev/null +++ b/queue-4.1/cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch @@ -0,0 +1,31 @@ +From 82e3b88b679049f043fe9b03991d6d66fc0a43c8 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Tue, 28 Apr 2015 19:03:59 -0300 +Subject: [media] cx24117: fix a buffer overflow when checking userspace params + +From: Mauro Carvalho Chehab + +commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream. + +The maximum size for a DiSEqC command is 6, according to the +userspace API. However, the code allows to write up much more values: + drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/cx24117.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb-frontends/cx24117.c ++++ b/drivers/media/dvb-frontends/cx24117.c +@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struc + dev_dbg(&state->priv->i2c->dev, ")\n"); + + /* Validate length */ +- if (d->msg_len > 15) ++ if (d->msg_len > sizeof(d->msg)) + return -EINVAL; + + /* DiSEqC message */ diff --git a/queue-4.1/ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch b/queue-4.1/ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch new file mode 100644 index 00000000000..3e339d0560a --- /dev/null +++ b/queue-4.1/ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch @@ -0,0 +1,49 @@ +From c45653c341f5c8a0ce19c8f0ad4678640849cb86 Mon Sep 17 00:00:00 2001 +From: Nikolay Borisov +Date: Thu, 2 Jul 2015 01:34:07 -0400 +Subject: ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp + +From: Nikolay Borisov + +commit c45653c341f5c8a0ce19c8f0ad4678640849cb86 upstream. + +Switch ext4 to using sb_getblk_gfp with GFP_NOFS added to fix possible +deadlocks in the page writeback path. + +Signed-off-by: Nikolay Borisov +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/extents.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *fun + struct buffer_head *bh; + int err; + +- bh = sb_getblk(inode->i_sb, pblk); ++ bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) + return ERR_PTR(-ENOMEM); + +@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *hand + err = -EIO; + goto cleanup; + } +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) { + err = -ENOMEM; + goto cleanup; +@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_ + if (newblock == 0) + return err; + +- bh = sb_getblk(inode->i_sb, newblock); ++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS); + if (unlikely(!bh)) + return -ENOMEM; + lock_buffer(bh); diff --git a/queue-4.1/ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch b/queue-4.1/ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch new file mode 100644 index 00000000000..2ef95c4c8fb --- /dev/null +++ b/queue-4.1/ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch @@ -0,0 +1,91 @@ +From d6f123a9297496ad0b6335fe881504c4b5b2a5e5 Mon Sep 17 00:00:00 2001 +From: Eryu Guan +Date: Fri, 3 Jul 2015 23:56:50 -0400 +Subject: ext4: be more strict when migrating to non-extent based file + +From: Eryu Guan + +commit d6f123a9297496ad0b6335fe881504c4b5b2a5e5 upstream. + +Currently the check in ext4_ind_migrate() is not enough before doing the +real conversion: + +a) delayed allocated extents could bypass the check on eh->eh_entries + and eh->eh_depth + +This can be demonstrated by this script + + xfs_io -fc "pwrite 0 4k" -c "pwrite 8k 4k" /mnt/ext4/testfile + chattr -e /mnt/ext4/testfile + +where testfile has two extents but still be converted to non-extent +based file format. + +b) only extent length is checked but not the offset, which would result + in data lose (delalloc) or fs corruption (nodelalloc), because + non-extent based file only supports at most (12 + 2^10 + 2^20 + 2^30) + blocks + +This can be demostrated by + + xfs_io -fc "pwrite 5T 4k" /mnt/ext4/testfile + chattr -e /mnt/ext4/testfile + sync + +If delalloc is enabled, dmesg prints + EXT4-fs warning (device dm-4): ext4_block_to_path:105: block 1342177280 > max in inode 53 + EXT4-fs (dm-4): Delayed block allocation failed for inode 53 at logical offset 1342177280 with max blocks 1 with error 5 + EXT4-fs (dm-4): This should not happen!! Data will be lost + +If delalloc is disabled, e2fsck -nf shows corruption + Inode 53, i_size is 5497558142976, should be 4096. Fix? no + +Fix the two issues by + +a) forcing all delayed allocation blocks to be allocated before checking + eh->eh_depth and eh->eh_entries +b) limiting the last logical block of the extent is within direct map + +Signed-off-by: Eryu Guan +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/migrate.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode + struct ext4_inode_info *ei = EXT4_I(inode); + struct ext4_extent *ex; + unsigned int i, len; ++ ext4_lblk_t end; + ext4_fsblk_t blk; + handle_t *handle; + int ret; +@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) + return -EOPNOTSUPP; + ++ /* ++ * In order to get correct extent info, force all delayed allocation ++ * blocks to be allocated, otherwise delayed allocation blocks may not ++ * be reflected and bypass the checks on extent header. ++ */ ++ if (test_opt(inode->i_sb, DELALLOC)) ++ ext4_alloc_da_blocks(inode); ++ + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); + if (IS_ERR(handle)) + return PTR_ERR(handle); +@@ -654,7 +663,8 @@ int ext4_ind_migrate(struct inode *inode + else { + len = le16_to_cpu(ex->ee_len); + blk = ext4_ext_pblock(ex); +- if (len > EXT4_NDIR_BLOCKS) { ++ end = le32_to_cpu(ex->ee_block) + len - 1; ++ if (end >= EXT4_NDIR_BLOCKS) { + ret = -EOPNOTSUPP; + goto errout; + } diff --git a/queue-4.1/ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch b/queue-4.1/ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch new file mode 100644 index 00000000000..0a7444a4946 --- /dev/null +++ b/queue-4.1/ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch @@ -0,0 +1,36 @@ +From 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Sat, 20 Jun 2015 22:50:33 -0400 +Subject: ext4: call sync_blockdev() before invalidate_bdev() in put_super() + +From: Theodore Ts'o + +commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream. + +Normally all of the buffers will have been forced out to disk before +we call invalidate_bdev(), but there will be some cases, where a file +system operation was aborted due to an ext4_error(), where there may +still be some dirty buffers in the buffer cache for the device. So +try to force them out to memory before calling invalidate_bdev(). + +This fixes a warning triggered by generic/081: + +WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f() + +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_ + dump_orphan_list(sb, sbi); + J_ASSERT(list_empty(&sbi->s_orphan)); + ++ sync_blockdev(sb->s_bdev); + invalidate_bdev(sb->s_bdev); + if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { + /* diff --git a/queue-4.1/ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch b/queue-4.1/ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch new file mode 100644 index 00000000000..becd7d7801a --- /dev/null +++ b/queue-4.1/ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch @@ -0,0 +1,76 @@ +From 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 Mon Sep 17 00:00:00 2001 +From: Eryu Guan +Date: Sat, 4 Jul 2015 00:03:44 -0400 +Subject: ext4: correctly migrate a file with a hole at the beginning + +From: Eryu Guan + +commit 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 upstream. + +Currently ext4_ind_migrate() doesn't correctly handle a file which +contains a hole at the beginning of the file. This caused the migration +to be done incorrectly, and then if there is a subsequent following +delayed allocation write to the "hole", this would reclaim the same data +blocks again and results in fs corruption. + + # assmuing 4k block size ext4, with delalloc enabled + # skip the first block and write to the second block + xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/ext4/testfile + + # converting to indirect-mapped file, which would move the data blocks + # to the beginning of the file, but extent status cache still marks + # that region as a hole + chattr -e /mnt/ext4/testfile + + # delayed allocation writes to the "hole", reclaim the same data block + # again, results in i_blocks corruption + xfs_io -c "pwrite 0 4k" /mnt/ext4/testfile + umount /mnt/ext4 + e2fsck -nf /dev/sda6 + ... + Inode 53, i_blocks is 16, should be 8. Fix? no + ... + +Signed-off-by: Eryu Guan +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/migrate.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -620,7 +620,7 @@ int ext4_ind_migrate(struct inode *inode + struct ext4_inode_info *ei = EXT4_I(inode); + struct ext4_extent *ex; + unsigned int i, len; +- ext4_lblk_t end; ++ ext4_lblk_t start, end; + ext4_fsblk_t blk; + handle_t *handle; + int ret; +@@ -659,11 +659,12 @@ int ext4_ind_migrate(struct inode *inode + goto errout; + } + if (eh->eh_entries == 0) +- blk = len = 0; ++ blk = len = start = end = 0; + else { + len = le16_to_cpu(ex->ee_len); + blk = ext4_ext_pblock(ex); +- end = le32_to_cpu(ex->ee_block) + len - 1; ++ start = le32_to_cpu(ex->ee_block); ++ end = start + len - 1; + if (end >= EXT4_NDIR_BLOCKS) { + ret = -EOPNOTSUPP; + goto errout; +@@ -672,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode + + ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); + memset(ei->i_data, 0, sizeof(ei->i_data)); +- for (i=0; i < len; i++) ++ for (i = start; i <= end; i++) + ei->i_data[i] = cpu_to_le32(blk++); + ext4_mark_inode_dirty(handle, inode); + errout: diff --git a/queue-4.1/ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch b/queue-4.1/ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch new file mode 100644 index 00000000000..3f016d89aa5 --- /dev/null +++ b/queue-4.1/ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch @@ -0,0 +1,35 @@ +From 292db1bc6c105d86111e858859456bcb11f90f91 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Sun, 21 Jun 2015 21:10:51 -0400 +Subject: ext4: don't retry file block mapping on bigalloc fs with non-extent file + +From: "Darrick J. Wong" + +commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream. + +ext4 isn't willing to map clusters to a non-extent file. Don't signal +this with an out of space error, since the FS will retry the +allocation (which didn't fail) forever. Instead, return EUCLEAN so +that the operation will fail immediately all the way back to userspace. + +(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.) + +Signed-off-by: Darrick J. Wong +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/indirect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { + EXT4_ERROR_INODE(inode, "Can't allocate blocks for " + "non-extent mapped inodes with bigalloc"); +- return -ENOSPC; ++ return -EUCLEAN; + } + + /* Set up for the direct block allocation */ diff --git a/queue-4.1/ext4-fix-fencepost-error-in-lazytime-optimization.patch b/queue-4.1/ext4-fix-fencepost-error-in-lazytime-optimization.patch new file mode 100644 index 00000000000..04dc38f7b28 --- /dev/null +++ b/queue-4.1/ext4-fix-fencepost-error-in-lazytime-optimization.patch @@ -0,0 +1,40 @@ +From 0f0ff9a9f3fa2ec6f427603fd521d5f3a0b076d1 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Wed, 1 Jul 2015 23:37:46 -0400 +Subject: ext4: fix fencepost error in lazytime optimization + +From: Theodore Ts'o + +commit 0f0ff9a9f3fa2ec6f427603fd521d5f3a0b076d1 upstream. + +Commit 8f4d8558391: "ext4: fix lazytime optimization" was not a +complete fix. In the case where the inode number is a multiple of 16, +and we could still end up updating an inode with dirty timestamps +written to the wrong inode on disk. Oops. + +This can be easily reproduced by using generic/005 with a file system +with metadata_csum and lazytime enabled. + +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4360,7 +4360,12 @@ static void ext4_update_other_inodes_tim + int inode_size = EXT4_INODE_SIZE(sb); + + oi.orig_ino = orig_ino; +- ino = (orig_ino & ~(inodes_per_block - 1)) + 1; ++ /* ++ * Calculate the first inode in the inode table block. Inode ++ * numbers are one-based. That is, the first inode in a block ++ * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1). ++ */ ++ ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1; + for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) { + if (ino == orig_ino) + continue; diff --git a/queue-4.1/ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch b/queue-4.1/ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch new file mode 100644 index 00000000000..2fd7285b262 --- /dev/null +++ b/queue-4.1/ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch @@ -0,0 +1,133 @@ +From bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Fri, 12 Jun 2015 23:45:33 -0400 +Subject: ext4: fix race between truncate and __ext4_journalled_writepage() + +From: Theodore Ts'o + +commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream. + +The commit cf108bca465d: "ext4: Invert the locking order of page_lock +and transaction start" caused __ext4_journalled_writepage() to drop +the page lock before the page was written back, as part of changing +the locking order to jbd2_journal_start -> page_lock. However, this +introduced a potential race if there was a truncate racing with the +data=journalled writeback mode. + +Fix this by grabbing the page lock after starting the journal handle, +and then checking to see if page had gotten truncated out from under +us. + +This fixes a number of different warnings or BUG_ON's when running +xfstests generic/086 in data=journalled mode, including: + +jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7 +c0, 164), jh->b_transaction ( (null), 0), jh->b_next_transaction ( (null), 0), jlist 0 + + - and - + +kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200! + ... +Call Trace: + [] ? __ext4_journalled_invalidatepage+0x117/0x117 + [] __ext4_journalled_invalidatepage+0x10f/0x117 + [] ? __ext4_journalled_invalidatepage+0x117/0x117 + [] ? lock_buffer+0x36/0x36 + [] ext4_journalled_invalidatepage+0xd/0x22 + [] do_invalidatepage+0x22/0x26 + [] truncate_inode_page+0x5b/0x85 + [] truncate_inode_pages_range+0x156/0x38c + [] truncate_inode_pages+0x11/0x15 + [] truncate_pagecache+0x55/0x71 + [] ext4_setattr+0x4a9/0x560 + [] ? current_kernel_time+0x10/0x44 + [] notify_change+0x1c7/0x2be + [] do_truncate+0x65/0x85 + [] ? file_ra_state_init+0x12/0x29 + + - and - + +WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396 +irty_metadata+0x14a/0x1ae() + ... +Call Trace: + [] ? console_unlock+0x3a1/0x3ce + [] dump_stack+0x48/0x60 + [] warn_slowpath_common+0x89/0xa0 + [] ? jbd2_journal_dirty_metadata+0x14a/0x1ae + [] warn_slowpath_null+0x14/0x18 + [] jbd2_journal_dirty_metadata+0x14a/0x1ae + [] __ext4_handle_dirty_metadata+0xd4/0x19d + [] write_end_fn+0x40/0x53 + [] ext4_walk_page_buffers+0x4e/0x6a + [] ext4_writepage+0x354/0x3b8 + [] ? mpage_release_unused_pages+0xd4/0xd4 + [] ? wait_on_buffer+0x2c/0x2c + [] ? ext4_writepage+0x3b8/0x3b8 + [] __writepage+0x10/0x2e + [] write_cache_pages+0x22d/0x32c + [] ? ext4_writepage+0x3b8/0x3b8 + [] ext4_writepages+0x102/0x607 + [] ? sched_clock_local+0x10/0x10e + [] ? __lock_is_held+0x2e/0x44 + [] ? lock_is_held+0x43/0x51 + [] do_writepages+0x1c/0x29 + [] __writeback_single_inode+0xc3/0x545 + [] writeback_sb_inodes+0x21f/0x36d + ... + +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1701,19 +1701,32 @@ static int __ext4_journalled_writepage(s + ext4_walk_page_buffers(handle, page_bufs, 0, len, + NULL, bget_one); + } +- /* As soon as we unlock the page, it can go away, but we have +- * references to buffers so we are safe */ ++ /* ++ * We need to release the page lock before we start the ++ * journal, so grab a reference so the page won't disappear ++ * out from under us. ++ */ ++ get_page(page); + unlock_page(page); + + handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, + ext4_writepage_trans_blocks(inode)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out; ++ put_page(page); ++ goto out_no_pagelock; + } +- + BUG_ON(!ext4_handle_valid(handle)); + ++ lock_page(page); ++ put_page(page); ++ if (page->mapping != mapping) { ++ /* The page got truncated from under us */ ++ ext4_journal_stop(handle); ++ ret = 0; ++ goto out; ++ } ++ + if (inline_data) { + BUFFER_TRACE(inode_bh, "get write access"); + ret = ext4_journal_get_write_access(handle, inode_bh); +@@ -1739,6 +1752,8 @@ static int __ext4_journalled_writepage(s + NULL, bput_one); + ext4_set_inode_state(inode, EXT4_STATE_JDATA); + out: ++ unlock_page(page); ++out_no_pagelock: + brelse(inode_bh); + return ret; + } diff --git a/queue-4.1/ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch b/queue-4.1/ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch new file mode 100644 index 00000000000..761892a1f73 --- /dev/null +++ b/queue-4.1/ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch @@ -0,0 +1,128 @@ +From 9705acd63b125dee8b15c705216d7186daea4625 Mon Sep 17 00:00:00 2001 +From: Lukas Czerner +Date: Fri, 3 Jul 2015 21:13:55 -0400 +Subject: ext4: fix reservation release on invalidatepage for delalloc fs + +From: Lukas Czerner + +commit 9705acd63b125dee8b15c705216d7186daea4625 upstream. + +On delalloc enabled file system on invalidatepage operation +in ext4_da_page_release_reservation() we want to clear the delayed +buffer and remove the extent covering the delayed buffer from the extent +status tree. + +However currently there is a bug where on the systems with page size > +block size we will always remove extents from the start of the page +regardless where the actual delayed buffers are positioned in the page. +This leads to the errors like this: + +EXT4-fs warning (device loop0): ext4_da_release_space:1225: +ext4_da_release_space: ino 13, to_free 1 with only 0 reserved data +blocks + +This however can cause data loss on writeback time if the file system is +in ENOSPC condition because we're releasing reservation for someones +else delayed buffer. + +Fix this by only removing extents that corresponds to the part of the +page we want to invalidate. + +This problem is reproducible by the following fio receipt (however I was +only able to reproduce it with fio-2.1 or older. + +[global] +bs=8k +iodepth=1024 +iodepth_batch=60 +randrepeat=1 +size=1m +directory=/mnt/test +numjobs=20 +[job1] +ioengine=sync +bs=1k +direct=1 +rw=randread +filename=file1:file2 +[job2] +ioengine=libaio +rw=randwrite +direct=1 +filename=file1:file2 +[job3] +bs=1k +ioengine=posixaio +rw=randwrite +direct=1 +filename=file1:file2 +[job5] +bs=1k +ioengine=sync +rw=randread +filename=file1:file2 +[job7] +ioengine=libaio +rw=randwrite +filename=file1:file2 +[job8] +ioengine=posixaio +rw=randwrite +filename=file1:file2 +[job10] +ioengine=mmap +rw=randwrite +bs=1k +filename=file1:file2 +[job11] +ioengine=mmap +rw=randwrite +direct=1 +filename=file1:file2 + +Signed-off-by: Lukas Czerner +Signed-off-by: Theodore Ts'o +Reviewed-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reserva + unsigned int offset, + unsigned int length) + { +- int to_release = 0; ++ int to_release = 0, contiguous_blks = 0; + struct buffer_head *head, *bh; + unsigned int curr_off = 0; + struct inode *inode = page->mapping->host; +@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reserva + + if ((offset <= curr_off) && (buffer_delay(bh))) { + to_release++; ++ contiguous_blks++; + clear_buffer_delay(bh); ++ } else if (contiguous_blks) { ++ lblk = page->index << ++ (PAGE_CACHE_SHIFT - inode->i_blkbits); ++ lblk += (curr_off >> inode->i_blkbits) - ++ contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); ++ contiguous_blks = 0; + } + curr_off = next_off; + } while ((bh = bh->b_this_page) != head); + +- if (to_release) { ++ if (contiguous_blks) { + lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); +- ext4_es_remove_extent(inode, lblk, to_release); ++ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; ++ ext4_es_remove_extent(inode, lblk, contiguous_blks); + } + + /* If we have released all the blocks belonging to a cluster, then we diff --git a/queue-4.1/ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch b/queue-4.1/ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch new file mode 100644 index 00000000000..1666c70bc43 --- /dev/null +++ b/queue-4.1/ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch @@ -0,0 +1,49 @@ +From 7444a072c387a93ebee7066e8aee776954ab0e41 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Sun, 5 Jul 2015 12:33:44 -0400 +Subject: ext4: replace open coded nofail allocation in ext4_free_blocks() + +From: Michal Hocko + +commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream. + +ext4_free_blocks is looping around the allocation request and mimics +__GFP_NOFAIL behavior without any allocation fallback strategy. Let's +remove the open coded loop and replace it with __GFP_NOFAIL. Without the +flag the allocator has no way to find out never-fail requirement and +cannot help in any way. + +Signed-off-by: Michal Hocko +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/mballoc.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4800,18 +4800,12 @@ do_more: + /* + * blocks being freed are metadata. these blocks shouldn't + * be used until this transaction is committed ++ * ++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed ++ * to fail. + */ +- retry: +- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS); +- if (!new_entry) { +- /* +- * We use a retry loop because +- * ext4_free_blocks() is not allowed to fail. +- */ +- cond_resched(); +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; +- } ++ new_entry = kmem_cache_alloc(ext4_free_data_cachep, ++ GFP_NOFS|__GFP_NOFAIL); + new_entry->efd_start_cluster = bit; + new_entry->efd_group = block_group; + new_entry->efd_count = count_clusters; diff --git a/queue-4.1/ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch b/queue-4.1/ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch new file mode 100644 index 00000000000..11ca809512b --- /dev/null +++ b/queue-4.1/ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch @@ -0,0 +1,34 @@ +From a2fd66d069d86d793e9d39d4079b96f46d13f237 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Tue, 23 Jun 2015 11:03:54 -0400 +Subject: ext4: set lazytime on remount if MS_LAZYTIME is set by mount + +From: Theodore Ts'o + +commit a2fd66d069d86d793e9d39d4079b96f46d13f237 upstream. + +Newer versions of mount parse the lazytime feature and pass it to the +mount system call via the flags field in the mount system call, +removing the lazytime string from the mount options list. So we need +to check for the presence of MS_LAZYTIME and set it in sb->s_flags in +order for this flag to be set on a remount. + +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4944,6 +4944,9 @@ static int ext4_remount(struct super_blo + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); + } + ++ if (*flags & MS_LAZYTIME) ++ sb->s_flags |= MS_LAZYTIME; ++ + if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) { + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) { + err = -EROFS; diff --git a/queue-4.1/hid-sensor-fix-suspend-resume-delay.patch b/queue-4.1/hid-sensor-fix-suspend-resume-delay.patch new file mode 100644 index 00000000000..db7781e1a6b --- /dev/null +++ b/queue-4.1/hid-sensor-fix-suspend-resume-delay.patch @@ -0,0 +1,89 @@ +From 1e25aa9641e8f3fa39cd5e46b4afcafd7f12a44b Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Mon, 1 Jun 2015 16:36:27 -0700 +Subject: hid-sensor: Fix suspend/resume delay + +From: Srinivas Pandruvada + +commit 1e25aa9641e8f3fa39cd5e46b4afcafd7f12a44b upstream. + +By default all the sensors are runtime suspended state (lowest power +state). During Linux suspend process, all the run time suspended +devices are resumed and then suspended. This caused all sensors to +power up and introduced delay in suspend time, when we introduced +runtime PM for HID sensors. The opposite process happens during resume +process. + +To fix this, we do powerup process of the sensors only when the request +is issued from user (raw or tiggerred). In this way when runtime, +resume calls for powerup it will simply return as this will not match +user requested state. + +Note this is a regression fix as the increase in suspend / resume +times can be substantial (report of 8 seconds on Len's laptop!) + +Signed-off-by: Srinivas Pandruvada +Tested-by: Len Brown +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 11 ++++++++++- + include/linux/hid-sensor-hub.h | 1 + + 2 files changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struc + s32 poll_value = 0; + + if (state) { ++ if (!atomic_read(&st->user_requested_state)) ++ return 0; + if (sensor_hub_device_open(st->hsdev)) + return -EIO; + +@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struc + + poll_value = hid_sensor_read_poll_value(st); + } else { +- if (!atomic_dec_and_test(&st->data_ready)) ++ int val; ++ ++ val = atomic_dec_if_positive(&st->data_ready); ++ if (val < 0) + return 0; ++ + sensor_hub_device_close(st->hsdev); + state_val = hid_sensor_get_usage_index(st->hsdev, + st->power_state.report_id, +@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state); + + int hid_sensor_power_state(struct hid_sensor_common *st, bool state) + { ++ + #ifdef CONFIG_PM + int ret; + ++ atomic_set(&st->user_requested_state, state); + if (state) + ret = pm_runtime_get_sync(&st->pdev->dev); + else { +@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_se + + return 0; + #else ++ atomic_set(&st->user_requested_state, state); + return _hid_sensor_power_state(st, state); + #endif + } +--- a/include/linux/hid-sensor-hub.h ++++ b/include/linux/hid-sensor-hub.h +@@ -230,6 +230,7 @@ struct hid_sensor_common { + struct platform_device *pdev; + unsigned usage_id; + atomic_t data_ready; ++ atomic_t user_requested_state; + struct iio_trigger *trigger; + struct hid_sensor_hub_attribute_info poll; + struct hid_sensor_hub_attribute_info report_state; diff --git a/queue-4.1/i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch b/queue-4.1/i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch new file mode 100644 index 00000000000..6a2dc37efcc --- /dev/null +++ b/queue-4.1/i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch @@ -0,0 +1,184 @@ +From 93563a6a71bb69dd324fc7354c60fb05f84aae6b Mon Sep 17 00:00:00 2001 +From: Cyrille Pitchen +Date: Tue, 9 Jun 2015 18:22:14 +0200 +Subject: i2c: at91: fix a race condition when using the DMA controller + +From: Cyrille Pitchen + +commit 93563a6a71bb69dd324fc7354c60fb05f84aae6b upstream. + +For TX transactions, the TXCOMP bit in the Status Register is cleared +when the first data is written into the Transmit Holding Register. + +In the lines from at91_do_twi_transfer(): +at91_twi_write_data_dma(dev); +at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + +the TXCOMP interrupt may be enabled before the DMA controller has +actually started to write into the THR. In such a case, the TXCOMP bit +is still set into the Status Register so the interrupt is triggered +immediately. The driver understands that a transaction completion has +occurred but this transaction hasn't started yet. Hence the TXCOMP +interrupt is no longer enabled by at91_do_twi_transfer() but instead +by at91_twi_write_data_dma_callback(). + +Also, the TXCOMP bit in the Status Register in not a clear on read flag +but a snapshot of the transmission state at the time the Status +Register is read. +When a NACK error is dectected by the I2C controller, the TXCOMP, NACK +and TXRDY bits are set together to 1 in the SR. If enabled, the TXCOMP +interrupt is triggered at the same time. Also setting the TXRDY to 1 +triggers the DMA controller to write the next data into the THR. Such +a write resets the TXCOMP bit to 0 in the SR. So depending on when the +interrupt handler reads the SR, it may fail to detect the NACK error +if it relies on the TXCOMP bit. The NACK bit and its interrupt should +be used instead. + +For RX transactions, the TXCOMP bit in the Status Register is cleared +when the START bit is set into the Control Register. However to unify +the management of the TXCOMP bit when the DMA controller is used, the +TXCOMP interrupt is now enabled by the DMA callbacks for both TX and +RX transfers. + +Signed-off-by: Cyrille Pitchen +Acked-by: Ludovic Desroches +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-at91.c | 70 +++++++++++++++++++++++++++++++----------- + 1 file changed, 53 insertions(+), 17 deletions(-) + +--- a/drivers/i2c/busses/i2c-at91.c ++++ b/drivers/i2c/busses/i2c-at91.c +@@ -65,6 +65,9 @@ + #define AT91_TWI_UNRE 0x0080 /* Underrun Error */ + #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */ + ++#define AT91_TWI_INT_MASK \ ++ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) ++ + #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */ + #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */ + #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */ +@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_t + + static void at91_disable_twi_interrupts(struct at91_twi_dev *dev) + { +- at91_twi_write(dev, AT91_TWI_IDR, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY); ++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK); + } + + static void at91_twi_irq_save(struct at91_twi_dev *dev) + { +- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7; ++ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK; + at91_disable_twi_interrupts(dev); + } + +@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_call + dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg), + dev->buf_len, DMA_TO_DEVICE); + ++ /* ++ * When this callback is called, THR/TX FIFO is likely not to be empty ++ * yet. So we have to wait for TXCOMP or NACK bits to be set into the ++ * Status Register to be sure that the STOP bit has been sent and the ++ * transfer is completed. The NACK interrupt has already been enabled, ++ * we just have to enable TXCOMP one. ++ */ ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP); + } + +@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callb + /* The last two bytes have to be read without using dma */ + dev->buf += dev->buf_len - 2; + dev->buf_len = 2; +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY); ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP); + } + + static void at91_twi_read_data_dma(struct at91_twi_dev *dev) +@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(i + /* catch error flags */ + dev->transfer_status |= status; + +- if (irqstatus & AT91_TWI_TXCOMP) { ++ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) { + at91_disable_twi_interrupts(dev); + complete(&dev->cmd_complete); + } +@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct a + unsigned long time_left; + bool has_unre_flag = dev->pdata->has_unre_flag; + ++ /* ++ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on ++ * read flag but shows the state of the transmission at the time the ++ * Status Register is read. According to the programmer datasheet, ++ * TXCOMP is set when both holding register and internal shifter are ++ * empty and STOP condition has been sent. ++ * Consequently, we should enable NACK interrupt rather than TXCOMP to ++ * detect transmission failure. ++ * ++ * Besides, the TXCOMP bit is already set before the i2c transaction ++ * has been started. For read transactions, this bit is cleared when ++ * writing the START bit into the Control Register. So the ++ * corresponding interrupt can safely be enabled just after. ++ * However for write transactions managed by the CPU, we first write ++ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP ++ * interrupt. If TXCOMP interrupt were enabled before writing into THR, ++ * the interrupt handler would be called immediately and the i2c command ++ * would be reported as completed. ++ * Also when a write transaction is managed by the DMA controller, ++ * enabling the TXCOMP interrupt in this function may lead to a race ++ * condition since we don't know whether the TXCOMP interrupt is enabled ++ * before or after the DMA has started to write into THR. So the TXCOMP ++ * interrupt is enabled later by at91_twi_write_data_dma_callback(). ++ * Immediately after in that DMA callback, we still need to send the ++ * STOP condition manually writing the corresponding bit into the ++ * Control Register. ++ */ ++ + dev_dbg(dev->dev, "transfer: %s %d bytes.\n", + (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len); + +@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct a + * seems to be the best solution. + */ + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_read_data_dma(dev); +- /* +- * It is important to enable TXCOMP irq here because +- * doing it only when transferring the last two bytes +- * will mask NACK errors since TXCOMP is set when a +- * NACK occurs. +- */ +- at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP); +- } else ++ } else { + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_RXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_RXRDY); ++ } + } else { + if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { ++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); + at91_twi_write_data_dma(dev); +- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); + } else { + at91_twi_write_next_byte(dev); + at91_twi_write(dev, AT91_TWI_IER, +- AT91_TWI_TXCOMP | AT91_TWI_TXRDY); ++ AT91_TWI_TXCOMP | ++ AT91_TWI_NACK | ++ AT91_TWI_TXRDY); + } + } + diff --git a/queue-4.1/i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch b/queue-4.1/i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch new file mode 100644 index 00000000000..c3753b3dc98 --- /dev/null +++ b/queue-4.1/i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch @@ -0,0 +1,59 @@ +From 0a8237ae319ab5988d40a7a9b33d68846aae34b4 Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 12 Jun 2015 14:41:00 +0200 +Subject: i2c: mux: pca954x: Use __i2c_transfer because of quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Sverdlin + +commit 0a8237ae319ab5988d40a7a9b33d68846aae34b4 upstream. + +pca9541 and pca954x are calling master_xfer() of the parent adapter directly +thus bypassing the quirks checks of the adapter. Use __i2c_transfer() instead. + +Signed-off-by: Alexander Sverdlin +Tested-by: Łukasz Gemborowski +Acked-by: Laurent Pinchart +Reviewed-by: Jisheng Zhang +Signed-off-by: Wolfram Sang +Fixes: b7f625840267b1 ("i2c: add quirk checks to core") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/muxes/i2c-mux-pca9541.c | 4 ++-- + drivers/i2c/muxes/i2c-mux-pca954x.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/muxes/i2c-mux-pca9541.c ++++ b/drivers/i2c/muxes/i2c-mux-pca9541.c +@@ -104,7 +104,7 @@ static int pca9541_reg_write(struct i2c_ + buf[0] = command; + buf[1] = val; + msg.buf = buf; +- ret = adap->algo->master_xfer(adap, &msg, 1); ++ ret = __i2c_transfer(adap, &msg, 1); + } else { + union i2c_smbus_data data; + +@@ -144,7 +144,7 @@ static int pca9541_reg_read(struct i2c_c + .buf = &val + } + }; +- ret = adap->algo->master_xfer(adap, msg, 2); ++ ret = __i2c_transfer(adap, msg, 2); + if (ret == 2) + ret = val; + else if (ret >= 0) +--- a/drivers/i2c/muxes/i2c-mux-pca954x.c ++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c +@@ -134,7 +134,7 @@ static int pca954x_reg_write(struct i2c_ + msg.len = 1; + buf[0] = val; + msg.buf = buf; +- ret = adap->algo->master_xfer(adap, &msg, 1); ++ ret = __i2c_transfer(adap, &msg, 1); + } else { + union i2c_smbus_data data; + ret = adap->algo->smbus_xfer(adap, client->addr, diff --git a/queue-4.1/i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch b/queue-4.1/i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch new file mode 100644 index 00000000000..8695ad5e44f --- /dev/null +++ b/queue-4.1/i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch @@ -0,0 +1,40 @@ +From e766f338a74200b8104b1165776b19f56e252834 Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 12 Jun 2015 14:40:37 +0200 +Subject: i2c: mux: Use __i2c_transfer() instead of calling parent's master_xfer() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Sverdlin + +commit e766f338a74200b8104b1165776b19f56e252834 upstream. + +Newly introduced quirks infrastructure doesn't work for the devices behind +MUXes because MUX's master_xfer() calls parent's master_xfer() directly +without checking the quirks. Instead of duplicating check code in MUX just +call __i2c_transfer() instead. This has a side effect on tracing (messages +will appear on both MUX bus and parent bus), but maybe that's not bad at +the end. + +Signed-off-by: Alexander Sverdlin +Tested-by: Łukasz Gemborowski +Signed-off-by: Wolfram Sang +Fixes: b7f625840267b1 ("i2c: add quirk checks to core") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-mux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/i2c-mux.c ++++ b/drivers/i2c/i2c-mux.c +@@ -51,7 +51,7 @@ static int i2c_mux_master_xfer(struct i2 + + ret = priv->select(parent, priv->mux_priv, priv->chan_id); + if (ret >= 0) +- ret = parent->algo->master_xfer(parent, msgs, num); ++ ret = __i2c_transfer(parent, msgs, num); + if (priv->deselect) + priv->deselect(parent, priv->mux_priv, priv->chan_id); + diff --git a/queue-4.1/i2c-use-parent-adapter-quirks-in-mux.patch b/queue-4.1/i2c-use-parent-adapter-quirks-in-mux.patch new file mode 100644 index 00000000000..cbd0b751d03 --- /dev/null +++ b/queue-4.1/i2c-use-parent-adapter-quirks-in-mux.patch @@ -0,0 +1,35 @@ +From dc362d50ba94eaf2b1f11eecd81eb1d040d2d6e6 Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 12 Jun 2015 14:41:16 +0200 +Subject: i2c: use parent adapter quirks in mux +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Sverdlin + +commit dc362d50ba94eaf2b1f11eecd81eb1d040d2d6e6 upstream. + +Inherit parent adapter quirks in MUX in case the devices on the multiplexed +buses are interested in the adapter limitations. + +Signed-off-by: Łukasz Gemborowski +Signed-off-by: Alexander Sverdlin +Signed-off-by: Wolfram Sang +Fixes: b7f625840267b1 ("i2c: add quirk checks to core") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-mux.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/i2c-mux.c ++++ b/drivers/i2c/i2c-mux.c +@@ -144,6 +144,7 @@ struct i2c_adapter *i2c_add_mux_adapter( + priv->adap.dev.parent = &parent->dev; + priv->adap.retries = parent->retries; + priv->adap.timeout = parent->timeout; ++ priv->adap.quirks = parent->quirks; + + /* Sanity check on class */ + if (i2c_mux_parent_classes(parent) & class) diff --git a/queue-4.1/ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch b/queue-4.1/ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch new file mode 100644 index 00000000000..86d2b7fcbf8 --- /dev/null +++ b/queue-4.1/ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch @@ -0,0 +1,75 @@ +From 8a70cefa3037d62e7c0b6068a66675def1a330c9 Mon Sep 17 00:00:00 2001 +From: Lennert Buytenhek +Date: Wed, 3 Jun 2015 10:50:19 +0300 +Subject: ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. + +From: Lennert Buytenhek + +commit 8a70cefa3037d62e7c0b6068a66675def1a330c9 upstream. + +The AF_IEEE802154 sockaddr looks like this: + + struct sockaddr_ieee802154 { + sa_family_t family; /* AF_IEEE802154 */ + struct ieee802154_addr_sa addr; + }; + + struct ieee802154_addr_sa { + int addr_type; + u16 pan_id; + union { + u8 hwaddr[IEEE802154_ADDR_LEN]; + u16 short_addr; + }; + }; + +On most architectures there will be implicit structure padding here, +in two different places: + +* In struct sockaddr_ieee802154, two bytes of padding between 'family' + (unsigned short) and 'addr', so that 'addr' starts on a four byte + boundary. + +* In struct ieee802154_addr_sa, two bytes at the end of the structure, + to make the structure 16 bytes. + +When calling recvmsg(2) on a PF_IEEE802154 SOCK_DGRAM socket, the +ieee802154 stack constructs a struct sockaddr_ieee802154 on the +kernel stack without clearing these padding fields, and, depending +on the addr_type, between four and ten bytes of uncleared kernel +stack will be copied to userspace. + +We can't just insert two 'u16 __pad's in the right places and zero +those before copying an address to userspace, as not all architectures +insert this implicit padding -- from a quick test it seems that avr32, +cris and m68k don't insert this padding, while every other architecture +that I have cross compilers for does insert this padding. + +The easiest way to plug the leak is to just memset the whole struct +sockaddr_ieee802154 before filling in the fields we want to fill in, +and that's what this patch does. + +Signed-off-by: Lennert Buytenhek +Acked-by: Alexander Aring +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/ieee802154/socket.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk + sock_recv_ts_and_drops(msg, sk, skb); + + if (saddr) { ++ /* Clear the implicit padding in struct sockaddr_ieee802154 ++ * (16 bits between 'family' and 'addr') and in struct ++ * ieee802154_addr_sa (16 bits at the end of the structure). ++ */ ++ memset(saddr, 0, sizeof(*saddr)); ++ + saddr->family = AF_IEEE802154; + ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source); + *addr_len = sizeof(*saddr); diff --git a/queue-4.1/iio-abi-clarify-proximity-output-value.patch b/queue-4.1/iio-abi-clarify-proximity-output-value.patch new file mode 100644 index 00000000000..dfc9610a473 --- /dev/null +++ b/queue-4.1/iio-abi-clarify-proximity-output-value.patch @@ -0,0 +1,44 @@ +From bdc10d57f236b534fb675a4bbefd10017aeb2b26 Mon Sep 17 00:00:00 2001 +From: Daniel Baluta +Date: Thu, 11 Jun 2015 18:49:33 +0300 +Subject: iio: ABI: Clarify proximity output value + +From: Daniel Baluta + +commit bdc10d57f236b534fb675a4bbefd10017aeb2b26 upstream. + +Current description for proximity measurement is ambiguous. While +the first part says that proximity is measured by observing +reflectivity, the second part incorrectly infers that reported values +should behave like a distance. + +This is because of AS3935 lightning sensor which uses the proximity +API, while not being a true proximity sensor. + +Note this is marked for stable as it accompanies a fix in ABI usage +to the sx9500 driver which would otherwise appear to be correct. + +Fixes: 614e8842ddf ("iio: ABI: add clarification for proximity") +Signed-off-by: Daniel Baluta +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/ABI/testing/sysfs-bus-iio | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -1165,10 +1165,8 @@ Description: + object is near the sensor, usually be observing + reflectivity of infrared or ultrasound emitted. + Often these sensors are unit less and as such conversion +- to SI units is not possible. Where it is, the units should +- be meters. If such a conversion is not possible, the reported +- values should behave in the same way as a distance, i.e. lower +- values indicate something is closer to the sensor. ++ to SI units is not possible. Higher proximity measurements ++ indicate closer objects, and vice versa. + + What: /sys/.../iio:deviceX/in_illuminance_input + What: /sys/.../iio:deviceX/in_illuminance_raw diff --git a/queue-4.1/iio-accel-bmc150-accel-fix-counting-direction.patch b/queue-4.1/iio-accel-bmc150-accel-fix-counting-direction.patch new file mode 100644 index 00000000000..b12b3db8d4c --- /dev/null +++ b/queue-4.1/iio-accel-bmc150-accel-fix-counting-direction.patch @@ -0,0 +1,33 @@ +From 7a1d0d91c94305fa5802a53df3a54c0ea1963c48 Mon Sep 17 00:00:00 2001 +From: Hartmut Knaack +Date: Mon, 15 Jun 2015 23:48:24 +0200 +Subject: iio:accel:bmc150-accel: fix counting direction + +From: Hartmut Knaack + +commit 7a1d0d91c94305fa5802a53df3a54c0ea1963c48 upstream. + +In bmc150_accel_unregister_triggers() triggers should be unregistered in +reverse order of registration. Trigger registration starts with number 0, +counting up. In consequence, trigger number needs to be count down here. + +Signed-off-by: Hartmut Knaack +Reviewed-by: Octavian Purdila +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/bmc150-accel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/bmc150-accel.c ++++ b/drivers/iio/accel/bmc150-accel.c +@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_trig + { + int i; + +- for (i = from; i >= 0; i++) { ++ for (i = from; i >= 0; i--) { + if (data->triggers[i].indio_trig) { + iio_trigger_unregister(data->triggers[i].indio_trig); + data->triggers[i].indio_trig = NULL; diff --git a/queue-4.1/iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch b/queue-4.1/iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch new file mode 100644 index 00000000000..8e01a3dea25 --- /dev/null +++ b/queue-4.1/iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch @@ -0,0 +1,65 @@ +From 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 Mon Sep 17 00:00:00 2001 +From: Jan Leupold +Date: Wed, 17 Jun 2015 18:21:36 +0200 +Subject: iio: adc: at91_adc: allow to use full range of startup time + +From: Jan Leupold + +commit 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 upstream. + +The DT-Property "atmel,adc-startup-time" is stored in an u8 for a microsecond +value. When trying to increase the value of STARTUP in Register AT91_ADC_MR +some higher values can't be reached. + +Change the type in function parameter and private structure field from u8 to +u32. + +Signed-off-by: Jan Leupold +[nicolas.ferre@atmel.com: change commit message, increase u16 to u32 for startup time] +Signed-off-by: Nicolas Ferre +Acked-by: Alexandre Belloni +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/at91_adc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -182,7 +182,7 @@ struct at91_adc_caps { + u8 ts_pen_detect_sensitivity; + + /* startup time calculate function */ +- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz); ++ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz); + + u8 num_channels; + struct at91_adc_reg_desc registers; +@@ -201,7 +201,7 @@ struct at91_adc_state { + u8 num_channels; + void __iomem *reg_base; + struct at91_adc_reg_desc *registers; +- u8 startup_time; ++ u32 startup_time; + u8 sample_hold_time; + bool sleep_mode; + struct iio_trigger **trig; +@@ -779,7 +779,7 @@ ret: + return ret; + } + +-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz) + { + /* + * Number of ticks needed to cover the startup time of the ADC +@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 st + return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8; + } + +-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz) ++static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz) + { + /* + * For sama5d3x and at91sam9x5, the formula changes to: diff --git a/queue-4.1/iio-adc-cc10001_adc-fix-kconfig-dependency.patch b/queue-4.1/iio-adc-cc10001_adc-fix-kconfig-dependency.patch new file mode 100644 index 00000000000..0b0a5a5a49b --- /dev/null +++ b/queue-4.1/iio-adc-cc10001_adc-fix-kconfig-dependency.patch @@ -0,0 +1,32 @@ +From b2b3c3dc6a7bef886850920f5f5dca041b443aa0 Mon Sep 17 00:00:00 2001 +From: Hartmut Knaack +Date: Sun, 21 Jun 2015 12:15:50 +0200 +Subject: iio:adc:cc10001_adc: fix Kconfig dependency + +From: Hartmut Knaack + +commit b2b3c3dc6a7bef886850920f5f5dca041b443aa0 upstream. + +The Cosmic Circuits 10001 ADC driver depends on HAS_IOMEM, HAVE_CLK and +REGULATOR together, not just any of these. + +Signed-off-by: Hartmut Knaack +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -146,8 +146,7 @@ config DA9150_GPADC + + config CC10001_ADC + tristate "Cosmic Circuits 10001 ADC driver" +- depends on HAVE_CLK || REGULATOR +- depends on HAS_IOMEM ++ depends on HAS_IOMEM && HAVE_CLK && REGULATOR + select IIO_BUFFER + select IIO_TRIGGERED_BUFFER + help diff --git a/queue-4.1/iio-adc-rockchip_saradc-add-missing-module_-data.patch b/queue-4.1/iio-adc-rockchip_saradc-add-missing-module_-data.patch new file mode 100644 index 00000000000..104fafb83b8 --- /dev/null +++ b/queue-4.1/iio-adc-rockchip_saradc-add-missing-module_-data.patch @@ -0,0 +1,32 @@ +From dc7b8d98ac003c9f1e83a5f927c372dac6f114a1 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Mon, 25 May 2015 22:36:58 +0200 +Subject: iio: adc: rockchip_saradc: add missing MODULE_* data + +From: Heiko Stuebner + +commit dc7b8d98ac003c9f1e83a5f927c372dac6f114a1 upstream. + +The module-data is currently missing. This includes the license-information +which makes the driver taint the kernel and miss symbols when compiled as +module. + +Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc") +Signed-off-by: Heiko Stuebner +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/rockchip_saradc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -349,3 +349,7 @@ static struct platform_driver rockchip_s + }; + + module_platform_driver(rockchip_saradc_driver); ++ ++MODULE_AUTHOR("Heiko Stuebner "); ++MODULE_DESCRIPTION("Rockchip SARADC driver"); ++MODULE_LICENSE("GPL v2"); diff --git a/queue-4.1/iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch b/queue-4.1/iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch new file mode 100644 index 00000000000..a372f620271 --- /dev/null +++ b/queue-4.1/iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch @@ -0,0 +1,43 @@ +From adfa969850ae93beca57f7527f0e4dc10cbe1309 Mon Sep 17 00:00:00 2001 +From: JM Friedt +Date: Fri, 19 Jun 2015 14:48:06 +0200 +Subject: iio: DAC: ad5624r_spi: fix bit shift of output data value + +From: JM Friedt + +commit adfa969850ae93beca57f7527f0e4dc10cbe1309 upstream. + +The value sent on the SPI bus is shifted by an erroneous number of bits. +The shift value was already computed in the iio_chan_spec structure and +hence subtracting this argument to 16 yields an erroneous data position +in the SPI stream. + +Signed-off-by: JM Friedt +Acked-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dac/ad5624r_spi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/dac/ad5624r_spi.c ++++ b/drivers/iio/dac/ad5624r_spi.c +@@ -22,7 +22,7 @@ + #include "ad5624r.h" + + static int ad5624r_spi_write(struct spi_device *spi, +- u8 cmd, u8 addr, u16 val, u8 len) ++ u8 cmd, u8 addr, u16 val, u8 shift) + { + u32 data; + u8 msg[3]; +@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_ + * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, + * for the AD5664R, AD5644R, and AD5624R, respectively. + */ +- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); ++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); + msg[0] = data >> 16; + msg[1] = data >> 8; + msg[2] = data; diff --git a/queue-4.1/iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch b/queue-4.1/iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch new file mode 100644 index 00000000000..28e33a812bb --- /dev/null +++ b/queue-4.1/iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch @@ -0,0 +1,56 @@ +From 6a3c45bb5a385be7049a7725a4fe93eaa76915f4 Mon Sep 17 00:00:00 2001 +From: Adriana Reus +Date: Fri, 12 Jun 2015 18:10:23 +0300 +Subject: iio: inv-mpu: Specify the expected format/precision for write channels + +From: Adriana Reus + +commit 6a3c45bb5a385be7049a7725a4fe93eaa76915f4 upstream. + +The gyroscope needs IIO_VAL_INT_PLUS_NANO for the scale channel and +unless specified write returns MICRO by default. +This needs to be properly specified so that write operations into scale +have the expected behaviour. + +Signed-off-by: Adriana Reus +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale( + return -EINVAL; + } + ++static int inv_write_raw_get_fmt(struct iio_dev *indio_dev, ++ struct iio_chan_spec const *chan, long mask) ++{ ++ switch (mask) { ++ case IIO_CHAN_INFO_SCALE: ++ switch (chan->type) { ++ case IIO_ANGL_VEL: ++ return IIO_VAL_INT_PLUS_NANO; ++ default: ++ return IIO_VAL_INT_PLUS_MICRO; ++ } ++ default: ++ return IIO_VAL_INT_PLUS_MICRO; ++ } ++ ++ return -EINVAL; ++} + static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val) + { + int result, i; +@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = + .driver_module = THIS_MODULE, + .read_raw = &inv_mpu6050_read_raw, + .write_raw = &inv_mpu6050_write_raw, ++ .write_raw_get_fmt = &inv_write_raw_get_fmt, + .attrs = &inv_attribute_group, + .validate_trigger = inv_mpu6050_validate_trigger, + }; diff --git a/queue-4.1/iio-light-cm3323-clear-bitmask-before-set.patch b/queue-4.1/iio-light-cm3323-clear-bitmask-before-set.patch new file mode 100644 index 00000000000..548bdab4c05 --- /dev/null +++ b/queue-4.1/iio-light-cm3323-clear-bitmask-before-set.patch @@ -0,0 +1,31 @@ +From c288503b32e8c5534062a05ec565d28bffa06db3 Mon Sep 17 00:00:00 2001 +From: Hartmut Knaack +Date: Thu, 18 Jun 2015 00:31:59 +0200 +Subject: iio:light:cm3323: clear bitmask before set + +From: Hartmut Knaack + +commit c288503b32e8c5534062a05ec565d28bffa06db3 upstream. + +When setting the bits for integration time, the appropriate bitmask needs +to be cleared first. + +Signed-off-by: Hartmut Knaack +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/cm3323.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/cm3323.c ++++ b/drivers/iio/light/cm3323.c +@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3 + for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) { + if (val == cm3323_int_time[i].val && + val2 == cm3323_int_time[i].val2) { +- reg_conf = data->reg_conf; ++ reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK; + reg_conf |= i << CM3323_CONF_IT_SHIFT; + + ret = i2c_smbus_write_word_data(data->client, diff --git a/queue-4.1/iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch b/queue-4.1/iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch new file mode 100644 index 00000000000..6980a46f98a --- /dev/null +++ b/queue-4.1/iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch @@ -0,0 +1,32 @@ +From 33361e5678a541f82f29f85467d589e7bf8da76b Mon Sep 17 00:00:00 2001 +From: Peter Meerwald +Date: Sun, 14 Jun 2015 23:09:35 +0200 +Subject: iio: light: tcs3414: Fix bug preventing to set integration time + +From: Peter Meerwald + +commit 33361e5678a541f82f29f85467d589e7bf8da76b upstream. + +the millisecond values in tcs3414_times should be checked against +val2, not val, which is always zero. + +Signed-off-by: Peter Meerwald +Reported-by: Stephan Kleisinger +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/tcs3414.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/tcs3414.c ++++ b/drivers/iio/light/tcs3414.c +@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_ + if (val != 0) + return -EINVAL; + for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) { +- if (val == tcs3414_times[i] * 1000) { ++ if (val2 == tcs3414_times[i] * 1000) { + data->timing &= ~TCS3414_INTEG_MASK; + data->timing |= i; + return i2c_smbus_write_byte_data( diff --git a/queue-4.1/iio-proximity-sx9500-fix-proximity-value.patch b/queue-4.1/iio-proximity-sx9500-fix-proximity-value.patch new file mode 100644 index 00000000000..952faa54071 --- /dev/null +++ b/queue-4.1/iio-proximity-sx9500-fix-proximity-value.patch @@ -0,0 +1,32 @@ +From fd1883f07cb434707e50c4c9a16e3ed4b3a5e74f Mon Sep 17 00:00:00 2001 +From: Daniel Baluta +Date: Thu, 11 Jun 2015 18:49:34 +0300 +Subject: iio: proximity: sx9500: Fix proximity value + +From: Daniel Baluta + +commit fd1883f07cb434707e50c4c9a16e3ed4b3a5e74f upstream. + +Because of the ABI confusion proximity value exposed by SX9500 +was inverted. + +Signed-off-by: Daniel Baluta +Reviewed-by: Vlad Dogaru +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/proximity/sx9500.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/proximity/sx9500.c ++++ b/drivers/iio/proximity/sx9500.c +@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct + if (ret < 0) + return ret; + +- *val = 32767 - (s16)be16_to_cpu(regval); ++ *val = be16_to_cpu(regval); + + return IIO_VAL_INT; + } diff --git a/queue-4.1/iio-tmp006-check-channel-info-on-write.patch b/queue-4.1/iio-tmp006-check-channel-info-on-write.patch new file mode 100644 index 00000000000..34b3b2f87a8 --- /dev/null +++ b/queue-4.1/iio-tmp006-check-channel-info-on-write.patch @@ -0,0 +1,35 @@ +From 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf Mon Sep 17 00:00:00 2001 +From: Peter Meerwald +Date: Sun, 21 Jun 2015 23:50:21 +0200 +Subject: iio: tmp006: Check channel info on write + +From: Peter Meerwald + +commit 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf upstream. + +only SAMP_FREQ is writable + +Will lead to SAMP_FREQ being written by any attempt to write +to the other exported attributes and hence a rather unexpected +result! + +Signed-off-by: Peter Meerwald +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/temperature/tmp006.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/iio/temperature/tmp006.c ++++ b/drivers/iio/temperature/tmp006.c +@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_d + struct tmp006_data *data = iio_priv(indio_dev); + int i; + ++ if (mask != IIO_CHAN_INFO_SAMP_FREQ) ++ return -EINVAL; ++ + for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++) + if ((val == tmp006_freqs[i][0]) && + (val2 == tmp006_freqs[i][1])) { diff --git a/queue-4.1/iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch b/queue-4.1/iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch new file mode 100644 index 00000000000..f75dfac6630 --- /dev/null +++ b/queue-4.1/iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch @@ -0,0 +1,38 @@ +From 6c0d48cb29c29b306ba3548afb45154d22eb4d78 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 24 May 2015 17:39:04 -0300 +Subject: iio: twl4030-madc: Pass the IRQF_ONESHOT flag + +From: Fabio Estevam + +commit 6c0d48cb29c29b306ba3548afb45154d22eb4d78 upstream. + +Since commit 1c6c69525b40 ("genirq: Reject bogus threaded irq requests") +threaded IRQs without a primary handler need to be requested with +IRQF_ONESHOT, otherwise the request will fail. + +So pass the IRQF_ONESHOT flag in this case. + +The semantic patch that makes this change is available +in scripts/coccinelle/misc/irqf_oneshot.cocci. + +Signed-off-by: Fabio Estevam +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/twl4030-madc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/twl4030-madc.c ++++ b/drivers/iio/adc/twl4030-madc.c +@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct pla + irq = platform_get_irq(pdev, 0); + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, + twl4030_madc_threaded_irq_handler, +- IRQF_TRIGGER_RISING, "twl4030_madc", madc); ++ IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ "twl4030_madc", madc); + if (ret) { + dev_err(&pdev->dev, "could not request irq\n"); + goto err_i2c; diff --git a/queue-4.1/jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch b/queue-4.1/jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch new file mode 100644 index 00000000000..51504d1e715 --- /dev/null +++ b/queue-4.1/jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch @@ -0,0 +1,197 @@ +From 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a Mon Sep 17 00:00:00 2001 +From: Joseph Qi +Date: Mon, 15 Jun 2015 14:36:01 -0400 +Subject: jbd2: fix ocfs2 corrupt when updating journal superblock fails + +From: Joseph Qi + +commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream. + +If updating journal superblock fails after journal data has been +flushed, the error is omitted and this will mislead the caller as a +normal case. In ocfs2, the checkpoint will be treated successfully +and the other node can get the lock to update. Since the sb_start is +still pointing to the old log block, it will rewrite the journal data +during journal recovery by the other node. Thus the new updates will +be overwritten and ocfs2 corrupts. So in above case we have to return +the error, and ocfs2_commit_cache will take care of the error and +prevent the other node to do update first. And only after recovering +journal it can do the new updates. + +The issue discussion mail can be found at: +https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html +http://comments.gmane.org/gmane.comp.file-systems.ext4/48841 + +[ Fixed bug in patch which allowed a non-negative error return from + jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this + was causing xfstests ext4/306 to fail. -- Ted ] + +Reported-by: Yiwen Jiang +Signed-off-by: Joseph Qi +Signed-off-by: Theodore Ts'o +Tested-by: Yiwen Jiang +Cc: Junxiao Bi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/checkpoint.c | 5 ++--- + fs/jbd2/journal.c | 38 +++++++++++++++++++++++++++++++------- + include/linux/jbd2.h | 4 ++-- + 3 files changed, 35 insertions(+), 12 deletions(-) + +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t + unsigned long blocknr; + + if (is_journal_aborted(journal)) +- return 1; ++ return -EIO; + + if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) + return 1; +@@ -407,8 +407,7 @@ int jbd2_cleanup_journal_tail(journal_t + if (journal->j_flags & JBD2_BARRIER) + blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); + +- __jbd2_update_log_tail(journal, first_tid, blocknr); +- return 0; ++ return __jbd2_update_log_tail(journal, first_tid, blocknr); + } + + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t + * + * Requires j_checkpoint_mutex + */ +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + { + unsigned long freed; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + +@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *j + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ if (ret) ++ goto out; ++ + write_lock(&journal->j_state_lock); + freed = block - journal->j_tail; + if (block < journal->j_tail) +@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *j + journal->j_tail_sequence = tid; + journal->j_tail = block; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /* +@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *jour + return jbd2_journal_start_thread(journal); + } + +-static void jbd2_write_superblock(journal_t *journal, int write_op) ++static int jbd2_write_superblock(journal_t *journal, int write_op) + { + struct buffer_head *bh = journal->j_sb_buffer; + journal_superblock_t *sb = journal->j_superblock; +@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journa + printk(KERN_ERR "JBD2: Error %d detected when updating " + "journal superblock for %s.\n", ret, + journal->j_devname); ++ jbd2_journal_abort(journal, ret); + } ++ ++ return ret; + } + + /** +@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journa + * Update a journal's superblock information about log tail and write it to + * disk, waiting for the IO to complete. + */ +-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, ++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + unsigned long tail_block, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", +@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(jou + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +- jbd2_write_superblock(journal, write_op); ++ ret = jbd2_write_superblock(journal, write_op); ++ if (ret) ++ goto out; + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); + WARN_ON(!sb->s_sequence); + journal->j_flags &= ~JBD2_FLUSHED; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /** +@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journa + return -EIO; + + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_cleanup_journal_tail(journal); ++ if (!err) { ++ err = jbd2_cleanup_journal_tail(journal); ++ if (err < 0) { ++ mutex_unlock(&journal->j_checkpoint_mutex); ++ goto out; ++ } ++ err = 0; ++ } + + /* Finally, mark the journal as really needing no recovery. + * This sets s_start==0 in the underlying superblock, which is +@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journa + J_ASSERT(journal->j_head == journal->j_tail); + J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); + write_unlock(&journal->j_state_lock); +- return 0; ++out: ++ return err; + } + + /** +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_des + int jbd2_journal_next_log_block(journal_t *, unsigned long long *); + int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + unsigned long *block); +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + + /* Commit management */ +@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (j + extern int jbd2_journal_wipe (journal_t *, int); + extern int jbd2_journal_skip_recovery (journal_t *); + extern void jbd2_journal_update_sb_errno(journal_t *); +-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, ++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, + unsigned long, int); + extern void __jbd2_journal_abort_hard (journal_t *); + extern void jbd2_journal_abort (journal_t *, int); diff --git a/queue-4.1/jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch b/queue-4.1/jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch new file mode 100644 index 00000000000..bc68408db5b --- /dev/null +++ b/queue-4.1/jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch @@ -0,0 +1,66 @@ +From b4f1afcd068f6e533230dfed00782cd8a907f96b Mon Sep 17 00:00:00 2001 +From: Dmitry Monakhov +Date: Mon, 15 Jun 2015 00:18:02 -0400 +Subject: jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() + +From: Dmitry Monakhov + +commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream. + +jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start() +So allocations should be done with GFP_NOFS + +[Full stack trace snipped from 3.10-rh7] +[] dump_stack+0x19/0x1b +[] warn_slowpath_common+0x61/0x80 +[] warn_slowpath_null+0x1a/0x20 +[] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17 +[] kmem_cache_alloc+0x55/0x210 +[] ? mempool_alloc_slab+0x15/0x20 +[] mempool_alloc_slab+0x15/0x20 +[] mempool_alloc+0x69/0x170 +[] ? _raw_spin_unlock_irq+0xe/0x20 +[] ? finish_task_switch+0x5d/0x150 +[] bio_alloc_bioset+0x1be/0x2e0 +[] blkdev_issue_flush+0x99/0x120 +[] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL +[] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2] +[] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2] +[] start_this_handle+0x2d8/0x550 [jbd2] +[] ? __memcg_kmem_put_cache+0x29/0x30 +[] ? kmem_cache_alloc+0x130/0x210 +[] jbd2__journal_start+0xba/0x190 [jbd2] +[] ? lru_cache_add+0xe/0x10 +[] ? ext4_da_write_begin+0xf9/0x330 [ext4] +[] __ext4_journal_start_sb+0x77/0x160 [ext4] +[] ext4_da_write_begin+0xf9/0x330 [ext4] +[] generic_file_buffered_write_iter+0x10c/0x270 +[] __generic_file_write_iter+0x178/0x390 +[] __generic_file_aio_write+0x8b/0xb0 +[] generic_file_aio_write+0x5d/0xc0 +[] ext4_file_write+0xa9/0x450 [ext4] +[] ? pipe_read+0x379/0x4f0 +[] do_sync_write+0x90/0xe0 +[] vfs_write+0xbd/0x1e0 +[] SyS_write+0x58/0xb0 +[] system_call_fastpath+0x16/0x1b + +Signed-off-by: Dmitry Monakhov +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/checkpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -405,7 +405,7 @@ int jbd2_cleanup_journal_tail(journal_t + * jbd2_cleanup_journal_tail() doesn't get called all that often. + */ + if (journal->j_flags & JBD2_BARRIER) +- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); ++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); + + __jbd2_update_log_tail(journal, first_tid, blocknr); + return 0; diff --git a/queue-4.1/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch b/queue-4.1/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch new file mode 100644 index 00000000000..c772dfed3fd --- /dev/null +++ b/queue-4.1/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch @@ -0,0 +1,40 @@ +From 08c85d2a599d967ede38a847f5594447b6100642 Mon Sep 17 00:00:00 2001 +From: Aleksei Mamlin +Date: Wed, 1 Jul 2015 13:48:30 +0300 +Subject: libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER + +From: Aleksei Mamlin + +commit 08c85d2a599d967ede38a847f5594447b6100642 upstream. + +Enabling AA on HP 250GB SATA disk VB0250EAVER causes errors: + +[ 3.788362] ata3.00: failed to enable AA (error_mask=0x1) +[ 3.789243] ata3.00: failed to enable AA (error_mask=0x1) + +Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk. + +tj: Collected FPDMA_AA entries and updated comment. + +Signed-off-by: Aleksei Mamlin +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4174,9 +4174,10 @@ static const struct ata_blacklist_entry + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + +- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ ++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ diff --git a/queue-4.1/libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch b/queue-4.1/libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch new file mode 100644 index 00000000000..a916ab7d484 --- /dev/null +++ b/queue-4.1/libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch @@ -0,0 +1,81 @@ +From af34d637637eabaf49406eb35c948cd51ba262a6 Mon Sep 17 00:00:00 2001 +From: David Milburn +Date: Mon, 13 Jul 2015 11:48:23 -0500 +Subject: libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit + +From: David Milburn + +commit af34d637637eabaf49406eb35c948cd51ba262a6 upstream. + +Since no longer limiting max_sectors to BLK_DEF_MAX_SECTORS (commit 34b48db66e08), +data corruption may occur on ST380013AS drive configured on 82801JI (ICH10 Family) +SATA controller. This patch will allow the driver to limit max_sectors as before + + # cat /sys/block/sdb/queue/max_sectors_kb + 512 + +I was able to double the max_sectors_kb value up to 16384 on linux-4.2.0-rc2 +before seeing corruption, but seems safer to use previous limit. Without this +patch max_sectors_kb will be 32767. + +tj: Minor comment update. + +Reported-by: Jeff Moyer +Signed-off-by: David Milburn +Signed-off-by: Tejun Heo +Fixes: 34b48db66e08 ("block: remove artifical max_hw_sectors cap") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 10 ++++++++++ + include/linux/ata.h | 1 + + include/linux/libata.h | 2 +- + 3 files changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device + dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128, + dev->max_sectors); + ++ if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024) ++ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024, ++ dev->max_sectors); ++ + if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48) + dev->max_sectors = ATA_MAX_SECTORS_LBA48; + +@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry + { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, + { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, + ++ /* ++ * Causes silent data corruption with higher max sects. ++ * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com ++ */ ++ { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 }, ++ + /* Devices we expect to fail diagnostics */ + + /* Devices where NCQ should be avoided */ +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -45,6 +45,7 @@ enum { + ATA_SECT_SIZE = 512, + ATA_MAX_SECTORS_128 = 128, + ATA_MAX_SECTORS = 256, ++ ATA_MAX_SECTORS_1024 = 1024, + ATA_MAX_SECTORS_LBA48 = 65535,/* TODO: 65536? */ + ATA_MAX_SECTORS_TAPE = 65535, + +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -433,7 +433,7 @@ enum { + ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */ + ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */ + ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ +- ++ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ diff --git a/queue-4.1/libata-add-ata_horkage_notrim.patch b/queue-4.1/libata-add-ata_horkage_notrim.patch new file mode 100644 index 00000000000..18a08f91c5f --- /dev/null +++ b/queue-4.1/libata-add-ata_horkage_notrim.patch @@ -0,0 +1,58 @@ +From 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 Mon Sep 17 00:00:00 2001 +From: Arne Fitzenreiter +Date: Wed, 15 Jul 2015 13:54:36 +0200 +Subject: libata: add ATA_HORKAGE_NOTRIM + +From: Arne Fitzenreiter + +commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream. + +Some devices lose data on TRIM whether queued or not. This patch adds +a horkage to disable TRIM. + +tj: Collapsed unnecessary if() nesting. + +Signed-off-by: Arne Fitzenreiter +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-scsi.c | 3 ++- + drivers/ata/libata-transport.c | 2 ++ + include/linux/libata.h | 2 ++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap( + rbuf[14] = (lowest_aligned >> 8) & 0x3f; + rbuf[15] = lowest_aligned; + +- if (ata_id_has_trim(args->id)) { ++ if (ata_id_has_trim(args->id) && ++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { + rbuf[14] |= 0x80; /* LBPME */ + + if (ata_id_has_zero_after_trim(args->id) && +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -569,6 +569,8 @@ show_ata_dev_trim(struct device *dev, + + if (!ata_id_has_trim(ata_dev->id)) + mode = "unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM) ++ mode = "forced_unsupported"; + else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) + mode = "forced_unqueued"; + else if (ata_fpdma_dsm_supported(ata_dev)) +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -432,6 +432,8 @@ enum { + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ + ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */ + ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */ ++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ++ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ diff --git a/queue-4.1/libata-do-not-blacklist-m510dc.patch b/queue-4.1/libata-do-not-blacklist-m510dc.patch new file mode 100644 index 00000000000..7f82de5abe7 --- /dev/null +++ b/queue-4.1/libata-do-not-blacklist-m510dc.patch @@ -0,0 +1,32 @@ +From 9051bd393cf25e76dfb45409792719a854661500 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Wed, 15 Jul 2015 21:03:23 -0400 +Subject: libata: Do not blacklist M510DC + +From: "Martin K. Petersen" + +commit 9051bd393cf25e76dfb45409792719a854661500 upstream. + +A new Micron drive was just announced, once again recycling the first +part of the model string. Add an underscore to the M510/M550 pattern to +avoid picking up the new DC drive. + +Signed-off-by: Martin K. Petersen +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4240,7 +4240,7 @@ static const struct ata_blacklist_entry + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +- { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, diff --git a/queue-4.1/libata-do-not-blacklist-micron-m500dc.patch b/queue-4.1/libata-do-not-blacklist-micron-m500dc.patch new file mode 100644 index 00000000000..02232f9ff9d --- /dev/null +++ b/queue-4.1/libata-do-not-blacklist-micron-m500dc.patch @@ -0,0 +1,33 @@ +From 243918be6393f643e513a26e7882e6ae06ff7717 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Thu, 18 Jun 2015 14:50:18 -0400 +Subject: libata: Do not blacklist Micron M500DC + +From: "Martin K. Petersen" + +commit 243918be6393f643e513a26e7882e6ae06ff7717 upstream. + +Queued TRIM got disabled on Micron M500DC drives thanks to the +"Micron_M500*" pattern we had in place to accommodate the previous +generation of this drive family. Tweak the blacklist entry slightly so +we only disable queued TRIM for the non-DC variants of M500 drives. + +Signed-off-by: Martin K. Petersen +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4225,7 +4225,7 @@ static const struct ata_blacklist_entry + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + + /* devices that don't properly handle queued TRIM commands */ +- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, diff --git a/queue-4.1/libata-expose-trim-capability-in-sysfs.patch b/queue-4.1/libata-expose-trim-capability-in-sysfs.patch new file mode 100644 index 00000000000..9fcda8afa9d --- /dev/null +++ b/queue-4.1/libata-expose-trim-capability-in-sysfs.patch @@ -0,0 +1,81 @@ +From f303074160d3401970ccae082014e1ee5a9a52c5 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Mon, 4 May 2015 21:54:19 -0400 +Subject: libata: Expose TRIM capability in sysfs + +From: "Martin K. Petersen" + +commit f303074160d3401970ccae082014e1ee5a9a52c5 upstream. + +Create a sysfs "trim" attribute for each ata_device that displays +whether DSM TRIM is "unsupported", "unqueued", "forced_unqueued" +(blacklisted) or "queued". + +Signed-off-by: Martin K. Petersen +Reviewed-by: Hannes Reinecke +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/ABI/testing/sysfs-ata | 11 +++++++++++ + drivers/ata/libata-transport.c | 22 ++++++++++++++++++++++ + 2 files changed, 33 insertions(+) + +--- a/Documentation/ABI/testing/sysfs-ata ++++ b/Documentation/ABI/testing/sysfs-ata +@@ -90,6 +90,17 @@ gscr + 130: SATA_PMP_GSCR_SII_GPIO + Only valid if the device is a PM. + ++trim ++ ++ Shows the DSM TRIM mode currently used by the device. Valid ++ values are: ++ unsupported: Drive does not support DSM TRIM ++ unqueued: Drive supports unqueued DSM TRIM only ++ queued: Drive supports queued DSM TRIM ++ forced_unqueued: Drive's unqueued DSM support is known to be ++ buggy and only unqueued TRIM commands ++ are sent ++ + spdn_cnt + + Number of time libata decided to lower the speed of link due to errors. +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -560,6 +560,27 @@ show_ata_dev_gscr(struct device *dev, + + static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL); + ++static ssize_t ++show_ata_dev_trim(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct ata_device *ata_dev = transport_class_to_dev(dev); ++ unsigned char *mode; ++ ++ if (!ata_id_has_trim(ata_dev->id)) ++ mode = "unsupported"; ++ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) ++ mode = "forced_unqueued"; ++ else if (ata_fpdma_dsm_supported(ata_dev)) ++ mode = "queued"; ++ else ++ mode = "unqueued"; ++ ++ return snprintf(buf, 20, "%s\n", mode); ++} ++ ++static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL); ++ + static DECLARE_TRANSPORT_CLASS(ata_dev_class, + "ata_device", NULL, NULL, NULL); + +@@ -733,6 +754,7 @@ struct scsi_transport_template *ata_atta + SETUP_DEV_ATTRIBUTE(ering); + SETUP_DEV_ATTRIBUTE(id); + SETUP_DEV_ATTRIBUTE(gscr); ++ SETUP_DEV_ATTRIBUTE(trim); + BUG_ON(count > ATA_DEV_ATTRS); + i->dev_attrs[count] = NULL; + diff --git a/queue-4.1/libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch b/queue-4.1/libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch new file mode 100644 index 00000000000..363e8207a5f --- /dev/null +++ b/queue-4.1/libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch @@ -0,0 +1,71 @@ +From 5d3abf8ff67f49271a42c0f7fa4f20f9e046bf0e Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Mon, 4 May 2015 21:54:21 -0400 +Subject: libata: Fall back to unqueued READ LOG EXT if the DMA variant fails + +From: "Martin K. Petersen" + +commit 5d3abf8ff67f49271a42c0f7fa4f20f9e046bf0e upstream. + +Some devices advertise support for the READ/WRITE LOG DMA EXT commands +but fail when we try to issue them. This can lead to queued TRIM being +unintentionally disabled since the relevant feature flag is located in a +general purpose log page. + +Fall back to unqueued READ LOG EXT if the DMA variant fails while +reading a log page. + +Signed-off-by: Martin K. Petersen +Reviewed-by: Hannes Reinecke +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 12 +++++++++++- + include/linux/libata.h | 1 + + 2 files changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1507,13 +1507,17 @@ unsigned int ata_read_log_page(struct at + { + struct ata_taskfile tf; + unsigned int err_mask; ++ bool dma = false; + + DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page); + ++retry: + ata_tf_init(dev, &tf); +- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) { ++ if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && ++ !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) { + tf.command = ATA_CMD_READ_LOG_DMA_EXT; + tf.protocol = ATA_PROT_DMA; ++ dma = true; + } else { + tf.command = ATA_CMD_READ_LOG_EXT; + tf.protocol = ATA_PROT_PIO; +@@ -1527,6 +1531,12 @@ unsigned int ata_read_log_page(struct at + err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE, + buf, sectors * ATA_SECT_SIZE, 0); + ++ if (err_mask && dma) { ++ dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG; ++ ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n"); ++ goto retry; ++ } ++ + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; + } +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -431,6 +431,7 @@ enum { + ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ + ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ + ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */ ++ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ diff --git a/queue-4.1/libata-force-disable-trim-for-supersspeed-s238.patch b/queue-4.1/libata-force-disable-trim-for-supersspeed-s238.patch new file mode 100644 index 00000000000..42acb2282d6 --- /dev/null +++ b/queue-4.1/libata-force-disable-trim-for-supersspeed-s238.patch @@ -0,0 +1,33 @@ +From cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc Mon Sep 17 00:00:00 2001 +From: Arne Fitzenreiter +Date: Wed, 15 Jul 2015 13:54:37 +0200 +Subject: libata: force disable trim for SuperSSpeed S238 + +From: Arne Fitzenreiter + +commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream. + +This device loses blocks, often the partition table area, on trim. +Disable TRIM. +http://pcengines.ch/msata16a.htm + +Signed-off-by: Arne Fitzenreiter +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4249,6 +4249,9 @@ static const struct ata_blacklist_entry + { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + ++ /* devices that don't properly handle TRIM commands */ ++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, ++ + /* + * As defined, the DRAT (Deterministic Read After Trim) and RZAT + * (Return Zero After Trim) flags in the ATA Command Set are diff --git a/queue-4.1/libata-increase-the-timeout-when-setting-transfer-mode.patch b/queue-4.1/libata-increase-the-timeout-when-setting-transfer-mode.patch new file mode 100644 index 00000000000..b77c5837e58 --- /dev/null +++ b/queue-4.1/libata-increase-the-timeout-when-setting-transfer-mode.patch @@ -0,0 +1,37 @@ +From d531be2ca2f27cca5f041b6a140504999144a617 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Wed, 8 Jul 2015 13:06:12 -0400 +Subject: libata: increase the timeout when setting transfer mode + +From: Mikulas Patocka + +commit d531be2ca2f27cca5f041b6a140504999144a617 upstream. + +I have a ST4000DM000 disk. If Linux is booted while the disk is spun down, +the command that sets transfer mode causes the disk to spin up. The +spin-up takes longer than the default 5s timeout, so the command fails and +timeout is reported. + +Fix this by increasing the timeout to 15s, which is enough for the disk to +spin up. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4502,7 +4502,8 @@ static unsigned int ata_dev_set_xfermode + else /* In the ancient relic department - skip all of this */ + return 0; + +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); ++ /* On some disks, this command causes spin-up, so we need longer timeout */ ++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); + + DPRINTK("EXIT, err_mask=%x\n", err_mask); + return err_mask; diff --git a/queue-4.1/media-fix-regression-in-some-more-dib0700-based-devices.patch b/queue-4.1/media-fix-regression-in-some-more-dib0700-based-devices.patch new file mode 100644 index 00000000000..b3687b694d4 --- /dev/null +++ b/queue-4.1/media-fix-regression-in-some-more-dib0700-based-devices.patch @@ -0,0 +1,57 @@ +From e989a73ebd09d22c22ead51fa363a2f56f70f28a Mon Sep 17 00:00:00 2001 +From: Thomas Reitmayr +Date: Fri, 1 May 2015 20:18:04 -0300 +Subject: [media] media: Fix regression in some more dib0700 based devices + +From: Thomas Reitmayr + +commit e989a73ebd09d22c22ead51fa363a2f56f70f28a upstream. + +Fix an oops during device initialization by correctly setting size_of_priv +instead of leaving it 0. +The regression was introduced by 8abe4a0a3f6d4217b16a ("[media] dib7000: +export just one symbol") and only fixed for one type of dib0700 based +devices in 9e334c75642b6e5bfb95 ("[media] Fix regression in some dib0700 +based devices"). + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=92301 + +Fixes: 8abe4a0a3f6d4217b16a ("[media] dib7000: export just one symbol") + +Signed-off-by: Thomas Reitmayr +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb/dib0700_devices.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/media/usb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c +@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700 + + DIB0700_DEFAULT_STREAMING_CONFIG(0x02), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + }, { + .num_frontends = 1, + .fe = {{ +@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700 + + DIB0700_DEFAULT_STREAMING_CONFIG(0x03), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + } + }, + +@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700 + + DIB0700_DEFAULT_STREAMING_CONFIG(0x02), + }}, ++ .size_of_priv = sizeof(struct ++ dib0700_adapter_state), + }, + }, + diff --git a/queue-4.1/nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch b/queue-4.1/nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch new file mode 100644 index 00000000000..8445128cba2 --- /dev/null +++ b/queue-4.1/nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch @@ -0,0 +1,45 @@ +From 09f39a950523b1bb830c30a8670b77e0067da092 Mon Sep 17 00:00:00 2001 +From: Christophe Ricard +Date: Sat, 6 Jun 2015 13:16:43 +0200 +Subject: NFC: st21nfcb: Do not remove header once the payload is sent + +From: Christophe Ricard + +commit 09f39a950523b1bb830c30a8670b77e0067da092 upstream. + +Once the data is sent, we need to preserve the full frame for +the ndlc state machine. If the NDLC ACK is not received in time, +the ndlc layer will resend the same frame. +Having the header byte pulled will corrupt the frame. + +Signed-off-by: Christophe Ricard +Signed-off-by: Samuel Ortiz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nfc/st21nfcb/i2c.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/nfc/st21nfcb/i2c.c ++++ b/drivers/nfc/st21nfcb/i2c.c +@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(voi + gpio_set_value(phy->gpio_reset, 1); + } + +-static void st21nfcb_nci_remove_header(struct sk_buff *skb) +-{ +- skb_pull(skb, ST21NFCB_FRAME_HEADROOM); +-} +- + /* + * Writing a frame must not return the number of written bytes. + * It must return either zero for success, or <0 for error. +@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void * + r = 0; + } + +- st21nfcb_nci_remove_header(skb); +- + return r; + } + diff --git a/queue-4.1/nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch b/queue-4.1/nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch new file mode 100644 index 00000000000..15212928da4 --- /dev/null +++ b/queue-4.1/nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch @@ -0,0 +1,36 @@ +From 38bd83f04c5e9695011dc5c294e0c4e6a9f9052d Mon Sep 17 00:00:00 2001 +From: Firo Yang +Date: Sat, 6 Jun 2015 13:16:42 +0200 +Subject: NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer + +From: Firo Yang + +commit 38bd83f04c5e9695011dc5c294e0c4e6a9f9052d upstream. + +Since ndev->driver_data is allocated by devm_kzalloc(), we do not +need the inappropriate kfree to free it in driver's remove function. +Freeing will trigger when driver unloads. + +Acked-by: Christophe Ricard +Signed-off-by: Firo Yang +Signed-off-by: Samuel Ortiz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nfc/st21nfcb/st21nfcb.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/nfc/st21nfcb/st21nfcb.c ++++ b/drivers/nfc/st21nfcb/st21nfcb.c +@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe); + + void st21nfcb_nci_remove(struct nci_dev *ndev) + { +- struct st21nfcb_nci_info *info = nci_get_drvdata(ndev); +- + nci_unregister_device(ndev); + nci_free_device(ndev); +- kfree(info); + } + EXPORT_SYMBOL_GPL(st21nfcb_nci_remove); + diff --git a/queue-4.1/nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch b/queue-4.1/nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch new file mode 100644 index 00000000000..38b6fa94616 --- /dev/null +++ b/queue-4.1/nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch @@ -0,0 +1,32 @@ +From 4ac82e894825126816d7b7f662743335ce2b015e Mon Sep 17 00:00:00 2001 +From: Christophe Ricard +Date: Sat, 6 Jun 2015 13:16:44 +0200 +Subject: NFC: st21nfcb: remove st21nfcb_nci_i2c_disable + +From: Christophe Ricard + +commit 4ac82e894825126816d7b7f662743335ce2b015e upstream. + +ndlc_remove already calls st21nfcb_nci_i2c_disable and +phy->powered is already set to 0. + +Signed-off-by: Christophe Ricard +Signed-off-by: Samuel Ortiz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nfc/st21nfcb/i2c.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/nfc/st21nfcb/i2c.c ++++ b/drivers/nfc/st21nfcb/i2c.c +@@ -359,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struc + + ndlc_remove(phy->ndlc); + +- if (phy->powered) +- st21nfcb_nci_i2c_disable(phy); +- + return 0; + } + diff --git a/queue-4.1/rc-core-fix-dib0700-scancode-generation-for-rc5.patch b/queue-4.1/rc-core-fix-dib0700-scancode-generation-for-rc5.patch new file mode 100644 index 00000000000..6752726495a --- /dev/null +++ b/queue-4.1/rc-core-fix-dib0700-scancode-generation-for-rc5.patch @@ -0,0 +1,138 @@ +From 4d298b8539ed59f1d69d3aa6e41a2c4908137612 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?David=20H=C3=A4rdeman?= +Date: Mon, 30 Mar 2015 17:51:01 -0300 +Subject: [media] rc-core: fix dib0700 scancode generation for RC5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?David=20H=C3=A4rdeman?= + +commit 4d298b8539ed59f1d69d3aa6e41a2c4908137612 upstream. + +commit af3a4a9bbeb0 ("[media] dib0700: NEC scancode cleanup") cleaned +up the NEC scancode logic but overlooked the RC5 case. + +This patch brings the RC5 case in line with the NEC code and makes +the struct self-documenting. + +Signed-off-by: David Härdeman +Reported-by: David Cimbůrek +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb/dib0700_core.c | 70 +++++++++++++++++-------------- + 1 file changed, 40 insertions(+), 30 deletions(-) + +--- a/drivers/media/usb/dvb-usb/dib0700_core.c ++++ b/drivers/media/usb/dvb-usb/dib0700_core.c +@@ -655,10 +655,20 @@ out: + struct dib0700_rc_response { + u8 report_id; + u8 data_state; +- u8 system; +- u8 not_system; +- u8 data; +- u8 not_data; ++ union { ++ struct { ++ u8 system; ++ u8 not_system; ++ u8 data; ++ u8 not_data; ++ } nec; ++ struct { ++ u8 not_used; ++ u8 system; ++ u8 data; ++ u8 not_data; ++ } rc5; ++ }; + }; + #define RC_MSG_SIZE_V1_20 6 + +@@ -694,8 +704,8 @@ static void dib0700_rc_urb_completion(st + + deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n", + poll_reply->report_id, poll_reply->data_state, +- poll_reply->system, poll_reply->not_system, +- poll_reply->data, poll_reply->not_data, ++ poll_reply->nec.system, poll_reply->nec.not_system, ++ poll_reply->nec.data, poll_reply->nec.not_data, + purb->actual_length); + + switch (d->props.rc.core.protocol) { +@@ -704,30 +714,30 @@ static void dib0700_rc_urb_completion(st + toggle = 0; + + /* NEC protocol sends repeat code as 0 0 0 FF */ +- if (poll_reply->system == 0x00 && +- poll_reply->not_system == 0x00 && +- poll_reply->data == 0x00 && +- poll_reply->not_data == 0xff) { ++ if (poll_reply->nec.system == 0x00 && ++ poll_reply->nec.not_system == 0x00 && ++ poll_reply->nec.data == 0x00 && ++ poll_reply->nec.not_data == 0xff) { + poll_reply->data_state = 2; + break; + } + +- if ((poll_reply->data ^ poll_reply->not_data) != 0xff) { ++ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) { + deb_data("NEC32 protocol\n"); +- keycode = RC_SCANCODE_NEC32(poll_reply->system << 24 | +- poll_reply->not_system << 16 | +- poll_reply->data << 8 | +- poll_reply->not_data); +- } else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) { ++ keycode = RC_SCANCODE_NEC32(poll_reply->nec.system << 24 | ++ poll_reply->nec.not_system << 16 | ++ poll_reply->nec.data << 8 | ++ poll_reply->nec.not_data); ++ } else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) { + deb_data("NEC extended protocol\n"); +- keycode = RC_SCANCODE_NECX(poll_reply->system << 8 | +- poll_reply->not_system, +- poll_reply->data); ++ keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 | ++ poll_reply->nec.not_system, ++ poll_reply->nec.data); + + } else { + deb_data("NEC normal protocol\n"); +- keycode = RC_SCANCODE_NEC(poll_reply->system, +- poll_reply->data); ++ keycode = RC_SCANCODE_NEC(poll_reply->nec.system, ++ poll_reply->nec.data); + } + + break; +@@ -735,17 +745,17 @@ static void dib0700_rc_urb_completion(st + deb_data("RC5 protocol\n"); + protocol = RC_TYPE_RC5; + toggle = poll_reply->report_id; +- keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data); ++ keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data); + +- break; +- } ++ if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) { ++ /* Key failed integrity check */ ++ err("key failed integrity check: %02x %02x %02x %02x", ++ poll_reply->rc5.not_used, poll_reply->rc5.system, ++ poll_reply->rc5.data, poll_reply->rc5.not_data); ++ goto resubmit; ++ } + +- if ((poll_reply->data + poll_reply->not_data) != 0xff) { +- /* Key failed integrity check */ +- err("key failed integrity check: %02x %02x %02x %02x", +- poll_reply->system, poll_reply->not_system, +- poll_reply->data, poll_reply->not_data); +- goto resubmit; ++ break; + } + + rc_keydown(d->rc_dev, protocol, keycode, toggle); diff --git a/queue-4.1/rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch b/queue-4.1/rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch new file mode 100644 index 00000000000..fadf9507c3b --- /dev/null +++ b/queue-4.1/rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch @@ -0,0 +1,82 @@ +From 119434f44c78df8c4b6d67f835448542a4bd7e91 Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Thu, 21 May 2015 17:29:35 +0200 +Subject: rtc: snvs: fix wakealarm by call enable_irq_wake earlier + +From: Stefan Agner + +commit 119434f44c78df8c4b6d67f835448542a4bd7e91 upstream. + +When entering suspend while an wakeup alarm is set, enable_set_wake +should make sure that the RTC interrupt keep being enabled and the +.irq_set_wake for the RTC interrupt get called. However, since the +driver uses the suspend_noirq callback, the call to enable_irq_wake +has been made after disabling the interrupts. While .irq_set_wake +has been called properly, the interrupt remained disabled. + +Use the suspend callback to call enable_irq_wake early enough to +ensure the RTC interrupt remains enabled. + +Fixes: 7654e9d4fd8f ("drivers/rtc/rtc-snvs: fix suspend/resume") +Signed-off-by: Stefan Agner +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-snvs.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct devic + if (device_may_wakeup(dev)) + enable_irq_wake(data->irq); + ++ return 0; ++} ++ ++static int snvs_rtc_suspend_noirq(struct device *dev) ++{ ++ struct snvs_rtc_data *data = dev_get_drvdata(dev); ++ + if (data->clk) + clk_disable_unprepare(data->clk); + +@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct devic + static int snvs_rtc_resume(struct device *dev) + { + struct snvs_rtc_data *data = dev_get_drvdata(dev); +- int ret; + + if (device_may_wakeup(dev)) +- disable_irq_wake(data->irq); ++ return disable_irq_wake(data->irq); + +- if (data->clk) { +- ret = clk_prepare_enable(data->clk); +- if (ret) +- return ret; +- } ++ return 0; ++} ++ ++static int snvs_rtc_resume_noirq(struct device *dev) ++{ ++ struct snvs_rtc_data *data = dev_get_drvdata(dev); ++ ++ if (data->clk) ++ return clk_prepare_enable(data->clk); + + return 0; + } + + static const struct dev_pm_ops snvs_rtc_pm_ops = { +- .suspend_noirq = snvs_rtc_suspend, +- .resume_noirq = snvs_rtc_resume, ++ .suspend = snvs_rtc_suspend, ++ .suspend_noirq = snvs_rtc_suspend_noirq, ++ .resume = snvs_rtc_resume, ++ .resume_noirq = snvs_rtc_resume_noirq, + }; + + #define SNVS_RTC_PM_OPS (&snvs_rtc_pm_ops) diff --git a/queue-4.1/rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch b/queue-4.1/rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch new file mode 100644 index 00000000000..b159ae9c3bd --- /dev/null +++ b/queue-4.1/rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch @@ -0,0 +1,196 @@ +From 1277fa2ab2f9a624a4b0177119ca13b5fd65edd0 Mon Sep 17 00:00:00 2001 +From: Vincent Fann +Date: Fri, 15 May 2015 21:29:27 -0500 +Subject: rtlwifi: Remove the clear interrupt routine from all drivers + +From: Vincent Fann + +commit 1277fa2ab2f9a624a4b0177119ca13b5fd65edd0 upstream. + +Several of these drivers have there TX randomly blocked for 3~5 seconds while +measuring tx throughput (iperf). The root couse happens in rtl_pci_flush(). +The function uses a while-loop to wait for TX queue length to decrease to 0. +The TX queue length counts the number of packets that are queued in the driver. +The driver relys on the TX OK interrupt to return skb and reduce TX queue length. + +The interrupt subroutine disables interupts, reads the interrupt registers, and +then clears the registers in the beginning of _rtl_pci_interrupt(). After all +interupts process are finished, the driver invokes enable_interrupt() to enable +interupts. This behavior is normal for an interrupt subroutine. + +But enable_interrupt() invokes clear_interrupt() again. This unexpected interrupt +clearing may cleari me fresh TX OK interrupts. These missing interrupts cause TX +queue length to never reduce to 0i, which causes rtl_pci_flush() to be stuck in +unterminated while-loop. + +This patch removes clear_interrupt() in enable_interrupt() to avoid this behavior. + +Signed-off-by: Vincent Fann +Signed-off-by: Shao Fu +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8188ee/hw.c | 16 ---------------- + drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 17 ----------------- + drivers/net/wireless/rtlwifi/rtl8723ae/hw.c | 13 ------------- + drivers/net/wireless/rtlwifi/rtl8723be/hw.c | 17 ----------------- + drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 20 -------------------- + 5 files changed, 83 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c +@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw + } + } + +-static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl88ee_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl88ee_clear_interrupt(hw);/*clear it here first*/ + rtl_write_dword(rtlpriv, REG_HIMR, + rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c +@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw + } + } + +-static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl92ee_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl92ee_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c +@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_h + } + } + +-static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +-} +- + void rtl8723e_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct i + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); +- rtl8723e_clear_interrupt(hw);/*clear it here first*/ + rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED); + rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED); + rtlpci->irq_enabled = false; +--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c +@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_ + } + } + +-static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl8723be_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl8723be_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_ + } + } + +-static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 tmp; +- tmp = rtl_read_dword(rtlpriv, REG_HISR); +- /*printk("clear interrupt first:\n"); +- printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HISR, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HISRE); +- /*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HISRE, tmp); +- +- tmp = rtl_read_dword(rtlpriv, REG_HSISR); +- /*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/ +- rtl_write_dword(rtlpriv, REG_HSISR, tmp); +-} +- + void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- rtl8821ae_clear_interrupt(hw);/*clear it here first*/ +- + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; diff --git a/queue-4.1/s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch b/queue-4.1/s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch new file mode 100644 index 00000000000..88375cea18e --- /dev/null +++ b/queue-4.1/s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch @@ -0,0 +1,31 @@ +From 12f4543f5d6811f864e6c4952eb27253c7466c02 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Tue, 28 Apr 2015 18:34:40 -0300 +Subject: [media] s5h1420: fix a buffer overflow when checking userspace params + +From: Mauro Carvalho Chehab + +commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream. + +The maximum size for a DiSEqC command is 6, according to the +userspace API. However, the code allows to write up to 7 values: + drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/s5h1420.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb-frontends/s5h1420.c ++++ b/drivers/media/dvb-frontends/s5h1420.c +@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (stru + int result = 0; + + dprintk("enter %s\n", __func__); +- if (cmd->msg_len > 8) ++ if (cmd->msg_len > sizeof(cmd->msg)) + return -EINVAL; + + /* setup for DISEQC */ diff --git a/queue-4.1/saa7164-fix-querycap-warning.patch b/queue-4.1/saa7164-fix-querycap-warning.patch new file mode 100644 index 00000000000..2cf3f70d837 --- /dev/null +++ b/queue-4.1/saa7164-fix-querycap-warning.patch @@ -0,0 +1,65 @@ +From 534bc3e2ee93835badca753bedce8073c67caa92 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Fri, 27 Mar 2015 15:17:56 -0300 +Subject: [media] saa7164: fix querycap warning + +From: Hans Verkuil + +commit 534bc3e2ee93835badca753bedce8073c67caa92 upstream. + +Fix the VIDIOC_QUERYCAP warning due to the missing device_caps. Don't fill +in the version field, the V4L2 core will do that for you. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/saa7164/saa7164-encoder.c | 11 ++++++----- + drivers/media/pci/saa7164/saa7164-vbi.c | 11 ++++++----- + 2 files changed, 12 insertions(+), 10 deletions(-) + +--- a/drivers/media/pci/saa7164/saa7164-encoder.c ++++ b/drivers/media/pci/saa7164/saa7164-encoder.c +@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file * + sizeof(cap->card)); + sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci)); + +- cap->capabilities = ++ cap->device_caps = + V4L2_CAP_VIDEO_CAPTURE | +- V4L2_CAP_READWRITE | +- 0; ++ V4L2_CAP_READWRITE | ++ V4L2_CAP_TUNER; + +- cap->capabilities |= V4L2_CAP_TUNER; +- cap->version = 0; ++ cap->capabilities = cap->device_caps | ++ V4L2_CAP_VBI_CAPTURE | ++ V4L2_CAP_DEVICE_CAPS; + + return 0; + } +--- a/drivers/media/pci/saa7164/saa7164-vbi.c ++++ b/drivers/media/pci/saa7164/saa7164-vbi.c +@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file * + sizeof(cap->card)); + sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci)); + +- cap->capabilities = ++ cap->device_caps = + V4L2_CAP_VBI_CAPTURE | +- V4L2_CAP_READWRITE | +- 0; ++ V4L2_CAP_READWRITE | ++ V4L2_CAP_TUNER; + +- cap->capabilities |= V4L2_CAP_TUNER; +- cap->version = 0; ++ cap->capabilities = cap->device_caps | ++ V4L2_CAP_VIDEO_CAPTURE | ++ V4L2_CAP_DEVICE_CAPS; + + return 0; + } diff --git a/queue-4.1/series b/queue-4.1/series index 62722b34e42..9e36a7c9306 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -12,3 +12,81 @@ pinctrl-mvebu-armada-xp-fix-functions-of-mpp48.patch openrisc-fix-config_uid16-setting.patch m68knommu-make-coldfire-soc-selection-a-choice.patch m68knommu-force-setting-of-config_clock_freq-for-coldfire.patch +bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch +bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch +bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch +bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch +bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch +ath9k-fix-dma-stop-sequence-for-ar9003.patch +ath9k_htc-memory-corruption-calling-set_bit.patch +rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch +ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch +staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch +staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch +staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch +staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch +staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch +hid-sensor-fix-suspend-resume-delay.patch +ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch +ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch +ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch +ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch +ext4-fix-fencepost-error-in-lazytime-optimization.patch +bufferhead-add-_gfp-version-for-sb_getblk.patch +ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch +ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch +ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch +ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch +ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch +jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch +jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch +nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch +nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch +nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch +rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch +i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch +i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch +i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch +i2c-use-parent-adapter-quirks-in-mux.patch +iio-light-cm3323-clear-bitmask-before-set.patch +iio-adc-cc10001_adc-fix-kconfig-dependency.patch +iio-accel-bmc150-accel-fix-counting-direction.patch +iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch +iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch +iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch +iio-tmp006-check-channel-info-on-write.patch +iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch +iio-abi-clarify-proximity-output-value.patch +iio-proximity-sx9500-fix-proximity-value.patch +iio-adc-rockchip_saradc-add-missing-module_-data.patch +iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch +vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch +media-fix-regression-in-some-more-dib0700-based-devices.patch +rc-core-fix-dib0700-scancode-generation-for-rc5.patch +cx18-add-missing-caps-for-the-pcm-video-device.patch +cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch +af9013-don-t-accept-invalid-bandwidth.patch +saa7164-fix-querycap-warning.patch +s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch +cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch +asoc-arizona-fix-noise-generator-gain-tlv.patch +asoc-rt5645-init-jack_detect_work-before-registering-irq.patch +asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch +asoc-qcom-remove-incorrect-dependencies.patch +asoc-imx-wm8962-add-a-missing-error-check.patch +asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch +asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch +asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch +asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch +asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch +asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch +asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch +libata-do-not-blacklist-micron-m500dc.patch +libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch +libata-increase-the-timeout-when-setting-transfer-mode.patch +libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch +libata-expose-trim-capability-in-sysfs.patch +libata-add-ata_horkage_notrim.patch +libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch +libata-do-not-blacklist-m510dc.patch +libata-force-disable-trim-for-supersspeed-s238.patch diff --git a/queue-4.1/staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch b/queue-4.1/staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch new file mode 100644 index 00000000000..04d00b3288b --- /dev/null +++ b/queue-4.1/staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch @@ -0,0 +1,65 @@ +From b08ad6657aacf9b5d7c4b22de2ba891b152d0528 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 12 Jun 2015 16:37:41 +0100 +Subject: staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices + +From: Ian Abbott + +commit b08ad6657aacf9b5d7c4b22de2ba891b152d0528 upstream. + +Normally, low-level Comedi drivers set an `insn_bits` handler for +digital input (DI), digital output (DO) and digital input/output (DIO) +subdevice types to handle normal reading and writing of digital +channels. The "cb_pcimdas" driver currently has an `insn_read` handler +for the DI subdevice and an `insn_write` handler for the DO subdevice. +However, the actual handler functions `cb_pcimdas_di_insn_read()` and +`cb_pcimdas_do_insn_write()` are written to behave like `insn_bits` +handlers. Something's wrong there! To fix it, set the functions as +`insn_bits` handlers and rename them for consistency. + +Fixes: e56d03dee14a ("staging: comedi: cb_pcimdas: add main connector digital input/output") +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/cb_pcimdas.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/staging/comedi/drivers/cb_pcimdas.c ++++ b/drivers/staging/comedi/drivers/cb_pcimdas.c +@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(stru + return insn->n; + } + +-static int cb_pcimdas_di_insn_read(struct comedi_device *dev, ++static int cb_pcimdas_di_insn_bits(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, + unsigned int *data) +@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struc + return insn->n; + } + +-static int cb_pcimdas_do_insn_write(struct comedi_device *dev, ++static int cb_pcimdas_do_insn_bits(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, + unsigned int *data) +@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct + s->n_chan = 4; + s->maxdata = 1; + s->range_table = &range_digital; +- s->insn_read = cb_pcimdas_di_insn_read; ++ s->insn_bits = cb_pcimdas_di_insn_bits; + + /* Digital Output subdevice (main connector) */ + s = &dev->subdevices[4]; +@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct + s->n_chan = 4; + s->maxdata = 1; + s->range_table = &range_digital; +- s->insn_write = cb_pcimdas_do_insn_write; ++ s->insn_bits = cb_pcimdas_do_insn_bits; + + /* Counter subdevice (8254) */ + s = &dev->subdevices[5]; diff --git a/queue-4.1/staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch b/queue-4.1/staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch new file mode 100644 index 00000000000..530b09b53db --- /dev/null +++ b/queue-4.1/staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch @@ -0,0 +1,35 @@ +From cab462140f8a183e3cca0b51c8b59ef715cb6148 Mon Sep 17 00:00:00 2001 +From: Haggai Eran +Date: Sat, 23 May 2015 23:13:51 +0300 +Subject: staging: rtl8712: prevent buffer overrun in recvbuf2recvframe + +From: Haggai Eran + +commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream. + +With an RTL8191SU USB adaptor, sometimes the hints for a fragmented +packet are set, but the packet length is too large. Allocate enough +space to prevent memory corruption and a resulting kernel panic [1]. + +[1] http://www.spinics.net/lists/linux-wireless/msg136546.html + +Signed-off-by: Haggai Eran +ACKed-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/rtl8712_recv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/staging/rtl8712/rtl8712_recv.c ++++ b/drivers/staging/rtl8712/rtl8712_recv.c +@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _ada + /* for first fragment packet, driver need allocate 1536 + + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ + if ((mf == 1) && (frag == 0)) +- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ ++ /*1658+6=1664, 1664 is 128 alignment.*/ ++ alloc_sz = max_t(u16, tmp_len, 1658); + else + alloc_sz = tmp_len; + /* 2 is for IP header 4 bytes alignment in QoS packet case. diff --git a/queue-4.1/staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch b/queue-4.1/staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch new file mode 100644 index 00000000000..46241baa2b8 --- /dev/null +++ b/queue-4.1/staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch @@ -0,0 +1,29 @@ +From 8e8e9198920ddfa920191069ae02eba75d39e653 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Thu, 9 Jul 2015 17:01:24 +0100 +Subject: staging: vt6655: check ieee80211_bss_conf bssid not NULL + +From: Malcolm Priestley + +commit 8e8e9198920ddfa920191069ae02eba75d39e653 upstream. + +Sometimes bssid can go null on failed association. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1417,7 +1417,7 @@ static void vnt_bss_info_changed(struct + + priv->current_aid = conf->aid; + +- if (changed & BSS_CHANGED_BSSID) { ++ if (changed & BSS_CHANGED_BSSID && conf->bssid) { + unsigned long flags; + + spin_lock_irqsave(&priv->lock, flags); diff --git a/queue-4.1/staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch b/queue-4.1/staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch new file mode 100644 index 00000000000..c742b599d7d --- /dev/null +++ b/queue-4.1/staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch @@ -0,0 +1,34 @@ +From b5eeed8cb6097c8ea660b6598d36fdbb94065a22 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 31 May 2015 10:35:28 +0100 +Subject: staging: vt6655: device_rx_srv check sk_buff is NULL + +From: Malcolm Priestley + +commit b5eeed8cb6097c8ea660b6598d36fdbb94065a22 upstream. + +There is a small chance that pRD->pRDInfo->skb could go NULL +while the interrupt is processing. + +Put NULL check on loop to break out. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_priv + pRD = pRD->next) { + if (works++ > 15) + break; ++ ++ if (!pRD->pRDInfo->skb) ++ break; ++ + if (vnt_receive_frame(pDevice, pRD)) { + if (!device_alloc_rx_buf(pDevice, pRD)) { + dev_err(&pDevice->pcid->dev, diff --git a/queue-4.1/staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch b/queue-4.1/staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch new file mode 100644 index 00000000000..7ad373aa280 --- /dev/null +++ b/queue-4.1/staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch @@ -0,0 +1,29 @@ +From d309509f84725f99326cc73d3b00aae096b374ae Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Thu, 9 Jul 2015 17:03:57 +0100 +Subject: staging: vt6656: check ieee80211_bss_conf bssid not NULL + +From: Malcolm Priestley + +commit d309509f84725f99326cc73d3b00aae096b374ae upstream. + +Sometimes bssid can go null on failed association. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct + + priv->current_aid = conf->aid; + +- if (changed & BSS_CHANGED_BSSID) ++ if (changed & BSS_CHANGED_BSSID && conf->bssid) + vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid); + + diff --git a/queue-4.1/vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch b/queue-4.1/vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch new file mode 100644 index 00000000000..81f1ff611fb --- /dev/null +++ b/queue-4.1/vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch @@ -0,0 +1,93 @@ +From 77a3c6fd90c94f635edb00d4a65f485687538791 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Fri, 19 Jun 2015 08:50:07 -0300 +Subject: [media] vb2: Don't WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers + +From: Laurent Pinchart + +commit 77a3c6fd90c94f635edb00d4a65f485687538791 upstream. + +Commit f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the +vb2_queue struct") added a WARN_ONCE to catch usage of a deprecated API +using a zero value for v4l2_buffer.bytesused. + +However, the condition is checked incorrectly, as the v4L2_buffer +bytesused field is supposed to be ignored for multiplanar buffers. This +results in spurious warnings when using the multiplanar API. + +Fix it by checking v4l2_buffer.bytesused for uniplanar buffers and +v4l2_plane.bytesused for multiplanar buffers. + +Fixes: f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the vb2_queue struct") + +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-core.c | 33 +++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue * + } + EXPORT_SYMBOL_GPL(vb2_discard_done); + ++static void vb2_warn_zero_bytesused(struct vb2_buffer *vb) ++{ ++ static bool __check_once __read_mostly; ++ ++ if (__check_once) ++ return; ++ ++ __check_once = true; ++ __WARN(); ++ ++ pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n"); ++ if (vb->vb2_queue->allow_zero_bytesused) ++ pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n"); ++ else ++ pr_warn_once("use the actual size instead.\n"); ++} ++ + /** + * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a + * v4l2_buffer by the userspace. The caller has already verified that struct +@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2 + { + unsigned int plane; + +- if (V4L2_TYPE_IS_OUTPUT(b->type)) { +- if (WARN_ON_ONCE(b->bytesused == 0)) { +- pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n"); +- if (vb->vb2_queue->allow_zero_bytesused) +- pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n"); +- else +- pr_warn_once("use the actual size instead.\n"); +- } +- } +- + if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) { + if (b->memory == V4L2_MEMORY_USERPTR) { + for (plane = 0; plane < vb->num_planes; ++plane) { +@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2 + struct v4l2_plane *pdst = &v4l2_planes[plane]; + struct v4l2_plane *psrc = &b->m.planes[plane]; + ++ if (psrc->bytesused == 0) ++ vb2_warn_zero_bytesused(vb); ++ + if (vb->vb2_queue->allow_zero_bytesused) + pdst->bytesused = psrc->bytesused; + else +@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2 + } + + if (V4L2_TYPE_IS_OUTPUT(b->type)) { ++ if (b->bytesused == 0) ++ vb2_warn_zero_bytesused(vb); ++ + if (vb->vb2_queue->allow_zero_bytesused) + v4l2_planes[0].bytesused = b->bytesused; + else