From: Greg Kroah-Hartman Date: Tue, 3 Feb 2015 02:33:09 +0000 (-0800) Subject: 3.18-stable patches X-Git-Tag: v3.18.6~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4acb24e626b3ed72000cf95385b9a2dab623cf54;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch asoc-pcm512x-fix-dsp-program-selection.patch asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch asoc-soc-compress.c-fix-null-dereference.patch asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch can-kvaser_usb-do-not-sleep-in-atomic-context.patch can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch can-kvaser_usb-send-correct-context-to-urb-completion.patch i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch udf-release-preallocation-on-last-writeable-close.patch usb-add-otg-pet-device-to-tpl.patch usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch --- diff --git a/queue-3.18/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch b/queue-3.18/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch new file mode 100644 index 00000000000..28b4a95d6cd --- /dev/null +++ b/queue-3.18/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch @@ -0,0 +1,74 @@ +From 0767e95bb96d7fdddcd590fb809e6975d93aebc5 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Sun, 25 Jan 2015 14:34:29 +0100 +Subject: ALSA: seq-dummy: remove deadlock-causing events on close + +From: Clemens Ladisch + +commit 0767e95bb96d7fdddcd590fb809e6975d93aebc5 upstream. + +When the last subscriber to a "Through" port has been removed, the +subscribed destination ports might still be active, so it would be +wrong to send "all sounds off" and "reset controller" events to them. +The proper place for such a shutdown would be the closing of the actual +MIDI port (and close_substream() in rawmidi.c already can do this). + +This also fixes a deadlock when dummy_unuse() tries to send events to +its own port that is already locked because it is being freed. + +Reported-by: Peter Billam +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_dummy.c | 31 ------------------------------- + 1 file changed, 31 deletions(-) + +--- a/sound/core/seq/seq_dummy.c ++++ b/sound/core/seq/seq_dummy.c +@@ -82,36 +82,6 @@ struct snd_seq_dummy_port { + static int my_client = -1; + + /* +- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events +- * to subscribers. +- * Note: this callback is called only after all subscribers are removed. +- */ +-static int +-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info) +-{ +- struct snd_seq_dummy_port *p; +- int i; +- struct snd_seq_event ev; +- +- p = private_data; +- memset(&ev, 0, sizeof(ev)); +- if (p->duplex) +- ev.source.port = p->connect; +- else +- ev.source.port = p->port; +- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; +- ev.type = SNDRV_SEQ_EVENT_CONTROLLER; +- for (i = 0; i < 16; i++) { +- ev.data.control.channel = i; +- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- } +- return 0; +-} +- +-/* + * event input callback - just redirect events to subscribers + */ + static int +@@ -175,7 +145,6 @@ create_port(int idx, int type) + | SNDRV_SEQ_PORT_TYPE_PORT; + memset(&pcb, 0, sizeof(pcb)); + pcb.owner = THIS_MODULE; +- pcb.unuse = dummy_unuse; + pcb.event_input = dummy_input; + pcb.private_free = dummy_free; + pcb.private_data = rec; diff --git a/queue-3.18/asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch b/queue-3.18/asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch new file mode 100644 index 00000000000..714e9f1657e --- /dev/null +++ b/queue-3.18/asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch @@ -0,0 +1,32 @@ +From adc60298c80efef4c2d7a7860b91b450931a7cf8 Mon Sep 17 00:00:00 2001 +From: Aurelien BOUIN +Date: Mon, 29 Dec 2014 16:13:51 -0800 +Subject: ASoC: fsl_esai: Fix incorrect xDC field width of xCCR registers + +From: Aurelien BOUIN + +commit adc60298c80efef4c2d7a7860b91b450931a7cf8 upstream. + +The xDC field should have 5 bit width according to Reference Manual. +Thus this patch fixes it. + +Signed-off-by: Aurelien BOUIN +Signed-off-by: Nicolin Chen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/fsl_esai.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/fsl/fsl_esai.h ++++ b/sound/soc/fsl/fsl_esai.h +@@ -302,7 +302,7 @@ + #define ESAI_xCCR_xFP_MASK (((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT) + #define ESAI_xCCR_xFP(v) ((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK) + #define ESAI_xCCR_xDC_SHIFT 9 +-#define ESAI_xCCR_xDC_WIDTH 4 ++#define ESAI_xCCR_xDC_WIDTH 5 + #define ESAI_xCCR_xDC_MASK (((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT) + #define ESAI_xCCR_xDC(v) ((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK) + #define ESAI_xCCR_xPSR_SHIFT 8 diff --git a/queue-3.18/asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch b/queue-3.18/asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch new file mode 100644 index 00000000000..07d641cf910 --- /dev/null +++ b/queue-3.18/asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch @@ -0,0 +1,31 @@ +From 20602e34cd33dd452bc1836fa7c9b59978f75db0 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 16 Jan 2015 11:20:25 +0200 +Subject: ASoC: omap-mcbsp: Correct CBM_CFS dai format configuration + +From: Peter Ujfalusi + +commit 20602e34cd33dd452bc1836fa7c9b59978f75db0 upstream. + +We should select FSR also to be driven by McBSP, not only FSX. + +Signed-off-by: Peter Ujfalusi +Acked-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/omap/omap-mcbsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/omap/omap-mcbsp.c ++++ b/sound/soc/omap/omap-mcbsp.c +@@ -434,7 +434,7 @@ static int omap_mcbsp_dai_set_dai_fmt(st + case SND_SOC_DAIFMT_CBM_CFS: + /* McBSP slave. FS clock as output */ + regs->srgr2 |= FSGM; +- regs->pcr0 |= FSXM; ++ regs->pcr0 |= FSXM | FSRM; + break; + case SND_SOC_DAIFMT_CBM_CFM: + /* McBSP slave */ diff --git a/queue-3.18/asoc-pcm512x-fix-dsp-program-selection.patch b/queue-3.18/asoc-pcm512x-fix-dsp-program-selection.patch new file mode 100644 index 00000000000..4dbe0b6304e --- /dev/null +++ b/queue-3.18/asoc-pcm512x-fix-dsp-program-selection.patch @@ -0,0 +1,31 @@ +From 3a8e5019846736046c0af9dbee3f921c0456141a Mon Sep 17 00:00:00 2001 +From: Peter Rosin +Date: Thu, 8 Jan 2015 22:56:30 +0100 +Subject: ASoC: pcm512x: Fix DSP program selection + +From: Peter Rosin + +commit 3a8e5019846736046c0af9dbee3f921c0456141a upstream. + +The DSP programs are listed out of order. + +Signed-off-by: Peter Rosin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/pcm512x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/pcm512x.c ++++ b/sound/soc/codecs/pcm512x.c +@@ -188,8 +188,8 @@ static const DECLARE_TLV_DB_SCALE(boost_ + static const char * const pcm512x_dsp_program_texts[] = { + "FIR interpolation with de-emphasis", + "Low latency IIR with de-emphasis", +- "Fixed process flow", + "High attenuation with de-emphasis", ++ "Fixed process flow", + "Ringing-less low latency FIR", + }; + diff --git a/queue-3.18/asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch b/queue-3.18/asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch new file mode 100644 index 00000000000..12dadac4957 --- /dev/null +++ b/queue-3.18/asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch @@ -0,0 +1,70 @@ +From 7ddfdb5c5a5b51bdd2cb749d8341d763b079d520 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 13 Jan 2015 21:03:37 +0100 +Subject: ASoC: simple-card: Fix crash in asoc_simple_card_unref() + +From: Geert Uytterhoeven + +commit 7ddfdb5c5a5b51bdd2cb749d8341d763b079d520 upstream. + +If asoc_simple_card_probe() fails, asoc_simple_card_unref() may be +called before dev_set_drvdata(), causing a NULL pointer dereference in +asoc_simple_card_unref(): + + Unable to handle kernel NULL pointer dereference at virtual address 000000d4 + ... + PC is at asoc_simple_card_unref+0x14/0x48 + LR is at asoc_simple_card_probe+0x3d4/0x40c + +This typically happens because asoc_simple_card_parse_of() returns +-EPROBE_DEFER, but other failure modes are possible. +devm_snd_soc_register_card()/snd_soc_register_card() may fail either +before or after dev_set_drvdata(). + +Pass a snd_soc_card pointer instead of a platform_device pointer to +asoc_simple_card_unref() to fix this. + +Note that if CONFIG_OF_DYNAMIC=n, of_node_put() is a dummy, and gcc may +optimize away the loop over card->dai_link, never actually dereferencing +card, and thus avoiding the crash... + +Signed-off-by: Geert Uytterhoeven +Fixes: e512e001dafa54e5 ("ASoC: simple-card: Fix the reference count of device nodes") +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/generic/simple-card.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -453,9 +453,8 @@ static int asoc_simple_card_parse_of(str + } + + /* Decrease the reference count of the device nodes */ +-static int asoc_simple_card_unref(struct platform_device *pdev) ++static int asoc_simple_card_unref(struct snd_soc_card *card) + { +- struct snd_soc_card *card = platform_get_drvdata(pdev); + struct snd_soc_dai_link *dai_link; + struct device_node *np; + int num_links; +@@ -562,7 +561,7 @@ static int asoc_simple_card_probe(struct + return ret; + + err: +- asoc_simple_card_unref(pdev); ++ asoc_simple_card_unref(&priv->snd_card); + return ret; + } + +@@ -578,7 +577,7 @@ static int asoc_simple_card_remove(struc + snd_soc_jack_free_gpios(&simple_card_mic_jack, 1, + &simple_card_mic_jack_gpio); + +- return asoc_simple_card_unref(pdev); ++ return asoc_simple_card_unref(card); + } + + static const struct of_device_id asoc_simple_of_match[] = { diff --git a/queue-3.18/asoc-soc-compress.c-fix-null-dereference.patch b/queue-3.18/asoc-soc-compress.c-fix-null-dereference.patch new file mode 100644 index 00000000000..ade9b1db443 --- /dev/null +++ b/queue-3.18/asoc-soc-compress.c-fix-null-dereference.patch @@ -0,0 +1,57 @@ +From d3268a40d4b19ff7bee23f52eabbc4e96bb685e8 Mon Sep 17 00:00:00 2001 +From: Qais Yousef +Date: Wed, 14 Jan 2015 08:47:29 +0000 +Subject: ASoC: soc-compress.c: fix NULL dereference + +From: Qais Yousef + +commit d3268a40d4b19ff7bee23f52eabbc4e96bb685e8 upstream. + +In soc_new_compress() when rtd->dai_link->dynamic is set, we create the pcm +substreams with this call: + + ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num, + 1, 0, &be_pcm); + +which passes 0 as capture_count leading to + + be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream + +being NULL, hence when trying to set rtd a few lines below we get an oops. + +Fix by using rtd->dai_link->dpcm_playback and rtd->dai_link->dpcm_capture as +playback_count and capture_count to snd_pcm_new_internal(). + +Signed-off-by: Qais Yousef +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-compress.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -666,7 +666,8 @@ int soc_new_compress(struct snd_soc_pcm_ + rtd->dai_link->stream_name); + + ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num, +- 1, 0, &be_pcm); ++ rtd->dai_link->dpcm_playback, ++ rtd->dai_link->dpcm_capture, &be_pcm); + if (ret < 0) { + dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n", + rtd->dai_link->name); +@@ -675,8 +676,10 @@ int soc_new_compress(struct snd_soc_pcm_ + + rtd->pcm = be_pcm; + rtd->fe_compr = 1; +- be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; +- be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; ++ if (rtd->dai_link->dpcm_playback) ++ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; ++ else if (rtd->dai_link->dpcm_capture) ++ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; + memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); + } else + memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops)); diff --git a/queue-3.18/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch b/queue-3.18/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch new file mode 100644 index 00000000000..fd1fa721053 --- /dev/null +++ b/queue-3.18/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch @@ -0,0 +1,31 @@ +From 22ee76daddb87f88d2336d1b4737ef27c4f307ac Mon Sep 17 00:00:00 2001 +From: Zidan Wang +Date: Wed, 31 Dec 2014 11:39:14 +0800 +Subject: ASoC: wm8960: Fix capture sample rate from 11250 to 11025 + +From: Zidan Wang + +commit 22ee76daddb87f88d2336d1b4737ef27c4f307ac upstream. + +wm8960 codec can't support sample rate 11250, it must be 11025. + +Signed-off-by: Zidan Wang +Acked-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -555,7 +555,7 @@ static struct { + { 22050, 2 }, + { 24000, 2 }, + { 16000, 3 }, +- { 11250, 4 }, ++ { 11025, 4 }, + { 12000, 4 }, + { 8000, 5 }, + }; diff --git a/queue-3.18/can-kvaser_usb-do-not-sleep-in-atomic-context.patch b/queue-3.18/can-kvaser_usb-do-not-sleep-in-atomic-context.patch new file mode 100644 index 00000000000..fe0e74e6fa0 --- /dev/null +++ b/queue-3.18/can-kvaser_usb-do-not-sleep-in-atomic-context.patch @@ -0,0 +1,101 @@ +From ded5006667318c06df875609535176bd33f243a1 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 26 Jan 2015 07:20:39 +0200 +Subject: can: kvaser_usb: Do not sleep in atomic context + +From: "Ahmed S. Darwish" + +commit ded5006667318c06df875609535176bd33f243a1 upstream. + +Upon receiving a hardware event with the BUS_RESET flag set, +the driver kills all of its anchored URBs and resets all of +its transmit URB contexts. + +Unfortunately it does so under the context of URB completion +handler `kvaser_usb_read_bulk_callback()', which is often +called in an atomic context. + +While the device is flooded with many received error packets, +usb_kill_urb() typically sleeps/reschedules till the transfer +request of each killed URB in question completes, leading to +the sleep in atomic bug. [3] + +In v2 submission of the original driver patch [1], it was +stated that the URBs kill and tx contexts reset was needed +since we don't receive any tx acknowledgments later and thus +such resources will be locked down forever. Fortunately this +is no longer needed since an earlier bugfix in this patch +series is now applied: all tx URB contexts are reset upon CAN +channel close. [2] + +Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF +event, which is the recommended handling method advised by +the device manufacturer. + +[1] http://article.gmane.org/gmane.linux.network/239442 + http://www.webcitation.org/6Vr2yagAQ + +[2] can: kvaser_usb: Reset all URB tx contexts upon channel close + 889b77f7fd2bcc922493d73a4c51d8a851505815 + +[3] Stacktrace: + + [] dump_stack+0x45/0x57 + [] __schedule_bug+0x41/0x4f + [] __schedule+0x5f1/0x700 + [] ? _raw_spin_unlock_irqrestore+0xa/0x10 + [] schedule+0x24/0x70 + [] usb_kill_urb+0x65/0xa0 + [] ? prepare_to_wait_event+0x110/0x110 + [] usb_kill_anchored_urbs+0x48/0x80 + [] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb] + [] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb] + [] ? vprintk_default+0x1a/0x20 + [] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb] + [] __usb_hcd_giveback_urb+0x5e/0xc0 + [] usb_hcd_giveback_urb+0x41/0x110 + [] finish_urb+0x98/0x180 [ohci_hcd] + [] ? acct_account_cputime+0x17/0x20 + [] ? local_clock+0x15/0x30 + [] ohci_work+0x1fb/0x5a0 [ohci_hcd] + [] ? process_backlog+0xb1/0x130 + [] ohci_irq+0xeb/0x270 [ohci_hcd] + [] usb_hcd_irq+0x21/0x30 + [] handle_irq_event_percpu+0x43/0x120 + [] handle_irq_event+0x3d/0x60 + [] handle_fasteoi_irq+0x74/0x110 + [] handle_irq+0x1d/0x30 + [] do_IRQ+0x57/0x100 + [] common_interrupt+0x6a/0x6a + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const st + priv = dev->nets[channel]; + stats = &priv->netdev->stats; + +- if (status & M16C_STATE_BUS_RESET) { +- kvaser_usb_unlink_tx_urbs(priv); +- return; +- } +- + skb = alloc_can_err_skb(priv->netdev, &cf); + if (!skb) { + stats->rx_dropped++; +@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const st + + netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status); + +- if (status & M16C_STATE_BUS_OFF) { ++ if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) { + cf->can_id |= CAN_ERR_BUSOFF; + + priv->can.can_stats.bus_off++; diff --git a/queue-3.18/can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch b/queue-3.18/can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch new file mode 100644 index 00000000000..3f4ccd5a906 --- /dev/null +++ b/queue-3.18/can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch @@ -0,0 +1,53 @@ +From e638642b08c170d2021b706f0b1c4f4ae93d8cbd Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 26 Jan 2015 07:25:43 +0200 +Subject: can: kvaser_usb: Fix state handling upon BUS_ERROR events + +From: "Ahmed S. Darwish" + +commit e638642b08c170d2021b706f0b1c4f4ae93d8cbd upstream. + +While being in an ERROR_WARNING state, and receiving further +bus error events with error counters still in the ERROR_WARNING +range of 97-127 inclusive, the state handling code erroneously +reverts back to ERROR_ACTIVE. + +Per the CAN standard, only revert to ERROR_ACTIVE when the +error counters are less than 96. + +Moreover, in certain Kvaser models, the BUS_ERROR flag is +always set along with undefined bits in the M16C status +register. Thus use bitwise operators instead of full equality +for checking that register against bus errors. + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -698,9 +698,7 @@ static void kvaser_usb_rx_error(const st + } + + new_state = CAN_STATE_ERROR_PASSIVE; +- } +- +- if (status == M16C_STATE_BUS_ERROR) { ++ } else if (status & M16C_STATE_BUS_ERROR) { + if ((priv->can.state < CAN_STATE_ERROR_WARNING) && + ((txerr >= 96) || (rxerr >= 96))) { + cf->can_id |= CAN_ERR_CRTL; +@@ -710,7 +708,8 @@ static void kvaser_usb_rx_error(const st + + priv->can.can_stats.error_warning++; + new_state = CAN_STATE_ERROR_WARNING; +- } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) { ++ } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) && ++ ((txerr < 96) && (rxerr < 96))) { + cf->can_id |= CAN_ERR_PROT; + cf->data[2] = CAN_ERR_PROT_ACTIVE; + diff --git a/queue-3.18/can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch b/queue-3.18/can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch new file mode 100644 index 00000000000..968e5e59405 --- /dev/null +++ b/queue-3.18/can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch @@ -0,0 +1,50 @@ +From 14c10c2a1dd8eb8e00b750b521753260befa2789 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 26 Jan 2015 07:24:06 +0200 +Subject: can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT + +From: "Ahmed S. Darwish" + +commit 14c10c2a1dd8eb8e00b750b521753260befa2789 upstream. + +On some x86 laptops, plugging a Kvaser device again after an +unplug makes the firmware always ignore the very first command. +For such a case, provide some room for retries instead of +completely exiting the driver init code. + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1588,7 +1588,7 @@ static int kvaser_usb_probe(struct usb_i + { + struct kvaser_usb *dev; + int err = -ENOMEM; +- int i; ++ int i, retry = 3; + + dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL); + if (!dev) +@@ -1606,7 +1606,15 @@ static int kvaser_usb_probe(struct usb_i + + usb_set_intfdata(intf, dev); + +- err = kvaser_usb_get_software_info(dev); ++ /* On some x86 laptops, plugging a Kvaser device again after ++ * an unplug makes the firmware always ignore the very first ++ * command. For such a case, provide some room for retries ++ * instead of completely exiting the driver. ++ */ ++ do { ++ err = kvaser_usb_get_software_info(dev); ++ } while (--retry && err == -ETIMEDOUT); ++ + if (err) { + dev_err(&intf->dev, + "Cannot get software infos, error %d\n", err); diff --git a/queue-3.18/can-kvaser_usb-send-correct-context-to-urb-completion.patch b/queue-3.18/can-kvaser_usb-send-correct-context-to-urb-completion.patch new file mode 100644 index 00000000000..99284c9f5ab --- /dev/null +++ b/queue-3.18/can-kvaser_usb-send-correct-context-to-urb-completion.patch @@ -0,0 +1,35 @@ +From 3803fa6977f1de15fda4e8646c8fec97c8045cae Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 26 Jan 2015 07:22:54 +0200 +Subject: can: kvaser_usb: Send correct context to URB completion + +From: "Ahmed S. Darwish" + +commit 3803fa6977f1de15fda4e8646c8fec97c8045cae upstream. + +Send expected argument to the URB completion hander: a CAN +netdevice instead of the network interface private context +`kvaser_usb_net_priv'. + +This was discovered by having some garbage in the kernel +log in place of the netdevice names: can0 and can1. + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(s + usb_sndbulkpipe(dev->udev, + dev->bulk_out->bEndpointAddress), + buf, msg->len, +- kvaser_usb_simple_msg_callback, priv); ++ kvaser_usb_simple_msg_callback, netdev); + usb_anchor_urb(urb, &priv->tx_submitted); + + err = usb_submit_urb(urb, GFP_ATOMIC); diff --git a/queue-3.18/i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch b/queue-3.18/i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch new file mode 100644 index 00000000000..fd15d301c0e --- /dev/null +++ b/queue-3.18/i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch @@ -0,0 +1,148 @@ +From 34e81ad5f0b60007c95995eb7803da7e00c6c611 Mon Sep 17 00:00:00 2001 +From: Paul Osmialowski +Date: Mon, 19 Jan 2015 17:03:33 +0100 +Subject: i2c: s3c2410: fix ABBA deadlock by keeping clock prepared + +From: Paul Osmialowski + +commit 34e81ad5f0b60007c95995eb7803da7e00c6c611 upstream. + +This patch solves deadlock between clock prepare mutex and regmap mutex reported +by Tomasz Figa in [1] by implementing solution from [2]: "always leave the clock +of the i2c controller in a prepared state". + +[1] https://lkml.org/lkml/2014/7/2/171 +[2] https://lkml.org/lkml/2014/7/2/207 + +On each i2c transfer handled by s3c24xx_i2c_xfer(), clk_prepare_enable() was +called, which calls clk_prepare() then clk_enable(). clk_prepare() takes +prepare_lock mutex before proceeding. Note that i2c transfer functions are +invoked from many places in kernel, typically with some other additional lock +held. + +It may happen that function on CPU1 (e.g. regmap_update_bits()) has taken a +mutex (i.e. regmap lock mutex) then it attempts i2c communication in order to +proceed (so it needs to obtain clock related prepare_lock mutex during transfer +preparation stage due to clk_prepare() call). At the same time other task on +CPU0 wants to operate on clock (e.g. to (un)prepare clock for some other reason) +so it has taken prepare_lock mutex. + +CPU0: CPU1: +clk_disable_unused() regulator_disable() + clk_prepare_lock() map->lock(map->lock_arg) + regmap_read() s3c24xx_i2c_xfer() + map->lock(map->lock_arg) clk_prepare_lock() + +Implemented solution from [2] leaves i2c clock prepared. Preparation is done in +s3c24xx_i2c_probe() function. Without this patch, it is immediately unprepared +by clk_disable_unprepare() call. I've replaced this call with clk_disable() and +I've added clk_unprepare() call in s3c24xx_i2c_remove(). + +The s3c24xx_i2c_xfer() function now uses clk_enable() instead of +clk_prepare_enable() (and clk_disable() instead of clk_unprepare_disable()). + +Signed-off-by: Paul Osmialowski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-s3c2410.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -778,14 +778,16 @@ static int s3c24xx_i2c_xfer(struct i2c_a + int ret; + + pm_runtime_get_sync(&adap->dev); +- clk_prepare_enable(i2c->clk); ++ ret = clk_enable(i2c->clk); ++ if (ret) ++ return ret; + + for (retry = 0; retry < adap->retries; retry++) { + + ret = s3c24xx_i2c_doxfer(i2c, msgs, num); + + if (ret != -EAGAIN) { +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + pm_runtime_put(&adap->dev); + return ret; + } +@@ -795,7 +797,7 @@ static int s3c24xx_i2c_xfer(struct i2c_a + udelay(100); + } + +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + pm_runtime_put(&adap->dev); + return -EREMOTEIO; + } +@@ -1174,7 +1176,7 @@ static int s3c24xx_i2c_probe(struct plat + + clk_prepare_enable(i2c->clk); + ret = s3c24xx_i2c_init(i2c); +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + if (ret != 0) { + dev_err(&pdev->dev, "I2C controller init failed\n"); + return ret; +@@ -1187,6 +1189,7 @@ static int s3c24xx_i2c_probe(struct plat + i2c->irq = ret = platform_get_irq(pdev, 0); + if (ret <= 0) { + dev_err(&pdev->dev, "cannot find IRQ\n"); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1195,6 +1198,7 @@ static int s3c24xx_i2c_probe(struct plat + + if (ret != 0) { + dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq); ++ clk_unprepare(i2c->clk); + return ret; + } + } +@@ -1202,6 +1206,7 @@ static int s3c24xx_i2c_probe(struct plat + ret = s3c24xx_i2c_register_cpufreq(i2c); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register cpufreq notifier\n"); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1218,6 +1223,7 @@ static int s3c24xx_i2c_probe(struct plat + if (ret < 0) { + dev_err(&pdev->dev, "failed to add bus to i2c core\n"); + s3c24xx_i2c_deregister_cpufreq(i2c); ++ clk_unprepare(i2c->clk); + return ret; + } + +@@ -1239,6 +1245,8 @@ static int s3c24xx_i2c_remove(struct pla + { + struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); + ++ clk_unprepare(i2c->clk); ++ + pm_runtime_disable(&i2c->adap.dev); + pm_runtime_disable(&pdev->dev); + +@@ -1267,10 +1275,13 @@ static int s3c24xx_i2c_resume_noirq(stru + { + struct platform_device *pdev = to_platform_device(dev); + struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); ++ int ret; + +- clk_prepare_enable(i2c->clk); ++ ret = clk_enable(i2c->clk); ++ if (ret) ++ return ret; + s3c24xx_i2c_init(i2c); +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + i2c->suspended = 0; + + return 0; diff --git a/queue-3.18/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch b/queue-3.18/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch new file mode 100644 index 00000000000..72a956cf155 --- /dev/null +++ b/queue-3.18/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch @@ -0,0 +1,39 @@ +From e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 Mon Sep 17 00:00:00 2001 +From: Laurent Dufour +Date: Thu, 15 Jan 2015 18:23:47 +0100 +Subject: powerpc/xmon: Fix another endiannes issue in RTAS call from xmon + +From: Laurent Dufour + +commit e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 upstream. + +The commit 3b8a3c010969 ("powerpc/pseries: Fix endiannes issue in RTAS +call from xmon") was fixing an endianness issue in the call made from +xmon to RTAS. + +However, as Michael Ellerman noticed, this fix was not complete, the +token value was not byte swapped. This lead to call an unexpected and +most of the time unexisting RTAS function, which is silently ignored by +RTAS. + +This fix addresses this hole. + +Reported-by: Michael Ellerman +Signed-off-by: Laurent Dufour +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/xmon/xmon.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -293,6 +293,7 @@ static inline void disable_surveillance( + args.token = rtas_token("set-indicator"); + if (args.token == RTAS_UNKNOWN_SERVICE) + return; ++ args.token = cpu_to_be32(args.token); + args.nargs = cpu_to_be32(3); + args.nret = cpu_to_be32(1); + args.rets = &args.args[3]; diff --git a/queue-3.18/rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch b/queue-3.18/rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch new file mode 100644 index 00000000000..a765506e558 --- /dev/null +++ b/queue-3.18/rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch @@ -0,0 +1,64 @@ +From e69b8d414f948c242ad9f3eb2b7e24fba783dbbd Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Mon, 19 Jan 2015 12:06:14 +0300 +Subject: rbd: drop parent_ref in rbd_dev_unprobe() unconditionally + +From: Ilya Dryomov + +commit e69b8d414f948c242ad9f3eb2b7e24fba783dbbd upstream. + +This effectively reverts the last hunk of 392a9dad7e77 ("rbd: detect +when clone image is flattened"). + +The problem with parent_overlap != 0 condition is that it's possible +and completely valid to have an image with parent_overlap == 0 whose +parent state needs to be cleaned up on unmap. The next commit, which +drops the "clone image now standalone" logic, opens up another window +of opportunity to hit this, but even without it + + # cat parent-ref.sh + #!/bin/bash + rbd create --image-format 2 --size 1 foo + rbd snap create foo@snap + rbd snap protect foo@snap + rbd clone foo@snap bar + rbd resize --allow-shrink --size 0 bar + rbd resize --size 1 bar + DEV=$(rbd map bar) + rbd unmap $DEV + +leaves rbd_device/rbd_spec/etc and rbd_client along with ceph_client +hanging around. + +My thinking behind calling rbd_dev_parent_put() unconditionally is that +there shouldn't be any requests in flight at that point in time as we +are deep into unmap sequence. Hence, even if rbd_dev_unparent() caused +by flatten is delayed by in-flight requests, it will have finished by +the time we reach rbd_dev_unprobe() caused by unmap, thus turning +unconditional rbd_dev_parent_put() into a no-op. + +Fixes: http://tracker.ceph.com/issues/10352 + +Signed-off-by: Ilya Dryomov +Reviewed-by: Josh Durgin +Reviewed-by: Alex Elder +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5111,10 +5111,7 @@ static void rbd_dev_unprobe(struct rbd_d + { + struct rbd_image_header *header; + +- /* Drop parent reference unless it's already been done (or none) */ +- +- if (rbd_dev->parent_overlap) +- rbd_dev_parent_put(rbd_dev); ++ rbd_dev_parent_put(rbd_dev); + + /* Free dynamic fields from the header, then zero it out */ + diff --git a/queue-3.18/rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch b/queue-3.18/rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch new file mode 100644 index 00000000000..16c92f426f2 --- /dev/null +++ b/queue-3.18/rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch @@ -0,0 +1,94 @@ +From ae43e9d05eb4bd324155292f889fbd001c4faea8 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Mon, 19 Jan 2015 18:13:43 +0300 +Subject: rbd: fix rbd_dev_parent_get() when parent_overlap == 0 + +From: Ilya Dryomov + +commit ae43e9d05eb4bd324155292f889fbd001c4faea8 upstream. + +The comment for rbd_dev_parent_get() said + + * We must get the reference before checking for the overlap to + * coordinate properly with zeroing the parent overlap in + * rbd_dev_v2_parent_info() when an image gets flattened. We + * drop it again if there is no overlap. + +but the "drop it again if there is no overlap" part was missing from +the implementation. This lead to absurd parent_ref values for images +with parent_overlap == 0, as parent_ref was incremented for each +img_request and virtually never decremented. + +Fix this by leveraging the fact that refresh path calls +rbd_dev_v2_parent_info() under header_rwsem and use it for read in +rbd_dev_parent_get(), instead of messing around with atomics. Get rid +of barriers in rbd_dev_v2_parent_info() while at it - I don't see what +they'd pair with now and I suspect we are in a pretty miserable +situation as far as proper locking goes regardless. + +Signed-off-by: Ilya Dryomov +Reviewed-by: Josh Durgin +Reviewed-by: Alex Elder +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2098,32 +2098,26 @@ static void rbd_dev_parent_put(struct rb + * If an image has a non-zero parent overlap, get a reference to its + * parent. + * +- * We must get the reference before checking for the overlap to +- * coordinate properly with zeroing the parent overlap in +- * rbd_dev_v2_parent_info() when an image gets flattened. We +- * drop it again if there is no overlap. +- * + * Returns true if the rbd device has a parent with a non-zero + * overlap and a reference for it was successfully taken, or + * false otherwise. + */ + static bool rbd_dev_parent_get(struct rbd_device *rbd_dev) + { +- int counter; ++ int counter = 0; + + if (!rbd_dev->parent_spec) + return false; + +- counter = atomic_inc_return_safe(&rbd_dev->parent_ref); +- if (counter > 0 && rbd_dev->parent_overlap) +- return true; +- +- /* Image was flattened, but parent is not yet torn down */ ++ down_read(&rbd_dev->header_rwsem); ++ if (rbd_dev->parent_overlap) ++ counter = atomic_inc_return_safe(&rbd_dev->parent_ref); ++ up_read(&rbd_dev->header_rwsem); + + if (counter < 0) + rbd_warn(rbd_dev, "parent reference overflow"); + +- return false; ++ return counter > 0; + } + + /* +@@ -4236,7 +4230,6 @@ static int rbd_dev_v2_parent_info(struct + */ + if (rbd_dev->parent_overlap) { + rbd_dev->parent_overlap = 0; +- smp_mb(); + rbd_dev_parent_put(rbd_dev); + pr_info("%s: clone image has been flattened\n", + rbd_dev->disk->disk_name); +@@ -4282,7 +4275,6 @@ static int rbd_dev_v2_parent_info(struct + * treat it specially. + */ + rbd_dev->parent_overlap = overlap; +- smp_mb(); + if (!overlap) { + + /* A null parent_spec indicates it's the initial probe */ diff --git a/queue-3.18/series b/queue-3.18/series index ce74ac23fc0..b1da6015c80 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -3,3 +3,23 @@ spi-dw-fix-detecting-fifo-depth.patch spi-dw-mid-fix-fifo-size.patch vm-add-vm_fault_sigsegv-handling-support.patch arc-mm-fix-build-failure.patch +vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch +asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch +asoc-pcm512x-fix-dsp-program-selection.patch +asoc-fsl_esai-fix-incorrect-xdc-field-width-of-xccr-registers.patch +asoc-soc-compress.c-fix-null-dereference.patch +asoc-simple-card-fix-crash-in-asoc_simple_card_unref.patch +asoc-omap-mcbsp-correct-cbm_cfs-dai-format-configuration.patch +udf-release-preallocation-on-last-writeable-close.patch +can-kvaser_usb-do-not-sleep-in-atomic-context.patch +can-kvaser_usb-send-correct-context-to-urb-completion.patch +can-kvaser_usb-retry-the-first-bulk-transfer-on-etimedout.patch +can-kvaser_usb-fix-state-handling-upon-bus_error-events.patch +powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch +alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch +rbd-drop-parent_ref-in-rbd_dev_unprobe-unconditionally.patch +rbd-fix-rbd_dev_parent_get-when-parent_overlap-0.patch +usb-add-otg-pet-device-to-tpl.patch +usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch +uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch +i2c-s3c2410-fix-abba-deadlock-by-keeping-clock-prepared.patch diff --git a/queue-3.18/uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch b/queue-3.18/uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch new file mode 100644 index 00000000000..a8525c9ecd9 --- /dev/null +++ b/queue-3.18/uas-add-no-report-opcodes-quirk-for-simpletech-devices-with-id-4971-8017.patch @@ -0,0 +1,33 @@ +From 8a870880bd6f17b7ccef69a6432ab8df8775fcf6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 12 Jan 2015 13:34:33 +0100 +Subject: uas: Add no-report-opcodes quirk for Simpletech devices with id 4971:8017 + +From: Hans de Goede + +commit 8a870880bd6f17b7ccef69a6432ab8df8775fcf6 upstream. + +Like some other uas devices these devices hang when a report-opcodes scsi +command is send to them. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1124119 +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -138,3 +138,10 @@ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x99 + "External HDD", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_UAS), ++ ++/* Reported-by: Richard Henderson */ ++UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999, ++ "SimpleTech", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_OPCODES), diff --git a/queue-3.18/udf-release-preallocation-on-last-writeable-close.patch b/queue-3.18/udf-release-preallocation-on-last-writeable-close.patch new file mode 100644 index 00000000000..f8e3af6b490 --- /dev/null +++ b/queue-3.18/udf-release-preallocation-on-last-writeable-close.patch @@ -0,0 +1,37 @@ +From b07ef35244424cbeda9844198607c7077099c82c Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 28 Jan 2015 08:38:20 +0100 +Subject: udf: Release preallocation on last writeable close + +From: Jan Kara + +commit b07ef35244424cbeda9844198607c7077099c82c upstream. + +Commit 6fb1ca92a640 "udf: Fix race between write(2) and close(2)" +changed the condition when preallocation is released. The idea was that +we don't want to release the preallocation for an inode on close when +there are other writeable file descriptors for the inode. However the +condition was written in the opposite way so we released preallocation +only if there were other writeable file descriptors. Fix the problem by +changing the condition properly. + +Fixes: 6fb1ca92a6409a9d5b0696447cd4997bc9aaf5a2 +Reported-by: Fabian Frederick +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/udf/file.c ++++ b/fs/udf/file.c +@@ -224,7 +224,7 @@ out: + static int udf_release_file(struct inode *inode, struct file *filp) + { + if (filp->f_mode & FMODE_WRITE && +- atomic_read(&inode->i_writecount) > 1) { ++ atomic_read(&inode->i_writecount) == 1) { + /* + * Grab i_mutex to avoid races with writes changing i_size + * while we are running. diff --git a/queue-3.18/usb-add-otg-pet-device-to-tpl.patch b/queue-3.18/usb-add-otg-pet-device-to-tpl.patch new file mode 100644 index 00000000000..250ad6e4364 --- /dev/null +++ b/queue-3.18/usb-add-otg-pet-device-to-tpl.patch @@ -0,0 +1,49 @@ +From e5dff0e80463cc3fa236e898ef1491b40be70b19 Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Fri, 23 Jan 2015 14:39:02 +0800 +Subject: USB: Add OTG PET device to TPL + +From: Macpaul Lin + +commit e5dff0e80463cc3fa236e898ef1491b40be70b19 upstream. + +OTG device shall support this device for allowing compliance automated testing. +The modification is derived from Pavankumar and Vijayavardhans' previous work. + +Signed-off-by: Macpaul Lin +Cc: Pavankumar Kondeti +Cc: Vijayavardhan Vennapusa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/otg_whitelist.h | 5 +++++ + drivers/usb/core/quirks.c | 4 ++++ + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/core/otg_whitelist.h ++++ b/drivers/usb/core/otg_whitelist.h +@@ -55,6 +55,11 @@ static int is_targeted(struct usb_device + le16_to_cpu(dev->descriptor.idProduct) == 0xbadd)) + return 0; + ++ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */ ++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a && ++ le16_to_cpu(dev->descriptor.idProduct) == 0x0200)) ++ return 1; ++ + /* NOTE: can't use usb_match_id() since interface caches + * aren't set up yet. this is cut/paste from that code. + */ +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -179,6 +179,10 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Protocol and OTG Electrical Test Device */ ++ { USB_DEVICE(0x1a0a, 0x0200), .driver_info = ++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, ++ + { } /* terminating entry must be last */ + }; + diff --git a/queue-3.18/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch b/queue-3.18/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch new file mode 100644 index 00000000000..d3db2955800 --- /dev/null +++ b/queue-3.18/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch @@ -0,0 +1,52 @@ +From bf5c4136fa5ce471bdbf4cf59a813e32755fd014 Mon Sep 17 00:00:00 2001 +From: Dmitry Nezhevenko +Date: Mon, 12 Jan 2015 19:13:01 +0200 +Subject: usb-storage/SCSI: blacklist FUA on JMicron 152d:2566 USB-SATA controller + +From: Dmitry Nezhevenko + +commit bf5c4136fa5ce471bdbf4cf59a813e32755fd014 upstream. + +It looks like FUA support is broken on JMicron 152d:2566 bridge: + +[223159.885704] sd 7:0:0:0: [sdc] Write Protect is off +[223159.885706] sd 7:0:0:0: [sdc] Mode Sense: 47 00 10 08 +[223159.885942] sd 7:0:0:0: [sdc] Write cache: enabled, read cache: enabled, supports DPO and FUA + +[223283.691677] sd 7:0:0:0: [sdc] +[223283.691680] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE +[223283.691681] sd 7:0:0:0: [sdc] +[223283.691682] Sense Key : Illegal Request [current] +[223283.691684] sd 7:0:0:0: [sdc] +[223283.691685] Add. Sense: Invalid field in cdb +[223283.691686] sd 7:0:0:0: [sdc] CDB: +[223283.691687] Write(10): 2a 08 15 d0 83 0d 00 00 01 00 +[223283.691690] blk_update_request: critical target error, dev sdc, sector 2927892584 + +This patch adds blacklist flag so that sd will not use FUA + +Signed-off-by: Dmitry Nezhevenko +Cc: Phil Dibowitz +Cc: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1995,6 +1995,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), + ++/* Reported by Dmitry Nezhevenko */ ++UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) + * and Mac USB Dock USB-SCSI */ + UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133, diff --git a/queue-3.18/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch b/queue-3.18/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch new file mode 100644 index 00000000000..af8c6a5fe22 --- /dev/null +++ b/queue-3.18/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch @@ -0,0 +1,42 @@ +From 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 29 Jan 2015 11:15:17 -0800 +Subject: vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than SIGBUS + +From: Linus Torvalds + +commit 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba upstream. + +The stack guard page error case has long incorrectly caused a SIGBUS +rather than a SIGSEGV, but nobody actually noticed until commit +fee7e49d4514 ("mm: propagate error from stack expansion even for guard +page") because that error case was never actually triggered in any +normal situations. + +Now that we actually report the error, people noticed the wrong signal +that resulted. So far, only the test suite of libsigsegv seems to have +actually cared, but there are real applications that use libsigsegv, so +let's not wait for any of those to break. + +Reported-and-tested-by: Takashi Iwai +Tested-by: Jan Engelhardt +Acked-by: Heiko Carstens # "s390 still compiles and boots" +Cc: linux-arch@vger.kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2645,7 +2645,7 @@ static int do_anonymous_page(struct mm_s + + /* Check if we need to add a guard page to the stack */ + if (check_stack_guard_page(vma, address) < 0) +- return VM_FAULT_SIGBUS; ++ return VM_FAULT_SIGSEGV; + + /* Use the zero-page for reads */ + if (!(flags & FAULT_FLAG_WRITE)) {