From: Greg Kroah-Hartman Date: Sun, 1 Mar 2015 20:04:57 +0000 (-0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.71~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6faa613e5daff3c4d03cf7d95231cb21d7989fe8;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: acpi-lpss-always-disable-i2c-host-controllers.patch acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch added-little-endian-support-to-vtpm-module.patch alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch alsa-hdspm-constrain-periods-to-2-on-older-cards.patch alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch arm-dts-bcm63xx-fix-l2-cache-properties.patch arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch arm-mvebu-build-armada375-smp-code-conditionally.patch arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch arm-vexpress-use-arm_cpu_suspend-if-needed.patch asoc-davinci-fix-dm365_evm-codec-selection.patch asoc-mioa701_wm9713-fix-speaker-event.patch asoc-rt5670-set-use_single_rw-flag-for-regmap.patch axonram-fix-bug-in-direct_access.patch blk-mq-fix-double-free-in-error-path.patch bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch bluetooth-fix-valid-identity-address-check.patch cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch cfq-iosched-handle-failure-of-cfq-group-allocation.patch char-tpm-add-missing-error-check-for-devm_kzalloc.patch cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch cpufreq-s3c-remove-incorrect-__init-annotations.patch cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch em28xx-audio-fix-missing-newlines-again.patch em28xx-audio-fix-missing-newlines.patch em28xx-core-fix-missing-newlines.patch em28xx-dvb-fix-missing-newlines.patch em28xx-ensure-closing-messages-terminate-with-a-newline.patch em28xx-input-fix-missing-newlines.patch em28xx-video-fix-missing-newlines.patch fsnotify-fix-handling-of-renames-in-audit.patch hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch iscsi-target-drop-problematic-active_ts_list-usage.patch iwlwifi-mvm-always-use-mac-color-zero.patch iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch kvm-mips-disable-htw-while-in-guest.patch kvm-mips-don-t-leak-fpu-dsp-to-guest.patch lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch lmedm04-increase-interupt-due-time-to-200-msec.patch megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch mei-mask-interrupt-set-bit-on-clean-reset-bit.patch mei-me-release-hw-from-reset-only-during-the-reset-flow.patch mips-alchemy-fix-cpu-clock-calculation.patch mips-asm-asmmacro-replace-add-instructions-with-addu.patch mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch mips-kernel-cps-vec-replace-addi-with-addiu.patch mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch nfs-don-t-call-blocking-operations-while-task_running.patch nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch pci-fix-infinite-loop-with-rom-image-of-size-0.patch pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch power-bq24190-fix-ignored-supplicants.patch power-gpio-charger-balance-enable-disable_irq_wake-calls.patch power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch proc-pagemap-walk-page-tables-under-pte-lock.patch random-fix-fast_mix-function.patch rc-main-re-apply-filter-for-no-op-protocol-change.patch ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch rtlwifi-rtl8192ee-fix-adhoc-fail.patch rtlwifi-rtl8192ee-fix-dma-stalls.patch rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch serial-fsl_lpuart-delete-timer-on-shutdown.patch sg-fix-ewouldblock-errors-with-scsi-mq.patch sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch si2168-define-symbol-rate-limits.patch smack-fix-possible-use-after-frees-in-task_security-callers.patch sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch timberdale-do-not-select-timb_dma.patch tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch tpm_tis-verify-interrupt-during-init.patch tracing-fix-unmapping-loop-in-tracing_mark_write.patch tty-prevent-untrappable-signals-from-malicious-program.patch tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch usb-musb-add-omap-control-dependency.patch vt-provide-notifications-on-selection-changes.patch xen-manage-fix-usb-interaction-issues-when-resuming.patch xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch xfs-ensure-buffer-types-are-set-correctly.patch xfs-inode-unlink-does-not-set-agi-buffer-type.patch xfs-set-buf-types-when-converting-extent-formats.patch xfs-set-superblock-buffer-type-correctly.patch --- diff --git a/queue-3.18/acpi-lpss-always-disable-i2c-host-controllers.patch b/queue-3.18/acpi-lpss-always-disable-i2c-host-controllers.patch new file mode 100644 index 00000000000..081060b74d2 --- /dev/null +++ b/queue-3.18/acpi-lpss-always-disable-i2c-host-controllers.patch @@ -0,0 +1,60 @@ +From 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 18 Feb 2015 13:50:16 +0200 +Subject: ACPI / LPSS: Always disable I2C host controllers + +From: Mika Westerberg + +commit 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 upstream. + +On Baytrail and Braswell the BIOS might leave the I2C host controllers +enabled, probably because it uses them for its own purposes. This is fine +in normal cases because the I2C driver will disable the hardware when it +is probed anyway. + +However, in case of suspend to disk it is different story. If the driver +happens to be compiled as a module the boot kernel never loads the driver +thus leaving host controllers enabled upon loading the hibernation image. + +The I2C host controller interrupt mask register has default value of 0x8ff, +in other words it has most of the interrupts unmasked. When combined with +the fact that the host controller is enabled, the driver immediately starts +getting interrupts even before its resume hook is called (once IO-APIC is +resumed). Since the driver is not prepared for this it will crash the +kernel due to NULL pointer derefence because dev->msgs is NULL. + +Unfortunately we were not able to get full backtrace to from the console +which could be reproduced here. + +In order to fix this even when the driver is compiled as module, we disable +the I2C host controllers in byt_i2c_setup() before devices are created. + +Reported-by: Yu Chen +Signed-off-by: Mika Westerberg +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -105,6 +105,8 @@ static void lpss_uart_setup(struct lpss_ + } + } + ++#define LPSS_I2C_ENABLE 0x6c ++ + static void byt_i2c_setup(struct lpss_private_data *pdata) + { + unsigned int offset; +@@ -117,6 +119,8 @@ static void byt_i2c_setup(struct lpss_pr + + if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset)) + pdata->fixed_clk_rate = 133000000; ++ ++ writel(0, pdata->mmio_base + LPSS_I2C_ENABLE); + } + + static struct lpss_device_desc lpt_dev_desc = { diff --git a/queue-3.18/acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch b/queue-3.18/acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch new file mode 100644 index 00000000000..b446c2a2b62 --- /dev/null +++ b/queue-3.18/acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch @@ -0,0 +1,73 @@ +From 3095794ae972bc6fc76af6cb3b864d6686b96094 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 18 Feb 2015 13:50:17 +0200 +Subject: ACPI / LPSS: Deassert resets for SPI host controllers on Braswell + +From: Mika Westerberg + +commit 3095794ae972bc6fc76af6cb3b864d6686b96094 upstream. + +On some Braswell systems BIOS leaves resets for SPI host controllers +active. This prevents the SPI driver from transferring messages on wire. + +Fix this in similar way that we do for I2C already by deasserting resets +for the SPI host controllers. + +Reported-by: Yang A Fang +Signed-off-by: Mika Westerberg +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -105,9 +105,7 @@ static void lpss_uart_setup(struct lpss_ + } + } + +-#define LPSS_I2C_ENABLE 0x6c +- +-static void byt_i2c_setup(struct lpss_private_data *pdata) ++static void lpss_deassert_reset(struct lpss_private_data *pdata) + { + unsigned int offset; + u32 val; +@@ -116,6 +114,13 @@ static void byt_i2c_setup(struct lpss_pr + val = readl(pdata->mmio_base + offset); + val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC; + writel(val, pdata->mmio_base + offset); ++} ++ ++#define LPSS_I2C_ENABLE 0x6c ++ ++static void byt_i2c_setup(struct lpss_private_data *pdata) ++{ ++ lpss_deassert_reset(pdata); + + if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset)) + pdata->fixed_clk_rate = 133000000; +@@ -170,6 +175,12 @@ static struct lpss_device_desc byt_i2c_d + .setup = byt_i2c_setup, + }; + ++static struct lpss_device_desc bsw_spi_dev_desc = { ++ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX, ++ .prv_offset = 0x400, ++ .setup = lpss_deassert_reset, ++}; ++ + #else + + #define LPSS_ADDR(desc) (0UL) +@@ -202,7 +213,7 @@ static const struct acpi_device_id acpi_ + /* Braswell LPSS devices */ + { "80862288", LPSS_ADDR(byt_pwm_dev_desc) }, + { "8086228A", LPSS_ADDR(byt_uart_dev_desc) }, +- { "8086228E", LPSS_ADDR(byt_spi_dev_desc) }, ++ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) }, + { "808622C1", LPSS_ADDR(byt_i2c_dev_desc) }, + + { "INT3430", LPSS_ADDR(lpt_dev_desc) }, diff --git a/queue-3.18/added-little-endian-support-to-vtpm-module.patch b/queue-3.18/added-little-endian-support-to-vtpm-module.patch new file mode 100644 index 00000000000..d1176366b46 --- /dev/null +++ b/queue-3.18/added-little-endian-support-to-vtpm-module.patch @@ -0,0 +1,100 @@ +From eb71f8a5e33fa1066fb92f0111ab366a341e1f6c Mon Sep 17 00:00:00 2001 +From: honclo +Date: Thu, 12 Feb 2015 21:02:24 -0500 +Subject: Added Little Endian support to vtpm module + +From: honclo + +commit eb71f8a5e33fa1066fb92f0111ab366a341e1f6c upstream. + +The tpm_ibmvtpm module is affected by an unaligned access problem. +ibmvtpm_crq_get_version failed with rc=-4 during boot when vTPM is +enabled in Power partition, which supports both little endian and +big endian modes. + +We added little endian support to fix this problem: +1) added cpu_to_be64 calls to ensure BE data is sent from an LE OS. +2) added be16_to_cpu and be32_to_cpu calls to make sure data received + is in LE format on a LE OS. + +Signed-off-by: Hon Ching(Vicky) Lo +Signed-off-by: Joy Latten +[phuewe: manually applied the patch :( ] +Reviewed-by: Ashley Lai +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_ibmvtpm.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -148,7 +148,8 @@ static int tpm_ibmvtpm_send(struct tpm_c + crq.len = (u16)count; + crq.data = ibmvtpm->rtce_dma_handle; + +- rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]); ++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]), ++ cpu_to_be64(word[1])); + if (rc != H_SUCCESS) { + dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc); + rc = 0; +@@ -186,7 +187,8 @@ static int ibmvtpm_crq_get_rtce_size(str + crq.valid = (u8)IBMVTPM_VALID_CMD; + crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE; + +- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); ++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), ++ cpu_to_be64(buf[1])); + if (rc != H_SUCCESS) + dev_err(ibmvtpm->dev, + "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc); +@@ -212,7 +214,8 @@ static int ibmvtpm_crq_get_version(struc + crq.valid = (u8)IBMVTPM_VALID_CMD; + crq.msg = (u8)VTPM_GET_VERSION; + +- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); ++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), ++ cpu_to_be64(buf[1])); + if (rc != H_SUCCESS) + dev_err(ibmvtpm->dev, + "ibmvtpm_crq_get_version failed rc=%d\n", rc); +@@ -335,7 +338,8 @@ static int tpm_ibmvtpm_suspend(struct de + crq.valid = (u8)IBMVTPM_VALID_CMD; + crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND; + +- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); ++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), ++ cpu_to_be64(buf[1])); + if (rc != H_SUCCESS) + dev_err(ibmvtpm->dev, + "tpm_ibmvtpm_suspend failed rc=%d\n", rc); +@@ -480,11 +484,11 @@ static void ibmvtpm_crq_process(struct i + case IBMVTPM_VALID_CMD: + switch (crq->msg) { + case VTPM_GET_RTCE_BUFFER_SIZE_RES: +- if (crq->len <= 0) { ++ if (be16_to_cpu(crq->len) <= 0) { + dev_err(ibmvtpm->dev, "Invalid rtce size\n"); + return; + } +- ibmvtpm->rtce_size = crq->len; ++ ibmvtpm->rtce_size = be16_to_cpu(crq->len); + ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size, + GFP_KERNEL); + if (!ibmvtpm->rtce_buf) { +@@ -505,11 +509,11 @@ static void ibmvtpm_crq_process(struct i + + return; + case VTPM_GET_VERSION_RES: +- ibmvtpm->vtpm_version = crq->data; ++ ibmvtpm->vtpm_version = be32_to_cpu(crq->data); + return; + case VTPM_TPM_COMMAND_RES: + /* len of the data in rtce buffer */ +- ibmvtpm->res_len = crq->len; ++ ibmvtpm->res_len = be16_to_cpu(crq->len); + wake_up_interruptible(&ibmvtpm->wq); + return; + default: diff --git a/queue-3.18/alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch b/queue-3.18/alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch new file mode 100644 index 00000000000..302c306a696 --- /dev/null +++ b/queue-3.18/alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch @@ -0,0 +1,31 @@ +From 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 13 Feb 2015 11:14:41 +0800 +Subject: ALSA: hda - enable mute led quirk for one more hp machine. + +From: Hui Wang + +commit 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 upstream. + +Otherwise, the mute led can't work at all. + +Tested-by: Taihsiang Ho +BugLink: https://bugs.launchpad.net/bugs/1410704 +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4805,6 +4805,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED), + /* ALC282 */ ++ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED), diff --git a/queue-3.18/alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch b/queue-3.18/alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch new file mode 100644 index 00000000000..49fdd22f1e0 --- /dev/null +++ b/queue-3.18/alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch @@ -0,0 +1,70 @@ +From 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 5 Feb 2015 12:23:33 +0100 +Subject: ALSA: hda - Set up GPIO for Toshiba Satellite S50D + +From: Takashi Iwai + +commit 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 upstream. + +Toshiba Satellite S50D laptop with an IDT codec uses the GPIO4 (0x10) +as the master EAPD. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=915858 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -99,6 +99,7 @@ enum { + STAC_HP_ENVY_BASS, + STAC_HP_BNB13_EQ, + STAC_HP_ENVY_TS_BASS, ++ STAC_92HD83XXX_GPIO10_EAPD, + STAC_92HD83XXX_MODELS + }; + +@@ -2141,6 +2142,19 @@ static void stac92hd83xxx_fixup_headset_ + spec->headset_jack = 1; + } + ++static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct sigmatel_spec *spec = codec->spec; ++ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ spec->eapd_mask = spec->gpio_mask = spec->gpio_dir = ++ spec->gpio_data = 0x10; ++ spec->eapd_switch = 0; ++} ++ + static const struct hda_verb hp_bnb13_eq_verbs[] = { + /* 44.1KHz base */ + { 0x22, 0x7A6, 0x3E }, +@@ -2656,6 +2670,10 @@ static const struct hda_fixup stac92hd83 + {} + }, + }, ++ [STAC_92HD83XXX_GPIO10_EAPD] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = stac92hd83xxx_fixup_gpio10_eapd, ++ }, + }; + + static const struct hda_model_fixup stac92hd83xxx_models[] = { +@@ -2861,6 +2879,8 @@ static const struct snd_pci_quirk stac92 + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a, + "HP Mini", STAC_92HD83XXX_HP_LED), + SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91, ++ "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD), + {} /* terminator */ + }; + diff --git a/queue-3.18/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch b/queue-3.18/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch new file mode 100644 index 00000000000..2082a30fbcd --- /dev/null +++ b/queue-3.18/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch @@ -0,0 +1,47 @@ +From f0153c3d948c1764f6c920a0675d86fc1d75813e Mon Sep 17 00:00:00 2001 +From: Adrian Knoth +Date: Tue, 10 Feb 2015 11:33:50 +0100 +Subject: ALSA: hdspm - Constrain periods to 2 on older cards + +From: Adrian Knoth + +commit f0153c3d948c1764f6c920a0675d86fc1d75813e upstream. + +RME RayDAT and AIO use a fixed buffer size of 16384 samples. With period +sizes of 32-4096, this translates to 4-512 periods. + +The older RME cards have a variable buffer size but require exactly two +periods. + +This patch enforces nperiods=2 on those cards. + +Signed-off-by: Adrian Knoth +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/rme9652/hdspm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -6114,6 +6114,9 @@ static int snd_hdspm_playback_open(struc + snd_pcm_hw_constraint_minmax(runtime, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, + 64, 8192); ++ snd_pcm_hw_constraint_minmax(runtime, ++ SNDRV_PCM_HW_PARAM_PERIODS, ++ 2, 2); + break; + } + +@@ -6188,6 +6191,9 @@ static int snd_hdspm_capture_open(struct + snd_pcm_hw_constraint_minmax(runtime, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, + 64, 8192); ++ snd_pcm_hw_constraint_minmax(runtime, ++ SNDRV_PCM_HW_PARAM_PERIODS, ++ 2, 2); + break; + } + diff --git a/queue-3.18/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch b/queue-3.18/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch new file mode 100644 index 00000000000..dd07cd688b9 --- /dev/null +++ b/queue-3.18/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch @@ -0,0 +1,91 @@ +From e4940626defdf6c92da1052ad3f12741c1a28c90 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 9 Feb 2015 16:51:40 +0300 +Subject: ALSA: off by one bug in snd_riptide_joystick_probe() + +From: Dan Carpenter + +commit e4940626defdf6c92da1052ad3f12741c1a28c90 upstream. + +The problem here is that we check: + + if (dev >= SNDRV_CARDS) + +Then we increment "dev". + + if (!joystick_port[dev++]) + +Then we use it as an offset into a array with SNDRV_CARDS elements. + + if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { + +This has 3 effects: +1) If you use the module option to specify the joystick port then it has + to be shifted one space over. +2) The wrong error message will be printed on failure if you have over + 32 cards. +3) Static checkers will correctly complain that are off by one. + +Fixes: db1005ec6ff8 ('ALSA: riptide - Fix joystick resource handling') +Signed-off-by: Dan Carpenter +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/riptide/riptide.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +--- a/sound/pci/riptide/riptide.c ++++ b/sound/pci/riptide/riptide.c +@@ -2030,32 +2030,43 @@ snd_riptide_joystick_probe(struct pci_de + { + static int dev; + struct gameport *gameport; ++ int ret; + + if (dev >= SNDRV_CARDS) + return -ENODEV; ++ + if (!enable[dev]) { +- dev++; +- return -ENOENT; ++ ret = -ENOENT; ++ goto inc_dev; + } + +- if (!joystick_port[dev++]) +- return 0; ++ if (!joystick_port[dev]) { ++ ret = 0; ++ goto inc_dev; ++ } + + gameport = gameport_allocate_port(); +- if (!gameport) +- return -ENOMEM; ++ if (!gameport) { ++ ret = -ENOMEM; ++ goto inc_dev; ++ } + if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { + snd_printk(KERN_WARNING + "Riptide: cannot grab gameport 0x%x\n", + joystick_port[dev]); + gameport_free_port(gameport); +- return -EBUSY; ++ ret = -EBUSY; ++ goto inc_dev; + } + + gameport->io = joystick_port[dev]; + gameport_register_port(gameport); + pci_set_drvdata(pci, gameport); +- return 0; ++ ++ ret = 0; ++inc_dev: ++ dev++; ++ return ret; + } + + static void snd_riptide_joystick_remove(struct pci_dev *pci) diff --git a/queue-3.18/arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch b/queue-3.18/arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch new file mode 100644 index 00000000000..61e92166d34 --- /dev/null +++ b/queue-3.18/arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch @@ -0,0 +1,52 @@ +From 06f34e1c28f3608b0ce5b310e41102d3fe7b65a1 Mon Sep 17 00:00:00 2001 +From: Alexey Brodkin +Date: Thu, 12 Feb 2015 21:10:11 +0300 +Subject: ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE + +From: Alexey Brodkin + +commit 06f34e1c28f3608b0ce5b310e41102d3fe7b65a1 upstream. + +We used to calculate page address differently in 2 cases: + +1. In virt_to_page(x) we do + --->8--- + mem_map + (x - CONFIG_LINUX_LINK_BASE) >> PAGE_SHIFT + --->8--- + +2. In in pte_page(x) we do + --->8--- + mem_map + (pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT + --->8--- + +That leads to problems in case PAGE_OFFSET != CONFIG_LINUX_LINK_BASE - +different pages will be selected depending on where and how we calculate +page address. + +In particular in the STAR 9000853582 when gdb attempted to read memory +of another process it got improper page in get_user_pages() because this +is exactly one of the places where we search for a page by pte_page(). + +The fix is trivial - we need to calculate page address similarly in both +cases. + +Signed-off-by: Alexey Brodkin +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/pgtable.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -259,7 +259,8 @@ static inline void pmd_set(pmd_t *pmdp, + #define pmd_clear(xp) do { pmd_val(*(xp)) = 0; } while (0) + + #define pte_page(x) (mem_map + \ +- (unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT))) ++ (unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \ ++ PAGE_SHIFT))) + + #define mk_pte(page, pgprot) \ + ({ \ diff --git a/queue-3.18/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch b/queue-3.18/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch new file mode 100644 index 00000000000..045fb689319 --- /dev/null +++ b/queue-3.18/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch @@ -0,0 +1,33 @@ +From e461894dc2ce7778ccde1c3483c9b15a85a7fc5f Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin-Solenikov +Date: Thu, 15 Jan 2015 03:06:22 +0100 +Subject: ARM: 8284/1: sa1100: clear RCSR_SMR on resume + +From: Dmitry Eremin-Solenikov + +commit e461894dc2ce7778ccde1c3483c9b15a85a7fc5f upstream. + +StrongARM core uses RCSR SMR bit to tell to bootloader that it was reset +by entering the sleep mode. After we have resumed, there is little point +in having that bit enabled. Moreover, if this bit is set before reboot, +the bootloader can become confused. Thus clear the SMR bit on resume +just before clearing the scratchpad (resume address) register. + +Signed-off-by: Dmitry Eremin-Solenikov +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-sa1100/pm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/mach-sa1100/pm.c ++++ b/arch/arm/mach-sa1100/pm.c +@@ -81,6 +81,7 @@ static int sa11x0_pm_enter(suspend_state + /* + * Ensure not to come back here if it wasn't intended + */ ++ RCSR = RCSR_SMR; + PSPR = 0; + + /* diff --git a/queue-3.18/arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch b/queue-3.18/arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch new file mode 100644 index 00000000000..8b1089f51f5 --- /dev/null +++ b/queue-3.18/arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch @@ -0,0 +1,41 @@ +From 1c7e36bfc3e2fb2df5e2d1989a4b6fb9055a0f9b Mon Sep 17 00:00:00 2001 +From: Lokesh Vutla +Date: Thu, 8 Jan 2015 17:22:04 +0530 +Subject: ARM: DRA7: hwmod: Fix boot crash with DEBUG_LL enabled on UART3 + +From: Lokesh Vutla + +commit 1c7e36bfc3e2fb2df5e2d1989a4b6fb9055a0f9b upstream. + +With commit '7dedd34: ARM: OMAP2+: hwmod: Fix a crash in _setup_reset() +with DEBUG_LL' we moved from parsing cmdline to identify uart used +for earlycon to using the requsite hwmod CONFIG_DEBUG_OMAPxUARTy FLAGS. + +On DRA7 UART3 hwmod doesn't have this flag enabled, and atleast on +BeagleBoard-X15, where we use UART3 for console, boot fails with +DEBUG_LL enabled. Enable DEBUG_OMAP4UART3_FLAGS for UART3 hwmod. + +For using DEBUG_LL, enable CONFIG_DEBUG_OMAP4UART3 in menuconfig. + +Fixes: 90020c7b2c5e ("ARM: OMAP: DRA7: hwmod: Create initial DRA7XX SoC data") +Reviewed-by: Felipe Balbi +Acked-by: Felipe Balbi +Signed-off-by: Lokesh Vutla +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +@@ -2017,7 +2017,7 @@ static struct omap_hwmod dra7xx_uart3_hw + .class = &dra7xx_uart_hwmod_class, + .clkdm_name = "l4per_clkdm", + .main_clk = "uart3_gfclk_mux", +- .flags = HWMOD_SWSUP_SIDLE_ACT, ++ .flags = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP4UART3_FLAGS, + .prcm = { + .omap4 = { + .clkctrl_offs = DRA7XX_CM_L4PER_UART3_CLKCTRL_OFFSET, diff --git a/queue-3.18/arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch b/queue-3.18/arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch new file mode 100644 index 00000000000..09fc4eb32b7 --- /dev/null +++ b/queue-3.18/arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch @@ -0,0 +1,33 @@ +From 67fd14b3eca63b14429350e9eadc5fab709a8821 Mon Sep 17 00:00:00 2001 +From: Robert Nelson +Date: Tue, 24 Feb 2015 10:10:43 -0600 +Subject: ARM: dts: am335x-bone*: usb0 is hardwired for peripheral + +From: Robert Nelson + +commit 67fd14b3eca63b14429350e9eadc5fab709a8821 upstream. + +Fixes: http://bugs.elinux.org/issues/127 + +the bb.org community was seeing random reboots before this change. + +Signed-off-by: Robert Nelson +Reviewed-by: Felipe Balbi +Acked-by: Felipe Balbi +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/am335x-bone-common.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/am335x-bone-common.dtsi ++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi +@@ -195,6 +195,7 @@ + + &usb0 { + status = "okay"; ++ dr_mode = "peripheral"; + }; + + &usb1 { diff --git a/queue-3.18/arm-dts-bcm63xx-fix-l2-cache-properties.patch b/queue-3.18/arm-dts-bcm63xx-fix-l2-cache-properties.patch new file mode 100644 index 00000000000..66bcdfee737 --- /dev/null +++ b/queue-3.18/arm-dts-bcm63xx-fix-l2-cache-properties.patch @@ -0,0 +1,36 @@ +From 9df11828d9b5665ddef81e45f83dd5376a8cd620 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Tue, 10 Feb 2015 17:33:07 -0800 +Subject: ARM: dts: BCM63xx: fix L2 cache properties + +From: Florian Fainelli + +commit 9df11828d9b5665ddef81e45f83dd5376a8cd620 upstream. + +The L2 cache properties were completely off with respect to what the +hardware is configured for. Fix the cache-size, cache-line-size and +cache-sets to reflect the L2 cache controller we have: 512KB, 16 ways +and 32 bytes per cache-line. + +Fixes: 46d4bca0445a0 ("ARM: BCM63XX: add BCM63138 minimal Device Tree") +Signed-off-by: Florian Fainelli +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/bcm63138.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm63138.dtsi ++++ b/arch/arm/boot/dts/bcm63138.dtsi +@@ -66,8 +66,9 @@ + reg = <0x1d000 0x1000>; + cache-unified; + cache-level = <2>; +- cache-sets = <16>; +- cache-size = <0x80000>; ++ cache-size = <524288>; ++ cache-sets = <1024>; ++ cache-line-size = <32>; + interrupts = ; + }; + diff --git a/queue-3.18/arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch b/queue-3.18/arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch new file mode 100644 index 00000000000..905e4d3c952 --- /dev/null +++ b/queue-3.18/arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch @@ -0,0 +1,50 @@ +From de47699d005996b41cea590c6098078ac12058be Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Fri, 12 Dec 2014 18:19:19 +0300 +Subject: ARM: dts: tegra20: fix GR3D, DSI unit and reg base addresses + +From: Dmitry Osipenko + +commit de47699d005996b41cea590c6098078ac12058be upstream. + +Commit 58ecb23f64ee ("ARM: tegra: add missing unit addresses to DT") added +unit address and changed reg base for GR3D and DSI host1x modules, but these +addresses belongs to GR2D and TVO modules respectively. Fix it by changing +modules unit and reg base addresses to proper ones. + +Signed-off-by: Dmitry Osipenko +Fixes: 58ecb23f64ee (ARM: tegra: add missing unit addresses to DT) +Reviewed-by: Alexandre Courbot +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/tegra20.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/tegra20.dtsi ++++ b/arch/arm/boot/dts/tegra20.dtsi +@@ -68,9 +68,9 @@ + reset-names = "2d"; + }; + +- gr3d@54140000 { ++ gr3d@54180000 { + compatible = "nvidia,tegra20-gr3d"; +- reg = <0x54140000 0x00040000>; ++ reg = <0x54180000 0x00040000>; + clocks = <&tegra_car TEGRA20_CLK_GR3D>; + resets = <&tegra_car 24>; + reset-names = "3d"; +@@ -130,9 +130,9 @@ + status = "disabled"; + }; + +- dsi@542c0000 { ++ dsi@54300000 { + compatible = "nvidia,tegra20-dsi"; +- reg = <0x542c0000 0x00040000>; ++ reg = <0x54300000 0x00040000>; + clocks = <&tegra_car TEGRA20_CLK_DSI>; + resets = <&tegra_car 48>; + reset-names = "dsi"; diff --git a/queue-3.18/arm-mvebu-build-armada375-smp-code-conditionally.patch b/queue-3.18/arm-mvebu-build-armada375-smp-code-conditionally.patch new file mode 100644 index 00000000000..38ef8688b9b --- /dev/null +++ b/queue-3.18/arm-mvebu-build-armada375-smp-code-conditionally.patch @@ -0,0 +1,41 @@ +From 165235180ff61f0012ea68a299e46daec43dcaa7 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 2 Feb 2015 15:27:16 +0100 +Subject: ARM: mvebu: build armada375-smp code conditionally + +From: Arnd Bergmann + +commit 165235180ff61f0012ea68a299e46daec43dcaa7 upstream. + +mvebu_armada375_smp_wa_init is only used on armada 375 but is defined +for all mvebu machines. As it calls a function that is only provided +sometimes, this can result in a link error: + +arch/arm/mach-mvebu/built-in.o: In function `mvebu_armada375_smp_wa_init': +:(.text+0x228): undefined reference to `mvebu_setup_boot_addr_wa' + +To solve this, we can just change the existing #ifdef around the +function to also check for Armada375 SMP platforms. + +Signed-off-by: Arnd Bergmann +Fixes: 305969fb6292 ("ARM: mvebu: use the common function for Armada 375 SMP workaround") +Cc: Andrew Lunn +Cc: Jason Cooper +Cc: Gregory Clement +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-mvebu/system-controller.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-mvebu/system-controller.c ++++ b/arch/arm/mach-mvebu/system-controller.c +@@ -126,7 +126,7 @@ int mvebu_system_controller_get_soc_id(u + return -ENODEV; + } + +-#ifdef CONFIG_SMP ++#if defined(CONFIG_SMP) && defined(CONFIG_MACH_MVEBU_V7) + void mvebu_armada375_smp_wa_init(void) + { + u32 dev, rev; diff --git a/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch b/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch new file mode 100644 index 00000000000..5917d2746d3 --- /dev/null +++ b/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch @@ -0,0 +1,51 @@ +From 271e80176aae4e5b481f4bb92df9768c6075bbca Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin-Solenikov +Date: Thu, 4 Dec 2014 14:10:00 +0300 +Subject: ARM: pxa: add regulator_has_full_constraints to corgi board file + +From: Dmitry Eremin-Solenikov + +commit 271e80176aae4e5b481f4bb92df9768c6075bbca upstream. + +Add regulator_has_full_constraints() call to corgi board file to let +regulator core know that we do not have any additional regulators left. +This lets it substitute unprovided regulators with dummy ones. + +This fixes the following warnings that can be seen on corgi if +regulators are enabled: + +ads7846 spi1.0: unable to get regulator: -517 +spi spi1.0: Driver ads7846 requests probe deferral +wm8731 0-001b: Failed to get supply 'AVDD': -517 +wm8731 0-001b: Failed to request supplies: -517 +wm8731 0-001b: ASoC: failed to probe component -517 +corgi-audio corgi-audio: ASoC: failed to instantiate card -517 + +Signed-off-by: Dmitry Eremin-Solenikov +Acked-by: Mark Brown +Signed-off-by: Robert Jarzmik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/corgi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/mach-pxa/corgi.c ++++ b/arch/arm/mach-pxa/corgi.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -752,6 +753,8 @@ static void __init corgi_init(void) + sharpsl_nand_partitions[1].size = 53 * 1024 * 1024; + + platform_add_devices(devices, ARRAY_SIZE(devices)); ++ ++ regulator_has_full_constraints(); + } + + static void __init fixup_corgi(struct tag *tags, char **cmdline) diff --git a/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch b/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch new file mode 100644 index 00000000000..f01e09858f3 --- /dev/null +++ b/queue-3.18/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch @@ -0,0 +1,49 @@ +From 9bc78f32c2e430aebf6def965b316aa95e37a20c Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin-Solenikov +Date: Thu, 4 Dec 2014 14:10:01 +0300 +Subject: ARM: pxa: add regulator_has_full_constraints to poodle board file + +From: Dmitry Eremin-Solenikov + +commit 9bc78f32c2e430aebf6def965b316aa95e37a20c upstream. + +Add regulator_has_full_constraints() call to poodle board file to let +regulator core know that we do not have any additional regulators left. +This lets it substitute unprovided regulators with dummy ones. + +This fixes the following warnings that can be seen on poodle if +regulators are enabled: + +ads7846 spi1.0: unable to get regulator: -517 +spi spi1.0: Driver ads7846 requests probe deferral +wm8731 0-001b: Failed to get supply 'AVDD': -517 +wm8731 0-001b: Failed to request supplies: -517 +wm8731 0-001b: ASoC: failed to probe component -517 + +Signed-off-by: Dmitry Eremin-Solenikov +Acked-by: Mark Brown +Signed-off-by: Robert Jarzmik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/poodle.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/mach-pxa/poodle.c ++++ b/arch/arm/mach-pxa/poodle.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -455,6 +456,7 @@ static void __init poodle_init(void) + pxa_set_i2c_info(NULL); + i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices)); + poodle_init_spi(); ++ regulator_has_full_constraints(); + } + + static void __init fixup_poodle(struct tag *tags, char **cmdline) diff --git a/queue-3.18/arm-vexpress-use-arm_cpu_suspend-if-needed.patch b/queue-3.18/arm-vexpress-use-arm_cpu_suspend-if-needed.patch new file mode 100644 index 00000000000..ca326a65095 --- /dev/null +++ b/queue-3.18/arm-vexpress-use-arm_cpu_suspend-if-needed.patch @@ -0,0 +1,42 @@ +From 95fcedb027a27f32bf2434f9271635c380e57fb5 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 5 Feb 2015 13:42:43 +0100 +Subject: ARM: vexpress: use ARM_CPU_SUSPEND if needed + +From: Arnd Bergmann + +commit 95fcedb027a27f32bf2434f9271635c380e57fb5 upstream. + +The vexpress tc2 power management code calls mcpm_loopback, which +is only available if ARM_CPU_SUSPEND is enabled, otherwise we +get a link error: + +arch/arm/mach-vexpress/built-in.o: In function `tc2_pm_init': +arch/arm/mach-vexpress/tc2_pm.c:389: undefined reference to `mcpm_loopback' + +This explicitly selects ARM_CPU_SUSPEND like other platforms that +need it. + +Signed-off-by: Arnd Bergmann +Fixes: 3592d7e002438 ("ARM: 8082/1: TC2: test the MCPM loopback during boot") +Acked-by: Nicolas Pitre +Acked-by: Liviu Dudau +Cc: Kevin Hilman +Cc: Sudeep Holla +Cc: Lorenzo Pieralisi +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-vexpress/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/mach-vexpress/Kconfig ++++ b/arch/arm/mach-vexpress/Kconfig +@@ -75,6 +75,7 @@ config ARCH_VEXPRESS_TC2_PM + depends on MCPM + select ARM_CCI + select ARCH_VEXPRESS_SPC ++ select ARM_CPU_SUSPEND + help + Support for CPU and cluster power management on Versatile Express + with a TC2 (A15x2 A7x3) big.LITTLE core tile. diff --git a/queue-3.18/asoc-davinci-fix-dm365_evm-codec-selection.patch b/queue-3.18/asoc-davinci-fix-dm365_evm-codec-selection.patch new file mode 100644 index 00000000000..44abda87c56 --- /dev/null +++ b/queue-3.18/asoc-davinci-fix-dm365_evm-codec-selection.patch @@ -0,0 +1,52 @@ +From f9a7ba326938f03b9305af8d31c360fce10cd4df Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 28 Jan 2015 22:30:01 +0100 +Subject: ASoC: davinci: fix DM365_EVM codec selection + +From: Arnd Bergmann + +commit f9a7ba326938f03b9305af8d31c360fce10cd4df upstream. + +An earlier bug fix of mine made the SND_DM365_VOICE_CODEC symbol +tristate to avoid creating an undefined reference from the +davinci-vcif.c driver to the davinci_soc_platform_register +function that may be in a module. + +However, this may now lead to a different error on randconfig +kernels: + +"warning: SND_DM365_VOICE_CODEC creates inconsistent choice state" + +This happens because we now have a choice statement with +one bool and one tristate option, and the latter might not +support being set to 'y' because of dependencies. + +This new change turns the other option into 'tristate' as well, +which avoids the problem. + +Signed-off-by: Arnd Bergmann +Fixes: 19926c6de0c3 ("ASoC: davinci: vcif must be a module if SND_DAVINCI_SOC is") +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/davinci/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/davinci/Kconfig ++++ b/sound/soc/davinci/Kconfig +@@ -58,13 +58,12 @@ choice + depends on MACH_DAVINCI_DM365_EVM + + config SND_DM365_AIC3X_CODEC +- bool "Audio Codec - AIC3101" ++ tristate "Audio Codec - AIC3101" + help + Say Y if you want to add support for AIC3101 audio codec + + config SND_DM365_VOICE_CODEC + tristate "Voice Codec - CQ93VC" +- depends on SND_DAVINCI_SOC + select MFD_DAVINCI_VOICECODEC + select SND_DAVINCI_SOC_VCIF + select SND_SOC_CQ0093VC diff --git a/queue-3.18/asoc-mioa701_wm9713-fix-speaker-event.patch b/queue-3.18/asoc-mioa701_wm9713-fix-speaker-event.patch new file mode 100644 index 00000000000..a323197ca36 --- /dev/null +++ b/queue-3.18/asoc-mioa701_wm9713-fix-speaker-event.patch @@ -0,0 +1,38 @@ +From 7331ea474e9e7a348541c207bdb6aa518c6403f4 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Thu, 15 Jan 2015 12:52:01 +0100 +Subject: ASoC: mioa701_wm9713: Fix speaker event + +From: Lars-Peter Clausen + +commit 7331ea474e9e7a348541c207bdb6aa518c6403f4 upstream. + +Commit f6b2a04590bb ("ASoC: pxa: mioa701_wm9713: Convert to table based DAPM +setup") converted the driver to register the board level DAPM elements with +the card's DAPM context rather than the CODEC's DAPM context. The change +overlooked that the speaker widget event callback accesses the widget's +codec field which is only valid if the widget has been registered in a CODEC +DAPM context. This patch modifies the callback to take an alternative route +to get the CODEC. + +Fixes: f6b2a04590bb ("ASoC: pxa: mioa701_wm9713: Convert to table based DAPM +setup") +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/pxa/mioa701_wm9713.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/pxa/mioa701_wm9713.c ++++ b/sound/soc/pxa/mioa701_wm9713.c +@@ -81,7 +81,7 @@ static int rear_amp_power(struct snd_soc + static int rear_amp_event(struct snd_soc_dapm_widget *widget, + struct snd_kcontrol *kctl, int event) + { +- struct snd_soc_codec *codec = widget->codec; ++ struct snd_soc_codec *codec = widget->dapm->card->rtd[0].codec; + + return rear_amp_power(codec, SND_SOC_DAPM_EVENT_ON(event)); + } diff --git a/queue-3.18/asoc-rt5670-set-use_single_rw-flag-for-regmap.patch b/queue-3.18/asoc-rt5670-set-use_single_rw-flag-for-regmap.patch new file mode 100644 index 00000000000..d4309fcc76a --- /dev/null +++ b/queue-3.18/asoc-rt5670-set-use_single_rw-flag-for-regmap.patch @@ -0,0 +1,30 @@ +From 92b133f251b5f914f3ed28bc83e5b7a40d4e22ed Mon Sep 17 00:00:00 2001 +From: Bard Liao +Date: Mon, 9 Feb 2015 14:41:50 +0800 +Subject: ASoC: rt5670: Set use_single_rw flag for regmap + +From: Bard Liao + +commit 92b133f251b5f914f3ed28bc83e5b7a40d4e22ed upstream. + +RT5670 doesn't support auto incrementing writes so driver should +set the use_single_rw flag for regmap. + +Signed-off-by: Bard Liao +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5670.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/rt5670.c ++++ b/sound/soc/codecs/rt5670.c +@@ -2439,6 +2439,7 @@ static struct snd_soc_codec_driver soc_c + static const struct regmap_config rt5670_regmap = { + .reg_bits = 8, + .val_bits = 16, ++ .use_single_rw = true, + .max_register = RT5670_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5670_ranges) * + RT5670_PR_SPACING), + .volatile_reg = rt5670_volatile_register, diff --git a/queue-3.18/axonram-fix-bug-in-direct_access.patch b/queue-3.18/axonram-fix-bug-in-direct_access.patch new file mode 100644 index 00000000000..a18c4c7f9a6 --- /dev/null +++ b/queue-3.18/axonram-fix-bug-in-direct_access.patch @@ -0,0 +1,33 @@ +From 91117a20245b59f70b563523edbf998a62fc6383 Mon Sep 17 00:00:00 2001 +From: Matthew Wilcox +Date: Wed, 7 Jan 2015 18:04:18 +0200 +Subject: axonram: Fix bug in direct_access + +From: Matthew Wilcox + +commit 91117a20245b59f70b563523edbf998a62fc6383 upstream. + +The 'pfn' returned by axonram was completely bogus, and has been since +2008. + +Signed-off-by: Matthew Wilcox +Reviewed-by: Jan Kara +Reviewed-by: Mathieu Desnoyers +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/sysdev/axonram.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/sysdev/axonram.c ++++ b/arch/powerpc/sysdev/axonram.c +@@ -156,7 +156,7 @@ axon_ram_direct_access(struct block_devi + } + + *kaddr = (void *)(bank->ph_addr + offset); +- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT; ++ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT; + + return 0; + } diff --git a/queue-3.18/blk-mq-fix-double-free-in-error-path.patch b/queue-3.18/blk-mq-fix-double-free-in-error-path.patch new file mode 100644 index 00000000000..820aa0f5534 --- /dev/null +++ b/queue-3.18/blk-mq-fix-double-free-in-error-path.patch @@ -0,0 +1,32 @@ +From 564e559f2baf6a868768d0cac286980b3cfd6e30 Mon Sep 17 00:00:00 2001 +From: Tony Battersby +Date: Wed, 11 Feb 2015 11:32:30 -0500 +Subject: blk-mq: fix double-free in error path + +From: Tony Battersby + +commit 564e559f2baf6a868768d0cac286980b3cfd6e30 upstream. + +If the allocation of bt->bs fails, then bt->map can be freed twice, once +in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in +blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to +NULL after the first free. + +Signed-off-by: Tony Battersby +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq-tag.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -500,6 +500,7 @@ static int bt_alloc(struct blk_mq_bitmap + bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL); + if (!bt->bs) { + kfree(bt->map); ++ bt->map = NULL; + return -ENOMEM; + } + diff --git a/queue-3.18/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch b/queue-3.18/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch new file mode 100644 index 00000000000..9882821682a --- /dev/null +++ b/queue-3.18/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch @@ -0,0 +1,78 @@ +From 033efa920a7f22a8caf7a38d851a2f451781bbf7 Mon Sep 17 00:00:00 2001 +From: Dmitry Tunin +Date: Sun, 18 Jan 2015 00:16:51 +0300 +Subject: Bluetooth: ath3k: Add support of AR3012 bluetooth 13d3:3423 device + +From: Dmitry Tunin + +commit 033efa920a7f22a8caf7a38d851a2f451781bbf7 upstream. + +Add support of 13d3:3423 device. + +BugLink: https://bugs.launchpad.net/bugs/1411193 + +T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3423 Rev= 0.01 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Dmitry Tunin +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -106,6 +106,7 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x13d3, 0x3393) }, + { USB_DEVICE(0x13d3, 0x3402) }, + { USB_DEVICE(0x13d3, 0x3408) }, ++ { USB_DEVICE(0x13d3, 0x3423) }, + { USB_DEVICE(0x13d3, 0x3432) }, + + /* Atheros AR5BBU12 with sflash firmware */ +@@ -158,6 +159,7 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -183,6 +183,7 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ diff --git a/queue-3.18/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch b/queue-3.18/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch new file mode 100644 index 00000000000..782dbef29b9 --- /dev/null +++ b/queue-3.18/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch @@ -0,0 +1,58 @@ +From c561a5753dd631920c4459a067d22679b3d110d6 Mon Sep 17 00:00:00 2001 +From: Adam Lee +Date: Wed, 28 Jan 2015 15:30:27 -0500 +Subject: Bluetooth: ath3k: workaround the compatibility issue with xHCI controller + +From: Adam Lee + +commit c561a5753dd631920c4459a067d22679b3d110d6 upstream. + +BugLink: https://bugs.launchpad.net/bugs/1400215 + +ath3k devices fail to load firmwares on xHCI buses, but work well on +EHCI, this might be a compatibility issue between xHCI and ath3k chips. +As my testing result, those chips will work on xHCI buses again with +this patch. + +This workaround is from Qualcomm, they also did some workarounds in +Windows driver. + +Signed-off-by: Adam Lee +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -170,6 +170,8 @@ static const struct usb_device_id ath3k_ + #define USB_REQ_DFU_DNLOAD 1 + #define BULK_SIZE 4096 + #define FW_HDR_SIZE 20 ++#define TIMEGAP_USEC_MIN 50 ++#define TIMEGAP_USEC_MAX 100 + + static int ath3k_load_firmware(struct usb_device *udev, + const struct firmware *firmware) +@@ -201,6 +203,9 @@ static int ath3k_load_firmware(struct us + pipe = usb_sndbulkpipe(udev, 0x02); + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + memcpy(send_buf, firmware->data + sent, size); + +@@ -298,6 +303,9 @@ static int ath3k_load_fwfile(struct usb_ + pipe = usb_sndbulkpipe(udev, 0x02); + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + memcpy(send_buf, firmware->data + sent, size); + diff --git a/queue-3.18/bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch b/queue-3.18/bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch new file mode 100644 index 00000000000..4fe037a14a1 --- /dev/null +++ b/queue-3.18/bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch @@ -0,0 +1,69 @@ +From 9a5abdaaf9d2e80e157c7a756f9d9fd933dee48e Mon Sep 17 00:00:00 2001 +From: Rick Dunn +Date: Sat, 17 Jan 2015 05:29:12 +0100 +Subject: Bluetooth: btusb: Add Broadcom patchram support for ASUSTek devices + +From: Rick Dunn + +commit 9a5abdaaf9d2e80e157c7a756f9d9fd933dee48e upstream. + +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0b05 ProdID=17cf Rev= 1.12 +S: Manufacturer=Broadcom Corp +S: Product=BCM20702A0 +S: SerialNumber=54271E3298CD +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Firmware is extracted from the latest Broadcom BCM4352 Windows driver +by extracting the zip and searching the .hex file names for '17cf'. + +The hex file must then be converted to hcd format using the hex2hcd +utility and then moved to /lib/firmware/brcm/. + +Signed-off-by: Rick Dunn +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -115,7 +115,8 @@ static const struct usb_device_id btusb_ + .driver_info = BTUSB_BCM_PATCHRAM }, + + /* ASUSTek Computer - Broadcom based */ +- { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) }, ++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), ++ .driver_info = BTUSB_BCM_PATCHRAM }, + + /* Belkin F8065bf - Broadcom based */ + { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) }, diff --git a/queue-3.18/bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch b/queue-3.18/bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch new file mode 100644 index 00000000000..5922989d479 --- /dev/null +++ b/queue-3.18/bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch @@ -0,0 +1,138 @@ +From d049f4e513e861167361b06c7ca85f9e872c8cde Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Mon, 26 Jan 2015 20:35:32 -0800 +Subject: Bluetooth: btusb: Add support for Dynex/Insignia USB dongles + +From: Marcel Holtmann + +commit d049f4e513e861167361b06c7ca85f9e872c8cde upstream. + +The Dynex/Insignia USB dongles are Broadcom BCM20702B0 based and require +firmware update before operation. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=19ff ProdID=0239 Rev= 1.12 +S: Manufacturer=Broadcom Corp +S: Product=BCM20702A0 +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Since this is an unsual USB vendor ID (0x19ff), these dongles are added +via USB_DEVICE macro and not USB_VENDOR_AND_INTERFACE_INFO as done for +mainstream Broadcom based dongles. + +The latest known working firmware is BCM20702B0_002.001.014.0527.0557.hex +which needs to be converted using hex2hcd utility and then installed +as /lib/firmware/brcm/BCM20702A0-19ff-0239.hcd to make this device fully +operational. + +Bluetooth: hci0: BCM: patching hci_ver=06 hci_rev=2000 lmp_ver=06 lmp_subver=410e +Bluetooth: hci0: BCM: firmware hci_ver=06 hci_rev=222d lmp_ver=06 lmp_subver=410e + +With this firmware the device reports support for connectionless slave +broadcast (master and slave) feature used by 3D Glasses and TVs. + + < HCI Command: Read Local Extended Features (0x04|0x0004) plen 1 + Page: 2 + > HCI Event: Command Complete (0x0e) plen 14 + Read Local Extended Features (0x04|0x0004) ncmd 1 + Status: Success (0x00) + Page: 2/2 + Features: 0x0f 0x00 0x00 0x00 0x00 0x00 0x00 0x00 + Connectionless Slave Broadcast - Master + Connectionless Slave Broadcast - Slave + Synchronization Train + Synchronization Scan + +However there are some flaws with this feature. The Set Event Mask Page 2 +command is actually not supported and with that all connectionless slave +broadcast events are always enabled. + + < HCI Command: Set Event Mask Page 2 (0x03|0x0063) plen 8 + Mask: 0x00000000000f0000 + Synchronization Train Received + Connectionless Slave Broadcast Receive + Connectionless Slave Broadcast Timeout + Truncated Page Complete + > HCI Event: Command Complete (0x0e) plen 4 + Set Event Mask Page 2 (0x03|0x0063) ncmd 1 + Status: Unknown HCI Command (0x01) + +In addition the Synchronization Train Received event is actually broken +on this controller. It mixes up the order of parameters. According to the +Bluetooth Core specification the fields are like this: + + struct hci_ev_sync_train_received { + __u8 status; + bdaddr_t bdaddr; + __le32 offset; + __u8 map[10]; + __u8 lt_addr; + __le32 instant; + __le16 interval; + __u8 service_data; + } __packed; + +This controller however sends the service_data as 5th parameter instead +of having it as last parameter. + + struct hci_ev_sync_train_received { + __u8 status; + bdaddr_t bdaddr; + __le32 offset; + __u8 map[10]; + __u8 service_data; + __u8 lt_addr; + __le32 instant; + __le16 interval; + } __packed; + +So anybody trying to use this hardware for utilizing connectionless slave +broadcast receivers (aka 3D Glasses), be warned about this shortcoming. + +Signed-off-by: Marcel Holtmann +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -107,6 +107,9 @@ static const struct usb_device_id btusb_ + { USB_DEVICE(0x0b05, 0x17cb) }, + { USB_DEVICE(0x413c, 0x8197) }, + ++ /* Broadcom BCM20702B0 (Dynex/Insignia) */ ++ { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, ++ + /* Foxconn - Hon Hai */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, + diff --git a/queue-3.18/bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch b/queue-3.18/bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch new file mode 100644 index 00000000000..1c2abdc8271 --- /dev/null +++ b/queue-3.18/bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch @@ -0,0 +1,76 @@ +From 8f0c304c693c5a9759ed6ae50d07d4590dad5ae7 Mon Sep 17 00:00:00 2001 +From: Matej Dubovy +Date: Mon, 2 Feb 2015 18:50:14 +0100 +Subject: Bluetooth: btusb: Add support for Lite-On (04ca) Broadcom based, BCM43142 + +From: Matej Dubovy + +commit 8f0c304c693c5a9759ed6ae50d07d4590dad5ae7 upstream. + +Please add support for sub BT chip on the combo card +Broadcom 43142A0 (in Lenovo E145), 04ca:2007 + +/sys/kernel/debug/usb/devices + +T: Bus=05 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04ca ProdID=2007 Rev= 1.12 +S: Manufacturer=Broadcom Corp +S: Product=BCM43142A0 +S: SerialNumber=28E347EC73BD +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Firmware for 04ca:2007 can be extracted from the latest Lenovo E145 +Bluetooth driver for Windows (driver is however described as BCM20702 +but contains also firwmare for BCM43142). +Search for BCM43142A0_001.001.011.0122.0153.hex within hex files, then +it must be converted using hex2hcd utility. Rename file to +BCM43142A0-04ca-2007.hcd, then move to /lib/firmware/brcm/. + +Signed-off-by: Matej Dubovy +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -113,6 +113,10 @@ static const struct usb_device_id btusb_ + /* Foxconn - Hon Hai */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, + ++ /* Lite-On Technology - Broadcom based */ ++ { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), ++ .driver_info = BTUSB_BCM_PATCHRAM }, ++ + /* Broadcom devices with vendor specific id */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), + .driver_info = BTUSB_BCM_PATCHRAM }, diff --git a/queue-3.18/bluetooth-fix-valid-identity-address-check.patch b/queue-3.18/bluetooth-fix-valid-identity-address-check.patch new file mode 100644 index 00000000000..993c90e1a99 --- /dev/null +++ b/queue-3.18/bluetooth-fix-valid-identity-address-check.patch @@ -0,0 +1,41 @@ +From e12af489b91d47a806f4e96e4edc20df612482e7 Mon Sep 17 00:00:00 2001 +From: Johan Hedberg +Date: Wed, 14 Jan 2015 20:51:37 +0200 +Subject: Bluetooth: Fix valid Identity Address check + +From: Johan Hedberg + +commit e12af489b91d47a806f4e96e4edc20df612482e7 upstream. + +According to the Bluetooth core specification valid identity addresses +are either Public Device Addresses or Static Random Addresses. IRKs +received with any other type of address should be discarded since we +cannot assume to know the permanent identity of the peer device. + +This patch fixes a missing check for the Identity Address when receiving +the Identity Address Information SMP PDU. + +Signed-off-by: Johan Hedberg +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/smp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -1392,8 +1392,12 @@ static int smp_cmd_ident_addr_info(struc + * implementations are not known of and in order to not over + * complicate our implementation, simply pretend that we never + * received an IRK for such a device. ++ * ++ * The Identity Address must also be a Static Random or Public ++ * Address, which hci_is_identity_address() checks for. + */ +- if (!bacmp(&info->bdaddr, BDADDR_ANY)) { ++ if (!bacmp(&info->bdaddr, BDADDR_ANY) || ++ !hci_is_identity_address(&info->bdaddr, info->addr_type)) { + BT_ERR("Ignoring IRK with no identity address"); + goto distribute; + } diff --git a/queue-3.18/cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch b/queue-3.18/cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch new file mode 100644 index 00000000000..cb4df2162ab --- /dev/null +++ b/queue-3.18/cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch @@ -0,0 +1,116 @@ +From c6ce194325cef342313e3d27620411ce90a89c50 Mon Sep 17 00:00:00 2001 +From: Jeff Moyer +Date: Mon, 12 Jan 2015 15:21:01 -0500 +Subject: cfq-iosched: fix incorrect filing of rt async cfqq + +From: Jeff Moyer + +commit c6ce194325cef342313e3d27620411ce90a89c50 upstream. + +Hi, + +If you can manage to submit an async write as the first async I/O from +the context of a process with realtime scheduling priority, then a +cfq_queue is allocated, but filed into the wrong async_cfqq bucket. It +ends up in the best effort array, but actually has realtime I/O +scheduling priority set in cfqq->ioprio. + +The reason is that cfq_get_queue assumes the default scheduling class and +priority when there is no information present (i.e. when the async cfqq +is created): + +static struct cfq_queue * +cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + struct bio *bio, gfp_t gfp_mask) +{ + const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); + const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio); + +cic->ioprio starts out as 0, which is "invalid". So, class of 0 +(IOPRIO_CLASS_NONE) is passed to cfq_async_queue_prio like so: + + async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio); + +static struct cfq_queue ** +cfq_async_queue_prio(struct cfq_data *cfqd, int ioprio_class, int ioprio) +{ + switch (ioprio_class) { + case IOPRIO_CLASS_RT: + return &cfqd->async_cfqq[0][ioprio]; + case IOPRIO_CLASS_NONE: + ioprio = IOPRIO_NORM; + /* fall through */ + case IOPRIO_CLASS_BE: + return &cfqd->async_cfqq[1][ioprio]; + case IOPRIO_CLASS_IDLE: + return &cfqd->async_idle_cfqq; + default: + BUG(); + } +} + +Here, instead of returning a class mapped from the process' scheduling +priority, we get back the bucket associated with IOPRIO_CLASS_BE. + +Now, there is no queue allocated there yet, so we create it: + + cfqq = cfq_find_alloc_queue(cfqd, is_sync, cic, bio, gfp_mask); + +That function ends up doing this: + + cfq_init_cfqq(cfqd, cfqq, current->pid, is_sync); + cfq_init_prio_data(cfqq, cic); + +cfq_init_cfqq marks the priority as having changed. Then, cfq_init_prio +data does this: + + ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); + switch (ioprio_class) { + default: + printk(KERN_ERR "cfq: bad prio %x\n", ioprio_class); + case IOPRIO_CLASS_NONE: + /* + * no prio set, inherit CPU scheduling settings + */ + cfqq->ioprio = task_nice_ioprio(tsk); + cfqq->ioprio_class = task_nice_ioclass(tsk); + break; + +So we basically have two code paths that treat IOPRIO_CLASS_NONE +differently, which results in an RT async cfqq filed into a best effort +bucket. + +Attached is a patch which fixes the problem. I'm not sure how to make +it cleaner. Suggestions would be welcome. + +Signed-off-by: Jeff Moyer +Tested-by: Hidehiro Kawai +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -3661,12 +3661,17 @@ static struct cfq_queue * + cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + struct bio *bio, gfp_t gfp_mask) + { +- const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); +- const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio); ++ int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); ++ int ioprio = IOPRIO_PRIO_DATA(cic->ioprio); + struct cfq_queue **async_cfqq = NULL; + struct cfq_queue *cfqq = NULL; + + if (!is_sync) { ++ if (!ioprio_valid(cic->ioprio)) { ++ struct task_struct *tsk = current; ++ ioprio = task_nice_ioprio(tsk); ++ ioprio_class = task_nice_ioclass(tsk); ++ } + async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio); + cfqq = *async_cfqq; + } diff --git a/queue-3.18/cfq-iosched-handle-failure-of-cfq-group-allocation.patch b/queue-3.18/cfq-iosched-handle-failure-of-cfq-group-allocation.patch new file mode 100644 index 00000000000..ba14954f5fc --- /dev/null +++ b/queue-3.18/cfq-iosched-handle-failure-of-cfq-group-allocation.patch @@ -0,0 +1,54 @@ +From 69abaffec7d47a083739b79e3066cb3730eba72e Mon Sep 17 00:00:00 2001 +From: Konstantin Khlebnikov +Date: Mon, 9 Feb 2015 16:42:49 +0300 +Subject: cfq-iosched: handle failure of cfq group allocation + +From: Konstantin Khlebnikov + +commit 69abaffec7d47a083739b79e3066cb3730eba72e upstream. + +Cfq_lookup_create_cfqg() allocates struct blkcg_gq using GFP_ATOMIC. +In cfq_find_alloc_queue() possible allocation failure is not handled. +As a result kernel oopses on NULL pointer dereference when +cfq_link_cfqq_cfqg() calls cfqg_get() for NULL pointer. + +Bug was introduced in v3.5 in commit cd1604fab4f9 ("blkcg: factor +out blkio_group creation"). Prior to that commit cfq group lookup +had returned pointer to root group as fallback. + +This patch handles this error using existing fallback oom_cfqq. + +Signed-off-by: Konstantin Khlebnikov +Acked-by: Tejun Heo +Acked-by: Vivek Goyal +Fixes: cd1604fab4f9 ("blkcg: factor out blkio_group creation") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -3590,6 +3590,11 @@ retry: + + blkcg = bio_blkcg(bio); + cfqg = cfq_lookup_create_cfqg(cfqd, blkcg); ++ if (!cfqg) { ++ cfqq = &cfqd->oom_cfqq; ++ goto out; ++ } ++ + cfqq = cic_to_cfqq(cic, is_sync); + + /* +@@ -3626,7 +3631,7 @@ retry: + } else + cfqq = &cfqd->oom_cfqq; + } +- ++out: + if (new_cfqq) + kmem_cache_free(cfq_pool, new_cfqq); + diff --git a/queue-3.18/char-tpm-add-missing-error-check-for-devm_kzalloc.patch b/queue-3.18/char-tpm-add-missing-error-check-for-devm_kzalloc.patch new file mode 100644 index 00000000000..ab263a8858e --- /dev/null +++ b/queue-3.18/char-tpm-add-missing-error-check-for-devm_kzalloc.patch @@ -0,0 +1,51 @@ +From bb95cd34ba4c9467114acc78eeddd53ab1c10085 Mon Sep 17 00:00:00 2001 +From: Kiran Padwal +Date: Fri, 19 Sep 2014 12:44:39 +0530 +Subject: char: tpm: Add missing error check for devm_kzalloc + +From: Kiran Padwal + +commit bb95cd34ba4c9467114acc78eeddd53ab1c10085 upstream. + +Currently these driver are missing a check on the return value of devm_kzalloc, +which would cause a NULL pointer dereference in a OOM situation. + +This patch adds a missing check for tpm_i2c_atmel.c and tpm_i2c_nuvoton.c + +Signed-off-by: Kiran Padwal +Reviewed-By: Jason Gunthorpe +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_i2c_atmel.c | 4 ++++ + drivers/char/tpm/tpm_i2c_nuvoton.c | 5 +++++ + 2 files changed, 9 insertions(+) + +--- a/drivers/char/tpm/tpm_i2c_atmel.c ++++ b/drivers/char/tpm/tpm_i2c_atmel.c +@@ -168,6 +168,10 @@ static int i2c_atmel_probe(struct i2c_cl + + chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data), + GFP_KERNEL); ++ if (!chip->vendor.priv) { ++ rc = -ENOMEM; ++ goto out_err; ++ } + + /* Default timeouts */ + chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT); +--- a/drivers/char/tpm/tpm_i2c_nuvoton.c ++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c +@@ -538,6 +538,11 @@ static int i2c_nuvoton_probe(struct i2c_ + + chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data), + GFP_KERNEL); ++ if (!chip->vendor.priv) { ++ rc = -ENOMEM; ++ goto out_err; ++ } ++ + init_waitqueue_head(&chip->vendor.read_queue); + init_waitqueue_head(&chip->vendor.int_queue); + diff --git a/queue-3.18/cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch b/queue-3.18/cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch new file mode 100644 index 00000000000..f1a386f9d2c --- /dev/null +++ b/queue-3.18/cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch @@ -0,0 +1,245 @@ +From 04f81f0154e4bf002be6f4d85668ce1257efa4d9 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Wed, 11 Feb 2015 14:46:37 -0500 +Subject: cipso: don't use IPCB() to locate the CIPSO IP option + +From: Paul Moore + +commit 04f81f0154e4bf002be6f4d85668ce1257efa4d9 upstream. + +Using the IPCB() macro to get the IPv4 options is convenient, but +unfortunately NetLabel often needs to examine the CIPSO option outside +of the scope of the IP layer in the stack. While historically IPCB() +worked above the IP layer, due to the inclusion of the inet_skb_param +struct at the head of the {tcp,udp}_skb_cb structs, recent commit +971f10ec ("tcp: better TCP_SKB_CB layout to reduce cache line misses") +reordered the tcp_skb_cb struct and invalidated this IPCB() trick. + +This patch fixes the problem by creating a new function, +cipso_v4_optptr(), which locates the CIPSO option inside the IP header +without calling IPCB(). Unfortunately, this isn't as fast as a simple +lookup so some additional tweaks were made to limit the use of this +new function. + +Reported-by: Casey Schaufler +Signed-off-by: Paul Moore +Tested-by: Casey Schaufler +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/cipso_ipv4.h | 25 +++++++++++++-------- + net/ipv4/cipso_ipv4.c | 51 +++++++++++++++++++++++++------------------ + net/netlabel/netlabel_kapi.c | 15 ++++++++---- + 3 files changed, 56 insertions(+), 35 deletions(-) + +--- a/include/net/cipso_ipv4.h ++++ b/include/net/cipso_ipv4.h +@@ -121,13 +121,6 @@ extern int cipso_v4_rbm_strictvalid; + #endif + + /* +- * Helper Functions +- */ +- +-#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0) +-#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso) +- +-/* + * DOI List Functions + */ + +@@ -190,7 +183,7 @@ static inline int cipso_v4_doi_domhsh_re + + #ifdef CONFIG_NETLABEL + void cipso_v4_cache_invalidate(void); +-int cipso_v4_cache_add(const struct sk_buff *skb, ++int cipso_v4_cache_add(const unsigned char *cipso_ptr, + const struct netlbl_lsm_secattr *secattr); + #else + static inline void cipso_v4_cache_invalidate(void) +@@ -198,7 +191,7 @@ static inline void cipso_v4_cache_invali + return; + } + +-static inline int cipso_v4_cache_add(const struct sk_buff *skb, ++static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr, + const struct netlbl_lsm_secattr *secattr) + { + return 0; +@@ -211,6 +204,8 @@ static inline int cipso_v4_cache_add(con + + #ifdef CONFIG_NETLABEL + void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway); ++int cipso_v4_getattr(const unsigned char *cipso, ++ struct netlbl_lsm_secattr *secattr); + int cipso_v4_sock_setattr(struct sock *sk, + const struct cipso_v4_doi *doi_def, + const struct netlbl_lsm_secattr *secattr); +@@ -226,6 +221,7 @@ int cipso_v4_skbuff_setattr(struct sk_bu + int cipso_v4_skbuff_delattr(struct sk_buff *skb); + int cipso_v4_skbuff_getattr(const struct sk_buff *skb, + struct netlbl_lsm_secattr *secattr); ++unsigned char *cipso_v4_optptr(const struct sk_buff *skb); + int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option); + #else + static inline void cipso_v4_error(struct sk_buff *skb, +@@ -235,6 +231,12 @@ static inline void cipso_v4_error(struct + return; + } + ++static inline int cipso_v4_getattr(const unsigned char *cipso, ++ struct netlbl_lsm_secattr *secattr) ++{ ++ return -ENOSYS; ++} ++ + static inline int cipso_v4_sock_setattr(struct sock *sk, + const struct cipso_v4_doi *doi_def, + const struct netlbl_lsm_secattr *secattr) +@@ -282,6 +284,11 @@ static inline int cipso_v4_skbuff_getatt + return -ENOSYS; + } + ++static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb) ++{ ++ return NULL; ++} ++ + static inline int cipso_v4_validate(const struct sk_buff *skb, + unsigned char **option) + { +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -376,20 +376,18 @@ static int cipso_v4_cache_check(const un + * negative values on failure. + * + */ +-int cipso_v4_cache_add(const struct sk_buff *skb, ++int cipso_v4_cache_add(const unsigned char *cipso_ptr, + const struct netlbl_lsm_secattr *secattr) + { + int ret_val = -EPERM; + u32 bkt; + struct cipso_v4_map_cache_entry *entry = NULL; + struct cipso_v4_map_cache_entry *old_entry = NULL; +- unsigned char *cipso_ptr; + u32 cipso_ptr_len; + + if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0) + return 0; + +- cipso_ptr = CIPSO_V4_OPTPTR(skb); + cipso_ptr_len = cipso_ptr[1]; + + entry = kzalloc(sizeof(*entry), GFP_ATOMIC); +@@ -1577,6 +1575,33 @@ static int cipso_v4_parsetag_loc(const s + } + + /** ++ * cipso_v4_optptr - Find the CIPSO option in the packet ++ * @skb: the packet ++ * ++ * Description: ++ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer ++ * to the start of the CIPSO option on success, NULL if one if not found. ++ * ++ */ ++unsigned char *cipso_v4_optptr(const struct sk_buff *skb) ++{ ++ const struct iphdr *iph = ip_hdr(skb); ++ unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]); ++ int optlen; ++ int taglen; ++ ++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { ++ if (optptr[0] == IPOPT_CIPSO) ++ return optptr; ++ taglen = optptr[1]; ++ optlen -= taglen; ++ optptr += taglen; ++ } ++ ++ return NULL; ++} ++ ++/** + * cipso_v4_validate - Validate a CIPSO option + * @option: the start of the option, on error it is set to point to the error + * +@@ -2117,8 +2142,8 @@ void cipso_v4_req_delattr(struct request + * on success and negative values on failure. + * + */ +-static int cipso_v4_getattr(const unsigned char *cipso, +- struct netlbl_lsm_secattr *secattr) ++int cipso_v4_getattr(const unsigned char *cipso, ++ struct netlbl_lsm_secattr *secattr) + { + int ret_val = -ENOMSG; + u32 doi; +@@ -2303,22 +2328,6 @@ int cipso_v4_skbuff_delattr(struct sk_bu + return 0; + } + +-/** +- * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option +- * @skb: the packet +- * @secattr: the security attributes +- * +- * Description: +- * Parse the given packet's CIPSO option and return the security attributes. +- * Returns zero on success and negative values on failure. +- * +- */ +-int cipso_v4_skbuff_getattr(const struct sk_buff *skb, +- struct netlbl_lsm_secattr *secattr) +-{ +- return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr); +-} +- + /* + * Setup Functions + */ +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -1065,10 +1065,12 @@ int netlbl_skbuff_getattr(const struct s + u16 family, + struct netlbl_lsm_secattr *secattr) + { ++ unsigned char *ptr; ++ + switch (family) { + case AF_INET: +- if (CIPSO_V4_OPTEXIST(skb) && +- cipso_v4_skbuff_getattr(skb, secattr) == 0) ++ ptr = cipso_v4_optptr(skb); ++ if (ptr && cipso_v4_getattr(ptr, secattr) == 0) + return 0; + break; + #if IS_ENABLED(CONFIG_IPV6) +@@ -1094,7 +1096,7 @@ int netlbl_skbuff_getattr(const struct s + */ + void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway) + { +- if (CIPSO_V4_OPTEXIST(skb)) ++ if (cipso_v4_optptr(skb)) + cipso_v4_error(skb, error, gateway); + } + +@@ -1126,11 +1128,14 @@ void netlbl_cache_invalidate(void) + int netlbl_cache_add(const struct sk_buff *skb, + const struct netlbl_lsm_secattr *secattr) + { ++ unsigned char *ptr; ++ + if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0) + return -ENOMSG; + +- if (CIPSO_V4_OPTEXIST(skb)) +- return cipso_v4_cache_add(skb, secattr); ++ ptr = cipso_v4_optptr(skb); ++ if (ptr) ++ return cipso_v4_cache_add(ptr, secattr); + + return -ENOMSG; + } diff --git a/queue-3.18/cpufreq-s3c-remove-incorrect-__init-annotations.patch b/queue-3.18/cpufreq-s3c-remove-incorrect-__init-annotations.patch new file mode 100644 index 00000000000..eeb30c5b5dd --- /dev/null +++ b/queue-3.18/cpufreq-s3c-remove-incorrect-__init-annotations.patch @@ -0,0 +1,59 @@ +From 61882b63171736571e1139ab5aa929e3bb336016 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 18 Feb 2015 21:55:03 +0100 +Subject: cpufreq: s3c: remove incorrect __init annotations + +From: Arnd Bergmann + +commit 61882b63171736571e1139ab5aa929e3bb336016 upstream. + +The two functions s3c2416_cpufreq_driver_init and s3c_cpufreq_register +are marked init but are called from a context that might be run after +the __init sections are discarded, as the compiler points out: + +WARNING: vmlinux.o(.data+0x1ad9dc): Section mismatch in reference from the variable s3c2416_cpufreq_driver to the function .init.text:s3c2416_cpufreq_driver_init() +WARNING: drivers/built-in.o(.text+0x35b5dc): Section mismatch in reference from the function s3c2410a_cpufreq_add() to the function .init.text:s3c_cpufreq_register() + +This removes the __init markings. + +Signed-off-by: Arnd Bergmann +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/s3c2416-cpufreq.c | 4 ++-- + drivers/cpufreq/s3c24xx-cpufreq.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/cpufreq/s3c2416-cpufreq.c ++++ b/drivers/cpufreq/s3c2416-cpufreq.c +@@ -263,7 +263,7 @@ out: + } + + #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE +-static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq) ++static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq) + { + int count, v, i, found; + struct cpufreq_frequency_table *pos; +@@ -333,7 +333,7 @@ static struct notifier_block s3c2416_cpu + .notifier_call = s3c2416_cpufreq_reboot_notifier_evt, + }; + +-static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) ++static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) + { + struct s3c2416_data *s3c_freq = &s3c2416_cpufreq; + struct cpufreq_frequency_table *pos; +--- a/drivers/cpufreq/s3c24xx-cpufreq.c ++++ b/drivers/cpufreq/s3c24xx-cpufreq.c +@@ -454,7 +454,7 @@ static struct cpufreq_driver s3c24xx_dri + }; + + +-int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info) ++int s3c_cpufreq_register(struct s3c_cpufreq_info *info) + { + if (!info || !info->name) { + printk(KERN_ERR "%s: failed to pass valid information\n", diff --git a/queue-3.18/cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch b/queue-3.18/cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch new file mode 100644 index 00000000000..da91d4aba99 --- /dev/null +++ b/queue-3.18/cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch @@ -0,0 +1,52 @@ +From 67fadaa2768716209ee19a8b8bf05bc3ac399445 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 18 Feb 2015 21:55:53 +0100 +Subject: cpufreq: s3c: remove last use of resume_clocks callback + +From: Arnd Bergmann + +commit 67fadaa2768716209ee19a8b8bf05bc3ac399445 upstream. + +Commit 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code") +already removed the callback pointer, but there was one remaining +user: + +drivers/cpufreq/s3c24xx-cpufreq.c: In function 's3c_cpufreq_resume_clocks': +drivers/cpufreq/s3c24xx-cpufreq.c:149:14: error: 'struct s3c_cpufreq_info' has no member named 'resume_clocks' + cpu_cur.info->resume_clocks(); + ^ + +Signed-off-by: Arnd Bergmann +Fixes: 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code") +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/s3c24xx-cpufreq.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/cpufreq/s3c24xx-cpufreq.c ++++ b/drivers/cpufreq/s3c24xx-cpufreq.c +@@ -144,11 +144,6 @@ static void s3c_cpufreq_setfvco(struct s + (cfg->info->set_fvco)(cfg); + } + +-static inline void s3c_cpufreq_resume_clocks(void) +-{ +- cpu_cur.info->resume_clocks(); +-} +- + static inline void s3c_cpufreq_updateclk(struct clk *clk, + unsigned int freq) + { +@@ -417,9 +412,6 @@ static int s3c_cpufreq_resume(struct cpu + + last_target = ~0; /* invalidate last_target setting */ + +- /* first, find out what speed we resumed at. */ +- s3c_cpufreq_resume_clocks(); +- + /* whilst we will be called later on, we try and re-set the + * cpu frequencies as soon as possible so that we do not end + * up resuming devices and then immediately having to re-set diff --git a/queue-3.18/cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch b/queue-3.18/cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch new file mode 100644 index 00000000000..9ee84aad8c2 --- /dev/null +++ b/queue-3.18/cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch @@ -0,0 +1,128 @@ +From 6ffae8c06fab058d6c3f8ecb7f921327721034e7 Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Sat, 31 Jan 2015 06:02:44 +0530 +Subject: cpufreq: Set cpufreq_cpu_data to NULL before putting kobject + +From: Viresh Kumar + +commit 6ffae8c06fab058d6c3f8ecb7f921327721034e7 upstream. + +In __cpufreq_remove_dev_finish(), per-cpu 'cpufreq_cpu_data' needs +to be cleared before calling kobject_put(&policy->kobj) and under +cpufreq_driver_lock. Otherwise, if someone else calls cpufreq_cpu_get() +in parallel with it, they can obtain a non-NULL policy from that after +kobject_put(&policy->kobj) was executed. + +Consider this case: + +Thread A Thread B +cpufreq_cpu_get() + acquire cpufreq_driver_lock + read-per-cpu cpufreq_cpu_data + kobject_put(&policy->kobj); + kobject_get(&policy->kobj); + ... + per_cpu(&cpufreq_cpu_data, cpu) = NULL + +And this will result in a warning like this one: + + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 4 at include/linux/kref.h:47 + kobject_get+0x41/0x50() + Modules linked in: acpi_cpufreq(+) nfsd auth_rpcgss nfs_acl + lockd grace sunrpc xfs libcrc32c sd_mod ixgbe igb mdio ahci hwmon + ... + Call Trace: + [] dump_stack+0x46/0x58 + [] warn_slowpath_common+0x81/0xa0 + [] warn_slowpath_null+0x1a/0x20 + [] kobject_get+0x41/0x50 + [] cpufreq_cpu_get+0x75/0xc0 + [] cpufreq_update_policy+0x2e/0x1f0 + [] ? up+0x32/0x50 + [] ? acpi_ns_get_node+0xcb/0xf2 + [] ? acpi_evaluate_object+0x22c/0x252 + [] ? acpi_get_handle+0x95/0xc0 + [] ? acpi_has_method+0x25/0x40 + [] acpi_processor_ppc_has_changed+0x77/0x82 + [] ? move_linked_works+0x66/0x90 + [] acpi_processor_notify+0x58/0xe7 + [] acpi_ev_notify_dispatch+0x44/0x5c + [] acpi_os_execute_deferred+0x15/0x22 + [] process_one_work+0x160/0x410 + [] worker_thread+0x11b/0x520 + [] ? rescuer_thread+0x380/0x380 + [] kthread+0xe1/0x100 + [] ? kthread_create_on_node+0x1b0/0x1b0 + [] ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x1b0/0x1b0 + ---[ end trace 89e66eb9795efdf7 ]--- + +The actual code flow is as follows: + + Thread A: Workqueue: kacpi_notify + + acpi_processor_notify() + acpi_processor_ppc_has_changed() + cpufreq_update_policy() + cpufreq_cpu_get() + kobject_get() + + Thread B: xenbus_thread() + + xenbus_thread() + msg->u.watch.handle->callback() + handle_vcpu_hotplug_event() + vcpu_hotplug() + cpu_down() + __cpu_notify(CPU_POST_DEAD..) + cpufreq_cpu_callback() + __cpufreq_remove_dev_finish() + cpufreq_policy_put_kobj() + kobject_put() + +cpufreq_cpu_get() gets the policy from per-cpu variable cpufreq_cpu_data +under cpufreq_driver_lock, and once it gets a valid policy it expects it +to not be freed until cpufreq_cpu_put() is called. + +But the race happens when another thread puts the kobject first and updates +cpufreq_cpu_data before or later. And so the first thread gets a valid policy +structure and before it does kobject_get() on it, the second one has already +done kobject_put(). + +Fix this by setting cpufreq_cpu_data to NULL before putting the kobject and that +too under locks. + +Reported-by: Ethan Zhao +Reported-by: Santosh Shilimkar +Signed-off-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1409,9 +1409,10 @@ static int __cpufreq_remove_dev_finish(s + unsigned long flags; + struct cpufreq_policy *policy; + +- read_lock_irqsave(&cpufreq_driver_lock, flags); ++ write_lock_irqsave(&cpufreq_driver_lock, flags); + policy = per_cpu(cpufreq_cpu_data, cpu); +- read_unlock_irqrestore(&cpufreq_driver_lock, flags); ++ per_cpu(cpufreq_cpu_data, cpu) = NULL; ++ write_unlock_irqrestore(&cpufreq_driver_lock, flags); + + if (!policy) { + pr_debug("%s: No cpu_data found\n", __func__); +@@ -1466,7 +1467,6 @@ static int __cpufreq_remove_dev_finish(s + } + } + +- per_cpu(cpufreq_cpu_data, cpu) = NULL; + return 0; + } + diff --git a/queue-3.18/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch b/queue-3.18/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch new file mode 100644 index 00000000000..d79bf6cc1f1 --- /dev/null +++ b/queue-3.18/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch @@ -0,0 +1,92 @@ +From d4d4eda23794c701442e55129dd4f8f2fefd5e4d Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 9 Feb 2015 13:38:17 -0500 +Subject: cpufreq: speedstep-smi: enable interrupts when waiting + +From: Mikulas Patocka + +commit d4d4eda23794c701442e55129dd4f8f2fefd5e4d upstream. + +On Dell Latitude C600 laptop with Pentium 3 850MHz processor, the +speedstep-smi driver sometimes loads and sometimes doesn't load with +"change to state X failed" message. + +The hardware sometimes refuses to change frequency and in this case, we +need to retry later. I found out that we need to enable interrupts while +waiting. When we enable interrupts, the hardware blockage that prevents +frequency transition resolves and the transition is possible. With +disabled interrupts, the blockage doesn't resolve (no matter how long do +we wait). The exact reasons for this hardware behavior are unknown. + +This patch enables interrupts in the function speedstep_set_state that can +be called with disabled interrupts. However, this function is called with +disabled interrupts only from speedstep_get_freqs, so it shouldn't cause +any problem. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/speedstep-lib.c | 3 +++ + drivers/cpufreq/speedstep-smi.c | 12 ++++++++++++ + 2 files changed, 15 insertions(+) + +--- a/drivers/cpufreq/speedstep-lib.c ++++ b/drivers/cpufreq/speedstep-lib.c +@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum sp + + pr_debug("previous speed is %u\n", prev_speed); + ++ preempt_disable(); + local_irq_save(flags); + + /* switch to low state */ +@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum sp + + out: + local_irq_restore(flags); ++ preempt_enable(); ++ + return ret; + } + EXPORT_SYMBOL_GPL(speedstep_get_freqs); +--- a/drivers/cpufreq/speedstep-smi.c ++++ b/drivers/cpufreq/speedstep-smi.c +@@ -156,6 +156,7 @@ static void speedstep_set_state(unsigned + return; + + /* Disable IRQs */ ++ preempt_disable(); + local_irq_save(flags); + + command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff); +@@ -166,9 +167,19 @@ static void speedstep_set_state(unsigned + + do { + if (retry) { ++ /* ++ * We need to enable interrupts, otherwise the blockage ++ * won't resolve. ++ * ++ * We disable preemption so that other processes don't ++ * run. If other processes were running, they could ++ * submit more DMA requests, making the blockage worse. ++ */ + pr_debug("retry %u, previous result %u, waiting...\n", + retry, result); ++ local_irq_enable(); + mdelay(retry * 50); ++ local_irq_disable(); + } + retry++; + __asm__ __volatile__( +@@ -185,6 +196,7 @@ static void speedstep_set_state(unsigned + + /* enable IRQs */ + local_irq_restore(flags); ++ preempt_enable(); + + if (new_state == state) + pr_debug("change to %u MHz succeeded after %u tries " diff --git a/queue-3.18/em28xx-audio-fix-missing-newlines-again.patch b/queue-3.18/em28xx-audio-fix-missing-newlines-again.patch new file mode 100644 index 00000000000..693423de4aa --- /dev/null +++ b/queue-3.18/em28xx-audio-fix-missing-newlines-again.patch @@ -0,0 +1,46 @@ +From fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:41 -0300 +Subject: [media] em28xx-audio: fix missing newlines, again +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-audio. Fix these. + +Fixes: 6d746f91f230 ("[media] em28xx-audio: implement em28xx_ops: suspend/resume hooks") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-audio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-audio.c ++++ b/drivers/media/usb/em28xx/em28xx-audio.c +@@ -1006,7 +1006,7 @@ static int em28xx_audio_suspend(struct e + if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR) + return 0; + +- em28xx_info("Suspending audio extension"); ++ em28xx_info("Suspending audio extension\n"); + em28xx_deinit_isoc_audio(dev); + atomic_set(&dev->adev.stream_started, 0); + return 0; +@@ -1020,7 +1020,7 @@ static int em28xx_audio_resume(struct em + if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR) + return 0; + +- em28xx_info("Resuming audio extension"); ++ em28xx_info("Resuming audio extension\n"); + /* Nothing to do other than schedule_work() ?? */ + schedule_work(&dev->adev.wq_trigger); + return 0; diff --git a/queue-3.18/em28xx-audio-fix-missing-newlines.patch b/queue-3.18/em28xx-audio-fix-missing-newlines.patch new file mode 100644 index 00000000000..6e281f95c19 --- /dev/null +++ b/queue-3.18/em28xx-audio-fix-missing-newlines.patch @@ -0,0 +1,37 @@ +From 7818b0aab87b680fb10f68eccebeeb6cd8283c73 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:36 -0300 +Subject: [media] em28xx-audio: fix missing newlines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit 7818b0aab87b680fb10f68eccebeeb6cd8283c73 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-audio. Fix these. + +Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/em28xx/em28xx-audio.c ++++ b/drivers/media/usb/em28xx/em28xx-audio.c +@@ -821,7 +821,7 @@ static int em28xx_audio_urb_init(struct + if (urb_size > ep_size * npackets) + npackets = DIV_ROUND_UP(urb_size, ep_size); + +- em28xx_info("Number of URBs: %d, with %d packets and %d size", ++ em28xx_info("Number of URBs: %d, with %d packets and %d size\n", + num_urb, npackets, urb_size); + + /* Estimate the bytes per period */ diff --git a/queue-3.18/em28xx-core-fix-missing-newlines.patch b/queue-3.18/em28xx-core-fix-missing-newlines.patch new file mode 100644 index 00000000000..43ef44ec4e1 --- /dev/null +++ b/queue-3.18/em28xx-core-fix-missing-newlines.patch @@ -0,0 +1,46 @@ +From 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:31 -0300 +Subject: [media] em28xx-core: fix missing newlines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-core. Fix these. + +Fixes: 9c669b731470 ("[media] em28xx: add suspend/resume to em28xx_ops") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-core.c ++++ b/drivers/media/usb/em28xx/em28xx-core.c +@@ -1122,7 +1122,7 @@ int em28xx_suspend_extension(struct em28 + { + const struct em28xx_ops *ops = NULL; + +- em28xx_info("Suspending extensions"); ++ em28xx_info("Suspending extensions\n"); + mutex_lock(&em28xx_devlist_mutex); + list_for_each_entry(ops, &em28xx_extension_devlist, next) { + if (ops->suspend) +@@ -1136,7 +1136,7 @@ int em28xx_resume_extension(struct em28x + { + const struct em28xx_ops *ops = NULL; + +- em28xx_info("Resuming extensions"); ++ em28xx_info("Resuming extensions\n"); + mutex_lock(&em28xx_devlist_mutex); + list_for_each_entry(ops, &em28xx_extension_devlist, next) { + if (ops->resume) diff --git a/queue-3.18/em28xx-dvb-fix-missing-newlines.patch b/queue-3.18/em28xx-dvb-fix-missing-newlines.patch new file mode 100644 index 00000000000..0978da7c903 --- /dev/null +++ b/queue-3.18/em28xx-dvb-fix-missing-newlines.patch @@ -0,0 +1,71 @@ +From a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:46 -0300 +Subject: [media] em28xx-dvb: fix missing newlines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-dvb. Fix these. + +Fixes: ca2b46dacbf5 ("[media] em28xx-dvb: implement em28xx_ops: suspend/resume hooks") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-dvb.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1718,17 +1718,17 @@ static int em28xx_dvb_suspend(struct em2 + if (!dev->board.has_dvb) + return 0; + +- em28xx_info("Suspending DVB extension"); ++ em28xx_info("Suspending DVB extension\n"); + if (dev->dvb) { + struct em28xx_dvb *dvb = dev->dvb; + + if (dvb->fe[0]) { + ret = dvb_frontend_suspend(dvb->fe[0]); +- em28xx_info("fe0 suspend %d", ret); ++ em28xx_info("fe0 suspend %d\n", ret); + } + if (dvb->fe[1]) { + dvb_frontend_suspend(dvb->fe[1]); +- em28xx_info("fe1 suspend %d", ret); ++ em28xx_info("fe1 suspend %d\n", ret); + } + } + +@@ -1745,18 +1745,18 @@ static int em28xx_dvb_resume(struct em28 + if (!dev->board.has_dvb) + return 0; + +- em28xx_info("Resuming DVB extension"); ++ em28xx_info("Resuming DVB extension\n"); + if (dev->dvb) { + struct em28xx_dvb *dvb = dev->dvb; + + if (dvb->fe[0]) { + ret = dvb_frontend_resume(dvb->fe[0]); +- em28xx_info("fe0 resume %d", ret); ++ em28xx_info("fe0 resume %d\n", ret); + } + + if (dvb->fe[1]) { + ret = dvb_frontend_resume(dvb->fe[1]); +- em28xx_info("fe1 resume %d", ret); ++ em28xx_info("fe1 resume %d\n", ret); + } + } + diff --git a/queue-3.18/em28xx-ensure-closing-messages-terminate-with-a-newline.patch b/queue-3.18/em28xx-ensure-closing-messages-terminate-with-a-newline.patch new file mode 100644 index 00000000000..daa522d644a --- /dev/null +++ b/queue-3.18/em28xx-ensure-closing-messages-terminate-with-a-newline.patch @@ -0,0 +1,78 @@ +From 0418ca6073478f54f1da2e4013fa50d36838de75 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:20 -0300 +Subject: [media] em28xx: ensure "closing" messages terminate with a newline +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit 0418ca6073478f54f1da2e4013fa50d36838de75 upstream. + +The lockdep splat addressed in a previous commit revealed that at +least one message in em28xx-input.c was missing a new line: + +em28178 #0: Closing input extensionINFO: trying to register non-static key. + +Further inspection shows several other messages also miss a new line. +These will be fixed in a subsequent patch. + +Fixes: aa929ad783c0 ("[media] em28xx: print a message at disconnect") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-audio.c | 2 +- + drivers/media/usb/em28xx/em28xx-dvb.c | 2 +- + drivers/media/usb/em28xx/em28xx-input.c | 2 +- + drivers/media/usb/em28xx/em28xx-video.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-audio.c ++++ b/drivers/media/usb/em28xx/em28xx-audio.c +@@ -982,7 +982,7 @@ static int em28xx_audio_fini(struct em28 + return 0; + } + +- em28xx_info("Closing audio extension"); ++ em28xx_info("Closing audio extension\n"); + + if (dev->adev.sndcard) { + snd_card_disconnect(dev->adev.sndcard); +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1667,7 +1667,7 @@ static int em28xx_dvb_fini(struct em28xx + if (!dev->dvb) + return 0; + +- em28xx_info("Closing DVB extension"); ++ em28xx_info("Closing DVB extension\n"); + + dvb = dev->dvb; + client = dvb->i2c_client_tuner; +--- a/drivers/media/usb/em28xx/em28xx-input.c ++++ b/drivers/media/usb/em28xx/em28xx-input.c +@@ -833,7 +833,7 @@ static int em28xx_ir_fini(struct em28xx + return 0; + } + +- em28xx_info("Closing input extension"); ++ em28xx_info("Closing input extension\n"); + + em28xx_shutdown_buttons(dev); + +--- a/drivers/media/usb/em28xx/em28xx-video.c ++++ b/drivers/media/usb/em28xx/em28xx-video.c +@@ -1956,7 +1956,7 @@ static int em28xx_v4l2_fini(struct em28x + if (v4l2 == NULL) + return 0; + +- em28xx_info("Closing video extension"); ++ em28xx_info("Closing video extension\n"); + + mutex_lock(&dev->lock); + diff --git a/queue-3.18/em28xx-input-fix-missing-newlines.patch b/queue-3.18/em28xx-input-fix-missing-newlines.patch new file mode 100644 index 00000000000..1fb5f05964f --- /dev/null +++ b/queue-3.18/em28xx-input-fix-missing-newlines.patch @@ -0,0 +1,46 @@ +From ebfd59cf549899a166d595bf1eab7eec3299ebe7 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:26 -0300 +Subject: [media] em28xx-input: fix missing newlines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit ebfd59cf549899a166d595bf1eab7eec3299ebe7 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-input. Fix these. + +Fixes: 5025076aadfe ("[media] em28xx-input: implement em28xx_ops: suspend/resume hooks") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-input.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-input.c ++++ b/drivers/media/usb/em28xx/em28xx-input.c +@@ -863,7 +863,7 @@ static int em28xx_ir_suspend(struct em28 + if (dev->is_audio_only) + return 0; + +- em28xx_info("Suspending input extension"); ++ em28xx_info("Suspending input extension\n"); + if (ir) + cancel_delayed_work_sync(&ir->work); + cancel_delayed_work_sync(&dev->buttons_query_work); +@@ -880,7 +880,7 @@ static int em28xx_ir_resume(struct em28x + if (dev->is_audio_only) + return 0; + +- em28xx_info("Resuming input extension"); ++ em28xx_info("Resuming input extension\n"); + /* if suspend calls ir_raw_event_unregister(), the should call + ir_raw_event_register() */ + if (ir) diff --git a/queue-3.18/em28xx-video-fix-missing-newlines.patch b/queue-3.18/em28xx-video-fix-missing-newlines.patch new file mode 100644 index 00000000000..81615753460 --- /dev/null +++ b/queue-3.18/em28xx-video-fix-missing-newlines.patch @@ -0,0 +1,46 @@ +From 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 20 Dec 2014 09:45:51 -0300 +Subject: [media] em28xx-video: fix missing newlines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King + +commit 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 upstream. + +Inspection shows that newlines are missing from several kernel messages +in em28xx-video. Fix these. + +Fixes: a61f68119af3 ("[media] em28xx-video: implement em28xx_ops: suspend/resume hooks") + +Signed-off-by: Russell King +Reviewed-by: Frank Schäfer +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-video.c ++++ b/drivers/media/usb/em28xx/em28xx-video.c +@@ -2005,7 +2005,7 @@ static int em28xx_v4l2_suspend(struct em + if (!dev->has_video) + return 0; + +- em28xx_info("Suspending video extension"); ++ em28xx_info("Suspending video extension\n"); + em28xx_stop_urbs(dev); + return 0; + } +@@ -2018,7 +2018,7 @@ static int em28xx_v4l2_resume(struct em2 + if (!dev->has_video) + return 0; + +- em28xx_info("Resuming video extension"); ++ em28xx_info("Resuming video extension\n"); + /* what do we do here */ + return 0; + } diff --git a/queue-3.18/fsnotify-fix-handling-of-renames-in-audit.patch b/queue-3.18/fsnotify-fix-handling-of-renames-in-audit.patch new file mode 100644 index 00000000000..229873d0e62 --- /dev/null +++ b/queue-3.18/fsnotify-fix-handling-of-renames-in-audit.patch @@ -0,0 +1,79 @@ +From 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 10 Feb 2015 14:08:32 -0800 +Subject: fsnotify: fix handling of renames in audit + +From: Jan Kara + +commit 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab upstream. + +Commit e9fd702a58c4 ("audit: convert audit watches to use fsnotify +instead of inotify") broke handling of renames in audit. Audit code +wants to update inode number of an inode corresponding to watched name +in a directory. When something gets renamed into a directory to a +watched name, inotify previously passed moved inode to audit code +however new fsnotify code passes directory inode where the change +happened. That confuses audit and it starts watching parent directory +instead of a file in a directory. + +This can be observed for example by doing: + + cd /tmp + touch foo bar + auditctl -w /tmp/foo + touch foo + mv bar foo + touch foo + +In audit log we see events like: + + type=CONFIG_CHANGE msg=audit(1423563584.155:90): auid=1000 ses=2 op="updated rules" path="/tmp/foo" key=(null) list=4 res=1 + ... + type=PATH msg=audit(1423563584.155:91): item=2 name="bar" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE + type=PATH msg=audit(1423563584.155:91): item=3 name="foo" inode=1046842 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE + type=PATH msg=audit(1423563584.155:91): item=4 name="foo" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE + ... + +and that's it - we see event for the first touch after creating the +audit rule, we see events for rename but we don't see any event for the +last touch. However we start seeing events for unrelated stuff +happening in /tmp. + +Fix the problem by passing moved inode as data in the FS_MOVED_FROM and +FS_MOVED_TO events instead of the directory where the change happens. +This doesn't introduce any new problems because noone besides +audit_watch.c cares about the passed value: + + fs/notify/fanotify/fanotify.c cares only about FSNOTIFY_EVENT_PATH events. + fs/notify/dnotify/dnotify.c doesn't care about passed 'data' value at all. + fs/notify/inotify/inotify_fsnotify.c uses 'data' only for FSNOTIFY_EVENT_PATH. + kernel/audit_tree.c doesn't care about passed 'data' at all. + kernel/audit_watch.c expects moved inode as 'data'. + +Fixes: e9fd702a58c49db ("audit: convert audit watches to use fsnotify instead of inotify") +Signed-off-by: Jan Kara +Cc: Paul Moore +Cc: Eric Paris +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/fsnotify.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/include/linux/fsnotify.h ++++ b/include/linux/fsnotify.h +@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct + new_dir_mask |= FS_ISDIR; + } + +- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie); +- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie); ++ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name, ++ fs_cookie); ++ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name, ++ fs_cookie); + + if (target) + fsnotify_link_count(target); diff --git a/queue-3.18/hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch b/queue-3.18/hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch new file mode 100644 index 00000000000..91d20866ba4 --- /dev/null +++ b/queue-3.18/hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch @@ -0,0 +1,41 @@ +From 6d00f37e49d95e640a3937a4a1ae07dbe92a10cb Mon Sep 17 00:00:00 2001 +From: Seth Forshee +Date: Fri, 20 Feb 2015 11:45:11 -0600 +Subject: HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events + +From: Seth Forshee + +commit 6d00f37e49d95e640a3937a4a1ae07dbe92a10cb upstream. + +d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ) +changed hid_get_input() to read ihid->bufsize bytes, which can be +more than wMaxInputLength. This is the case with the Dell XPS 13 +9343, and it is causing events to be missed. In some cases the +missed events are releases, which can cause the cursor to jump or +freeze, among other problems. Limit the number of bytes read to +min(wMaxInputLength, ihid->bufsize) to prevent such problems. + +Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ" +Signed-off-by: Seth Forshee +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/i2c-hid/i2c-hid.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_cl + static void i2c_hid_get_input(struct i2c_hid *ihid) + { + int ret, ret_size; +- int size = ihid->bufsize; ++ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength); ++ ++ if (size > ihid->bufsize) ++ size = ihid->bufsize; + + ret = i2c_master_recv(ihid->client, ihid->inbuf, size); + if (ret != size) { diff --git a/queue-3.18/iscsi-target-drop-problematic-active_ts_list-usage.patch b/queue-3.18/iscsi-target-drop-problematic-active_ts_list-usage.patch new file mode 100644 index 00000000000..c47d56a5788 --- /dev/null +++ b/queue-3.18/iscsi-target-drop-problematic-active_ts_list-usage.patch @@ -0,0 +1,133 @@ +From 3fd7b60f2c7418239d586e359e0c6d8503e10646 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 22 Jan 2015 00:56:53 -0800 +Subject: iscsi-target: Drop problematic active_ts_list usage + +From: Nicholas Bellinger + +commit 3fd7b60f2c7418239d586e359e0c6d8503e10646 upstream. + +This patch drops legacy active_ts_list usage within iscsi_target_tq.c +code. It was originally used to track the active thread sets during +iscsi-target shutdown, and is no longer used by modern upstream code. + +Two people have reported list corruption using traditional iscsi-target +and iser-target with the following backtrace, that appears to be related +to iscsi_thread_set->ts_list being used across both active_ts_list and +inactive_ts_list. + +[ 60.782534] ------------[ cut here ]------------ +[ 60.782543] WARNING: CPU: 0 PID: 9430 at lib/list_debug.c:53 __list_del_entry+0x63/0xd0() +[ 60.782545] list_del corruption, ffff88045b00d180->next is LIST_POISON1 (dead000000100100) +[ 60.782546] Modules linked in: ib_srpt tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc scsi_tgt ib_isert rdma_cm iw_cm ib_addr iscsi_target_mod target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge stp llc autofs4 sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ib_ipoib ib_cm ib_uverbs ib_umad mlx4_en mlx4_ib ib_sa ib_mad ib_core mlx4_core dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support microcode serio_raw pcspkr sb_edac edac_core sg i2c_i801 lpc_ich mfd_core mtip32xx igb i2c_algo_bit i2c_core ptp pps_core ioatdma dca wmi ext3(F) jbd(F) mbcache(F) sd_mod(F) crc_t10dif(F) crct10dif_common(F) ahci(F) libahci(F) isci(F) libsas(F) scsi_transport_sas(F) [last unloaded: speedstep_lib] +[ 60.782597] CPU: 0 PID: 9430 Comm: iscsi_ttx Tainted: GF 3.12.19+ #2 +[ 60.782598] Hardware name: Supermicro X9DRX+-F/X9DRX+-F, BIOS 3.00 07/09/2013 +[ 60.782599] 0000000000000035 ffff88044de31d08 ffffffff81553ae7 0000000000000035 +[ 60.782602] ffff88044de31d58 ffff88044de31d48 ffffffff8104d1cc 0000000000000002 +[ 60.782605] ffff88045b00d180 ffff88045b00d0c0 ffff88045b00d0c0 ffff88044de31e58 +[ 60.782607] Call Trace: +[ 60.782611] [] dump_stack+0x49/0x62 +[ 60.782615] [] warn_slowpath_common+0x8c/0xc0 +[ 60.782618] [] warn_slowpath_fmt+0x46/0x50 +[ 60.782620] [] __list_del_entry+0x63/0xd0 +[ 60.782622] [] list_del+0x11/0x40 +[ 60.782630] [] iscsi_del_ts_from_active_list+0x29/0x50 [iscsi_target_mod] +[ 60.782635] [] iscsi_tx_thread_pre_handler+0xa1/0x180 [iscsi_target_mod] +[ 60.782642] [] iscsi_target_tx_thread+0x4e/0x220 [iscsi_target_mod] +[ 60.782647] [] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod] +[ 60.782652] [] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod] +[ 60.782655] [] kthread+0xce/0xe0 +[ 60.782657] [] ? kthread_freezable_should_stop+0x70/0x70 +[ 60.782660] [] ret_from_fork+0x7c/0xb0 +[ 60.782662] [] ? kthread_freezable_should_stop+0x70/0x70 +[ 60.782663] ---[ end trace 9662f4a661d33965 ]--- + +Since this code is no longer used, go ahead and drop the problematic usage +all-together. + +Reported-by: Gavin Guo +Reported-by: Moussa Ba +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_tq.c | 28 +++++----------------------- + 1 file changed, 5 insertions(+), 23 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_tq.c ++++ b/drivers/target/iscsi/iscsi_target_tq.c +@@ -24,36 +24,22 @@ + #include "iscsi_target_tq.h" + #include "iscsi_target.h" + +-static LIST_HEAD(active_ts_list); + static LIST_HEAD(inactive_ts_list); +-static DEFINE_SPINLOCK(active_ts_lock); + static DEFINE_SPINLOCK(inactive_ts_lock); + static DEFINE_SPINLOCK(ts_bitmap_lock); + +-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts) +-{ +- spin_lock(&active_ts_lock); +- list_add_tail(&ts->ts_list, &active_ts_list); +- iscsit_global->active_ts++; +- spin_unlock(&active_ts_lock); +-} +- + static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts) + { ++ if (!list_empty(&ts->ts_list)) { ++ WARN_ON(1); ++ return; ++ } + spin_lock(&inactive_ts_lock); + list_add_tail(&ts->ts_list, &inactive_ts_list); + iscsit_global->inactive_ts++; + spin_unlock(&inactive_ts_lock); + } + +-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts) +-{ +- spin_lock(&active_ts_lock); +- list_del(&ts->ts_list); +- iscsit_global->active_ts--; +- spin_unlock(&active_ts_lock); +-} +- + static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) + { + struct iscsi_thread_set *ts; +@@ -66,7 +52,7 @@ static struct iscsi_thread_set *iscsi_ge + + ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list); + +- list_del(&ts->ts_list); ++ list_del_init(&ts->ts_list); + iscsit_global->inactive_ts--; + spin_unlock(&inactive_ts_lock); + +@@ -204,8 +190,6 @@ static void iscsi_deallocate_extra_threa + + void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts) + { +- iscsi_add_ts_to_active_list(ts); +- + spin_lock_bh(&ts->ts_state_lock); + conn->thread_set = ts; + ts->conn = conn; +@@ -397,7 +381,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_h + + if (ts->delay_inactive && (--ts->thread_count == 0)) { + spin_unlock_bh(&ts->ts_state_lock); +- iscsi_del_ts_from_active_list(ts); + + if (!iscsit_global->in_shutdown) + iscsi_deallocate_extra_thread_sets(); +@@ -452,7 +435,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_h + + if (ts->delay_inactive && (--ts->thread_count == 0)) { + spin_unlock_bh(&ts->ts_state_lock); +- iscsi_del_ts_from_active_list(ts); + + if (!iscsit_global->in_shutdown) + iscsi_deallocate_extra_thread_sets(); diff --git a/queue-3.18/iwlwifi-mvm-always-use-mac-color-zero.patch b/queue-3.18/iwlwifi-mvm-always-use-mac-color-zero.patch new file mode 100644 index 00000000000..2526b171bd1 --- /dev/null +++ b/queue-3.18/iwlwifi-mvm-always-use-mac-color-zero.patch @@ -0,0 +1,37 @@ +From 5523d11cc46393a1e61b7ef4a0b2d4e7ed9521e4 Mon Sep 17 00:00:00 2001 +From: Luciano Coelho +Date: Thu, 29 Jan 2015 12:48:20 +0200 +Subject: iwlwifi: mvm: always use mac color zero + +From: Luciano Coelho + +commit 5523d11cc46393a1e61b7ef4a0b2d4e7ed9521e4 upstream. + +We don't really need to use different mac colors when adding mac +contexts, because they're not used anywhere. In fact, the firmware +doesn't accept 255 as a valid color, so we get into a SYSASSERT 0x3401 +when we reach that. + +Remove the color increment to use always zero and avoid reaching 255. + +Signed-off-by: Luciano Coelho +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/mac80211.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -668,9 +668,6 @@ static void iwl_mvm_cleanup_iterator(voi + mvmvif->uploaded = false; + mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT; + +- /* does this make sense at all? */ +- mvmvif->color++; +- + spin_lock_bh(&mvm->time_event_lock); + iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data); + spin_unlock_bh(&mvm->time_event_lock); diff --git a/queue-3.18/iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch b/queue-3.18/iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch new file mode 100644 index 00000000000..152a8dc98d7 --- /dev/null +++ b/queue-3.18/iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch @@ -0,0 +1,33 @@ +From fd66fc1cafd72ddf27dbec3a5e29e99839d1bc84 Mon Sep 17 00:00:00 2001 +From: Luciano Coelho +Date: Tue, 27 Jan 2015 15:06:57 +0200 +Subject: iwlwifi: mvm: fix failure path when power_update fails in add_interface + +From: Luciano Coelho + +commit fd66fc1cafd72ddf27dbec3a5e29e99839d1bc84 upstream. + +When iwl_mvm_power_update_mac() is called, we have already added the +mac context, so if this call fails we should remove the mac. + +Fixes: commit e5e7aa8e2561 ('iwlwifi: mvm: refactor power code') +Signed-off-by: Luciano Coelho +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -1014,7 +1014,7 @@ static int iwl_mvm_mac_add_interface(str + + ret = iwl_mvm_power_update_mac(mvm); + if (ret) +- goto out_release; ++ goto out_remove_mac; + + /* beacon filtering */ + ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0); diff --git a/queue-3.18/iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch b/queue-3.18/iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch new file mode 100644 index 00000000000..c5294860059 --- /dev/null +++ b/queue-3.18/iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch @@ -0,0 +1,35 @@ +From 2cee4762c528a9bd2cdff793197bf591a2196c11 Mon Sep 17 00:00:00 2001 +From: Eyal Shapira +Date: Fri, 16 Jan 2015 11:09:30 +0200 +Subject: iwlwifi: mvm: validate tid and sta_id in ba_notif + +From: Eyal Shapira + +commit 2cee4762c528a9bd2cdff793197bf591a2196c11 upstream. + +These are coming from the FW and are used to access arrays. +Bad values can cause an out of bounds access so discard +such ba_notifs and warn. + +Signed-off-by: Eyal Shapira +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/tx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c +@@ -902,6 +902,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm * + sta_id = ba_notif->sta_id; + tid = ba_notif->tid; + ++ if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT || ++ tid >= IWL_MAX_TID_COUNT, ++ "sta_id %d tid %d", sta_id, tid)) ++ return 0; ++ + rcu_read_lock(); + + sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]); diff --git a/queue-3.18/iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch b/queue-3.18/iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch new file mode 100644 index 00000000000..72595db9b36 --- /dev/null +++ b/queue-3.18/iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch @@ -0,0 +1,53 @@ +From cd8f438405032ac8ff88bd8f2eca5e0c0063b14b Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 29 Jan 2015 21:34:00 +0200 +Subject: iwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN + +From: Emmanuel Grumbach + +commit cd8f438405032ac8ff88bd8f2eca5e0c0063b14b upstream. + +The base address of the scheduler in the device's memory +(SRAM) comes from two different sources. The periphery +register and the alive notification from the firmware. +We have a check in iwl_pcie_tx_start that ensures that +they are the same. +When we resume from WoWLAN, the firmware may have crashed +for whatever reason. In that case, the whole device may be +reset which means that the periphery register will hold a +meaningless value. When we come to compare +trans_pcie->scd_base_addr (which really holds the value we +had when we loaded the WoWLAN firmware upon suspend) and +the current value of the register, we don't see a match +unsurprisingly. +Trick the check to avoid a loud yet harmless WARN. +Note that when the WoWLAN has crashed, we will see that +in iwl_trans_pcie_d3_resume which will let the op_mode +know. Once the op_mode is informed that the WowLAN firmware +has crashed, it can't do much besides resetting the whole +device. + +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/tx.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c +@@ -722,7 +722,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_ + iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG, + trans_pcie->kw.dma >> 4); + +- iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr); ++ /* ++ * Send 0 as the scd_base_addr since the device may have be reset ++ * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will ++ * contain garbage. ++ */ ++ iwl_pcie_tx_start(trans, 0); + } + + /* diff --git a/queue-3.18/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch b/queue-3.18/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch new file mode 100644 index 00000000000..3a5f5fb06aa --- /dev/null +++ b/queue-3.18/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch @@ -0,0 +1,37 @@ +From 146755923262037fc4c54abc28c04b1103f3cc51 Mon Sep 17 00:00:00 2001 +From: Jay Lan +Date: Mon, 29 Sep 2014 15:36:57 -0700 +Subject: kdb: fix incorrect counts in KDB summary command output + +From: Jay Lan + +commit 146755923262037fc4c54abc28c04b1103f3cc51 upstream. + +The output of KDB 'summary' command should report MemTotal, MemFree +and Buffers output in kB. Current codes report in unit of pages. + +A define of K(x) as +is defined in the code, but not used. + +This patch would apply the define to convert the values to kB. +Please include me on Cc on replies. I do not subscribe to linux-kernel. + +Signed-off-by: Jay Lan +Signed-off-by: Jason Wessel +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/debug/kdb/kdb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -2535,7 +2535,7 @@ static int kdb_summary(int argc, const c + #define K(x) ((x) << (PAGE_SHIFT - 10)) + kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n" + "Buffers: %8lu kB\n", +- val.totalram, val.freeram, val.bufferram); ++ K(val.totalram), K(val.freeram), K(val.bufferram)); + return 0; + } + diff --git a/queue-3.18/kvm-mips-disable-htw-while-in-guest.patch b/queue-3.18/kvm-mips-disable-htw-while-in-guest.patch new file mode 100644 index 00000000000..9ecc3b1f040 --- /dev/null +++ b/queue-3.18/kvm-mips-disable-htw-while-in-guest.patch @@ -0,0 +1,83 @@ +From c4c6f2cad9e1d4cc076bc183c3689cc9e7019c75 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Wed, 4 Feb 2015 10:52:03 +0000 +Subject: KVM: MIPS: Disable HTW while in guest + +From: James Hogan + +commit c4c6f2cad9e1d4cc076bc183c3689cc9e7019c75 upstream. + +Ensure any hardware page table walker (HTW) is disabled while in KVM +guest mode, as KVM doesn't yet set up hardware page table walking for +guest mappings so the wrong mappings would get loaded, resulting in the +guest hanging or crashing once it reaches userland. + +The HTW is disabled and re-enabled around the call to +__kvm_mips_vcpu_run() which does the initial switch into guest mode and +the final switch out of guest context. Additionally it is enabled for +the duration of guest exits (i.e. kvm_mips_handle_exit()), getting +disabled again before returning back to guest or host. + +In all cases the HTW is only disabled in normal kernel mode while +interrupts are disabled, so that the HTW doesn't get left disabled if +the process is preempted. + +Signed-off-by: James Hogan +Cc: Paolo Bonzini +Cc: Ralf Baechle +Cc: Markos Chandras +Cc: Gleb Natapov +Cc: kvm@vger.kernel.org +Cc: linux-mips@linux-mips.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kvm/mips.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include + +@@ -385,8 +386,14 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + + kvm_guest_enter(); + ++ /* Disable hardware page table walking while in guest */ ++ htw_stop(); ++ + r = __kvm_mips_vcpu_run(run, vcpu); + ++ /* Re-enable HTW before enabling interrupts */ ++ htw_start(); ++ + kvm_guest_exit(); + local_irq_enable(); + +@@ -1002,6 +1009,9 @@ int kvm_mips_handle_exit(struct kvm_run + enum emulation_result er = EMULATE_DONE; + int ret = RESUME_GUEST; + ++ /* re-enable HTW before enabling interrupts */ ++ htw_start(); ++ + /* Set a default exit reason */ + run->exit_reason = KVM_EXIT_UNKNOWN; + run->ready_for_interrupt_injection = 1; +@@ -1136,6 +1146,9 @@ skip_emul: + } + } + ++ /* Disable HTW before returning to guest or host */ ++ htw_stop(); ++ + return ret; + } + diff --git a/queue-3.18/kvm-mips-don-t-leak-fpu-dsp-to-guest.patch b/queue-3.18/kvm-mips-don-t-leak-fpu-dsp-to-guest.patch new file mode 100644 index 00000000000..2b7e45f476e --- /dev/null +++ b/queue-3.18/kvm-mips-don-t-leak-fpu-dsp-to-guest.patch @@ -0,0 +1,92 @@ +From f798217dfd038af981a18bbe4bc57027a08bb182 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Wed, 4 Feb 2015 17:06:37 +0000 +Subject: KVM: MIPS: Don't leak FPU/DSP to guest + +From: James Hogan + +commit f798217dfd038af981a18bbe4bc57027a08bb182 upstream. + +The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by +kvm_mips_set_c0_status() on a guest exit, presumably in case there is +active state that needs saving if pre-emption occurs. However neither of +these bits are cleared again when returning to the guest. + +This effectively gives the guest access to the FPU/DSP hardware after +the first guest exit even though it is not aware of its presence, +allowing FP instructions in guest user code to intermittently actually +execute instead of trapping into the guest OS for emulation. It will +then read & manipulate the hardware FP registers which technically +belong to the user process (e.g. QEMU), or are stale from another user +process. It can also crash the guest OS by causing an FP exception, for +which a guest exception handler won't have been registered. + +First lets save and disable the FPU (and MSA) state with lose_fpu(1) +before entering the guest. This simplifies the problem, especially for +when guest FPU/MSA support is added in the future, and prevents FR=1 FPU +state being live when the FR bit gets cleared for the guest, which +according to the architecture causes the contents of the FPU and vector +registers to become UNPREDICTABLE. + +We can then safely remove the enabling of the FPU in +kvm_mips_set_c0_status(), since there should never be any active FPU or +MSA state to save at pre-emption, which should plug the FPU leak. + +DSP state is always live rather than being lazily restored, so for that +it is simpler to just clear the MX bit again when re-entering the guest. + +Signed-off-by: James Hogan +Cc: Paolo Bonzini +Cc: Ralf Baechle +Cc: Sanjay Lal +Cc: Gleb Natapov +Cc: kvm@vger.kernel.org +Cc: linux-mips@linux-mips.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kvm/locore.S | 2 +- + arch/mips/kvm/mips.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/kvm/locore.S ++++ b/arch/mips/kvm/locore.S +@@ -434,7 +434,7 @@ __kvm_mips_return_to_guest: + /* Setup status register for running guest in UM */ + .set at + or v1, v1, (ST0_EXL | KSU_USER | ST0_IE) +- and v1, v1, ~ST0_CU0 ++ and v1, v1, ~(ST0_CU0 | ST0_MX) + .set noat + mtc0 v1, CP0_STATUS + ehb +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -379,6 +380,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + vcpu->mmio_needed = 0; + } + ++ lose_fpu(1); ++ + local_irq_disable(); + /* Check if we have any exceptions/interrupts pending */ + kvm_mips_deliver_interrupts(vcpu, +@@ -987,9 +990,6 @@ static void kvm_mips_set_c0_status(void) + { + uint32_t status = read_c0_status(); + +- if (cpu_has_fpu) +- status |= (ST0_CU1); +- + if (cpu_has_dsp) + status |= (ST0_MX); + diff --git a/queue-3.18/lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch b/queue-3.18/lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch new file mode 100644 index 00000000000..0e14b3be501 --- /dev/null +++ b/queue-3.18/lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch @@ -0,0 +1,45 @@ +From 15e1ce33182d1d5dbd8efe8d382b9352dc857527 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 2 Jan 2015 10:56:28 -0300 +Subject: [media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb + +From: Malcolm Priestley + +commit 15e1ce33182d1d5dbd8efe8d382b9352dc857527 upstream. + +A quirk of some older firmwares that report endpoint pipe type as PIPE_BULK +but the endpoint otheriwse functions as interrupt. + +Check if usb_endpoint_type is USB_ENDPOINT_XFER_BULK and set as usb_rcvbulkpipe. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -354,6 +354,7 @@ static int lme2510_int_read(struct dvb_u + { + struct dvb_usb_device *d = adap_to_d(adap); + struct lme2510_state *lme_int = adap_to_priv(adap); ++ struct usb_host_endpoint *ep; + + lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC); + +@@ -375,6 +376,12 @@ static int lme2510_int_read(struct dvb_u + adap, + 8); + ++ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ ++ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); ++ ++ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) ++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa), ++ + lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + + usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC); diff --git a/queue-3.18/lmedm04-increase-interupt-due-time-to-200-msec.patch b/queue-3.18/lmedm04-increase-interupt-due-time-to-200-msec.patch new file mode 100644 index 00000000000..249657406ef --- /dev/null +++ b/queue-3.18/lmedm04-increase-interupt-due-time-to-200-msec.patch @@ -0,0 +1,38 @@ +From cfcd7b825892cb498c6bcb13257f2141f7eacb76 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 2 Jan 2015 10:56:27 -0300 +Subject: [media] lmedm04: Increase Interupt due time to 200 msec + +From: Malcolm Priestley + +commit cfcd7b825892cb498c6bcb13257f2141f7eacb76 upstream. + +Ocassionally the device fails to report back an interrupt urb status which +results in false no lock trigger on the RS2000 demodulator. + +Increase time from 60 msecs to 200 msecs. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -344,9 +344,10 @@ static void lme2510_int_response(struct + + usb_submit_urb(lme_urb, GFP_ATOMIC); + +- /* interrupt urb is due every 48 msecs while streaming +- * add 12msecs for system lag */ +- st->int_urb_due = jiffies + msecs_to_jiffies(60); ++ /* Interrupt urb is due every 48 msecs while streaming the buffer ++ * stores up to 4 periods if missed. Allow 200 msec for next interrupt. ++ */ ++ st->int_urb_due = jiffies + msecs_to_jiffies(200); + } + + static int lme2510_int_read(struct dvb_usb_adapter *adap) diff --git a/queue-3.18/megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch b/queue-3.18/megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch new file mode 100644 index 00000000000..a60678eb488 --- /dev/null +++ b/queue-3.18/megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch @@ -0,0 +1,42 @@ +From c2ced1719a1b903350955a511e1666e6d05a7f5b Mon Sep 17 00:00:00 2001 +From: "Sumit.Saxena@avagotech.com" +Date: Mon, 5 Jan 2015 20:06:13 +0530 +Subject: megaraid_sas: disable interrupt_mask before enabling hardware interrupts + +From: "Sumit.Saxena@avagotech.com" + +commit c2ced1719a1b903350955a511e1666e6d05a7f5b upstream. + +Update driver "mask_interrupts" before enable/disable hardware interrupt +in order to avoid missing interrupts because of "mask_interrupts" still +set to 1 and hardware interrupts are enabled. + +Signed-off-by: Sumit Saxena +Signed-off-by: Chaitra Basappa +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -101,6 +101,8 @@ megasas_enable_intr_fusion(struct megasa + { + struct megasas_register_set __iomem *regs; + regs = instance->reg_set; ++ ++ instance->mask_interrupts = 0; + /* For Thunderbolt/Invader also clear intr on enable */ + writel(~0, ®s->outbound_intr_status); + readl(®s->outbound_intr_status); +@@ -109,7 +111,6 @@ megasas_enable_intr_fusion(struct megasa + + /* Dummy readl to force pci flush */ + readl(®s->outbound_intr_mask); +- instance->mask_interrupts = 0; + } + + /** diff --git a/queue-3.18/megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch b/queue-3.18/megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch new file mode 100644 index 00000000000..47cec881032 --- /dev/null +++ b/queue-3.18/megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch @@ -0,0 +1,180 @@ +From 200aed582d6170a2687cd69095469b663f69f16f Mon Sep 17 00:00:00 2001 +From: "Sumit.Saxena@avagotech.com" +Date: Mon, 5 Jan 2015 20:05:58 +0530 +Subject: megaraid_sas: endianness related bug fixes and code optimization + +From: "Sumit.Saxena@avagotech.com" + +commit 200aed582d6170a2687cd69095469b663f69f16f upstream. + +This patch addresses below issues: + +1) Few endianness bug fixes. +2) Break the iteration after (MAX_LOGICAL_DRIVES_EXT - 1)), + instead of MAX_LOGICAL_DRIVES_EXT. +3) Optimization in MFI INIT frame before firing. +4) MFI IO frame should be 256bytes aligned. Code is optimized to reduce + the size of frame for fusion adapters and make the MFI frame size + calculation a bit transparent and readable. + +Signed-off-by: Kashyap Desai +Signed-off-by: Sumit Saxena +Signed-off-by: Chaitra Basappa +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 24 +++++++++++------------- + drivers/scsi/megaraid/megaraid_sas_fp.c | 14 ++++++++------ + drivers/scsi/megaraid/megaraid_sas_fusion.c | 7 +++---- + drivers/scsi/megaraid/megaraid_sas_fusion.h | 9 ++------- + 4 files changed, 24 insertions(+), 30 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3556,7 +3556,6 @@ static int megasas_create_frame_pool(str + int i; + u32 max_cmd; + u32 sge_sz; +- u32 sgl_sz; + u32 total_sz; + u32 frame_count; + struct megasas_cmd *cmd; +@@ -3575,24 +3574,23 @@ static int megasas_create_frame_pool(str + } + + /* +- * Calculated the number of 64byte frames required for SGL ++ * For MFI controllers. ++ * max_num_sge = 60 ++ * max_sge_sz = 16 byte (sizeof megasas_sge_skinny) ++ * Total 960 byte (15 MFI frame of 64 byte) ++ * ++ * Fusion adapter require only 3 extra frame. ++ * max_num_sge = 16 (defined as MAX_IOCTL_SGE) ++ * max_sge_sz = 12 byte (sizeof megasas_sge64) ++ * Total 192 byte (3 MFI frame of 64 byte) + */ +- sgl_sz = sge_sz * instance->max_num_sge; +- frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE; +- frame_count = 15; +- +- /* +- * We need one extra frame for the MFI command +- */ +- frame_count++; +- ++ frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1); + total_sz = MEGAMFI_FRAME_SIZE * frame_count; + /* + * Use DMA pool facility provided by PCI layer + */ + instance->frame_dma_pool = pci_pool_create("megasas frame pool", +- instance->pdev, total_sz, 64, +- 0); ++ instance->pdev, total_sz, 256, 0); + + if (!instance->frame_dma_pool) { + printk(KERN_DEBUG "megasas: failed to setup frame pool\n"); +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -170,6 +170,7 @@ void MR_PopulateDrvRaidMap(struct megasa + struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL; + struct MR_FW_RAID_MAP *pFwRaidMap = NULL; + int i; ++ u16 ld_count; + + + struct MR_DRV_RAID_MAP_ALL *drv_map = +@@ -189,9 +190,10 @@ void MR_PopulateDrvRaidMap(struct megasa + fw_map_old = (struct MR_FW_RAID_MAP_ALL *) + fusion->ld_map[(instance->map_id & 1)]; + pFwRaidMap = &fw_map_old->raidMap; ++ ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount); + + #if VD_EXT_DEBUG +- for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) { ++ for (i = 0; i < ld_count; i++) { + dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x " + "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n", + instance->unique_id, i, +@@ -203,12 +205,12 @@ void MR_PopulateDrvRaidMap(struct megasa + + memset(drv_map, 0, fusion->drv_map_sz); + pDrvRaidMap->totalSize = pFwRaidMap->totalSize; +- pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount; ++ pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); + pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec; + for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++) + pDrvRaidMap->ldTgtIdToLd[i] = + (u8)pFwRaidMap->ldTgtIdToLd[i]; +- for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) { ++ for (i = 0; i < ld_count; i++) { + pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i]; + #if VD_EXT_DEBUG + dev_dbg(&instance->pdev->dev, +@@ -250,7 +252,7 @@ u8 MR_ValidateMapInfo(struct megasas_ins + struct LD_LOAD_BALANCE_INFO *lbInfo; + PLD_SPAN_INFO ldSpanInfo; + struct MR_LD_RAID *raid; +- int ldCount, num_lds; ++ u16 ldCount, num_lds; + u16 ld; + u32 expected_size; + +@@ -354,7 +356,7 @@ static int getSpanInfo(struct MR_DRV_RAI + + for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) { + ld = MR_TargetIdToLdGet(ldCount, map); +- if (ld >= MAX_LOGICAL_DRIVES_EXT) ++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) + continue; + raid = MR_LdRaidGet(ld, map); + dev_dbg(&instance->pdev->dev, "LD %x: span_depth=%x\n", +@@ -1155,7 +1157,7 @@ void mr_update_span_set(struct MR_DRV_RA + + for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) { + ld = MR_TargetIdToLdGet(ldCount, map); +- if (ld >= MAX_LOGICAL_DRIVES_EXT) ++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) + continue; + raid = MR_LdRaidGet(ld, map); + for (element = 0; element < MAX_QUAD_DEPTH; element++) { +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -696,12 +696,11 @@ megasas_ioc_init_fusion(struct megasas_i + cpu_to_le32(lower_32_bits(ioc_init_handle)); + init_frame->data_xfer_len = cpu_to_le32(sizeof(struct MPI2_IOC_INIT_REQUEST)); + +- req_desc.Words = 0; ++ req_desc.u.low = cpu_to_le32(lower_32_bits(cmd->frame_phys_addr)); ++ req_desc.u.high = cpu_to_le32(upper_32_bits(cmd->frame_phys_addr)); + req_desc.MFAIo.RequestFlags = + (MEGASAS_REQ_DESCRIPT_FLAGS_MFA << +- MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); +- cpu_to_le32s((u32 *)&req_desc.MFAIo); +- req_desc.Words |= cpu_to_le64(cmd->frame_phys_addr); ++ MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); + + /* + * disable the intr before firing the init frame +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h +@@ -304,14 +304,9 @@ struct MPI2_RAID_SCSI_IO_REQUEST { + * MPT RAID MFA IO Descriptor. + */ + struct MEGASAS_RAID_MFA_IO_REQUEST_DESCRIPTOR { +-#if defined(__BIG_ENDIAN_BITFIELD) +- u32 MessageAddress1:24; /* bits 31:8*/ + u32 RequestFlags:8; +-#else +- u32 RequestFlags:8; +- u32 MessageAddress1:24; /* bits 31:8*/ +-#endif +- u32 MessageAddress2; /* bits 61:32 */ ++ u32 MessageAddress1:24; ++ u32 MessageAddress2; + }; + + /* Default Request Descriptor */ diff --git a/queue-3.18/megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch b/queue-3.18/megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch new file mode 100644 index 00000000000..afb16947e1a --- /dev/null +++ b/queue-3.18/megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch @@ -0,0 +1,67 @@ +From ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 Mon Sep 17 00:00:00 2001 +From: "Sumit.Saxena@avagotech.com" +Date: Mon, 5 Jan 2015 20:06:08 +0530 +Subject: megaraid_sas: fix the problem of non-existing VD exposed to host + +From: "Sumit.Saxena@avagotech.com" + +commit ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 upstream. + +This patch will address the issue of SCSI device created at OS level for +non existing VD. ldTgtIdtoLd[] array has size 256 for Extended VD firmware +and 128 for legacy firmware. Accessing indices beyond array size (OS will +send TUR, INQUIRY.. commands upto device index 255), may return valid LD +value and that particular SCSI command will be SUCCESS and creating SCSI +device for non existing target(VD). + +For legacy firmware (64 VD firmware), invalidates LD (by setting LD value +to 0xff) in LdTgtIdtoLd[] array for device index beyond 127, so that +invalid LD(0xff) value should be returned beyond device index beyond 127. + +Signed-off-by: Kashyap Desai +Signed-off-by: Sumit Saxena +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_fp.c | 3 +++ + drivers/scsi/megaraid/megaraid_sas_fusion.c | 14 ++++++++++++-- + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -210,6 +210,9 @@ void MR_PopulateDrvRaidMap(struct megasa + for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++) + pDrvRaidMap->ldTgtIdToLd[i] = + (u8)pFwRaidMap->ldTgtIdToLd[i]; ++ for (i = (MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS); ++ i < MAX_LOGICAL_DRIVES_EXT; i++) ++ pDrvRaidMap->ldTgtIdToLd[i] = 0xff; + for (i = 0; i < ld_count; i++) { + pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i]; + #if VD_EXT_DEBUG +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1752,9 +1752,19 @@ megasas_build_dcdb_fusion(struct megasas + if (scmd->device->channel < MEGASAS_MAX_PD_CHANNELS) + goto NonFastPath; + ++ /* ++ * For older firmware, Driver should not access ldTgtIdToLd ++ * beyond index 127 and for Extended VD firmware, ldTgtIdToLd ++ * should not go beyond 255. ++ */ ++ ++ if ((!fusion->fast_path_io) || ++ (device_id >= instance->fw_supported_vd_count)) ++ goto NonFastPath; ++ + ld = MR_TargetIdToLdGet(device_id, local_map_ptr); +- if ((ld >= instance->fw_supported_vd_count) || +- (!fusion->fast_path_io)) ++ ++ if (ld >= instance->fw_supported_vd_count) + goto NonFastPath; + + raid = MR_LdRaidGet(ld, local_map_ptr); diff --git a/queue-3.18/mei-mask-interrupt-set-bit-on-clean-reset-bit.patch b/queue-3.18/mei-mask-interrupt-set-bit-on-clean-reset-bit.patch new file mode 100644 index 00000000000..c56ed52c846 --- /dev/null +++ b/queue-3.18/mei-mask-interrupt-set-bit-on-clean-reset-bit.patch @@ -0,0 +1,35 @@ +From 1ab1e79b9fd4b01331490bbe2e630a0fc0b25449 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Sun, 25 Jan 2015 23:45:27 +0200 +Subject: mei: mask interrupt set bit on clean reset bit + +From: Alexander Usyskin + +commit 1ab1e79b9fd4b01331490bbe2e630a0fc0b25449 upstream. + +We should mask interrupt set bit when writing back +hcsr value in reset bit clean-up. + +This is refinement for +mei: clean reset bit before reset +commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -242,7 +242,7 @@ static int mei_me_hw_reset(struct mei_de + if ((hcsr & H_RST) == H_RST) { + dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr); + hcsr &= ~H_RST; +- mei_me_reg_write(hw, H_CSR, hcsr); ++ mei_hcsr_set(hw, hcsr); + hcsr = mei_hcsr_read(hw); + } + diff --git a/queue-3.18/mei-me-release-hw-from-reset-only-during-the-reset-flow.patch b/queue-3.18/mei-me-release-hw-from-reset-only-during-the-reset-flow.patch new file mode 100644 index 00000000000..9eeab01a86b --- /dev/null +++ b/queue-3.18/mei-me-release-hw-from-reset-only-during-the-reset-flow.patch @@ -0,0 +1,42 @@ +From 663b7ee9517eec6deea9a48c7a1392a9a34f7809 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Sun, 25 Jan 2015 23:45:28 +0200 +Subject: mei: me: release hw from reset only during the reset flow + +From: Alexander Usyskin + +commit 663b7ee9517eec6deea9a48c7a1392a9a34f7809 upstream. + +We might enter the interrupt handler with hw_ready already set, +but prior we actually started the reset flow. +To soleve this we move the reset release from the interrupt handler +to the HW start wait function which is part of the reset sequence. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -335,6 +335,7 @@ static int mei_me_hw_ready_wait(struct m + return -ETIME; + } + ++ mei_me_hw_reset_release(dev); + dev->recvd_hw_ready = false; + return 0; + } +@@ -729,9 +730,7 @@ irqreturn_t mei_me_irq_thread_handler(in + /* check if we need to start the dev */ + if (!mei_host_is_ready(dev)) { + if (mei_hw_is_ready(dev)) { +- mei_me_hw_reset_release(dev); + dev_dbg(dev->dev, "we need to start the dev.\n"); +- + dev->recvd_hw_ready = true; + wake_up(&dev->wait_hw_ready); + } else { diff --git a/queue-3.18/mips-alchemy-fix-cpu-clock-calculation.patch b/queue-3.18/mips-alchemy-fix-cpu-clock-calculation.patch new file mode 100644 index 00000000000..74743e76ac7 --- /dev/null +++ b/queue-3.18/mips-alchemy-fix-cpu-clock-calculation.patch @@ -0,0 +1,40 @@ +From 69e4e63ec816a7e22cc3aa14bc7ef4ac734d370c Mon Sep 17 00:00:00 2001 +From: Manuel Lauss +Date: Wed, 18 Feb 2015 11:01:56 +0100 +Subject: MIPS: Alchemy: Fix cpu clock calculation + +From: Manuel Lauss + +commit 69e4e63ec816a7e22cc3aa14bc7ef4ac734d370c upstream. + +The current code uses bits 0-6 of the sys_cpupll register to calculate +core clock speed. However this is only valid on Au1300, on all earlier +models the hardware only uses bits 0-5 to generate core clock. + +This fixes clock calculation on the MTX1 (Au1500), where bit 6 of cpupll +is set as well, which ultimately lead the code to calculate a bogus cpu +core clock and also uart base clock down the line. + +Signed-off-by: Manuel Lauss +Reported-by: John Crispin +Tested-by: Bruno Randolf +Cc: Linux-MIPS +Patchwork: https://patchwork.linux-mips.org/patch/9279/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/alchemy/common/clock.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/alchemy/common/clock.c ++++ b/arch/mips/alchemy/common/clock.c +@@ -128,6 +128,8 @@ static unsigned long alchemy_clk_cpu_rec + t = 396000000; + else { + t = alchemy_rdsys(AU1000_SYS_CPUPLL) & 0x7f; ++ if (alchemy_get_cputype() < ALCHEMY_CPU_AU1300) ++ t &= 0x3f; + t *= parent_rate; + } + diff --git a/queue-3.18/mips-asm-asmmacro-replace-add-instructions-with-addu.patch b/queue-3.18/mips-asm-asmmacro-replace-add-instructions-with-addu.patch new file mode 100644 index 00000000000..fc2a1eac3ea --- /dev/null +++ b/queue-3.18/mips-asm-asmmacro-replace-add-instructions-with-addu.patch @@ -0,0 +1,44 @@ +From 98a833c1fa4de0695830f77b2d13fd86693da298 Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Wed, 5 Nov 2014 14:17:52 +0000 +Subject: MIPS: asm: asmmacro: Replace "add" instructions with "addu" + +From: Markos Chandras + +commit 98a833c1fa4de0695830f77b2d13fd86693da298 upstream. + +The "add" instruction is actually a macro in binutils and depending on +the size of the immediate it can expand to an "addi" instruction. +However, the "addi" instruction traps on overflows which is not +something we want on address calculation. + +Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00121.html +Cc: Paul Burton +Cc: Maciej W. Rozycki +Signed-off-by: Markos Chandras +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/asmmacro.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/mips/include/asm/asmmacro.h ++++ b/arch/mips/include/asm/asmmacro.h +@@ -304,7 +304,7 @@ + .set push + .set noat + SET_HARDFLOAT +- add $1, \base, \off ++ addu $1, \base, \off + .word LDD_MSA_INSN | (\wd << 6) + .set pop + .endm +@@ -313,7 +313,7 @@ + .set push + .set noat + SET_HARDFLOAT +- add $1, \base, \off ++ addu $1, \base, \off + .word STD_MSA_INSN | (\wd << 6) + .set pop + .endm diff --git a/queue-3.18/mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch b/queue-3.18/mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch new file mode 100644 index 00000000000..ebcebbd8308 --- /dev/null +++ b/queue-3.18/mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch @@ -0,0 +1,58 @@ +From 461d1597ffad7a826f8aaa63ab0727c37b632e34 Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Mon, 26 Jan 2015 09:40:34 +0000 +Subject: MIPS: asm: pgtable: Add c0 hazards on HTW start/stop sequences + +From: Markos Chandras + +commit 461d1597ffad7a826f8aaa63ab0727c37b632e34 upstream. + +When we use htw_{start,stop}() outside of htw_reset(), we need +to ensure that c0 changes have been propagated properly before +we attempt to continue with subsequence memory operations. + +Signed-off-by: Markos Chandras +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9114/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/pgtable.h | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/mips/include/asm/pgtable.h ++++ b/arch/mips/include/asm/pgtable.h +@@ -99,16 +99,20 @@ extern void paging_init(void); + + #define htw_stop() \ + do { \ +- if (cpu_has_htw) \ ++ if (cpu_has_htw) { \ + write_c0_pwctl(read_c0_pwctl() & \ + ~(1 << MIPS_PWCTL_PWEN_SHIFT)); \ ++ back_to_back_c0_hazard(); \ ++ } \ + } while(0) + + #define htw_start() \ + do { \ +- if (cpu_has_htw) \ ++ if (cpu_has_htw) { \ + write_c0_pwctl(read_c0_pwctl() | \ + (1 << MIPS_PWCTL_PWEN_SHIFT)); \ ++ back_to_back_c0_hazard(); \ ++ } \ + } while(0) + + +@@ -116,9 +120,7 @@ do { \ + do { \ + if (cpu_has_htw) { \ + htw_stop(); \ +- back_to_back_c0_hazard(); \ + htw_start(); \ +- back_to_back_c0_hazard(); \ + } \ + } while(0) + diff --git a/queue-3.18/mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch b/queue-3.18/mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch new file mode 100644 index 00000000000..d826a3f7e09 --- /dev/null +++ b/queue-3.18/mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch @@ -0,0 +1,76 @@ +From fde3538a8a711aedf1173ecb2d45aed868f51c97 Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Mon, 26 Jan 2015 09:40:36 +0000 +Subject: MIPS: asm: pgtable: Prevent HTW race when updating PTEs + +From: Markos Chandras + +commit fde3538a8a711aedf1173ecb2d45aed868f51c97 upstream. + +Whenever we modify a page table entry, we need to ensure that the HTW +will not fetch a stable entry. And for that to happen we need to ensure +that HTW is stopped before we modify the said entry otherwise the HTW +may already be in the process of reading that entry and fetching the +old information. As a result of which, we replace the htw_reset() calls +with htw_{stop,start} in more appropriate places. This also removes the +remaining users of htw_reset() and as a result we drop that macro + +Signed-off-by: Markos Chandras +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9116/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/pgtable.h | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +--- a/arch/mips/include/asm/pgtable.h ++++ b/arch/mips/include/asm/pgtable.h +@@ -116,14 +116,6 @@ do { \ + } while(0) + + +-#define htw_reset() \ +-do { \ +- if (cpu_has_htw) { \ +- htw_stop(); \ +- htw_start(); \ +- } \ +-} while(0) +- + extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep, + pte_t pteval); + +@@ -155,12 +147,13 @@ static inline void pte_clear(struct mm_s + { + pte_t null = __pte(0); + ++ htw_stop(); + /* Preserve global status for the pair */ + if (ptep_buddy(ptep)->pte_low & _PAGE_GLOBAL) + null.pte_low = null.pte_high = _PAGE_GLOBAL; + + set_pte_at(mm, addr, ptep, null); +- htw_reset(); ++ htw_start(); + } + #else + +@@ -190,6 +183,7 @@ static inline void set_pte(pte_t *ptep, + + static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { ++ htw_stop(); + #if !defined(CONFIG_CPU_R3000) && !defined(CONFIG_CPU_TX39XX) + /* Preserve global status for the pair */ + if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL) +@@ -197,7 +191,7 @@ static inline void pte_clear(struct mm_s + else + #endif + set_pte_at(mm, addr, ptep, __pte(0)); +- htw_reset(); ++ htw_start(); + } + #endif + diff --git a/queue-3.18/mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch b/queue-3.18/mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch new file mode 100644 index 00000000000..ac3426ca132 --- /dev/null +++ b/queue-3.18/mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch @@ -0,0 +1,55 @@ +From 3ce465e04bfd8de9956d515d6e9587faac3375dc Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Tue, 10 Feb 2015 10:02:59 +0000 +Subject: MIPS: Export FP functions used by lose_fpu(1) for KVM + +From: James Hogan + +commit 3ce465e04bfd8de9956d515d6e9587faac3375dc upstream. + +Export the _save_fp asm function used by the lose_fpu(1) macro to GPL +modules so that KVM can make use of it when it is built as a module. + +This fixes the following build error when CONFIG_KVM=m due to commit +f798217dfd03 ("KVM: MIPS: Don't leak FPU/DSP to guest"): + +ERROR: "_save_fp" [arch/mips/kvm/kvm.ko] undefined! + +Signed-off-by: James Hogan +Fixes: f798217dfd03 (KVM: MIPS: Don't leak FPU/DSP to guest) +Cc: Paolo Bonzini +Cc: Ralf Baechle +Cc: Paul Burton +Cc: Gleb Natapov +Cc: kvm@vger.kernel.org +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9260/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/mips_ksyms.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/mips/kernel/mips_ksyms.c ++++ b/arch/mips/kernel/mips_ksyms.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + extern void *__bzero(void *__s, size_t __count); + extern long __strncpy_from_kernel_nocheck_asm(char *__to, +@@ -34,6 +35,11 @@ extern long __strnlen_user_nocheck_asm(c + extern long __strnlen_user_asm(const char *s); + + /* ++ * Core architecture code ++ */ ++EXPORT_SYMBOL_GPL(_save_fp); ++ ++/* + * String functions + */ + EXPORT_SYMBOL(memset); diff --git a/queue-3.18/mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch b/queue-3.18/mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch new file mode 100644 index 00000000000..86afa713f24 --- /dev/null +++ b/queue-3.18/mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch @@ -0,0 +1,54 @@ +From ca5d25642e212f73492d332d95dc90ef46a0e8dc Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Tue, 10 Feb 2015 10:03:00 +0000 +Subject: MIPS: Export MSA functions used by lose_fpu(1) for KVM + +From: James Hogan + +commit ca5d25642e212f73492d332d95dc90ef46a0e8dc upstream. + +Export the _save_msa asm function used by the lose_fpu(1) macro to GPL +modules so that KVM can make use of it when it is built as a module. + +This fixes the following build error when CONFIG_KVM=m and +CONFIG_CPU_HAS_MSA=y due to commit f798217dfd03 ("KVM: MIPS: Don't leak +FPU/DSP to guest"): + +ERROR: "_save_msa" [arch/mips/kvm/kvm.ko] undefined! + +Fixes: f798217dfd03 (KVM: MIPS: Don't leak FPU/DSP to guest) +Signed-off-by: James Hogan +Cc: Paolo Bonzini +Cc: Ralf Baechle +Cc: Paul Burton +Cc: Gleb Natapov +Cc: kvm@vger.kernel.org +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9261/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/mips_ksyms.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/kernel/mips_ksyms.c ++++ b/arch/mips/kernel/mips_ksyms.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + extern void *__bzero(void *__s, size_t __count); + extern long __strncpy_from_kernel_nocheck_asm(char *__to, +@@ -38,6 +39,9 @@ extern long __strnlen_user_asm(const cha + * Core architecture code + */ + EXPORT_SYMBOL_GPL(_save_fp); ++#ifdef CONFIG_CPU_HAS_MSA ++EXPORT_SYMBOL_GPL(_save_msa); ++#endif + + /* + * String functions diff --git a/queue-3.18/mips-kernel-cps-vec-replace-addi-with-addiu.patch b/queue-3.18/mips-kernel-cps-vec-replace-addi-with-addiu.patch new file mode 100644 index 00000000000..abda030c8d3 --- /dev/null +++ b/queue-3.18/mips-kernel-cps-vec-replace-addi-with-addiu.patch @@ -0,0 +1,88 @@ +From acac4108df6029c03195513ead7073bbb0cb9718 Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Mon, 24 Nov 2014 14:40:11 +0000 +Subject: MIPS: kernel: cps-vec: Replace "addi" with "addiu" + +From: Markos Chandras + +commit acac4108df6029c03195513ead7073bbb0cb9718 upstream. + +The "addi" instruction will trap on overflows which is not something +we need in this code, so we replace that with "addiu". + +Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00430.html +Cc: Maciej W. Rozycki +Cc: Paul Burton +Signed-off-by: Markos Chandras +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/cps-vec.S | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/arch/mips/kernel/cps-vec.S ++++ b/arch/mips/kernel/cps-vec.S +@@ -99,11 +99,11 @@ not_nmi: + xori t2, t1, 0x7 + beqz t2, 1f + li t3, 32 +- addi t1, t1, 1 ++ addiu t1, t1, 1 + sllv t1, t3, t1 + 1: /* At this point t1 == I-cache sets per way */ + _EXT t2, v0, MIPS_CONF1_IA_SHF, MIPS_CONF1_IA_SZ +- addi t2, t2, 1 ++ addiu t2, t2, 1 + mul t1, t1, t0 + mul t1, t1, t2 + +@@ -126,11 +126,11 @@ icache_done: + xori t2, t1, 0x7 + beqz t2, 1f + li t3, 32 +- addi t1, t1, 1 ++ addiu t1, t1, 1 + sllv t1, t3, t1 + 1: /* At this point t1 == D-cache sets per way */ + _EXT t2, v0, MIPS_CONF1_DA_SHF, MIPS_CONF1_DA_SZ +- addi t2, t2, 1 ++ addiu t2, t2, 1 + mul t1, t1, t0 + mul t1, t1, t2 + +@@ -250,7 +250,7 @@ LEAF(mips_cps_core_init) + mfc0 t0, CP0_MVPCONF0 + srl t0, t0, MVPCONF0_PVPE_SHIFT + andi t0, t0, (MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT) +- addi t7, t0, 1 ++ addiu t7, t0, 1 + + /* If there's only 1, we're done */ + beqz t0, 2f +@@ -280,7 +280,7 @@ LEAF(mips_cps_core_init) + mttc0 t0, CP0_TCHALT + + /* Next VPE */ +- addi t5, t5, 1 ++ addiu t5, t5, 1 + slt t0, t5, t7 + bnez t0, 1b + nop +@@ -317,7 +317,7 @@ LEAF(mips_cps_boot_vpes) + mfc0 t1, CP0_MVPCONF0 + srl t1, t1, MVPCONF0_PVPE_SHIFT + andi t1, t1, MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT +- addi t1, t1, 1 ++ addiu t1, t1, 1 + + /* Calculate a mask for the VPE ID from EBase.CPUNum */ + clz t1, t1 +@@ -424,7 +424,7 @@ LEAF(mips_cps_boot_vpes) + + /* Next VPE */ + 2: srl t6, t6, 1 +- addi t5, t5, 1 ++ addiu t5, t5, 1 + bnez t6, 1b + nop + diff --git a/queue-3.18/mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch b/queue-3.18/mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch new file mode 100644 index 00000000000..bb2232ad24f --- /dev/null +++ b/queue-3.18/mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch @@ -0,0 +1,94 @@ +From cbef8478bee55775ac312a574aad48af7bb9cf9f Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Wed, 11 Feb 2015 15:25:19 -0800 +Subject: mm/hugetlb: pmd_huge() returns true for non-present hugepage + +From: Naoya Horiguchi + +commit cbef8478bee55775ac312a574aad48af7bb9cf9f upstream. + +Migrating hugepages and hwpoisoned hugepages are considered as non-present +hugepages, and they are referenced via migration entries and hwpoison +entries in their page table slots. + +This behavior causes race condition because pmd_huge() doesn't tell +non-huge pages from migrating/hwpoisoned hugepages. follow_page_mask() is +one example where the kernel would call follow_page_pte() for such +hugepage while this function is supposed to handle only normal pages. + +To avoid this, this patch makes pmd_huge() return true when pmd_none() is +true *and* pmd_present() is false. We don't have to worry about mixing up +non-present pmd entry with normal pmd (pointing to leaf level pte entry) +because pmd_present() is true in normal pmd. + +The same race condition could happen in (x86-specific) gup_pmd_range(), +where this patch simply adds pmd_present() check instead of pmd_huge(). +This is because gup_pmd_range() is fast path. If we have non-present +hugepage in this function, we will go into gup_huge_pmd(), then return 0 +at flag mask check, and finally fall back to the slow path. + +Fixes: 290408d4a2 ("hugetlb: hugepage migration core") +Signed-off-by: Naoya Horiguchi +Cc: Hugh Dickins +Cc: James Hogan +Cc: David Rientjes +Cc: Mel Gorman +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Rik van Riel +Cc: Andrea Arcangeli +Cc: Luiz Capitulino +Cc: Nishanth Aravamudan +Cc: Lee Schermerhorn +Cc: Steve Capper +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/gup.c | 2 +- + arch/x86/mm/hugetlbpage.c | 8 +++++++- + mm/hugetlb.c | 2 ++ + 3 files changed, 10 insertions(+), 2 deletions(-) + +--- a/arch/x86/mm/gup.c ++++ b/arch/x86/mm/gup.c +@@ -172,7 +172,7 @@ static int gup_pmd_range(pud_t pud, unsi + */ + if (pmd_none(pmd) || pmd_trans_splitting(pmd)) + return 0; +- if (unlikely(pmd_large(pmd))) { ++ if (unlikely(pmd_large(pmd) || !pmd_present(pmd))) { + /* + * NUMA hinting faults need to be handled in the GUP + * slowpath for accounting purposes and so that they +--- a/arch/x86/mm/hugetlbpage.c ++++ b/arch/x86/mm/hugetlbpage.c +@@ -66,9 +66,15 @@ follow_huge_addr(struct mm_struct *mm, u + return ERR_PTR(-EINVAL); + } + ++/* ++ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal ++ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry. ++ * Otherwise, returns 0. ++ */ + int pmd_huge(pmd_t pmd) + { +- return !!(pmd_val(pmd) & _PAGE_PSE); ++ return !pmd_none(pmd) && ++ (pmd_val(pmd) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT; + } + + int pud_huge(pud_t pud) +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3659,6 +3659,8 @@ follow_huge_pmd(struct mm_struct *mm, un + { + struct page *page; + ++ if (!pmd_present(*pmd)) ++ return NULL; + page = pte_page(*(pte_t *)pmd); + if (page) + page += ((address & ~PMD_MASK) >> PAGE_SHIFT); diff --git a/queue-3.18/mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch b/queue-3.18/mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch new file mode 100644 index 00000000000..d20627387e6 --- /dev/null +++ b/queue-3.18/mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch @@ -0,0 +1,92 @@ +From a39128bcd6f1e56c6514abf489b40b67d226093b Mon Sep 17 00:00:00 2001 +From: Marcin Wojtas +Date: Thu, 29 Jan 2015 12:36:25 +0100 +Subject: mmc: sdhci-pxav3: Fix Armada 38x controller's caps according to erratum ERR-7878951 + +From: Marcin Wojtas + +commit a39128bcd6f1e56c6514abf489b40b67d226093b upstream. + +According to erratum 'ERR-7878951' Armada 38x SDHCI controller has +different capabilities than the ones shown in its registers: + +- it doesn't support the voltage switching: it can work either with + 3.3V or 1.8V supply +- it doesn't support the SDR104 mode +- SDR50 mode doesn't need tuning + +The SDHCI_QUIRK_MISSING_CAPS quirk is used for updating the +capabilities accordingly. + +[gregory.clement@free-electrons.com: port from 3.10] + +Fixes: 5491ce3f79ee ("mmc: sdhci-pxav3: add support for the Armada 38x SDHCI controller") + +Signed-off-by: Gregory CLEMENT +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pxav3.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -112,8 +112,11 @@ static int mv_conf_mbus_windows(struct p + return 0; + } + +-static int armada_38x_quirks(struct sdhci_host *host) ++static int armada_38x_quirks(struct platform_device *pdev, ++ struct sdhci_host *host) + { ++ struct device_node *np = pdev->dev.of_node; ++ + host->quirks |= SDHCI_QUIRK_MISSING_CAPS; + /* + * According to erratum 'FE-2946959' both SDR50 and DDR50 +@@ -123,6 +126,21 @@ static int armada_38x_quirks(struct sdhc + */ + host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); + host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50); ++ ++ /* ++ * According to erratum 'ERR-7878951' Armada 38x SDHCI ++ * controller has different capabilities than the ones shown ++ * in its registers ++ */ ++ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES); ++ if (of_property_read_bool(np, "no-1-8-v")) { ++ host->caps &= ~SDHCI_CAN_VDD_180; ++ host->mmc->caps &= ~MMC_CAP_1_8V_DDR; ++ } else { ++ host->caps &= ~SDHCI_CAN_VDD_330; ++ } ++ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_USE_SDR50_TUNING); ++ + return 0; + } + +@@ -309,8 +327,11 @@ static int sdhci_pxav3_probe(struct plat + if (IS_ERR(host)) + return PTR_ERR(host); + ++ /* enable 1/8V DDR capable */ ++ host->mmc->caps |= MMC_CAP_1_8V_DDR; ++ + if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) { +- ret = armada_38x_quirks(host); ++ ret = armada_38x_quirks(pdev, host); + if (ret < 0) + goto err_clk_get; + ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info()); +@@ -331,9 +352,6 @@ static int sdhci_pxav3_probe(struct plat + pltfm_host->clk = clk; + clk_prepare_enable(clk); + +- /* enable 1/8V DDR capable */ +- host->mmc->caps |= MMC_CAP_1_8V_DDR; +- + match = of_match_device(of_match_ptr(sdhci_pxav3_of_match), &pdev->dev); + if (match) { + ret = mmc_of_parse(host->mmc); diff --git a/queue-3.18/mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch b/queue-3.18/mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch new file mode 100644 index 00000000000..d5ba66aea63 --- /dev/null +++ b/queue-3.18/mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch @@ -0,0 +1,61 @@ +From d4b803c559843e3774736e5108cf6331cf75f64c Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Thu, 29 Jan 2015 12:36:24 +0100 +Subject: mmc: sdhci-pxav3: Fix SDR50 and DDR50 capabilities for the Armada 38x flavor + +From: Gregory CLEMENT + +commit d4b803c559843e3774736e5108cf6331cf75f64c upstream. + +According to erratum 'FE-2946959' both SDR50 and DDR50 modes require +specific clock adjustments in SDIO3 Configuration register. However, +this register was not part of the device tree binding. Even if the +binding can (and will) be extended we still need handling the case +where this register was not available. In this case we use the +SDHCI_QUIRK_MISSING_CAPS quirk remove them from the capabilities. + +This commit is based on the work done by Marcin Wojtas + +Fixes: 5491ce3f79ee ("mmc: sdhci-pxav3: add support for the Armada 38x SDHCI controller") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Marcin Wojtas +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pxav3.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -112,6 +112,20 @@ static int mv_conf_mbus_windows(struct p + return 0; + } + ++static int armada_38x_quirks(struct sdhci_host *host) ++{ ++ host->quirks |= SDHCI_QUIRK_MISSING_CAPS; ++ /* ++ * According to erratum 'FE-2946959' both SDR50 and DDR50 ++ * modes require specific clock adjustments in SDIO3 ++ * Configuration register, if the adjustment is not done, ++ * remove them from the capabilities. ++ */ ++ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); ++ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50); ++ return 0; ++} ++ + static void pxav3_reset(struct sdhci_host *host, u8 mask) + { + struct platform_device *pdev = to_platform_device(mmc_dev(host->mmc)); +@@ -296,6 +310,9 @@ static int sdhci_pxav3_probe(struct plat + return PTR_ERR(host); + + if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) { ++ ret = armada_38x_quirks(host); ++ if (ret < 0) ++ goto err_clk_get; + ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info()); + if (ret < 0) + goto err_mbus_win; diff --git a/queue-3.18/mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch b/queue-3.18/mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch new file mode 100644 index 00000000000..fce3a66024a --- /dev/null +++ b/queue-3.18/mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch @@ -0,0 +1,39 @@ +From 14460dbaf7a5a0488963fdb8232ad5c8a8cca7b7 Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Wed, 28 Jan 2015 19:54:12 +0800 +Subject: mmc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles + +From: Jisheng Zhang + +commit 14460dbaf7a5a0488963fdb8232ad5c8a8cca7b7 upstream. + +Current code checks "clk_delay_cycles > 0" to know whether the optional +"mrvl,clk_delay_cycles" is set or not. But of_property_read_u32() doesn't +touch clk_delay_cycles if the property is not set. And type of +clk_delay_cycles is u32, so we may always set pdata->clk_delay_cycles as a +random value. + +This patch fix this problem by check the return value of of_property_read_u32() +to know whether the optional clk-delay-cycles is set or not. + +Signed-off-by: Jisheng Zhang +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pxav3.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -261,8 +261,8 @@ static struct sdhci_pxa_platdata *pxav3_ + if (!pdata) + return NULL; + +- of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles); +- if (clk_delay_cycles > 0) ++ if (!of_property_read_u32(np, "mrvl,clk-delay-cycles", ++ &clk_delay_cycles)) + pdata->clk_delay_cycles = clk_delay_cycles; + + return pdata; diff --git a/queue-3.18/mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch b/queue-3.18/mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch new file mode 100644 index 00000000000..6e91574e1aa --- /dev/null +++ b/queue-3.18/mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch @@ -0,0 +1,59 @@ +From 62cf983ad84275f8580c807e5e596216c46773cf Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Sun, 4 Jan 2015 23:15:47 +0800 +Subject: mmc: sdhci-pxav3: fix unbalanced clock issues during probe + +From: Jisheng Zhang + +commit 62cf983ad84275f8580c807e5e596216c46773cf upstream. + +Commit 0dcaa2499b7d ("sdhci-pxav3: Fix runtime PM initialization") tries +to fix one hang issue caused by calling sdhci_add_host() on a suspended +device. The fix enables the clock twice, once by clk_prepare_enable() and +another by pm_runtime_get_sync(), meaning that the clock will never be +gated at runtime PM suspend. I observed the power consumption regression on +Marvell BG2Q SoCs. + +In fact, the fix is not correct. There still be a very small window +during which a runtime suspend might somehow occur after pm_runtime_enable() +but before pm_runtime_get_sync(). + +This patch fixes all of the two problems by just incrementing the usage +counter before pm_runtime_enable(). It also adjust the order of disabling +runtime pm and storing the usage count in the error path to handle clock +gating properly. + +Signed-off-by: Jisheng Zhang +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pxav3.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -355,10 +355,11 @@ static int sdhci_pxav3_probe(struct plat + } + } + +- pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); ++ pm_runtime_get_noresume(&pdev->dev); ++ pm_runtime_set_active(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, PXAV3_RPM_DELAY_MS); + pm_runtime_use_autosuspend(&pdev->dev); ++ pm_runtime_enable(&pdev->dev); + pm_suspend_ignore_children(&pdev->dev, 1); + + ret = sdhci_add_host(host); +@@ -381,8 +382,8 @@ static int sdhci_pxav3_probe(struct plat + return 0; + + err_add_host: +- pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ pm_runtime_put_noidle(&pdev->dev); + err_of_parse: + err_cd_req: + clk_disable_unprepare(clk); diff --git a/queue-3.18/nfs-don-t-call-blocking-operations-while-task_running.patch b/queue-3.18/nfs-don-t-call-blocking-operations-while-task_running.patch new file mode 100644 index 00000000000..b0c29ea138a --- /dev/null +++ b/queue-3.18/nfs-don-t-call-blocking-operations-while-task_running.patch @@ -0,0 +1,92 @@ +From 6ffa30d3f734d4f6b478081dfc09592021028f90 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Wed, 14 Jan 2015 13:08:57 -0500 +Subject: nfs: don't call blocking operations while !TASK_RUNNING + +From: Jeff Layton + +commit 6ffa30d3f734d4f6b478081dfc09592021028f90 upstream. + +Bruce reported seeing this warning pop when mounting using v4.1: + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 1121 at kernel/sched/core.c:7300 __might_sleep+0xbd/0xd0() + do not call blocking ops when !TASK_RUNNING; state=1 set at [] prepare_to_wait+0x2f/0x90 + Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer ppdev joydev snd virtio_console virtio_balloon pcspkr serio_raw parport_pc parport pvpanic floppy soundcore i2c_piix4 virtio_blk virtio_net qxl drm_kms_helper ttm drm virtio_pci virtio_ring ata_generic virtio pata_acpi + CPU: 1 PID: 1121 Comm: nfsv4.1-svc Not tainted 3.19.0-rc4+ #25 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014 + 0000000000000000 000000004e5e3f73 ffff8800b998fb48 ffffffff8186ac78 + 0000000000000000 ffff8800b998fba0 ffff8800b998fb88 ffffffff810ac9da + ffff8800b998fb68 ffffffff81c923e7 00000000000004d9 0000000000000000 + Call Trace: + [] dump_stack+0x4c/0x65 + [] warn_slowpath_common+0x8a/0xc0 + [] warn_slowpath_fmt+0x55/0x70 + [] ? prepare_to_wait+0x2f/0x90 + [] ? prepare_to_wait+0x2f/0x90 + [] __might_sleep+0xbd/0xd0 + [] kmem_cache_alloc_trace+0x243/0x430 + [] ? groups_alloc+0x3e/0x130 + [] groups_alloc+0x3e/0x130 + [] svcauth_unix_accept+0x16e/0x290 [sunrpc] + [] svc_authenticate+0xe1/0xf0 [sunrpc] + [] svc_process_common+0x244/0x6a0 [sunrpc] + [] bc_svc_process+0x1c4/0x260 [sunrpc] + [] nfs41_callback_svc+0x128/0x1f0 [nfsv4] + [] ? wait_woken+0xc0/0xc0 + [] ? nfs4_callback_svc+0x60/0x60 [nfsv4] + [] kthread+0x11f/0x140 + [] ? local_clock+0x15/0x30 + [] ? kthread_create_on_node+0x250/0x250 + [] ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x250/0x250 + ---[ end trace 675220a11e30f4f2 ]--- + +nfs41_callback_svc does most of its work while in TASK_INTERRUPTIBLE, +which is just wrong. Fix that by finishing the wait immediately if we've +found that the list has something on it. + +Also, we don't expect this kthread to accept signals, so we should be +using a TASK_UNINTERRUPTIBLE sleep instead. That however, opens us up +hung task warnings from the watchdog, so have the schedule_timeout +wake up every 60s if there's no callback activity. + +Reported-by: "J. Bruce Fields" +Signed-off-by: Jeff Layton +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/callback.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -128,22 +128,24 @@ nfs41_callback_svc(void *vrqstp) + if (try_to_freeze()) + continue; + +- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); ++ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE); + spin_lock_bh(&serv->sv_cb_lock); + if (!list_empty(&serv->sv_cb_list)) { + req = list_first_entry(&serv->sv_cb_list, + struct rpc_rqst, rq_bc_list); + list_del(&req->rq_bc_list); + spin_unlock_bh(&serv->sv_cb_lock); ++ finish_wait(&serv->sv_cb_waitq, &wq); + dprintk("Invoking bc_svc_process()\n"); + error = bc_svc_process(serv, req, rqstp); + dprintk("bc_svc_process() returned w/ error code= %d\n", + error); + } else { + spin_unlock_bh(&serv->sv_cb_lock); +- schedule(); ++ /* schedule_timeout to game the hung task watchdog */ ++ schedule_timeout(60 * HZ); ++ finish_wait(&serv->sv_cb_waitq, &wq); + } +- finish_wait(&serv->sv_cb_waitq, &wq); + } + return 0; + } diff --git a/queue-3.18/nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch b/queue-3.18/nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch new file mode 100644 index 00000000000..ba9ad972398 --- /dev/null +++ b/queue-3.18/nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch @@ -0,0 +1,45 @@ +From f4086a3d789dbe18949862276d83b8f49fce6d2f Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 13 Feb 2015 21:03:16 -0500 +Subject: NFS: struct nfs_commit_info.lock must always point to inode->i_lock + +From: Trond Myklebust + +commit f4086a3d789dbe18949862276d83b8f49fce6d2f upstream. + +Commit 411a99adffb4f (nfs: clear_request_commit while holding i_lock) +assumes that the nfs_commit_info always points to the inode->i_lock. +For historical reasons, that is not the case for O_DIRECT writes. + +Cc: Weston Andros Adamson +Fixes: 411a99adffb4f ("nfs: clear_request_commit while holding i_lock") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/direct.c | 2 +- + include/linux/nfs_xdr.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -242,7 +242,7 @@ static void nfs_direct_release_pages(str + void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo, + struct nfs_direct_req *dreq) + { +- cinfo->lock = &dreq->lock; ++ cinfo->lock = &dreq->inode->i_lock; + cinfo->mds = &dreq->mds_cinfo; + cinfo->ds = &dreq->ds_cinfo; + cinfo->dreq = dreq; +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1328,7 +1328,7 @@ struct nfs_commit_completion_ops { + }; + + struct nfs_commit_info { +- spinlock_t *lock; ++ spinlock_t *lock; /* inode->i_lock */ + struct nfs_mds_commit_info *mds; + struct pnfs_ds_commit_info *ds; + struct nfs_direct_req *dreq; /* O_DIRECT request */ diff --git a/queue-3.18/nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch b/queue-3.18/nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch new file mode 100644 index 00000000000..1e85bb5f13a --- /dev/null +++ b/queue-3.18/nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch @@ -0,0 +1,78 @@ +From cb5d04bc39e914124e811ea55f3034d2379a5f6c Mon Sep 17 00:00:00 2001 +From: Peng Tao +Date: Sat, 24 Jan 2015 22:14:52 +0800 +Subject: nfs41: .init_read and .init_write can be called with valid pg_lseg + +From: Peng Tao + +commit cb5d04bc39e914124e811ea55f3034d2379a5f6c upstream. + +With pgio refactoring in v3.15, .init_read and .init_write can be +called with valid pgio->pg_lseg. file layout was fixed at that time +by commit c6194271f (pnfs: filelayout: support non page aligned +layouts). But the generic helper still needs to be fixed. + +Signed-off-by: Peng Tao +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/pnfs.c | 41 ++++++++++++++++++++--------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1445,19 +1445,19 @@ pnfs_generic_pg_init_read(struct nfs_pag + { + u64 rd_size = req->wb_bytes; + +- WARN_ON_ONCE(pgio->pg_lseg != NULL); +- +- if (pgio->pg_dreq == NULL) +- rd_size = i_size_read(pgio->pg_inode) - req_offset(req); +- else +- rd_size = nfs_dreq_bytes_left(pgio->pg_dreq); +- +- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, +- req->wb_context, +- req_offset(req), +- rd_size, +- IOMODE_READ, +- GFP_KERNEL); ++ if (pgio->pg_lseg == NULL) { ++ if (pgio->pg_dreq == NULL) ++ rd_size = i_size_read(pgio->pg_inode) - req_offset(req); ++ else ++ rd_size = nfs_dreq_bytes_left(pgio->pg_dreq); ++ ++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, ++ req->wb_context, ++ req_offset(req), ++ rd_size, ++ IOMODE_READ, ++ GFP_KERNEL); ++ } + /* If no lseg, fall back to read through mds */ + if (pgio->pg_lseg == NULL) + nfs_pageio_reset_read_mds(pgio); +@@ -1469,14 +1469,13 @@ void + pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio, + struct nfs_page *req, u64 wb_size) + { +- WARN_ON_ONCE(pgio->pg_lseg != NULL); +- +- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, +- req->wb_context, +- req_offset(req), +- wb_size, +- IOMODE_RW, +- GFP_NOFS); ++ if (pgio->pg_lseg == NULL) ++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, ++ req->wb_context, ++ req_offset(req), ++ wb_size, ++ IOMODE_RW, ++ GFP_NOFS); + /* If no lseg, fall back to write through mds */ + if (pgio->pg_lseg == NULL) + nfs_pageio_reset_write_mds(pgio); diff --git a/queue-3.18/nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch b/queue-3.18/nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch new file mode 100644 index 00000000000..a2917ed63a1 --- /dev/null +++ b/queue-3.18/nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch @@ -0,0 +1,113 @@ +From ea7c38fef0b774a5dc16fb0ca5935f0ae8568176 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Thu, 5 Feb 2015 15:13:24 -0500 +Subject: NFSv4: Ensure we reference the inode for return-on-close in delegreturn + +From: Trond Myklebust + +commit ea7c38fef0b774a5dc16fb0ca5935f0ae8568176 upstream. + +If we have to do a return-on-close in the delegreturn code, then +we must ensure that the inode and super block remain referenced. + +Cc: Peng Tao +Signed-off-by: Trond Myklebust +Reviewed-by: Peng Tao +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/internal.h | 22 +++++++++++++++++++++- + fs/nfs/nfs4proc.c | 14 +++++++++----- + fs/nfs/super.c | 9 ++++++--- + 3 files changed, 36 insertions(+), 9 deletions(-) + +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -377,7 +377,7 @@ extern struct rpc_stat nfs_rpcstat; + + extern int __init register_nfs_fs(void); + extern void __exit unregister_nfs_fs(void); +-extern void nfs_sb_active(struct super_block *sb); ++extern bool nfs_sb_active(struct super_block *sb); + extern void nfs_sb_deactive(struct super_block *sb); + + /* namespace.c */ +@@ -495,6 +495,26 @@ extern int nfs41_walk_client_list(struct + struct nfs_client **result, + struct rpc_cred *cred); + ++static inline struct inode *nfs_igrab_and_active(struct inode *inode) ++{ ++ inode = igrab(inode); ++ if (inode != NULL && !nfs_sb_active(inode->i_sb)) { ++ iput(inode); ++ inode = NULL; ++ } ++ return inode; ++} ++ ++static inline void nfs_iput_and_deactive(struct inode *inode) ++{ ++ if (inode != NULL) { ++ struct super_block *sb = inode->i_sb; ++ ++ iput(inode); ++ nfs_sb_deactive(sb); ++ } ++} ++ + /* + * Determine the device name as a string + */ +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5130,9 +5130,13 @@ static void nfs4_delegreturn_done(struct + static void nfs4_delegreturn_release(void *calldata) + { + struct nfs4_delegreturndata *data = calldata; ++ struct inode *inode = data->inode; + +- if (data->roc) +- pnfs_roc_release(data->inode); ++ if (inode) { ++ if (data->roc) ++ pnfs_roc_release(inode); ++ nfs_iput_and_deactive(inode); ++ } + kfree(calldata); + } + +@@ -5189,9 +5193,9 @@ static int _nfs4_proc_delegreturn(struct + nfs_fattr_init(data->res.fattr); + data->timestamp = jiffies; + data->rpc_status = 0; +- data->inode = inode; +- data->roc = list_empty(&NFS_I(inode)->open_files) ? +- pnfs_roc(inode) : false; ++ data->inode = nfs_igrab_and_active(inode); ++ if (data->inode) ++ data->roc = nfs4_roc(inode); + + task_setup_data.callback_data = data; + msg.rpc_argp = &data->args; +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -405,12 +405,15 @@ void __exit unregister_nfs_fs(void) + unregister_filesystem(&nfs_fs_type); + } + +-void nfs_sb_active(struct super_block *sb) ++bool nfs_sb_active(struct super_block *sb) + { + struct nfs_server *server = NFS_SB(sb); + +- if (atomic_inc_return(&server->active) == 1) +- atomic_inc(&sb->s_active); ++ if (!atomic_inc_not_zero(&sb->s_active)) ++ return false; ++ if (atomic_inc_return(&server->active) != 1) ++ atomic_dec(&sb->s_active); ++ return true; + } + EXPORT_SYMBOL_GPL(nfs_sb_active); + diff --git a/queue-3.18/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch b/queue-3.18/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch new file mode 100644 index 00000000000..bb0206d282c --- /dev/null +++ b/queue-3.18/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch @@ -0,0 +1,36 @@ +From d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 11 Feb 2015 17:27:55 -0500 +Subject: NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args + +From: Trond Myklebust + +commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream. + +If the call to decode_rc_list() fails due to a memory allocation error, +then we need to truncate the array size to ensure that we only call +kfree() on those pointer that were allocated. + +Reported-by: David Ramos +Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/callback_xdr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(st + + for (i = 0; i < args->csa_nrclists; i++) { + status = decode_rc_list(xdr, &args->csa_rclists[i]); +- if (status) ++ if (status) { ++ args->csa_nrclists = i; + goto out_free; ++ } + } + } + status = 0; diff --git a/queue-3.18/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch b/queue-3.18/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch new file mode 100644 index 00000000000..d7fc461b130 --- /dev/null +++ b/queue-3.18/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch @@ -0,0 +1,71 @@ +From 29183a70b0b828500816bd794b3fe192fce89f73 Mon Sep 17 00:00:00 2001 +From: John Stultz +Date: Mon, 9 Feb 2015 23:30:36 -0800 +Subject: ntp: Fixup adjtimex freq validation on 32-bit systems + +From: John Stultz + +commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream. + +Additional validation of adjtimex freq values to avoid +potential multiplication overflows were added in commit +5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values) + +Unfortunately the patch used LONG_MAX/MIN instead of +LLONG_MAX/MIN, which was fine on 64-bit systems, but being +much smaller on 32-bit systems caused false positives +resulting in most direct frequency adjustments to fail w/ +EINVAL. + +ntpd only does direct frequency adjustments at startup, so +the issue was not as easily observed there, but other time +sync applications like ptpd and chrony were more effected by +the bug. + +See bugs: + + https://bugzilla.kernel.org/show_bug.cgi?id=92481 + https://bugzilla.redhat.com/show_bug.cgi?id=1188074 + +This patch changes the checks to use LLONG_MAX for +clarity, and additionally the checks are disabled +on 32-bit systems since LLONG_MAX/PPM_SCALE is always +larger then the 32-bit long freq value, so multiplication +overflows aren't possible there. + +Reported-by: Josh Boyer +Reported-by: George Joseph +Tested-by: George Joseph +Signed-off-by: John Stultz +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Sasha Levin +Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org +[ Prettified the changelog and the comments a bit. ] +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/ntp.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/kernel/time/ntp.c ++++ b/kernel/time/ntp.c +@@ -633,10 +633,14 @@ int ntp_validate_timex(struct timex *txc + if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) + return -EPERM; + +- if (txc->modes & ADJ_FREQUENCY) { +- if (LONG_MIN / PPM_SCALE > txc->freq) ++ /* ++ * Check for potential multiplication overflows that can ++ * only happen on 64-bit systems: ++ */ ++ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) { ++ if (LLONG_MIN / PPM_SCALE > txc->freq) + return -EINVAL; +- if (LONG_MAX / PPM_SCALE < txc->freq) ++ if (LLONG_MAX / PPM_SCALE < txc->freq) + return -EINVAL; + } + diff --git a/queue-3.18/pci-fix-infinite-loop-with-rom-image-of-size-0.patch b/queue-3.18/pci-fix-infinite-loop-with-rom-image-of-size-0.patch new file mode 100644 index 00000000000..9f19db11f4a --- /dev/null +++ b/queue-3.18/pci-fix-infinite-loop-with-rom-image-of-size-0.patch @@ -0,0 +1,54 @@ +From 16b036af31e1456cb69243a5a0c9ef801ecd1f17 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Mon, 19 Jan 2015 17:53:20 +0900 +Subject: PCI: Fix infinite loop with ROM image of size 0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= + +commit 16b036af31e1456cb69243a5a0c9ef801ecd1f17 upstream. + +If the image size would ever read as 0, pci_get_rom_size() could keep +processing the same image over and over again. Exit the loop if we ever +read a length of zero. + +This fixes a soft lockup on boot when the radeon driver calls +pci_get_rom_size() on an AMD Radeon R7 250X PCIe discrete graphics card. + +[bhelgaas: changelog, reference] +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386973 +Reported-by: Federico +Signed-off-by: Michel Dänzer +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/rom.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/pci/rom.c ++++ b/drivers/pci/rom.c +@@ -71,6 +71,7 @@ size_t pci_get_rom_size(struct pci_dev * + { + void __iomem *image; + int last_image; ++ unsigned length; + + image = rom; + do { +@@ -93,9 +94,9 @@ size_t pci_get_rom_size(struct pci_dev * + if (readb(pds + 3) != 'R') + break; + last_image = readb(pds + 21) & 0x80; +- /* this length is reliable */ +- image += readw(pds + 16) * 512; +- } while (!last_image); ++ length = readw(pds + 16); ++ image += length * 512; ++ } while (length && !last_image); + + /* never return a size larger than the PCI resource window */ + /* there are known ROMs that get the size wrong */ diff --git a/queue-3.18/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch b/queue-3.18/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch new file mode 100644 index 00000000000..9dfc5819bd9 --- /dev/null +++ b/queue-3.18/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch @@ -0,0 +1,47 @@ +From 145b3fe579db66fbe999a2bc3fd5b63dffe9636d Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda Delgado +Date: Tue, 2 Dec 2014 17:35:04 +0100 +Subject: PCI: Generate uppercase hex for modalias var in uevent + +From: Ricardo Ribalda Delgado + +commit 145b3fe579db66fbe999a2bc3fd5b63dffe9636d upstream. + +Some implementations of modprobe fail to load the driver for a PCI device +automatically because the "interface" part of the modalias from the kernel +is lowercase, and the modalias from file2alias is uppercase. + +The "interface" is the low-order byte of the Class Code, defined in PCI +r3.0, Appendix D. Most interface types defined in the spec do not use +alpha characters, so they won't be affected. For example, 00h, 01h, 10h, +20h, etc. are unaffected. + +Print the "interface" byte of the Class Code in uppercase hex, as we +already do for the Vendor ID, Device ID, Class, etc. + +Commit 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface +class") fixed only half of the problem. Some udev implementations rely on +the uevent file and not the modalias file. + +Fixes: d1ded203adf1 ("PCI: add MODALIAS to hotplug event for pci devices") +Fixes: 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface class") +Signed-off-by: Ricardo Ribalda Delgado +Signed-off-by: Bjorn Helgaas +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci-driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1389,7 +1389,7 @@ static int pci_uevent(struct device *dev + if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev))) + return -ENOMEM; + +- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x", ++ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X", + pdev->vendor, pdev->device, + pdev->subsystem_vendor, pdev->subsystem_device, + (u8)(pdev->class >> 16), (u8)(pdev->class >> 8), diff --git a/queue-3.18/power-bq24190-fix-ignored-supplicants.patch b/queue-3.18/power-bq24190-fix-ignored-supplicants.patch new file mode 100644 index 00000000000..93b60c4aaae --- /dev/null +++ b/queue-3.18/power-bq24190-fix-ignored-supplicants.patch @@ -0,0 +1,39 @@ +From 478913fdbdfd4a781d91c993eb86838620fe7421 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 5 Jan 2015 09:51:48 +0100 +Subject: power: bq24190: Fix ignored supplicants + +From: Krzysztof Kozlowski + +commit 478913fdbdfd4a781d91c993eb86838620fe7421 upstream. + +The driver mismatched 'num_supplicants' with 'num_supplies' of +power_supply structure. + +It provided list of supplicants (power_supply.supplied_to) but did +not set the number of supplicants. Instead it set the num_supplies which +is used when iterating over number of supplies (power_supply.supplied_from). + +As a result the list of supplicants was ignored by core because its size +was 0. + +Signed-off-by: Krzysztof Kozlowski +Fixes: d7bf353fd0aa ("bq24190_charger: Add support for TI BQ24190 Battery Charger") +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/bq24190_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/bq24190_charger.c ++++ b/drivers/power/bq24190_charger.c +@@ -929,7 +929,7 @@ static void bq24190_charger_init(struct + charger->properties = bq24190_charger_properties; + charger->num_properties = ARRAY_SIZE(bq24190_charger_properties); + charger->supplied_to = bq24190_charger_supplied_to; +- charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to); ++ charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to); + charger->get_property = bq24190_charger_get_property; + charger->set_property = bq24190_charger_set_property; + charger->property_is_writeable = bq24190_charger_property_is_writeable; diff --git a/queue-3.18/power-gpio-charger-balance-enable-disable_irq_wake-calls.patch b/queue-3.18/power-gpio-charger-balance-enable-disable_irq_wake-calls.patch new file mode 100644 index 00000000000..9937f1f41e9 --- /dev/null +++ b/queue-3.18/power-gpio-charger-balance-enable-disable_irq_wake-calls.patch @@ -0,0 +1,42 @@ +From faeed51bb65ce0241052d8dc24ac331ade12e976 Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin-Solenikov +Date: Thu, 15 Jan 2015 05:00:37 +0300 +Subject: power: gpio-charger: balance enable/disable_irq_wake calls + +From: Dmitry Eremin-Solenikov + +commit faeed51bb65ce0241052d8dc24ac331ade12e976 upstream. + +enable_irq_wakeup returns 0 in case it correctly enabled the IRQ to +generate the wakeup event (and thus resume should call disable_irq_wake). +Currently gpio-charger driver has this logic inverted. Correct that thus +correcting enable/disable_irq_wake() calls balance. + +Signed-off-by: Dmitry Eremin-Solenikov +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/gpio-charger.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/power/gpio-charger.c ++++ b/drivers/power/gpio-charger.c +@@ -168,7 +168,7 @@ static int gpio_charger_suspend(struct d + + if (device_may_wakeup(dev)) + gpio_charger->wakeup_enabled = +- enable_irq_wake(gpio_charger->irq); ++ !enable_irq_wake(gpio_charger->irq); + + return 0; + } +@@ -178,7 +178,7 @@ static int gpio_charger_resume(struct de + struct platform_device *pdev = to_platform_device(dev); + struct gpio_charger *gpio_charger = platform_get_drvdata(pdev); + +- if (gpio_charger->wakeup_enabled) ++ if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled) + disable_irq_wake(gpio_charger->irq); + power_supply_changed(&gpio_charger->charger); + diff --git a/queue-3.18/power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch b/queue-3.18/power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch new file mode 100644 index 00000000000..6284d9289c2 --- /dev/null +++ b/queue-3.18/power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch @@ -0,0 +1,32 @@ +From 24727b45b484e8937dcde53fa8d1aa70ac30ec0c Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 27 Jan 2015 16:51:54 +0100 +Subject: power_supply: 88pm860x: Fix leaked power supply on probe fail + +From: Krzysztof Kozlowski + +commit 24727b45b484e8937dcde53fa8d1aa70ac30ec0c upstream. + +Driver forgot to unregister power supply if request_threaded_irq() +failed in probe(). In such case the memory associated with power supply +leaked. + +Signed-off-by: Krzysztof Kozlowski +Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x") +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/88pm860x_charger.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/power/88pm860x_charger.c ++++ b/drivers/power/88pm860x_charger.c +@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct p + return 0; + + out_irq: ++ power_supply_unregister(&info->usb); + while (--i >= 0) + free_irq(info->irq[i], info); + out: diff --git a/queue-3.18/proc-pagemap-walk-page-tables-under-pte-lock.patch b/queue-3.18/proc-pagemap-walk-page-tables-under-pte-lock.patch new file mode 100644 index 00000000000..4305a9136c6 --- /dev/null +++ b/queue-3.18/proc-pagemap-walk-page-tables-under-pte-lock.patch @@ -0,0 +1,77 @@ +From 05fbf357d94152171bc50f8a369390f1f16efd89 Mon Sep 17 00:00:00 2001 +From: Konstantin Khlebnikov +Date: Wed, 11 Feb 2015 15:27:31 -0800 +Subject: proc/pagemap: walk page tables under pte lock + +From: Konstantin Khlebnikov + +commit 05fbf357d94152171bc50f8a369390f1f16efd89 upstream. + +Lockless access to pte in pagemap_pte_range() might race with page +migration and trigger BUG_ON(!PageLocked()) in migration_entry_to_page(): + +CPU A (pagemap) CPU B (migration) + lock_page() + try_to_unmap(page, TTU_MIGRATION...) + make_migration_entry() + set_pte_at() + +pte_to_pagemap_entry() + remove_migration_ptes() + unlock_page() + if(is_migration_entry()) + migration_entry_to_page() + BUG_ON(!PageLocked(page)) + +Also lockless read might be non-atomic if pte is larger than wordsize. +Other pte walkers (smaps, numa_maps, clear_refs) already lock ptes. + +Fixes: 052fb0d635df ("proc: report file/anon bit in /proc/pid/pagemap") +Signed-off-by: Konstantin Khlebnikov +Reported-by: Andrey Ryabinin +Reviewed-by: Cyrill Gorcunov +Acked-by: Naoya Horiguchi +Acked-by: Kirill A. Shutemov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/task_mmu.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1034,7 +1034,7 @@ static int pagemap_pte_range(pmd_t *pmd, + struct vm_area_struct *vma; + struct pagemapread *pm = walk->private; + spinlock_t *ptl; +- pte_t *pte; ++ pte_t *pte, *orig_pte; + int err = 0; + + /* find the first VMA at or above 'addr' */ +@@ -1095,15 +1095,19 @@ static int pagemap_pte_range(pmd_t *pmd, + BUG_ON(is_vm_hugetlb_page(vma)); + + /* Addresses in the VMA. */ +- for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) { ++ orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); ++ for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) { + pagemap_entry_t pme; +- pte = pte_offset_map(pmd, addr); ++ + pte_to_pagemap_entry(&pme, pm, vma, addr, *pte); +- pte_unmap(pte); + err = add_to_pagemap(addr, &pme, pm); + if (err) +- return err; ++ break; + } ++ pte_unmap_unlock(orig_pte, ptl); ++ ++ if (err) ++ return err; + + if (addr == end) + break; diff --git a/queue-3.18/random-fix-fast_mix-function.patch b/queue-3.18/random-fix-fast_mix-function.patch new file mode 100644 index 00000000000..b99efed5609 --- /dev/null +++ b/queue-3.18/random-fix-fast_mix-function.patch @@ -0,0 +1,60 @@ +From 19acc77a36970958a4a0e4daeb2c8cb2aab0ffd4 Mon Sep 17 00:00:00 2001 +From: George Spelvin +Date: Sat, 7 Feb 2015 00:32:06 -0500 +Subject: random: Fix fast_mix() function + +From: George Spelvin + +commit 19acc77a36970958a4a0e4daeb2c8cb2aab0ffd4 upstream. + +There was a bad typo in commit 43759d4f429c ("random: use an improved +fast_mix() function") and I didn't notice because it "looked right", so +I saw what I expected to see when I reviewed it. + +Only months later did I look and notice it's not the Threefish-inspired +mix function that I had designed and optimized. + +Mea Culpa. Each input bit still has a chance to affect each output bit, +and the fast pool is spilled *long* before it fills, so it's not a total +disaster, but it's definitely not the intended great improvement. + +I'm still working on finding better rotation constants. These are good +enough, but since it's unrolled twice, it's possible to get better +mixing for free by using eight different constants rather than repeating +the same four. + +Signed-off-by: George Spelvin +Cc: Theodore Ts'o +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/random.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -569,19 +569,19 @@ static void fast_mix(struct fast_pool *f + __u32 c = f->pool[2], d = f->pool[3]; + + a += b; c += d; +- b = rol32(a, 6); d = rol32(c, 27); ++ b = rol32(b, 6); d = rol32(d, 27); + d ^= a; b ^= c; + + a += b; c += d; +- b = rol32(a, 16); d = rol32(c, 14); ++ b = rol32(b, 16); d = rol32(d, 14); + d ^= a; b ^= c; + + a += b; c += d; +- b = rol32(a, 6); d = rol32(c, 27); ++ b = rol32(b, 6); d = rol32(d, 27); + d ^= a; b ^= c; + + a += b; c += d; +- b = rol32(a, 16); d = rol32(c, 14); ++ b = rol32(b, 16); d = rol32(d, 14); + d ^= a; b ^= c; + + f->pool[0] = a; f->pool[1] = b; diff --git a/queue-3.18/rc-main-re-apply-filter-for-no-op-protocol-change.patch b/queue-3.18/rc-main-re-apply-filter-for-no-op-protocol-change.patch new file mode 100644 index 00000000000..dcb96c945ed --- /dev/null +++ b/queue-3.18/rc-main-re-apply-filter-for-no-op-protocol-change.patch @@ -0,0 +1,71 @@ +From 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Mon, 8 Dec 2014 13:17:07 -0300 +Subject: [media] rc-main: Re-apply filter for no-op protocol change +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Hogan + +commit 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 upstream. + +Since commit da6e162d6a46 ("[media] rc-core: simplify sysfs code"), when +the IR protocol is set using the sysfs interface to the same set of +protocols that are already set, store_protocols() does not refresh the +scancode filter with the new protocol, even if it has already called the +change_protocol() callback successfully. This results in the filter +being disabled in the hardware and not re-enabled until the filter is +set again using sysfs. + +Fix in store_protocols() by still re-applying the filter whenever the +change_protocol() driver callback succeeded. + +The problem can be reproduced with the img-ir driver by setting a +filter, and then setting the protocol to the same protocol that is +already set: +$ echo nec > protocols +$ echo 0xffff > filter_mask +$ echo nec > protocols + +After this, messages which don't match the filter were still being +received. + +Fixes: da6e162d6a46 ("[media] rc-core: simplify sysfs code") + +Reported-by: Sifan Naeem +Signed-off-by: James Hogan +Cc: David Härdeman +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/rc-main.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1021,16 +1021,16 @@ static ssize_t store_protocols(struct de + goto out; + } + +- if (new_protocols == old_protocols) { +- rc = len; +- goto out; ++ if (new_protocols != old_protocols) { ++ *current_protocols = new_protocols; ++ IR_dprintk(1, "Protocols changed to 0x%llx\n", ++ (long long)new_protocols); + } + +- *current_protocols = new_protocols; +- IR_dprintk(1, "Protocols changed to 0x%llx\n", (long long)new_protocols); +- + /* +- * If the protocol is changed the filter needs updating. ++ * If a protocol change was attempted the filter may need updating, even ++ * if the actual protocol mask hasn't changed (since the driver may have ++ * cleared the filter). + * Try setting the same filter with the new protocol (if any). + * Fall back to clearing the filter. + */ diff --git a/queue-3.18/ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch b/queue-3.18/ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch new file mode 100644 index 00000000000..8ab87e5d47f --- /dev/null +++ b/queue-3.18/ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch @@ -0,0 +1,152 @@ +From 1e0d6714aceb770b04161fbedd7765d0e1fc27bd Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Tue, 10 Feb 2015 22:14:53 -0500 +Subject: ring-buffer: Do not wake up a splice waiter when page is not full + +From: "Steven Rostedt (Red Hat)" + +commit 1e0d6714aceb770b04161fbedd7765d0e1fc27bd upstream. + +When an application connects to the ring buffer via splice, it can only +read full pages. Splice does not work with partial pages. If there is +not enough data to fill a page, the splice command will either block +or return -EAGAIN (if set to nonblock). + +Code was added where if the page is not full, to just sleep again. +The problem is, it will get woken up again on the next event. That +is, when something is written into the ring buffer, if there is a waiter +it will wake it up. The waiter would then check the buffer, see that +it still does not have enough data to fill a page and go back to sleep. +To make matters worse, when the waiter goes back to sleep, it could +cause another event, which would wake it back up again to see it +doesn't have enough data and sleep again. This produces a tremendous +overhead and fills the ring buffer with noise. + +For example, recording sched_switch on an idle system for 10 seconds +produces 25,350,475 events!!! + +Create another wait queue for those waiters wanting full pages. +When an event is written, it only wakes up waiters if there's a full +page of data. It does not wake up the waiter if the page is not yet +full. + +After this change, recording sched_switch on an idle system for 10 +seconds produces only 800 events. Getting rid of 25,349,675 useless +events (99.9969% of events!!), is something to take seriously. + +Cc: Rabin Vincent +Fixes: e30f53aad220 "tracing: Do not busy wait in buffer splice" +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ring_buffer.c | 40 +++++++++++++++++++++++++++++++++++----- + 1 file changed, 35 insertions(+), 5 deletions(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -450,7 +450,10 @@ int ring_buffer_print_page_header(struct + struct rb_irq_work { + struct irq_work work; + wait_queue_head_t waiters; ++ wait_queue_head_t full_waiters; + bool waiters_pending; ++ bool full_waiters_pending; ++ bool wakeup_full; + }; + + /* +@@ -532,6 +535,10 @@ static void rb_wake_up_waiters(struct ir + struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work); + + wake_up_all(&rbwork->waiters); ++ if (rbwork->wakeup_full) { ++ rbwork->wakeup_full = false; ++ wake_up_all(&rbwork->full_waiters); ++ } + } + + /** +@@ -556,9 +563,11 @@ int ring_buffer_wait(struct ring_buffer + * data in any cpu buffer, or a specific buffer, put the + * caller on the appropriate wait queue. + */ +- if (cpu == RING_BUFFER_ALL_CPUS) ++ if (cpu == RING_BUFFER_ALL_CPUS) { + work = &buffer->irq_work; +- else { ++ /* Full only makes sense on per cpu reads */ ++ full = false; ++ } else { + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + return -ENODEV; + cpu_buffer = buffer->buffers[cpu]; +@@ -567,7 +576,10 @@ int ring_buffer_wait(struct ring_buffer + + + while (true) { +- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); ++ if (full) ++ prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); ++ else ++ prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); + + /* + * The events can happen in critical sections where +@@ -589,7 +601,10 @@ int ring_buffer_wait(struct ring_buffer + * that is necessary is that the wake up happens after + * a task has been queued. It's OK for spurious wake ups. + */ +- work->waiters_pending = true; ++ if (full) ++ work->full_waiters_pending = true; ++ else ++ work->waiters_pending = true; + + if (signal_pending(current)) { + ret = -EINTR; +@@ -618,7 +633,10 @@ int ring_buffer_wait(struct ring_buffer + schedule(); + } + +- finish_wait(&work->waiters, &wait); ++ if (full) ++ finish_wait(&work->full_waiters, &wait); ++ else ++ finish_wait(&work->waiters, &wait); + + return ret; + } +@@ -1233,6 +1251,7 @@ rb_allocate_cpu_buffer(struct ring_buffe + init_completion(&cpu_buffer->update_done); + init_irq_work(&cpu_buffer->irq_work.work, rb_wake_up_waiters); + init_waitqueue_head(&cpu_buffer->irq_work.waiters); ++ init_waitqueue_head(&cpu_buffer->irq_work.full_waiters); + + bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()), + GFP_KERNEL, cpu_to_node(cpu)); +@@ -2804,6 +2823,8 @@ static void rb_commit(struct ring_buffer + static __always_inline void + rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) + { ++ bool pagebusy; ++ + if (buffer->irq_work.waiters_pending) { + buffer->irq_work.waiters_pending = false; + /* irq_work_queue() supplies it's own memory barriers */ +@@ -2815,6 +2836,15 @@ rb_wakeups(struct ring_buffer *buffer, s + /* irq_work_queue() supplies it's own memory barriers */ + irq_work_queue(&cpu_buffer->irq_work.work); + } ++ ++ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; ++ ++ if (!pagebusy && cpu_buffer->irq_work.full_waiters_pending) { ++ cpu_buffer->irq_work.wakeup_full = true; ++ cpu_buffer->irq_work.full_waiters_pending = false; ++ /* irq_work_queue() supplies it's own memory barriers */ ++ irq_work_queue(&cpu_buffer->irq_work.work); ++ } + } + + /** diff --git a/queue-3.18/rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch b/queue-3.18/rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch new file mode 100644 index 00000000000..43c3b39bf45 --- /dev/null +++ b/queue-3.18/rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch @@ -0,0 +1,37 @@ +From aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 20 Jan 2015 11:01:20 -0600 +Subject: rtlwifi: Remove logging statement that is no longer needed + +From: Larry Finger + +commit aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 upstream. + +In commit e9538cf4f907 ("rtlwifi: Fix error when accessing unmapped memory +in skb"), a printk was included to indicate that the condition had been +reached. There is now enough evidence from other users that the fix is +working. That logging statement can now be removed. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/pci.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/pci.c ++++ b/drivers/net/wireless/rtlwifi/pci.c +@@ -816,11 +816,8 @@ static void _rtl_pci_rx_interrupt(struct + + /* get a new skb - if fail, old one will be reused */ + new_skb = dev_alloc_skb(rtlpci->rxbuffersize); +- if (unlikely(!new_skb)) { +- pr_err("Allocation of new skb failed in %s\n", +- __func__); ++ if (unlikely(!new_skb)) + goto no_new; +- } + if (rtlpriv->use_new_trx_flow) { + buffer_desc = + &rtlpci->rx_ring[rxring_idx].buffer_desc diff --git a/queue-3.18/rtlwifi-rtl8192ee-fix-adhoc-fail.patch b/queue-3.18/rtlwifi-rtl8192ee-fix-adhoc-fail.patch new file mode 100644 index 00000000000..a0eb256eed7 --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8192ee-fix-adhoc-fail.patch @@ -0,0 +1,86 @@ +From b661a5da57766f4f565d64238b753d6efc0f5499 Mon Sep 17 00:00:00 2001 +From: Troy Tan +Date: Tue, 20 Jan 2015 11:01:22 -0600 +Subject: rtlwifi: rtl8192ee: Fix adhoc fail + +From: Troy Tan + +commit b661a5da57766f4f565d64238b753d6efc0f5499 upstream. + +When the buffer descriptor index exceeds 2, then a TX HANG condition +will result. + +Signed-off-by: Troy Tan +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ee/fw.c | 6 +----- + drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 26 -------------------------- + 2 files changed, 1 insertion(+), 31 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c +@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i + struct sk_buff *skb = NULL; + + u32 totalpacketlen; +- bool rtstatus; + u8 u1rsvdpageloc[5] = { 0 }; + bool b_dlok = false; + +@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i + memcpy((u8 *)skb_put(skb, totalpacketlen), + &reserved_page_packet, totalpacketlen); + +- rtstatus = rtl_cmd_send_packet(hw, skb); +- +- if (rtstatus) +- b_dlok = true; ++ b_dlok = true; + + if (b_dlok) { + RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD , +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c +@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func + _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1)); + } + +-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); +- struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; +- unsigned long flags; +- +- spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); +- while (skb_queue_len(&ring->queue)) { +- struct rtl_tx_buffer_desc *entry = +- &ring->buffer_desc[ring->idx]; +- struct sk_buff *skb = __skb_dequeue(&ring->queue); +- +- pci_unmap_single(rtlpci->pdev, +- rtlpriv->cfg->ops->get_desc( +- (u8 *)entry, true, HW_DESC_TXBUFF_ADDR), +- skb->len, PCI_DMA_TODEVICE); +- kfree_skb(skb); +- ring->idx = (ring->idx + 1) % ring->entries; +- } +- spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); +-} +- + static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw) + { + _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0); +@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page( + rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2, + bcnvalid_reg | BIT(0)); + +- /* Return Beacon TCB */ +- _rtl92ee_return_beacon_queue_skb(hw); +- + /* download rsvd page */ + rtl92ee_set_fw_rsvdpagepkt(hw, false); + diff --git a/queue-3.18/rtlwifi-rtl8192ee-fix-dma-stalls.patch b/queue-3.18/rtlwifi-rtl8192ee-fix-dma-stalls.patch new file mode 100644 index 00000000000..953f31a9dfb --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8192ee-fix-dma-stalls.patch @@ -0,0 +1,192 @@ +From 21b39ddb5bb2294fe64fbd29045591fe0707825f Mon Sep 17 00:00:00 2001 +From: Troy Tan +Date: Tue, 20 Jan 2015 11:01:26 -0600 +Subject: rtlwifi: rtl8192ee: Fix DMA stalls + +From: Troy Tan + +commit 21b39ddb5bb2294fe64fbd29045591fe0707825f upstream. + +There are instances where the DMA engine stalls. The new code detects +such stalls and restarts DMA without needing a power reset. + +Signed-off-by: Troy Tan +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 140 +++++++++++++++++++++++++++ + drivers/net/wireless/rtlwifi/rtl8192ee/reg.h | 2 + 2 files changed, 142 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c +@@ -1137,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(s + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value); + } + ++static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv) ++{ ++ u8 tmp; ++ ++ /* write reg 0x350 Bit[26]=1. Enable debug port. */ ++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3); ++ if (!(tmp & BIT(2))) { ++ rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3, ++ tmp | BIT(2)); ++ mdelay(100); /* Suggested by DD Justin_tsai. */ ++ } ++ ++ /* read reg 0x350 Bit[25] if 1 : RX hang ++ * read reg 0x350 Bit[24] if 1 : TX hang ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3); ++ if ((tmp & BIT(0)) || (tmp & BIT(1))) { ++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, ++ "CheckPcieDMAHang8192EE(): true!!\n"); ++ return true; ++ } ++ return false; ++} ++ ++static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv, ++ bool mac_power_on) ++{ ++ u8 tmp; ++ bool release_mac_rx_pause; ++ u8 backup_pcie_dma_pause; ++ ++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, ++ "ResetPcieInterfaceDMA8192EE()\n"); ++ ++ /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03" ++ * released by SD1 Alan. ++ */ ++ ++ /* 1. disable register write lock ++ * write 0x1C bit[1:0] = 2'h0 ++ * write 0xCC bit[2] = 1'b1 ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL); ++ tmp &= ~(BIT(1) | BIT(0)); ++ rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp); ++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2); ++ tmp |= BIT(2); ++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp); ++ ++ /* 2. Check and pause TRX DMA ++ * write 0x284 bit[18] = 1'b1 ++ * write 0x301 = 0xFF ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL); ++ if (tmp & BIT(2)) { ++ /* Already pause before the function for another reason. */ ++ release_mac_rx_pause = false; ++ } else { ++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2))); ++ release_mac_rx_pause = true; ++ } ++ ++ backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1); ++ if (backup_pcie_dma_pause != 0xFF) ++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF); ++ ++ if (mac_power_on) { ++ /* 3. reset TRX function ++ * write 0x100 = 0x00 ++ */ ++ rtl_write_byte(rtlpriv, REG_CR, 0); ++ } ++ ++ /* 4. Reset PCIe DMA ++ * write 0x003 bit[0] = 0 ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1); ++ tmp &= ~(BIT(0)); ++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp); ++ ++ /* 5. Enable PCIe DMA ++ * write 0x003 bit[0] = 1 ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1); ++ tmp |= BIT(0); ++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp); ++ ++ if (mac_power_on) { ++ /* 6. enable TRX function ++ * write 0x100 = 0xFF ++ */ ++ rtl_write_byte(rtlpriv, REG_CR, 0xFF); ++ ++ /* We should init LLT & RQPN and ++ * prepare Tx/Rx descrptor address later ++ * because MAC function is reset. ++ */ ++ } ++ ++ /* 7. Restore PCIe autoload down bit ++ * write 0xF8 bit[17] = 1'b1 ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2); ++ tmp |= BIT(1); ++ rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp); ++ ++ /* In MAC power on state, BB and RF maybe in ON state, ++ * if we release TRx DMA here ++ * it will cause packets to be started to Tx/Rx, ++ * so we release Tx/Rx DMA later. ++ */ ++ if (!mac_power_on) { ++ /* 8. release TRX DMA ++ * write 0x284 bit[18] = 1'b0 ++ * write 0x301 = 0x00 ++ */ ++ if (release_mac_rx_pause) { ++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL); ++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, ++ (tmp & (~BIT(2)))); ++ } ++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, ++ backup_pcie_dma_pause); ++ } ++ ++ /* 9. lock system register ++ * write 0xCC bit[2] = 1'b0 ++ */ ++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2); ++ tmp &= ~(BIT(2)); ++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp); ++} ++ + int rtl92ee_hw_init(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +@@ -1162,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw + rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E; + } + ++ if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) { ++ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n"); ++ _rtl8192ee_reset_pcie_interface_dma(rtlpriv, ++ rtlhal->mac_func_enable); ++ rtlhal->mac_func_enable = false; ++ } ++ + rtstatus = _rtl92ee_init_mac(hw); + + rtl_write_byte(rtlpriv, 0x577, 0x03); +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h +@@ -77,9 +77,11 @@ + #define REG_HIMRE 0x00B8 + #define REG_HISRE 0x00BC + ++#define REG_PMC_DBG_CTRL2 0x00CC + #define REG_EFUSE_ACCESS 0x00CF + #define REG_HPON_FSM 0x00EC + #define REG_SYS_CFG1 0x00F0 ++#define REG_MAC_PHY_CTRL_NORMAL 0x00F8 + #define REG_SYS_CFG2 0x00FC + + #define REG_CR 0x0100 diff --git a/queue-3.18/rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch b/queue-3.18/rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch new file mode 100644 index 00000000000..2c81d11c83f --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch @@ -0,0 +1,48 @@ +From 92ff754240b892cbc16dee5aa080322f3db88b68 Mon Sep 17 00:00:00 2001 +From: Troy Tan +Date: Tue, 20 Jan 2015 11:01:24 -0600 +Subject: rtlwifi: rtl8192ee: Fix parsing of received packet + +From: Troy Tan + +commit 92ff754240b892cbc16dee5aa080322f3db88b68 upstream. + +The firmware supplies two kinds of packets via the RX mechanism. Besides the +normal data received over the air, these packets may contain bluetooth status +and other information. The present code fails to detect which kind of +information was received. + +Signed-off-by: Troy Tan +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 4 ++++ + drivers/net/wireless/rtlwifi/rtl8192ee/trx.h | 2 ++ + 2 files changed, 6 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c +@@ -512,6 +512,10 @@ bool rtl92ee_rx_query_desc(struct ieee80 + struct ieee80211_hdr *hdr; + u32 phystatus = GET_RX_DESC_PHYST(pdesc); + ++ if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0) ++ status->packet_report_type = NORMAL_RX; ++ else ++ status->packet_report_type = C2H_PACKET; + status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc); + status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) * + RX_DRV_INFO_SIZE_UNIT; +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h +@@ -542,6 +542,8 @@ + LE_BITS_TO_4BYTE(__pdesc+8, 12, 4) + #define GET_RX_DESC_RX_IS_QOS(__pdesc) \ + LE_BITS_TO_4BYTE(__pdesc+8, 16, 1) ++#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc) \ ++ LE_BITS_TO_4BYTE(__pdesc+8, 28, 1) + + #define GET_RX_DESC_RXMCS(__pdesc) \ + LE_BITS_TO_4BYTE(__pdesc+12, 0, 7) diff --git a/queue-3.18/rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch b/queue-3.18/rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch new file mode 100644 index 00000000000..39ff439b783 --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch @@ -0,0 +1,55 @@ +From 6d4beca3775222884e1ee9d48ef586c438c3dfa1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 3 Feb 2015 11:15:18 -0600 +Subject: rtlwifi: rtl8192ee: Fix problems with calculating free space in FIFO + +From: Larry Finger + +commit 6d4beca3775222884e1ee9d48ef586c438c3dfa1 upstream. + +This driver utilizes a FIFO buffer for RX descriptors. There are four places +in the code where it calculates the number of free slots. Several of those +locations do the calculation incorrectly. To fix these and to prevent future +mistakes, a common inline routine is created. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/pci.h | 7 +++++++ + drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 9 +-------- + 2 files changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/pci.h ++++ b/drivers/net/wireless/rtlwifi/pci.h +@@ -325,4 +325,11 @@ static inline void pci_write32_async(str + writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr); + } + ++static inline u16 calc_fifo_space(u16 rp, u16 wp) ++{ ++ if (rp <= wp) ++ return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp; ++ return rp - wp - 1; ++} ++ + #endif +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c +@@ -658,14 +658,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(st + if (!start_rx) + return 0; + +- if ((last_read_point > (RX_DESC_NUM_92E / 2)) && +- (read_point <= (RX_DESC_NUM_92E / 2))) { +- remind_cnt = RX_DESC_NUM_92E - write_point; +- } else { +- remind_cnt = (read_point >= write_point) ? +- (read_point - write_point) : +- (RX_DESC_NUM_92E - write_point + read_point); +- } ++ remind_cnt = calc_fifo_space(read_point, write_point); + + if (remind_cnt == 0) + return 0; diff --git a/queue-3.18/rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch b/queue-3.18/rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch new file mode 100644 index 00000000000..a00294ee6c4 --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch @@ -0,0 +1,34 @@ +From 6e5f4436162848289f071be38ee6b87dc8ea653d Mon Sep 17 00:00:00 2001 +From: Troy Tan +Date: Tue, 20 Jan 2015 11:01:23 -0600 +Subject: rtlwifi: rtl8192ee: Fix TX hang due to failure to update TX write point + +From: Troy Tan + +commit 6e5f4436162848289f071be38ee6b87dc8ea653d upstream. + +Initially, the routine to update the write point in the FIFO buffer was +coded to save CPU time by not doing the calculation every interrupt. This +was an error and results in TX hangs. + +Signed-off-by: Troy Tan +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c +@@ -1207,8 +1207,7 @@ bool rtl92ee_is_tx_desc_closed(struct ie + static u8 stop_report_cnt; + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue]; + +- /*checking Read/Write Point each interrupt wastes CPU */ +- if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) { ++ { + u16 point_diff = 0; + u16 cur_tx_rp, cur_tx_wp; + u32 tmpu32 = 0; diff --git a/queue-3.18/serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch b/queue-3.18/serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch new file mode 100644 index 00000000000..ebeb25c943c --- /dev/null +++ b/queue-3.18/serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch @@ -0,0 +1,81 @@ +From 5f1437f61a0b351d25b528c159360da3d5e8c77b Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Sat, 10 Jan 2015 01:08:59 +0100 +Subject: serial: fsl_lpuart: avoid new transfer while DMA is running + +From: Stefan Agner + +commit 5f1437f61a0b351d25b528c159360da3d5e8c77b upstream. + +When the UART is in DMA receive mode (RDMAS set) and one character +just arrived while another interrupt is handled (e.g. TX), the RDRF +(receiver data register full flag) is set due to the water level of +1. But since the DMA will take care of this character, there is no +need to handle it by calling lpuart_prepare_rx. Handling it leads to +adding the RX timeout timer twice: + +[ 74.336698] Kernel BUG at 80053070 [verbose debug info unavailable] +[ 74.342999] Internal error: Oops - BUG: 0 [#1] ARM0:00.00 khungtaskd +[ 74.347817] Modules linked in: 0 S 0.0 0.0 0:00.00 writeback +[ 74.350926] CPU: 0 PID: 0 Comm: swapper Not tainted 3.19.0-rc3-00001-g39d78e2 #1788 +[ 74.358617] Hardware name: Freescale Vybrid VF610 (Device Tree)t +[ 74.364563] task: 807a7678 ti: 8079c000 task.ti: 8079c000 kblockd +[ 74.370002] PC is at add_timer+0x24/0x28.0 0.0 0:00.09 kworker/u2:1 +[ 74.373960] LR is at lpuart_int+0x15c/0x3d8 +[ 74.378171] pc : [<80053070>] lr : [<802e0d88>] psr: a0010193 +[ 74.378171] sp : 8079de10 ip : 8079de20 fp : 8079de1c +[ 74.389694] r10: 807d44c0 r9 : 8688c300 r8 : 00000013 +[ 74.394943] r7 : 20010193 r6 : 00000000 r5 : 000000a0 r4 : 86997210 +[ 74.401498] r3 : ffffa7da r2 : 80817868 r1 : 86997210 r0 : 86997344 +[ 74.408052] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel +[ 74.415489] Control: 10c5387d Table: 8611c059 DAC: 00000015 +[ 74.421265] Process swapper (pid: 0, stack limit = 0x8079c230) +... + +Solve this by only execute the receiver path (lpuart_prepare_rx) if +the DMA receive mode (RDMAS) is not set. Also, make sure the flag is +cleared on initialization, in case it has been left set. + +This can be best reproduced using UART as a serial console, then +running top while dd'ing data into the terminal. + +Signed-off-by: Stefan Agner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/fsl_lpuart.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -755,18 +755,18 @@ out: + static irqreturn_t lpuart_int(int irq, void *dev_id) + { + struct lpuart_port *sport = dev_id; +- unsigned char sts; ++ unsigned char sts, crdma; + + sts = readb(sport->port.membase + UARTSR1); ++ crdma = readb(sport->port.membase + UARTCR5); + +- if (sts & UARTSR1_RDRF) { ++ if (sts & UARTSR1_RDRF && !(crdma & UARTCR5_RDMAS)) { + if (sport->lpuart_dma_use) + lpuart_prepare_rx(sport); + else + lpuart_rxint(irq, dev_id); + } +- if (sts & UARTSR1_TDRE && +- !(readb(sport->port.membase + UARTCR5) & UARTCR5_TDMAS)) { ++ if (sts & UARTSR1_TDRE && !(crdma & UARTCR5_TDMAS)) { + if (sport->lpuart_dma_use) + lpuart_pio_tx(sport); + else +@@ -1106,6 +1106,7 @@ static int lpuart_startup(struct uart_po + setup_timer(&sport->lpuart_timer, lpuart_timer_func, + (unsigned long)sport); + temp = readb(port->membase + UARTCR5); ++ temp &= ~UARTCR5_RDMAS; + writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5); + } + diff --git a/queue-3.18/serial-fsl_lpuart-delete-timer-on-shutdown.patch b/queue-3.18/serial-fsl_lpuart-delete-timer-on-shutdown.patch new file mode 100644 index 00000000000..6102288feb6 --- /dev/null +++ b/queue-3.18/serial-fsl_lpuart-delete-timer-on-shutdown.patch @@ -0,0 +1,73 @@ +From 4a8588a1cf867333187d9ff071e6fbdab587d194 Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Sat, 10 Jan 2015 01:08:58 +0100 +Subject: serial: fsl_lpuart: delete timer on shutdown + +From: Stefan Agner + +commit 4a8588a1cf867333187d9ff071e6fbdab587d194 upstream. + +If the serial port gets closed while a RX transfer is in progress, +the timer might fire after the serial port shutdown finished. This +leads in a NULL pointer dereference: + +[ 7.508324] Unable to handle kernel NULL pointer dereference at virtual address 00000000 +[ 7.516590] pgd = 86348000 +[ 7.519445] [00000000] *pgd=86179831, *pte=00000000, *ppte=00000000 +[ 7.526145] Internal error: Oops: 17 [#1] ARM +[ 7.530611] Modules linked in: +[ 7.533876] CPU: 0 PID: 123 Comm: systemd Not tainted 3.19.0-rc3-00004-g5b11ea7 #1778 +[ 7.541827] Hardware name: Freescale Vybrid VF610 (Device Tree) +[ 7.547862] task: 861c3400 ti: 86ac8000 task.ti: 86ac8000 +[ 7.553392] PC is at lpuart_timer_func+0x24/0xf8 +[ 7.558127] LR is at lpuart_timer_func+0x20/0xf8 +[ 7.562857] pc : [<802df99c>] lr : [<802df998>] psr: 600b0113 +[ 7.562857] sp : 86ac9b90 ip : 86ac9b90 fp : 86ac9bbc +[ 7.574467] r10: 80817180 r9 : 80817b98 r8 : 80817998 +[ 7.579803] r7 : 807acee0 r6 : 86989000 r5 : 00000100 r4 : 86997210 +[ 7.586444] r3 : 86ac8000 r2 : 86ac9bc0 r1 : 86997210 r0 : 00000000 +[ 7.593085] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 7.600341] Control: 10c5387d Table: 86348059 DAC: 00000015 +[ 7.606203] Process systemd (pid: 123, stack limit = 0x86ac8230) + +Setup the timer on UART startup which allows to delete the timer +unconditionally on shutdown. This also saves the initialization +on each transfer. + +Signed-off-by: Stefan Agner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/fsl_lpuart.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -506,9 +506,6 @@ static inline void lpuart_prepare_rx(str + + spin_lock_irqsave(&sport->port.lock, flags); + +- init_timer(&sport->lpuart_timer); +- sport->lpuart_timer.function = lpuart_timer_func; +- sport->lpuart_timer.data = (unsigned long)sport; + sport->lpuart_timer.expires = jiffies + sport->dma_rx_timeout; + add_timer(&sport->lpuart_timer); + +@@ -1106,6 +1103,8 @@ static int lpuart_startup(struct uart_po + sport->lpuart_dma_use = false; + } else { + sport->lpuart_dma_use = true; ++ setup_timer(&sport->lpuart_timer, lpuart_timer_func, ++ (unsigned long)sport); + temp = readb(port->membase + UARTCR5); + writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5); + } +@@ -1180,6 +1179,8 @@ static void lpuart_shutdown(struct uart_ + devm_free_irq(port->dev, port->irq, sport); + + if (sport->lpuart_dma_use) { ++ del_timer_sync(&sport->lpuart_timer); ++ + lpuart_dma_tx_free(port); + lpuart_dma_rx_free(port); + } diff --git a/queue-3.18/series b/queue-3.18/series new file mode 100644 index 00000000000..276379d4c79 --- /dev/null +++ b/queue-3.18/series @@ -0,0 +1,121 @@ +bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch +bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch +bluetooth-fix-valid-identity-address-check.patch +bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch +bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch +bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch +random-fix-fast_mix-function.patch +xfs-ensure-buffer-types-are-set-correctly.patch +xfs-inode-unlink-does-not-set-agi-buffer-type.patch +xfs-set-buf-types-when-converting-extent-formats.patch +xfs-set-superblock-buffer-type-correctly.patch +fsnotify-fix-handling-of-renames-in-audit.patch +iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch +iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch +iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch +iwlwifi-mvm-always-use-mac-color-zero.patch +hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch +pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch +pci-fix-infinite-loop-with-rom-image-of-size-0.patch +asoc-rt5670-set-use_single_rw-flag-for-regmap.patch +asoc-mioa701_wm9713-fix-speaker-event.patch +asoc-davinci-fix-dm365_evm-codec-selection.patch +rtlwifi-rtl8192ee-fix-adhoc-fail.patch +rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch +rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch +rtlwifi-rtl8192ee-fix-dma-stalls.patch +rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch +rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch +cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch +cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch +cpufreq-s3c-remove-incorrect-__init-annotations.patch +cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch +xen-manage-fix-usb-interaction-issues-when-resuming.patch +xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch +acpi-lpss-always-disable-i2c-host-controllers.patch +acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch +lmedm04-increase-interupt-due-time-to-200-msec.patch +lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch +si2168-define-symbol-rate-limits.patch +alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch +alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch +alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch +alsa-hdspm-constrain-periods-to-2-on-older-cards.patch +power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch +power-bq24190-fix-ignored-supplicants.patch +power-gpio-charger-balance-enable-disable_irq_wake-calls.patch +megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch +megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch +megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch +rc-main-re-apply-filter-for-no-op-protocol-change.patch +timberdale-do-not-select-timb_dma.patch +em28xx-ensure-closing-messages-terminate-with-a-newline.patch +em28xx-input-fix-missing-newlines.patch +em28xx-audio-fix-missing-newlines.patch +em28xx-core-fix-missing-newlines.patch +em28xx-video-fix-missing-newlines.patch +em28xx-dvb-fix-missing-newlines.patch +em28xx-audio-fix-missing-newlines-again.patch +mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch +mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch +mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch +mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch +proc-pagemap-walk-page-tables-under-pte-lock.patch +nfs-don-t-call-blocking-operations-while-task_running.patch +nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch +kvm-mips-disable-htw-while-in-guest.patch +kvm-mips-don-t-leak-fpu-dsp-to-guest.patch +mips-alchemy-fix-cpu-clock-calculation.patch +mips-kernel-cps-vec-replace-addi-with-addiu.patch +mips-asm-asmmacro-replace-add-instructions-with-addu.patch +mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch +mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch +mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch +mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch +mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch +tracing-fix-unmapping-loop-in-tracing_mark_write.patch +blk-mq-fix-double-free-in-error-path.patch +arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch +arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch +arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch +arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch +arm-dts-bcm63xx-fix-l2-cache-properties.patch +tpm_tis-verify-interrupt-during-init.patch +tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch +char-tpm-add-missing-error-check-for-devm_kzalloc.patch +tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch +tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch +added-little-endian-support-to-vtpm-module.patch +nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch +sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch +nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch +nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch +sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch +sg-fix-ewouldblock-errors-with-scsi-mq.patch +iscsi-target-drop-problematic-active_ts_list-usage.patch +cfq-iosched-handle-failure-of-cfq-group-allocation.patch +cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch +cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch +ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch +smack-fix-possible-use-after-frees-in-task_security-callers.patch +axonram-fix-bug-in-direct_access.patch +tty-prevent-untrappable-signals-from-malicious-program.patch +tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch +mei-mask-interrupt-set-bit-on-clean-reset-bit.patch +mei-me-release-hw-from-reset-only-during-the-reset-flow.patch +usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch +usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch +usb-musb-add-omap-control-dependency.patch +usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch +usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch +usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch +vt-provide-notifications-on-selection-changes.patch +arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch +arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch +arm-vexpress-use-arm_cpu_suspend-if-needed.patch +arm-mvebu-build-armada375-smp-code-conditionally.patch +kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch +ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch +serial-fsl_lpuart-delete-timer-on-shutdown.patch +serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch +arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch diff --git a/queue-3.18/sg-fix-ewouldblock-errors-with-scsi-mq.patch b/queue-3.18/sg-fix-ewouldblock-errors-with-scsi-mq.patch new file mode 100644 index 00000000000..c4b24134ca7 --- /dev/null +++ b/queue-3.18/sg-fix-ewouldblock-errors-with-scsi-mq.patch @@ -0,0 +1,54 @@ +From 7772855a996ec6e16944b120ab5ce21050279821 Mon Sep 17 00:00:00 2001 +From: Tony Battersby +Date: Fri, 13 Feb 2015 12:10:58 -0500 +Subject: sg: fix EWOULDBLOCK errors with scsi-mq + +From: Tony Battersby + +commit 7772855a996ec6e16944b120ab5ce21050279821 upstream. + +With scsi-mq enabled, userspace programs can get unexpected EWOULDBLOCK +(a.k.a. EAGAIN) errors when submitting commands to the SCSI generic +driver. Fix by calling blk_get_request() with GFP_KERNEL instead of +GFP_ATOMIC. + +Note: to avoid introducing a potential deadlock, this patch should be +applied after the patch titled "sg: fix unkillable I/O wait deadlock +with scsi-mq". + +Signed-off-by: Tony Battersby +Acked-by: Douglas Gilbert +Tested-by: Douglas Gilbert +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1721,7 +1721,22 @@ sg_start_req(Sg_request *srp, unsigned c + return -ENOMEM; + } + +- rq = blk_get_request(q, rw, GFP_ATOMIC); ++ /* ++ * NOTE ++ * ++ * With scsi-mq enabled, there are a fixed number of preallocated ++ * requests equal in number to shost->can_queue. If all of the ++ * preallocated requests are already in use, then using GFP_ATOMIC with ++ * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL ++ * will cause blk_get_request() to sleep until an active command ++ * completes, freeing up a request. Neither option is ideal, but ++ * GFP_KERNEL is the better choice to prevent userspace from getting an ++ * unexpected EWOULDBLOCK. ++ * ++ * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually ++ * does not sleep except under memory pressure. ++ */ ++ rq = blk_get_request(q, rw, GFP_KERNEL); + if (IS_ERR(rq)) { + kfree(long_cmdp); + return PTR_ERR(rq); diff --git a/queue-3.18/sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch b/queue-3.18/sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch new file mode 100644 index 00000000000..6df616ca03e --- /dev/null +++ b/queue-3.18/sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch @@ -0,0 +1,67 @@ +From 7568615c1054907ea8c7701ab86dad51aa099888 Mon Sep 17 00:00:00 2001 +From: Tony Battersby +Date: Fri, 13 Feb 2015 12:09:44 -0500 +Subject: sg: fix unkillable I/O wait deadlock with scsi-mq + +From: Tony Battersby + +commit 7568615c1054907ea8c7701ab86dad51aa099888 upstream. + +When using the write()/read() interface for submitting commands, the +SCSI generic driver does not call blk_put_request() on a completed SCSI +command until userspace calls read() to get the command completion. +Since scsi-mq uses a fixed number of preallocated requests, this makes +it possible for userspace to exhaust the entire preallocated supply of +requests. For places in the kernel that call blk_get_request() with +GFP_KERNEL, this can cause the calling process to deadlock in a +permanent unkillable I/O wait in blk_get_request() -> ... -> bt_get(). +For places in the kernel that call blk_get_request() with GFP_ATOMIC, +this can cause blk_get_request() always to return -EWOULDBLOCK. Note +that these problems happen only if scsi-mq is enabled. Prevent the +problems by calling blk_put_request() as soon as the SCSI command +completes instead of waiting for userspace to call read(). + +Signed-off-by: Tony Battersby +Acked-by: Douglas Gilbert +Tested-by: Douglas Gilbert +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1376,6 +1376,17 @@ sg_rq_end_io(struct request *rq, int upt + } + /* Rely on write phase to clean out srp status values, so no "else" */ + ++ /* ++ * Free the request as soon as it is complete so that its resources ++ * can be reused without waiting for userspace to read() the ++ * result. But keep the associated bio (if any) around until ++ * blk_rq_unmap_user() can be called from user context. ++ */ ++ srp->rq = NULL; ++ if (rq->cmd != rq->__cmd) ++ kfree(rq->cmd); ++ __blk_put_request(rq->q, rq); ++ + write_lock_irqsave(&sfp->rq_list_lock, iflags); + if (unlikely(srp->orphan)) { + if (sfp->keep_orphan) +@@ -1803,10 +1814,10 @@ sg_finish_rem_req(Sg_request *srp) + SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp, + "sg_finish_rem_req: res_used=%d\n", + (int) srp->res_used)); +- if (srp->rq) { +- if (srp->bio) +- ret = blk_rq_unmap_user(srp->bio); ++ if (srp->bio) ++ ret = blk_rq_unmap_user(srp->bio); + ++ if (srp->rq) { + if (srp->rq->cmd != srp->rq->__cmd) + kfree(srp->rq->cmd); + blk_put_request(srp->rq); diff --git a/queue-3.18/si2168-define-symbol-rate-limits.patch b/queue-3.18/si2168-define-symbol-rate-limits.patch new file mode 100644 index 00000000000..c07a79178f3 --- /dev/null +++ b/queue-3.18/si2168-define-symbol-rate-limits.patch @@ -0,0 +1,33 @@ +From f1ecc5d119530fce01094307e029ed7f2c9067d8 Mon Sep 17 00:00:00 2001 +From: Antti Palosaari +Date: Tue, 25 Nov 2014 16:26:49 -0300 +Subject: [media] si2168: define symbol rate limits + +From: Antti Palosaari + +commit f1ecc5d119530fce01094307e029ed7f2c9067d8 upstream. + +w_scan complains about missing symbol rate limits: +This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org + +Chip supports 1 to 7.2 MSymbol/s on DVB-C. + +Signed-off-by: Antti Palosaari +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/si2168.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/dvb-frontends/si2168.c ++++ b/drivers/media/dvb-frontends/si2168.c +@@ -605,6 +605,8 @@ static const struct dvb_frontend_ops si2 + .delsys = {SYS_DVBT, SYS_DVBT2, SYS_DVBC_ANNEX_A}, + .info = { + .name = "Silicon Labs Si2168", ++ .symbol_rate_min = 1000000, ++ .symbol_rate_max = 7200000, + .caps = FE_CAN_FEC_1_2 | + FE_CAN_FEC_2_3 | + FE_CAN_FEC_3_4 | diff --git a/queue-3.18/smack-fix-possible-use-after-frees-in-task_security-callers.patch b/queue-3.18/smack-fix-possible-use-after-frees-in-task_security-callers.patch new file mode 100644 index 00000000000..025a0a648af --- /dev/null +++ b/queue-3.18/smack-fix-possible-use-after-frees-in-task_security-callers.patch @@ -0,0 +1,250 @@ +From 6d1cff2a885850b78b40c34777b46cf5da5d1050 Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin +Date: Tue, 13 Jan 2015 18:52:40 +0300 +Subject: smack: fix possible use after frees in task_security() callers + +From: Andrey Ryabinin + +commit 6d1cff2a885850b78b40c34777b46cf5da5d1050 upstream. + +We hit use after free on dereferncing pointer to task_smack struct in +smk_of_task() called from smack_task_to_inode(). + +task_security() macro uses task_cred_xxx() to get pointer to the task_smack. +task_cred_xxx() could be used only for non-pointer members of task's +credentials. It cannot be used for pointer members since what they point +to may disapper after dropping RCU read lock. + +Mainly task_security() used this way: + smk_of_task(task_security(p)) + +Intead of this introduce function smk_of_task_struct() which +takes task_struct as argument and returns pointer to smk_known struct +and do this under RCU read lock. +Bogus task_security() macro is not used anymore, so remove it. + +KASan's report for this: + + AddressSanitizer: use after free in smack_task_to_inode+0x50/0x70 at addr c4635600 + ============================================================================= + BUG kmalloc-64 (Tainted: PO): kasan error + ----------------------------------------------------------------------------- + + Disabling lock debugging due to kernel taint + INFO: Allocated in new_task_smack+0x44/0xd8 age=39 cpu=0 pid=1866 + kmem_cache_alloc_trace+0x88/0x1bc + new_task_smack+0x44/0xd8 + smack_cred_prepare+0x48/0x21c + security_prepare_creds+0x44/0x4c + prepare_creds+0xdc/0x110 + smack_setprocattr+0x104/0x150 + security_setprocattr+0x4c/0x54 + proc_pid_attr_write+0x12c/0x194 + vfs_write+0x1b0/0x370 + SyS_write+0x5c/0x94 + ret_fast_syscall+0x0/0x48 + INFO: Freed in smack_cred_free+0xc4/0xd0 age=27 cpu=0 pid=1564 + kfree+0x270/0x290 + smack_cred_free+0xc4/0xd0 + security_cred_free+0x34/0x3c + put_cred_rcu+0x58/0xcc + rcu_process_callbacks+0x738/0x998 + __do_softirq+0x264/0x4cc + do_softirq+0x94/0xf4 + irq_exit+0xbc/0x120 + handle_IRQ+0x104/0x134 + gic_handle_irq+0x70/0xac + __irq_svc+0x44/0x78 + _raw_spin_unlock+0x18/0x48 + sync_inodes_sb+0x17c/0x1d8 + sync_filesystem+0xac/0xfc + vdfs_file_fsync+0x90/0xc0 + vfs_fsync_range+0x74/0x7c + INFO: Slab 0xd3b23f50 objects=32 used=31 fp=0xc4635600 flags=0x4080 + INFO: Object 0xc4635600 @offset=5632 fp=0x (null) + + Bytes b4 c46355f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ + Object c4635600: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + Object c4635610: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + Object c4635620: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + Object c4635630: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. + Redzone c4635640: bb bb bb bb .... + Padding c46356e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ + Padding c46356f8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ + CPU: 5 PID: 834 Comm: launchpad_prelo Tainted: PBO 3.10.30 #1 + Backtrace: + [] (dump_backtrace+0x0/0x158) from [] (show_stack+0x20/0x24) + r7:c4634010 r6:d3b23f50 r5:c4635600 r4:d1002140 + [] (show_stack+0x0/0x24) from [] (dump_stack+0x20/0x28) + [] (dump_stack+0x0/0x28) from [] (print_trailer+0x124/0x144) + [] (print_trailer+0x0/0x144) from [] (object_err+0x3c/0x44) + r7:c4635600 r6:d1002140 r5:d3b23f50 r4:c4635600 + [] (object_err+0x0/0x44) from [] (kasan_report_error+0x2b8/0x538) + r6:d1002140 r5:d3b23f50 r4:c6429cf8 r3:c09e1aa7 + [] (kasan_report_error+0x0/0x538) from [] (__asan_load4+0xd4/0xf8) + [] (__asan_load4+0x0/0xf8) from [] (smack_task_to_inode+0x50/0x70) + r5:c4635600 r4:ca9da000 + [] (smack_task_to_inode+0x0/0x70) from [] (security_task_to_inode+0x3c/0x44) + r5:cca25e80 r4:c0ba9780 + [] (security_task_to_inode+0x0/0x44) from [] (pid_revalidate+0x124/0x178) + r6:00000000 r5:cca25e80 r4:cbabe3c0 r3:00008124 + [] (pid_revalidate+0x0/0x178) from [] (lookup_fast+0x35c/0x43y4) + r9:c6429efc r8:00000101 r7:c079d940 r6:c6429e90 r5:c6429ed8 r4:c83c4148 + [] (lookup_fast+0x0/0x434) from [] (do_last.isra.24+0x1c0/0x1108) + [] (do_last.isra.24+0x0/0x1108) from [] (path_openat.isra.25+0xf4/0x648) + [] (path_openat.isra.25+0x0/0x648) from [] (do_filp_open+0x3c/0x88) + [] (do_filp_open+0x0/0x88) from [] (do_sys_open+0xf0/0x198) + r7:00000001 r6:c0ea2180 r5:0000000b r4:00000000 + [] (do_sys_open+0x0/0x198) from [] (SyS_open+0x30/0x34) + [] (SyS_open+0x0/0x34) from [] (ret_fast_syscall+0x0/0x48) + Read of size 4 by thread T834: + Memory state around the buggy address: + c4635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + c4635400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc + c4635480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + c4635500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc + c4635580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + >c4635600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + c4635680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + c4635700: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc + c4635780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + c4635800: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc + c4635880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ================================================================== + +Signed-off-by: Andrey Ryabinin +Signed-off-by: Greg Kroah-Hartman + +--- + security/smack/smack.h | 10 ++++++++++ + security/smack/smack_lsm.c | 24 +++++++++++++----------- + 2 files changed, 23 insertions(+), 11 deletions(-) + +--- a/security/smack/smack.h ++++ b/security/smack/smack.h +@@ -298,6 +298,16 @@ static inline struct smack_known *smk_of + return tsp->smk_task; + } + ++static inline struct smack_known *smk_of_task_struct(const struct task_struct *t) ++{ ++ struct smack_known *skp; ++ ++ rcu_read_lock(); ++ skp = smk_of_task(__task_cred(t)->security); ++ rcu_read_unlock(); ++ return skp; ++} ++ + /* + * Present a pointer to the forked smack label entry in an task blob. + */ +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -43,8 +43,6 @@ + #include + #include "smack.h" + +-#define task_security(task) (task_cred_xxx((task), security)) +- + #define TRANS_TRUE "TRUE" + #define TRANS_TRUE_SIZE 4 + +@@ -119,7 +117,7 @@ static int smk_bu_current(char *note, st + static int smk_bu_task(struct task_struct *otp, int mode, int rc) + { + struct task_smack *tsp = current_security(); +- struct task_smack *otsp = task_security(otp); ++ struct smack_known *smk_task = smk_of_task_struct(otp); + char acc[SMK_NUM_ACCESS_TYPE + 1]; + + if (rc <= 0) +@@ -127,7 +125,7 @@ static int smk_bu_task(struct task_struc + + smk_bu_mode(mode, acc); + pr_info("Smack Bringup: (%s %s %s) %s to %s\n", +- tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc, ++ tsp->smk_task->smk_known, smk_task->smk_known, acc, + current->comm, otp->comm); + return 0; + } +@@ -344,7 +342,8 @@ static int smk_ptrace_rule_check(struct + saip = &ad; + } + +- tsp = task_security(tracer); ++ rcu_read_lock(); ++ tsp = __task_cred(tracer)->security; + tracer_known = smk_of_task(tsp); + + if ((mode & PTRACE_MODE_ATTACH) && +@@ -364,11 +363,14 @@ static int smk_ptrace_rule_check(struct + tracee_known->smk_known, + 0, rc, saip); + ++ rcu_read_unlock(); + return rc; + } + + /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ + rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip); ++ ++ rcu_read_unlock(); + return rc; + } + +@@ -395,7 +397,7 @@ static int smack_ptrace_access_check(str + if (rc != 0) + return rc; + +- skp = smk_of_task(task_security(ctp)); ++ skp = smk_of_task_struct(ctp); + + rc = smk_ptrace_rule_check(current, skp, mode, __func__); + return rc; +@@ -1825,7 +1827,7 @@ static int smk_curacc_on_task(struct tas + const char *caller) + { + struct smk_audit_info ad; +- struct smack_known *skp = smk_of_task(task_security(p)); ++ struct smack_known *skp = smk_of_task_struct(p); + int rc; + + smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); +@@ -1878,7 +1880,7 @@ static int smack_task_getsid(struct task + */ + static void smack_task_getsecid(struct task_struct *p, u32 *secid) + { +- struct smack_known *skp = smk_of_task(task_security(p)); ++ struct smack_known *skp = smk_of_task_struct(p); + + *secid = skp->smk_secid; + } +@@ -1985,7 +1987,7 @@ static int smack_task_kill(struct task_s + { + struct smk_audit_info ad; + struct smack_known *skp; +- struct smack_known *tkp = smk_of_task(task_security(p)); ++ struct smack_known *tkp = smk_of_task_struct(p); + int rc; + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); +@@ -2039,7 +2041,7 @@ static int smack_task_wait(struct task_s + static void smack_task_to_inode(struct task_struct *p, struct inode *inode) + { + struct inode_smack *isp = inode->i_security; +- struct smack_known *skp = smk_of_task(task_security(p)); ++ struct smack_known *skp = smk_of_task_struct(p); + + isp->smk_inode = skp; + } +@@ -3199,7 +3201,7 @@ unlockandout: + */ + static int smack_getprocattr(struct task_struct *p, char *name, char **value) + { +- struct smack_known *skp = smk_of_task(task_security(p)); ++ struct smack_known *skp = smk_of_task_struct(p); + char *cp; + int slen; + diff --git a/queue-3.18/sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch b/queue-3.18/sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch new file mode 100644 index 00000000000..da6f6e9a5ac --- /dev/null +++ b/queue-3.18/sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch @@ -0,0 +1,183 @@ +From 03a9a42a1a7e5b3e7919ddfacc1d1cc81882a955 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 30 Jan 2015 18:12:28 -0500 +Subject: SUNRPC: NULL utsname dereference on NFS umount during namespace cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Trond Myklebust + +commit 03a9a42a1a7e5b3e7919ddfacc1d1cc81882a955 upstream. + +Fix an Oopsable condition when nsm_mon_unmon is called as part of the +namespace cleanup, which now apparently happens after the utsname +has been freed. + +Link: http://lkml.kernel.org/r/20150125220604.090121ae@neptune.home +Reported-by: Bruno Prémont +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/lockd/mon.c | 13 +++++++++---- + include/linux/sunrpc/clnt.h | 3 ++- + net/sunrpc/clnt.c | 12 +++++++----- + net/sunrpc/rpcb_clnt.c | 8 ++++++-- + 4 files changed, 24 insertions(+), 12 deletions(-) + +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -65,7 +65,7 @@ static inline struct sockaddr *nsm_addr( + return (struct sockaddr *)&nsm->sm_addr; + } + +-static struct rpc_clnt *nsm_create(struct net *net) ++static struct rpc_clnt *nsm_create(struct net *net, const char *nodename) + { + struct sockaddr_in sin = { + .sin_family = AF_INET, +@@ -77,6 +77,7 @@ static struct rpc_clnt *nsm_create(struc + .address = (struct sockaddr *)&sin, + .addrsize = sizeof(sin), + .servername = "rpc.statd", ++ .nodename = nodename, + .program = &nsm_program, + .version = NSM_VERSION, + .authflavor = RPC_AUTH_NULL, +@@ -102,7 +103,7 @@ out: + return clnt; + } + +-static struct rpc_clnt *nsm_client_get(struct net *net) ++static struct rpc_clnt *nsm_client_get(struct net *net, const char *nodename) + { + struct rpc_clnt *clnt, *new; + struct lockd_net *ln = net_generic(net, lockd_net_id); +@@ -111,7 +112,7 @@ static struct rpc_clnt *nsm_client_get(s + if (clnt != NULL) + goto out; + +- clnt = new = nsm_create(net); ++ clnt = new = nsm_create(net, nodename); + if (IS_ERR(clnt)) + goto out; + +@@ -190,19 +191,23 @@ int nsm_monitor(const struct nlm_host *h + struct nsm_res res; + int status; + struct rpc_clnt *clnt; ++ const char *nodename = NULL; + + dprintk("lockd: nsm_monitor(%s)\n", nsm->sm_name); + + if (nsm->sm_monitored) + return 0; + ++ if (host->h_rpcclnt) ++ nodename = host->h_rpcclnt->cl_nodename; ++ + /* + * Choose whether to record the caller_name or IP address of + * this peer in the local rpc.statd's database. + */ + nsm->sm_mon_name = nsm_use_hostnames ? nsm->sm_name : nsm->sm_addrbuf; + +- clnt = nsm_client_get(host->net); ++ clnt = nsm_client_get(host->net, nodename); + if (IS_ERR(clnt)) { + status = PTR_ERR(clnt); + dprintk("lockd: failed to create NSM upcall transport, " +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -57,7 +57,7 @@ struct rpc_clnt { + const struct rpc_timeout *cl_timeout; /* Timeout strategy */ + + int cl_nodelen; /* nodename length */ +- char cl_nodename[UNX_MAXNODENAME]; ++ char cl_nodename[UNX_MAXNODENAME+1]; + struct rpc_pipe_dir_head cl_pipedir_objects; + struct rpc_clnt * cl_parent; /* Points to parent of clones */ + struct rpc_rtt cl_rtt_default; +@@ -109,6 +109,7 @@ struct rpc_create_args { + struct sockaddr *saddress; + const struct rpc_timeout *timeout; + const char *servername; ++ const char *nodename; + const struct rpc_program *program; + u32 prognumber; /* overrides program->number */ + u32 version; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -286,10 +286,8 @@ static struct rpc_xprt *rpc_clnt_set_tra + + static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename) + { +- clnt->cl_nodelen = strlen(nodename); +- if (clnt->cl_nodelen > UNX_MAXNODENAME) +- clnt->cl_nodelen = UNX_MAXNODENAME; +- memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen); ++ clnt->cl_nodelen = strlcpy(clnt->cl_nodename, ++ nodename, sizeof(clnt->cl_nodename)); + } + + static int rpc_client_register(struct rpc_clnt *clnt, +@@ -360,6 +358,7 @@ static struct rpc_clnt * rpc_new_client( + const struct rpc_version *version; + struct rpc_clnt *clnt = NULL; + const struct rpc_timeout *timeout; ++ const char *nodename = args->nodename; + int err; + + /* sanity check the name before trying to print it */ +@@ -415,8 +414,10 @@ static struct rpc_clnt * rpc_new_client( + + atomic_set(&clnt->cl_count, 1); + ++ if (nodename == NULL) ++ nodename = utsname()->nodename; + /* save the nodename */ +- rpc_clnt_set_nodename(clnt, utsname()->nodename); ++ rpc_clnt_set_nodename(clnt, nodename); + + err = rpc_client_register(clnt, args->authflavor, args->client_name); + if (err) +@@ -571,6 +572,7 @@ static struct rpc_clnt *__rpc_clone_clie + if (xprt == NULL) + goto out_err; + args->servername = xprt->servername; ++ args->nodename = clnt->cl_nodename; + + new = rpc_new_client(args, xprt, clnt); + if (IS_ERR(new)) { +--- a/net/sunrpc/rpcb_clnt.c ++++ b/net/sunrpc/rpcb_clnt.c +@@ -355,7 +355,8 @@ out: + return result; + } + +-static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname, ++static struct rpc_clnt *rpcb_create(struct net *net, const char *nodename, ++ const char *hostname, + struct sockaddr *srvaddr, size_t salen, + int proto, u32 version) + { +@@ -365,6 +366,7 @@ static struct rpc_clnt *rpcb_create(stru + .address = srvaddr, + .addrsize = salen, + .servername = hostname, ++ .nodename = nodename, + .program = &rpcb_program, + .version = version, + .authflavor = RPC_AUTH_UNIX, +@@ -740,7 +742,9 @@ void rpcb_getport_async(struct rpc_task + dprintk("RPC: %5u %s: trying rpcbind version %u\n", + task->tk_pid, __func__, bind_version); + +- rpcb_clnt = rpcb_create(xprt->xprt_net, xprt->servername, sap, salen, ++ rpcb_clnt = rpcb_create(xprt->xprt_net, ++ clnt->cl_nodename, ++ xprt->servername, sap, salen, + xprt->prot, bind_version); + if (IS_ERR(rpcb_clnt)) { + status = PTR_ERR(rpcb_clnt); diff --git a/queue-3.18/timberdale-do-not-select-timb_dma.patch b/queue-3.18/timberdale-do-not-select-timb_dma.patch new file mode 100644 index 00000000000..08e44ce25be --- /dev/null +++ b/queue-3.18/timberdale-do-not-select-timb_dma.patch @@ -0,0 +1,45 @@ +From 244829226f47ffb4d6009a2ccd2771cd149d8114 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 28 Jan 2015 18:17:41 -0300 +Subject: [media] timberdale: do not select TIMB_DMA + +From: Arnd Bergmann + +commit 244829226f47ffb4d6009a2ccd2771cd149d8114 upstream. + +The timberdale media driver requires the use of the respective +dma engine driver, but that may not be enabled, causing a +Kconfig warning: + +warning: (VIDEO_TIMBERDALE) selects TIMB_DMA which has unmet direct dependencies (DMADEVICES && MFD_TIMBERDALE) + +This fixes the dependency by removing the inappropriate 'select' +statement and replacing it with a direct dependency on the +drivers that provide the services this needs. + +Fixes: 7155043c2d027 ("[media] enable COMPILE_TEST for media drivers") + +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/Kconfig | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/media/platform/Kconfig ++++ b/drivers/media/platform/Kconfig +@@ -56,10 +56,8 @@ config VIDEO_VIU + + config VIDEO_TIMBERDALE + tristate "Support for timberdale Video In/LogiWIN" +- depends on VIDEO_V4L2 && I2C && DMADEVICES +- depends on MFD_TIMBERDALE || COMPILE_TEST +- select DMA_ENGINE +- select TIMB_DMA ++ depends on VIDEO_V4L2 && I2C ++ depends on (MFD_TIMBERDALE && TIMB_DMA) || COMPILE_TEST + select VIDEO_ADV7180 + select VIDEOBUF_DMA_CONTIG + ---help--- diff --git a/queue-3.18/tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch b/queue-3.18/tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch new file mode 100644 index 00000000000..a2d6ea96607 --- /dev/null +++ b/queue-3.18/tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch @@ -0,0 +1,34 @@ +From 398a1e71dc827b994b7f2f56c7c2186fea7f8d75 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Fri, 29 Aug 2014 10:33:02 +0100 +Subject: TPM: Add new TPMs to the tail of the list to prevent inadvertent change of dev + +From: David Howells + +commit 398a1e71dc827b994b7f2f56c7c2186fea7f8d75 upstream. + +Add newly registered TPMs to the tail of the list, not the beginning, so that +things that are specifying TPM_ANY_NUM don't find that the device they're +using has inadvertently changed. Adding a second device would break IMA, for +instance. + +Signed-off-by: David Howells +Reviewed-by: Jason Gunthorpe +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm-interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -1122,7 +1122,7 @@ struct tpm_chip *tpm_register_hardware(s + + /* Make chip available */ + spin_lock(&driver_lock); +- list_add_rcu(&chip->list, &tpm_chip_list); ++ list_add_tail_rcu(&chip->list, &tpm_chip_list); + spin_unlock(&driver_lock); + + return chip; diff --git a/queue-3.18/tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch b/queue-3.18/tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch new file mode 100644 index 00000000000..3734fd8164d --- /dev/null +++ b/queue-3.18/tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch @@ -0,0 +1,49 @@ +From 84eb186bc37c0900b53077ca21cf6dd15823a232 Mon Sep 17 00:00:00 2001 +From: "Hon Ching (Vicky) Lo" +Date: Sun, 30 Nov 2014 15:01:28 +0100 +Subject: tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma + +From: "Hon Ching (Vicky) Lo" + +commit 84eb186bc37c0900b53077ca21cf6dd15823a232 upstream. + +There was an oops in tpm_ibmvtpm_get_desired_dma, which caused +kernel panic during boot when vTPM is enabled in Power partition +configured in AMS mode. + +vio_bus_probe calls vio_cmo_bus_probe which calls +tpm_ibmvtpm_get_desired_dma to get the size needed for DMA allocation. +The problem is, vio_cmo_bus_probe is called before calling probe, which +for vtpm is tpm_ibmvtpm_probe and it's this function that initializes +and sets up vtpm's CRQ and gets required data values. Therefore, +since this has not yet been done, NULL is returned in attempt to get +the size for DMA allocation. + +We added a NULL check. In addition, a default buffer size will +be set when NULL is returned. + +Signed-off-by: Hon Ching (Vicky) Lo +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -307,6 +307,14 @@ static int tpm_ibmvtpm_remove(struct vio + static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev) + { + struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev); ++ ++ /* ibmvtpm initializes at probe time, so the data we are ++ * asking for may not be set yet. Estimate that 4K required ++ * for TCE-mapped buffer in addition to CRQ. ++ */ ++ if (!ibmvtpm) ++ return CRQ_RES_BUF_SIZE + PAGE_SIZE; ++ + return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size; + } + diff --git a/queue-3.18/tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch b/queue-3.18/tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch new file mode 100644 index 00000000000..384752b9929 --- /dev/null +++ b/queue-3.18/tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch @@ -0,0 +1,37 @@ +From 1ba3b0b6f218072afe8372d12f1b6bf26a26008e Mon Sep 17 00:00:00 2001 +From: Christophe Ricard +Date: Mon, 1 Dec 2014 19:32:46 +0100 +Subject: tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send + +From: Christophe Ricard + +commit 1ba3b0b6f218072afe8372d12f1b6bf26a26008e upstream. + +When sending data in tpm_stm_i2c_send, each loop iteration send buf. +Send buf + i instead as the goal of this for loop is to send a number +of byte from buf that fit in burstcnt. Once those byte are sent, we are +supposed to send the next ones. + +The driver was working because the burstcount value returns always the maximum size for a TPM +command or response. (0x800 for a command and 0x400 for a response). + +Reviewed-by: Jason Gunthorpe +Signed-off-by: Christophe Ricard +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_i2c_stm_st33.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/tpm/tpm_i2c_stm_st33.c ++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c +@@ -487,7 +487,7 @@ static int tpm_stm_i2c_send(struct tpm_c + if (burstcnt < 0) + return burstcnt; + size = min_t(int, len - i - 1, burstcnt); +- ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size); ++ ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size); + if (ret < 0) + goto out_err; + diff --git a/queue-3.18/tpm_tis-verify-interrupt-during-init.patch b/queue-3.18/tpm_tis-verify-interrupt-during-init.patch new file mode 100644 index 00000000000..ba106337733 --- /dev/null +++ b/queue-3.18/tpm_tis-verify-interrupt-during-init.patch @@ -0,0 +1,163 @@ +From 448e9c55c12d6bd4fa90a7e31d802e045666d7c8 Mon Sep 17 00:00:00 2001 +From: Scot Doyle +Date: Wed, 24 Sep 2014 22:41:10 +0000 +Subject: tpm_tis: verify interrupt during init + +From: Scot Doyle + +commit 448e9c55c12d6bd4fa90a7e31d802e045666d7c8 upstream. + +Some machines, such as the Acer C720 and Toshiba CB35, have TPMs that do +not send IRQs while also having an ACPI TPM entry indicating that they +will be sent. These machines freeze on resume while the tpm_tis module +waits for an IRQ, eventually timing out. + +When in interrupt mode, the tpm_tis module should receive an IRQ during +module init. Fall back to polling mode if none is received when expected. + +Signed-off-by: Scot Doyle +Tested-by: Michael Mullin +Reviewed-by: Jason Gunthorpe +[phuewe: minor checkpatch fixed] +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 76 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 62 insertions(+), 14 deletions(-) + +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -75,6 +75,10 @@ enum tis_defaults { + #define TPM_DID_VID(l) (0x0F00 | ((l) << 12)) + #define TPM_RID(l) (0x0F04 | ((l) << 12)) + ++struct priv_data { ++ bool irq_tested; ++}; ++ + static LIST_HEAD(tis_chips); + static DEFINE_MUTEX(tis_lock); + +@@ -338,12 +342,27 @@ out_err: + return rc; + } + ++static void disable_interrupts(struct tpm_chip *chip) ++{ ++ u32 intmask; ++ ++ intmask = ++ ioread32(chip->vendor.iobase + ++ TPM_INT_ENABLE(chip->vendor.locality)); ++ intmask &= ~TPM_GLOBAL_INT_ENABLE; ++ iowrite32(intmask, ++ chip->vendor.iobase + ++ TPM_INT_ENABLE(chip->vendor.locality)); ++ free_irq(chip->vendor.irq, chip); ++ chip->vendor.irq = 0; ++} ++ + /* + * If interrupts are used (signaled by an irq set in the vendor structure) + * tpm.c can skip polling for the data to be available as the interrupt is + * waited for here + */ +-static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len) ++static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len) + { + int rc; + u32 ordinal; +@@ -373,6 +392,30 @@ out_err: + return rc; + } + ++static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len) ++{ ++ int rc, irq; ++ struct priv_data *priv = chip->vendor.priv; ++ ++ if (!chip->vendor.irq || priv->irq_tested) ++ return tpm_tis_send_main(chip, buf, len); ++ ++ /* Verify receipt of the expected IRQ */ ++ irq = chip->vendor.irq; ++ chip->vendor.irq = 0; ++ rc = tpm_tis_send_main(chip, buf, len); ++ chip->vendor.irq = irq; ++ if (!priv->irq_tested) ++ msleep(1); ++ if (!priv->irq_tested) { ++ disable_interrupts(chip); ++ dev_err(chip->dev, ++ FW_BUG "TPM interrupt not working, polling instead\n"); ++ } ++ priv->irq_tested = true; ++ return rc; ++} ++ + struct tis_vendor_timeout_override { + u32 did_vid; + unsigned long timeout_us[4]; +@@ -505,6 +548,7 @@ static irqreturn_t tis_int_handler(int d + if (interrupt == 0) + return IRQ_NONE; + ++ ((struct priv_data *)chip->vendor.priv)->irq_tested = true; + if (interrupt & TPM_INTF_DATA_AVAIL_INT) + wake_up_interruptible(&chip->vendor.read_queue); + if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT) +@@ -534,9 +578,14 @@ static int tpm_tis_init(struct device *d + u32 vendor, intfcaps, intmask; + int rc, i, irq_s, irq_e, probe; + struct tpm_chip *chip; ++ struct priv_data *priv; + ++ priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL); ++ if (priv == NULL) ++ return -ENOMEM; + if (!(chip = tpm_register_hardware(dev, &tpm_tis))) + return -ENODEV; ++ chip->vendor.priv = priv; + + chip->vendor.iobase = ioremap(start, len); + if (!chip->vendor.iobase) { +@@ -605,19 +654,6 @@ static int tpm_tis_init(struct device *d + if (intfcaps & TPM_INTF_DATA_AVAIL_INT) + dev_dbg(dev, "\tData Avail Int Support\n"); + +- /* get the timeouts before testing for irqs */ +- if (tpm_get_timeouts(chip)) { +- dev_err(dev, "Could not get TPM timeouts and durations\n"); +- rc = -ENODEV; +- goto out_err; +- } +- +- if (tpm_do_selftest(chip)) { +- dev_err(dev, "TPM self test failed\n"); +- rc = -ENODEV; +- goto out_err; +- } +- + /* INTERRUPT Setup */ + init_waitqueue_head(&chip->vendor.read_queue); + init_waitqueue_head(&chip->vendor.int_queue); +@@ -719,6 +755,18 @@ static int tpm_tis_init(struct device *d + } + } + ++ if (tpm_get_timeouts(chip)) { ++ dev_err(dev, "Could not get TPM timeouts and durations\n"); ++ rc = -ENODEV; ++ goto out_err; ++ } ++ ++ if (tpm_do_selftest(chip)) { ++ dev_err(dev, "TPM self test failed\n"); ++ rc = -ENODEV; ++ goto out_err; ++ } ++ + INIT_LIST_HEAD(&chip->vendor.list); + mutex_lock(&tis_lock); + list_add(&chip->vendor.list, &tis_chips); diff --git a/queue-3.18/tracing-fix-unmapping-loop-in-tracing_mark_write.patch b/queue-3.18/tracing-fix-unmapping-loop-in-tracing_mark_write.patch new file mode 100644 index 00000000000..22930580a37 --- /dev/null +++ b/queue-3.18/tracing-fix-unmapping-loop-in-tracing_mark_write.patch @@ -0,0 +1,41 @@ +From 7215853e985a4bef1a6c14e00e89dfec84f1e457 Mon Sep 17 00:00:00 2001 +From: Vikram Mulukutla +Date: Wed, 17 Dec 2014 18:50:56 -0800 +Subject: tracing: Fix unmapping loop in tracing_mark_write + +From: Vikram Mulukutla + +commit 7215853e985a4bef1a6c14e00e89dfec84f1e457 upstream. + +Commit 6edb2a8a385f0cdef51dae37ff23e74d76d8a6ce introduced +an array map_pages that contains the addresses returned by +kmap_atomic. However, when unmapping those pages, map_pages[0] +is unmapped before map_pages[1], breaking the nesting requirement +as specified in the documentation for kmap_atomic/kunmap_atomic. + +This was caught by the highmem debug code present in kunmap_atomic. +Fix the loop to do the unmapping properly. + +Link: http://lkml.kernel.org/r/1418871056-6614-1-git-send-email-markivx@codeaurora.org + +Reviewed-by: Stephen Boyd +Reported-by: Lime Yang +Signed-off-by: Vikram Mulukutla +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4916,7 +4916,7 @@ tracing_mark_write(struct file *filp, co + *fpos += written; + + out_unlock: +- for (i = 0; i < nr_pages; i++){ ++ for (i = nr_pages - 1; i >= 0; i--) { + kunmap_atomic(map_page[i]); + put_page(pages[i]); + } diff --git a/queue-3.18/tty-prevent-untrappable-signals-from-malicious-program.patch b/queue-3.18/tty-prevent-untrappable-signals-from-malicious-program.patch new file mode 100644 index 00000000000..17e4562ed76 --- /dev/null +++ b/queue-3.18/tty-prevent-untrappable-signals-from-malicious-program.patch @@ -0,0 +1,41 @@ +From 37480a05685ed5b8e1b9bf5e5c53b5810258b149 Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Mon, 19 Jan 2015 13:05:03 -0500 +Subject: tty: Prevent untrappable signals from malicious program + +From: Peter Hurley + +commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream. + +Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE") +allows a process which has opened a pty master to send _any_ signal +to the process group of the pty slave. Although potentially +exploitable by a malicious program running a setuid program on +a pty slave, it's unknown if this exploit currently exists. + +Limit to signals actually used. + +Cc: Theodore Ts'o +Cc: Howard Chu +Cc: One Thousand Gnomes +Cc: Jiri Slaby +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/pty.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -210,6 +210,9 @@ static int pty_signal(struct tty_struct + unsigned long flags; + struct pid *pgrp; + ++ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP) ++ return -EINVAL; ++ + if (tty->link) { + spin_lock_irqsave(&tty->link->ctrl_lock, flags); + pgrp = get_pid(tty->link->pgrp); diff --git a/queue-3.18/tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch b/queue-3.18/tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch new file mode 100644 index 00000000000..036c70a4d9a --- /dev/null +++ b/queue-3.18/tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch @@ -0,0 +1,49 @@ +From 6fbb9bdf0f3fbe23aeff806489791aa876adaffb Mon Sep 17 00:00:00 2001 +From: Cyrille Pitchen +Date: Tue, 9 Dec 2014 14:31:34 +0100 +Subject: tty/serial: at91: fix error handling in atmel_serial_probe() + +From: Cyrille Pitchen + +commit 6fbb9bdf0f3fbe23aeff806489791aa876adaffb upstream. + +-EDEFER error wasn't handle properly by atmel_serial_probe(). +As an example, when atmel_serial_probe() is called for the first time, we pass +the test_and_set_bit() test to check whether the port has already been +initalized. Then we call atmel_init_port(), which may return -EDEFER, possibly +returned before by clk_get(). Consequently atmel_serial_probe() used to return +this error code WITHOUT clearing the port bit in the "atmel_ports_in_use" mask. +When atmel_serial_probe() was called for the second time, it used to fail on +the test_and_set_bit() function then returning -EBUSY. + +When atmel_serial_probe() fails, this patch make it clear the port bit in the +"atmel_ports_in_use" mask, if needed, before returning the error code. + +Signed-off-by: Cyrille Pitchen +Acked-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2577,7 +2577,7 @@ static int atmel_serial_probe(struct pla + + ret = atmel_init_port(port, pdev); + if (ret) +- goto err; ++ goto err_clear_bit; + + if (!atmel_use_pdc_rx(&port->uart)) { + ret = -ENOMEM; +@@ -2626,6 +2626,8 @@ err_alloc_ring: + clk_put(port->clk); + port->clk = NULL; + } ++err_clear_bit: ++ clear_bit(port->uart.line, atmel_ports_in_use); + err: + return ret; + } diff --git a/queue-3.18/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch b/queue-3.18/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch new file mode 100644 index 00000000000..1fc7dc1e468 --- /dev/null +++ b/queue-3.18/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch @@ -0,0 +1,75 @@ +From 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 29 Jan 2015 15:05:04 -0500 +Subject: USB: add flag for HCDs that can't receive wakeup requests (isp1760-hcd) + +From: Alan Stern + +commit 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 upstream. + +Currently the USB stack assumes that all host controller drivers are +capable of receiving wakeup requests from downstream devices. +However, this isn't true for the isp1760-hcd driver, which means that +it isn't safe to do a runtime suspend of any device attached to a +root-hub port if the device requires wakeup. + +This patch adds a "cant_recv_wakeups" flag to the usb_hcd structure +and sets the flag in isp1760-hcd. The core is modified to prevent a +direct child of the root hub from being put into runtime suspend with +wakeup enabled if the flag is set. + +Signed-off-by: Alan Stern +Tested-by: Nicolas Pitre +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 12 ++++++++++++ + drivers/usb/host/isp1760-hcd.c | 3 +++ + include/linux/usb/hcd.h | 2 ++ + 3 files changed, 17 insertions(+) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1784,6 +1784,18 @@ static int autosuspend_check(struct usb_ + dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n"); + return -EOPNOTSUPP; + } ++ ++ /* ++ * If the device is a direct child of the root hub and the HCD ++ * doesn't handle wakeup requests, don't allow autosuspend when ++ * wakeup is needed. ++ */ ++ if (w && udev->parent == udev->bus->root_hub && ++ bus_to_hcd(udev->bus)->cant_recv_wakeups) { ++ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n"); ++ return -EOPNOTSUPP; ++ } ++ + udev->do_remote_wakeup = w; + return 0; + } +--- a/drivers/usb/host/isp1760-hcd.c ++++ b/drivers/usb/host/isp1760-hcd.c +@@ -2247,6 +2247,9 @@ struct usb_hcd *isp1760_register(phys_ad + hcd->rsrc_start = res_start; + hcd->rsrc_len = res_len; + ++ /* This driver doesn't support wakeup requests */ ++ hcd->cant_recv_wakeups = 1; ++ + ret = usb_add_hcd(hcd, irq, irqflags); + if (ret) + goto err_unmap; +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -146,6 +146,8 @@ struct usb_hcd { + unsigned amd_resume_bug:1; /* AMD remote wakeup quirk */ + unsigned can_do_streams:1; /* HC supports streams */ + unsigned tpl_support:1; /* OTG & EH TPL support */ ++ unsigned cant_recv_wakeups:1; ++ /* wakeup requests from downstream aren't received */ + + unsigned int irq; /* irq allocated */ + void __iomem *regs; /* device memory/io */ diff --git a/queue-3.18/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch b/queue-3.18/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch new file mode 100644 index 00000000000..b0a6c4f31ba --- /dev/null +++ b/queue-3.18/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch @@ -0,0 +1,99 @@ +From 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Fri, 5 Dec 2014 15:13:54 +0100 +Subject: usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN + +From: Sebastian Andrzej Siewior + +commit 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 upstream. + +the following error pops up during "testusb -a -t 10" +| musb-hdrc musb-hdrc.1.auto: dma_pool_free buffer-128, f134e000/be842000 (bad dma) +hcd_buffer_create() creates a few buffers, the smallest has 32 bytes of +size. ARCH_KMALLOC_MINALIGN is set to 64 bytes. This combo results in +hcd_buffer_alloc() returning memory which is 32 bytes aligned and it +might by identified by buffer_offset() as another buffer. This means the +buffer which is on a 32 byte boundary will not get freed, instead it +tries to free another buffer with the error message. + +This patch fixes the issue by creating the smallest DMA buffer with the +size of ARCH_KMALLOC_MINALIGN (or 32 in case ARCH_KMALLOC_MINALIGN is +smaller). This might be 32, 64 or even 128 bytes. The next three pools +will have the size 128, 512 and 2048. +In case the smallest pool is 128 bytes then we have only three pools +instead of four (and zero the first entry in the array). +The last pool size is always 2048 bytes which is the assumed PAGE_SIZE / +2 of 4096. I doubt it makes sense to continue using PAGE_SIZE / 2 where +we would end up with 8KiB buffer in case we have 16KiB pages. +Instead I think it makes sense to have a common size(s) and extend them +if there is need to. +There is a BUILD_BUG_ON() now in case someone has a minalign of more than +128 bytes. + +Signed-off-by: Sebastian Andrzej Siewior +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/buffer.c | 26 +++++++++++++++++--------- + drivers/usb/core/usb.c | 1 + + include/linux/usb/hcd.h | 1 + + 3 files changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/usb/core/buffer.c ++++ b/drivers/usb/core/buffer.c +@@ -22,17 +22,25 @@ + */ + + /* FIXME tune these based on pool statistics ... */ +-static const size_t pool_max[HCD_BUFFER_POOLS] = { +- /* platforms without dma-friendly caches might need to +- * prevent cacheline sharing... +- */ +- 32, +- 128, +- 512, +- PAGE_SIZE / 2 +- /* bigger --> allocate pages */ ++static size_t pool_max[HCD_BUFFER_POOLS] = { ++ 32, 128, 512, 2048, + }; + ++void __init usb_init_pool_max(void) ++{ ++ /* ++ * The pool_max values must never be smaller than ++ * ARCH_KMALLOC_MINALIGN. ++ */ ++ if (ARCH_KMALLOC_MINALIGN <= 32) ++ ; /* Original value is okay */ ++ else if (ARCH_KMALLOC_MINALIGN <= 64) ++ pool_max[0] = 64; ++ else if (ARCH_KMALLOC_MINALIGN <= 128) ++ pool_max[0] = 0; /* Don't use this pool */ ++ else ++ BUILD_BUG(); /* We don't allow this */ ++} + + /* SETUP primitives */ + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -1051,6 +1051,7 @@ static int __init usb_init(void) + pr_info("%s: USB support disabled\n", usbcore_name); + return 0; + } ++ usb_init_pool_max(); + + retval = usb_debugfs_init(); + if (retval) +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -450,6 +450,7 @@ extern const struct dev_pm_ops usb_hcd_p + #endif /* CONFIG_PCI */ + + /* pci-ish (pdev null is ok) buffer alloc/mapping support */ ++void usb_init_pool_max(void); + int hcd_buffer_create(struct usb_hcd *hcd); + void hcd_buffer_destroy(struct usb_hcd *hcd); + diff --git a/queue-3.18/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch b/queue-3.18/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch new file mode 100644 index 00000000000..9ed89f0ace0 --- /dev/null +++ b/queue-3.18/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch @@ -0,0 +1,30 @@ +From a6f0331236fa75afba14bbcf6668d42cebb55c43 Mon Sep 17 00:00:00 2001 +From: Lennart Sorensen +Date: Wed, 21 Jan 2015 15:24:27 -0500 +Subject: USB: cp210x: add ID for RUGGEDCOM USB Serial Console + +From: Lennart Sorensen + +commit a6f0331236fa75afba14bbcf6668d42cebb55c43 upstream. + +Added the USB serial console device ID for Siemens Ruggedcom devices +which have a USB port for their serial console. + +Signed-off-by: Len Sorensen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -56,6 +56,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ + { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ ++ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ + { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ diff --git a/queue-3.18/usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch b/queue-3.18/usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch new file mode 100644 index 00000000000..424327414ee --- /dev/null +++ b/queue-3.18/usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch @@ -0,0 +1,213 @@ +From 524134d422316a59d5464ccbc12036bbe90c5563 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 21 Jan 2015 14:02:43 -0500 +Subject: USB: don't cancel queued resets when unbinding drivers + +From: Alan Stern + +commit 524134d422316a59d5464ccbc12036bbe90c5563 upstream. + +The USB stack provides a mechanism for drivers to request an +asynchronous device reset (usb_queue_reset_device()). The mechanism +uses a work item (reset_ws) embedded in the usb_interface structure +used by the driver, and the reset is carried out by a work queue +routine. + +The asynchronous reset can race with driver unbinding. When this +happens, we try to cancel the queued reset before unbinding the +driver, on the theory that the driver won't care about any resets once +it is unbound. + +However, thanks to the fact that lockdep now tracks work queue +accesses, this can provoke a lockdep warning in situations where the +device reset causes another interface's driver to be unbound; see + + http://marc.info/?l=linux-usb&m=141893165203776&w=2 + +for an example. The reason is that the work routine for reset_ws in +one interface calls cancel_queued_work() for the reset_ws in another +interface. Lockdep thinks this might lead to a work routine trying to +cancel itself. The simplest solution is not to cancel queued resets +when unbinding drivers. + +This means we now need to acquire a reference to the usb_interface +when queuing a reset_ws work item and to drop the reference when the +work routine finishes. We also need to make sure that the +usb_interface structure doesn't outlive its parent usb_device; this +means acquiring and dropping a reference when the interface is created +and destroyed. + +In addition, cancelling a queued reset can fail (if the device is in +the middle of an earlier reset), and this can cause usb_reset_device() +to try to rebind an interface that has been deallocated (see +http://marc.info/?l=linux-usb&m=142175717016628&w=2 for details). +Acquiring the extra references prevents this failure. + +Signed-off-by: Alan Stern +Reported-by: Russell King - ARM Linux +Reported-by: Olivier Sobrie +Tested-by: Olivier Sobrie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 17 ----------------- + drivers/usb/core/hub.c | 25 +++++++++---------------- + drivers/usb/core/message.c | 23 +++-------------------- + include/linux/usb.h | 5 ----- + 4 files changed, 12 insertions(+), 58 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -275,21 +275,6 @@ static int usb_unbind_device(struct devi + return 0; + } + +-/* +- * Cancel any pending scheduled resets +- * +- * [see usb_queue_reset_device()] +- * +- * Called after unconfiguring / when releasing interfaces. See +- * comments in __usb_queue_reset_device() regarding +- * udev->reset_running. +- */ +-static void usb_cancel_queued_reset(struct usb_interface *iface) +-{ +- if (iface->reset_running == 0) +- cancel_work_sync(&iface->reset_ws); +-} +- + /* called from driver core with dev locked */ + static int usb_probe_interface(struct device *dev) + { +@@ -380,7 +365,6 @@ static int usb_probe_interface(struct de + usb_set_intfdata(intf, NULL); + intf->needs_remote_wakeup = 0; + intf->condition = USB_INTERFACE_UNBOUND; +- usb_cancel_queued_reset(intf); + + /* If the LPM disable succeeded, balance the ref counts. */ + if (!lpm_disable_error) +@@ -425,7 +409,6 @@ static int usb_unbind_interface(struct d + usb_disable_interface(udev, intf, false); + + driver->disconnect(intf); +- usb_cancel_queued_reset(intf); + + /* Free streams */ + for (i = 0, j = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5591,26 +5591,19 @@ EXPORT_SYMBOL_GPL(usb_reset_device); + * possible; depending on how the driver attached to each interface + * handles ->pre_reset(), the second reset might happen or not. + * +- * - If a driver is unbound and it had a pending reset, the reset will +- * be cancelled. ++ * - If the reset is delayed so long that the interface is unbound from ++ * its driver, the reset will be skipped. + * +- * - This function can be called during .probe() or .disconnect() +- * times. On return from .disconnect(), any pending resets will be +- * cancelled. +- * +- * There is no no need to lock/unlock the @reset_ws as schedule_work() +- * does its own. +- * +- * NOTE: We don't do any reference count tracking because it is not +- * needed. The lifecycle of the work_struct is tied to the +- * usb_interface. Before destroying the interface we cancel the +- * work_struct, so the fact that work_struct is queued and or +- * running means the interface (and thus, the device) exist and +- * are referenced. ++ * - This function can be called during .probe(). It can also be called ++ * during .disconnect(), but doing so is pointless because the reset ++ * will not occur. If you really want to reset the device during ++ * .disconnect(), call usb_reset_device() directly -- but watch out ++ * for nested unbinding issues! + */ + void usb_queue_reset_device(struct usb_interface *iface) + { +- schedule_work(&iface->reset_ws); ++ if (schedule_work(&iface->reset_ws)) ++ usb_get_intf(iface); + } + EXPORT_SYMBOL_GPL(usb_queue_reset_device); + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1551,6 +1551,7 @@ static void usb_release_interface(struct + altsetting_to_usb_interface_cache(intf->altsetting); + + kref_put(&intfc->ref, usb_release_interface_cache); ++ usb_put_dev(interface_to_usbdev(intf)); + kfree(intf); + } + +@@ -1626,24 +1627,6 @@ static struct usb_interface_assoc_descri + + /* + * Internal function to queue a device reset +- * +- * This is initialized into the workstruct in 'struct +- * usb_device->reset_ws' that is launched by +- * message.c:usb_set_configuration() when initializing each 'struct +- * usb_interface'. +- * +- * It is safe to get the USB device without reference counts because +- * the life cycle of @iface is bound to the life cycle of @udev. Then, +- * this function will be ran only if @iface is alive (and before +- * freeing it any scheduled instances of it will have been cancelled). +- * +- * We need to set a flag (usb_dev->reset_running) because when we call +- * the reset, the interfaces might be unbound. The current interface +- * cannot try to remove the queued work as it would cause a deadlock +- * (you cannot remove your work from within your executing +- * workqueue). This flag lets it know, so that +- * usb_cancel_queued_reset() doesn't try to do it. +- * + * See usb_queue_reset_device() for more details + */ + static void __usb_queue_reset_device(struct work_struct *ws) +@@ -1655,11 +1638,10 @@ static void __usb_queue_reset_device(str + + rc = usb_lock_device_for_reset(udev, iface); + if (rc >= 0) { +- iface->reset_running = 1; + usb_reset_device(udev); +- iface->reset_running = 0; + usb_unlock_device(udev); + } ++ usb_put_intf(iface); /* Undo _get_ in usb_queue_reset_device() */ + } + + +@@ -1854,6 +1836,7 @@ free_interfaces: + dev_set_name(&intf->dev, "%d-%s:%d.%d", + dev->bus->busnum, dev->devpath, + configuration, alt->desc.bInterfaceNumber); ++ usb_get_dev(dev); + } + kfree(new_interfaces); + +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -127,10 +127,6 @@ enum usb_interface_condition { + * to the sysfs representation for that device. + * @pm_usage_cnt: PM usage counter for this interface + * @reset_ws: Used for scheduling resets from atomic context. +- * @reset_running: set to 1 if the interface is currently running a +- * queued reset so that usb_cancel_queued_reset() doesn't try to +- * remove from the workqueue when running inside the worker +- * thread. See __usb_queue_reset_device(). + * @resetting_device: USB core reset the device, so use alt setting 0 as + * current; needs bandwidth alloc after reset. + * +@@ -181,7 +177,6 @@ struct usb_interface { + unsigned needs_remote_wakeup:1; /* driver requires remote wakeup */ + unsigned needs_altsetting0:1; /* switch to altsetting 0 is pending */ + unsigned needs_binding:1; /* needs delayed unbind/rebind */ +- unsigned reset_running:1; + unsigned resetting_device:1; /* true: bandwidth alloc after reset */ + + struct device dev; /* interface specific device info */ diff --git a/queue-3.18/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch b/queue-3.18/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch new file mode 100644 index 00000000000..c0877935bd7 --- /dev/null +++ b/queue-3.18/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch @@ -0,0 +1,66 @@ +From c99197902da284b4b723451c1471c45b18537cde Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 30 Jan 2015 12:58:26 -0500 +Subject: USB: fix use-after-free bug in usb_hcd_unlink_urb() + +From: Alan Stern + +commit c99197902da284b4b723451c1471c45b18537cde upstream. + +The usb_hcd_unlink_urb() routine in hcd.c contains two possible +use-after-free errors. The dev_dbg() statement at the end of the +routine dereferences urb and urb->dev even though both structures may +have been deallocated. + +This patch fixes the problem by storing urb->dev in a local variable +(avoiding the dereference of urb) and moving the dev_dbg() up before +the usb_put_dev() call. + +Signed-off-by: Alan Stern +Reported-by: Joe Lawrence +Tested-by: Joe Lawrence +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1618,6 +1618,7 @@ static int unlink1(struct usb_hcd *hcd, + int usb_hcd_unlink_urb (struct urb *urb, int status) + { + struct usb_hcd *hcd; ++ struct usb_device *udev = urb->dev; + int retval = -EIDRM; + unsigned long flags; + +@@ -1629,20 +1630,19 @@ int usb_hcd_unlink_urb (struct urb *urb, + spin_lock_irqsave(&hcd_urb_unlink_lock, flags); + if (atomic_read(&urb->use_count) > 0) { + retval = 0; +- usb_get_dev(urb->dev); ++ usb_get_dev(udev); + } + spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); + if (retval == 0) { + hcd = bus_to_hcd(urb->dev->bus); + retval = unlink1(hcd, urb, status); +- usb_put_dev(urb->dev); ++ if (retval == 0) ++ retval = -EINPROGRESS; ++ else if (retval != -EIDRM && retval != -EBUSY) ++ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", ++ urb, retval); ++ usb_put_dev(udev); + } +- +- if (retval == 0) +- retval = -EINPROGRESS; +- else if (retval != -EIDRM && retval != -EBUSY) +- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n", +- urb, retval); + return retval; + } + diff --git a/queue-3.18/usb-musb-add-omap-control-dependency.patch b/queue-3.18/usb-musb-add-omap-control-dependency.patch new file mode 100644 index 00000000000..758f8784149 --- /dev/null +++ b/queue-3.18/usb-musb-add-omap-control-dependency.patch @@ -0,0 +1,45 @@ +From fbba7db3990cb707ff91cd6507d53a0a730afe97 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 28 Jan 2015 22:51:04 +0100 +Subject: usb: musb: add omap-control dependency + +From: Arnd Bergmann + +commit fbba7db3990cb707ff91cd6507d53a0a730afe97 upstream. + +The omap musb front-end calls into the phy driver directly +instead of using a generic phy interface, which causes a link +error when the specific driver is not built-in: + +drivers/built-in.o: In function `omap2430_musb_disable': +usb/musb/omap2430.c:480: undefined reference to `omap_control_usb_set_mode' +drivers/built-in.o: In function `omap2430_musb_enable': +usb/musb/omap2430.c:466: undefined reference to `omap_control_usb_set_mode' +usb/musb/omap2430.c:447: undefined reference to `omap_control_usb_set_mode' +drivers/built-in.o: In function `omap_musb_set_mailbox': +usb/musb/omap2430.c:273: undefined reference to `omap_control_usb_set_mode' +usb/musb/omap2430.c:304: undefined reference to `omap_control_usb_set_mode' +drivers/built-in.o:(.debug_addr+0xbd9e0): more undefined references to `omap_control_usb_set_mode' follow + +This adds an explicit dependency. + +Signed-off-by: Arnd Bergmann +Fixes: ca784be36cc725 ("usb: start using the control module driver") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/musb/Kconfig ++++ b/drivers/usb/musb/Kconfig +@@ -76,7 +76,7 @@ config USB_MUSB_TUSB6010 + + config USB_MUSB_OMAP2PLUS + tristate "OMAP2430 and onwards" +- depends on ARCH_OMAP2PLUS && USB ++ depends on ARCH_OMAP2PLUS && USB && OMAP_CONTROL_PHY + select GENERIC_PHY + + config USB_MUSB_AM35X diff --git a/queue-3.18/vt-provide-notifications-on-selection-changes.patch b/queue-3.18/vt-provide-notifications-on-selection-changes.patch new file mode 100644 index 00000000000..3a7541a8b52 --- /dev/null +++ b/queue-3.18/vt-provide-notifications-on-selection-changes.patch @@ -0,0 +1,51 @@ +From 19e3ae6b4f07a87822c1c9e7ed99d31860e701af Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Fri, 23 Jan 2015 17:07:21 -0500 +Subject: vt: provide notifications on selection changes + +From: Nicolas Pitre + +commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream. + +The vcs device's poll/fasync support relies on the vt notifier to signal +changes to the screen content. Notifier invocations were missing for +changes that comes through the selection interface though. Fix that. + +Tested with BRLTTY 5.2. + +Signed-off-by: Nicolas Pitre +Cc: Dave Mielke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, i + #endif + if (DO_UPDATE(vc)) + do_update_region(vc, (unsigned long) p, count); ++ notify_update(vc); + } + + /* used by selection: complement pointer position */ +@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, + scr_writew(old, screenpos(vc, old_offset, 1)); + if (DO_UPDATE(vc)) + vc->vc_sw->con_putc(vc, old, oldy, oldx); ++ notify_update(vc); + } + + old_offset = offset; +@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, + oldy = (offset >> 1) / vc->vc_cols; + vc->vc_sw->con_putc(vc, new, oldy, oldx); + } ++ notify_update(vc); + } +- + } + + static void insert_char(struct vc_data *vc, unsigned int nr) diff --git a/queue-3.18/xen-manage-fix-usb-interaction-issues-when-resuming.patch b/queue-3.18/xen-manage-fix-usb-interaction-issues-when-resuming.patch new file mode 100644 index 00000000000..0b292a26b6b --- /dev/null +++ b/queue-3.18/xen-manage-fix-usb-interaction-issues-when-resuming.patch @@ -0,0 +1,95 @@ +From 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 Mon Sep 17 00:00:00 2001 +From: Ross Lagerwall +Date: Mon, 19 Jan 2015 13:19:38 +0000 +Subject: xen/manage: Fix USB interaction issues when resuming + +From: Ross Lagerwall + +commit 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 upstream. + +Commit 61a734d305e1 ("xen/manage: Always freeze/thaw processes when +suspend/resuming") ensured that userspace processes were always frozen +before suspending to reduce interaction issues when resuming devices. +However, freeze_processes() does not freeze kernel threads. Freeze +kernel threads as well to prevent deadlocks with the khubd thread when +resuming devices. + +This is what native suspend and resume does. + +Example deadlock: +[ 7279.648010] [] ? xen_poll_irq_timeout+0x3e/0x50 +[ 7279.648010] [] xen_poll_irq+0x10/0x20 +[ 7279.648010] [] xen_lock_spinning+0xb3/0x120 +[ 7279.648010] [] __raw_callee_save_xen_lock_spinning+0x11/0x20 +[ 7279.648010] [] ? usb_control_msg+0xe6/0x120 +[ 7279.648010] [] ? _raw_spin_lock_irq+0x50/0x60 +[ 7279.648010] [] wait_for_completion+0xac/0x160 +[ 7279.648010] [] ? try_to_wake_up+0x2c0/0x2c0 +[ 7279.648010] [] dpm_wait+0x32/0x40 +[ 7279.648010] [] device_resume+0x90/0x210 +[ 7279.648010] [] dpm_resume+0x121/0x250 +[ 7279.648010] [] ? xenbus_dev_request_and_reply+0xc0/0xc0 +[ 7279.648010] [] dpm_resume_end+0x15/0x30 +[ 7279.648010] [] do_suspend+0x10a/0x200 +[ 7279.648010] [] ? xen_pre_suspend+0x20/0x20 +[ 7279.648010] [] shutdown_handler+0x120/0x150 +[ 7279.648010] [] xenwatch_thread+0x9f/0x160 +[ 7279.648010] [] ? finish_wait+0x80/0x80 +[ 7279.648010] [] kthread+0xc9/0xe0 +[ 7279.648010] [] ? flush_kthread_worker+0x80/0x80 +[ 7279.648010] [] ret_from_fork+0x7c/0xb0 +[ 7279.648010] [] ? flush_kthread_worker+0x80/0x80 + +[ 7441.216287] INFO: task khubd:89 blocked for more than 120 seconds. +[ 7441.219457] Tainted: G X 3.13.11-ckt12.kz #1 +[ 7441.222176] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 7441.225827] khubd D ffff88003f433440 0 89 2 0x00000000 +[ 7441.229258] ffff88003ceb9b98 0000000000000046 ffff88003ce83000 0000000000013440 +[ 7441.232959] ffff88003ceb9fd8 0000000000013440 ffff88003cd13000 ffff88003ce83000 +[ 7441.236658] 0000000000000286 ffff88003d3e0000 ffff88003ceb9bd0 00000001001aa01e +[ 7441.240415] Call Trace: +[ 7441.241614] [] schedule+0x29/0x70 +[ 7441.243930] [] schedule_timeout+0x166/0x2c0 +[ 7441.246681] [] ? call_timer_fn+0x110/0x110 +[ 7441.249339] [] schedule_timeout_uninterruptible+0x1e/0x20 +[ 7441.252644] [] msleep+0x20/0x30 +[ 7441.254812] [] hub_port_reset+0xf0/0x580 +[ 7441.257400] [] hub_port_init+0x75/0xb40 +[ 7441.259981] [] ? update_autosuspend+0x39/0x60 +[ 7441.262817] [] ? pm_runtime_set_autosuspend_delay+0x50/0xa0 +[ 7441.266212] [] hub_thread+0x71a/0x1750 +[ 7441.268728] [] ? finish_wait+0x80/0x80 +[ 7441.271272] [] ? usb_port_resume+0x670/0x670 +[ 7441.274067] [] kthread+0xc9/0xe0 +[ 7441.276305] [] ? flush_kthread_worker+0x80/0x80 +[ 7441.279131] [] ret_from_fork+0x7c/0xb0 +[ 7441.281659] [] ? flush_kthread_worker+0x80/0x80 + +Signed-off-by: Ross Lagerwall +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/manage.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -105,10 +105,16 @@ static void do_suspend(void) + + err = freeze_processes(); + if (err) { +- pr_err("%s: freeze failed %d\n", __func__, err); ++ pr_err("%s: freeze processes failed %d\n", __func__, err); + goto out; + } + ++ err = freeze_kernel_threads(); ++ if (err) { ++ pr_err("%s: freeze kernel threads failed %d\n", __func__, err); ++ goto out_thaw; ++ } ++ + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { + pr_err("%s: dpm_suspend_start %d\n", __func__, err); diff --git a/queue-3.18/xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch b/queue-3.18/xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch new file mode 100644 index 00000000000..d5f2c592ae2 --- /dev/null +++ b/queue-3.18/xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch @@ -0,0 +1,77 @@ +From facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Tue, 17 Feb 2015 08:02:47 +0100 +Subject: xen-scsiback: mark pvscsi frontend request consumed only after last read + +From: Juergen Gross + +commit facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 upstream. + +A request in the ring buffer mustn't be read after it has been marked +as consumed. Otherwise it might already have been reused by the +frontend without violating the ring protocol. + +To avoid inconsistencies in the backend only work on a private copy +of the request. This will ensure a malicious guest not being able to +bypass consistency checks of the backend by modifying an active +request. + +Signed-off-by: Juergen Gross +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xen-scsiback.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/drivers/xen/xen-scsiback.c ++++ b/drivers/xen/xen-scsiback.c +@@ -712,12 +712,11 @@ static int prepare_pending_reqs(struct v + static int scsiback_do_cmd_fn(struct vscsibk_info *info) + { + struct vscsiif_back_ring *ring = &info->ring; +- struct vscsiif_request *ring_req; ++ struct vscsiif_request ring_req; + struct vscsibk_pend *pending_req; + RING_IDX rc, rp; + int err, more_to_do; + uint32_t result; +- uint8_t act; + + rc = ring->req_cons; + rp = ring->sring->req_prod; +@@ -738,11 +737,10 @@ static int scsiback_do_cmd_fn(struct vsc + if (!pending_req) + return 1; + +- ring_req = RING_GET_REQUEST(ring, rc); ++ ring_req = *RING_GET_REQUEST(ring, rc); + ring->req_cons = ++rc; + +- act = ring_req->act; +- err = prepare_pending_reqs(info, ring_req, pending_req); ++ err = prepare_pending_reqs(info, &ring_req, pending_req); + if (err) { + switch (err) { + case -ENODEV: +@@ -758,9 +756,9 @@ static int scsiback_do_cmd_fn(struct vsc + return 1; + } + +- switch (act) { ++ switch (ring_req.act) { + case VSCSIIF_ACT_SCSI_CDB: +- if (scsiback_gnttab_data_map(ring_req, pending_req)) { ++ if (scsiback_gnttab_data_map(&ring_req, pending_req)) { + scsiback_fast_flush_area(pending_req); + scsiback_do_resp_with_sense(NULL, + DRIVER_ERROR << 24, 0, pending_req); +@@ -771,7 +769,7 @@ static int scsiback_do_cmd_fn(struct vsc + break; + case VSCSIIF_ACT_SCSI_ABORT: + scsiback_device_action(pending_req, TMR_ABORT_TASK, +- ring_req->ref_rqid); ++ ring_req.ref_rqid); + break; + case VSCSIIF_ACT_SCSI_RESET: + scsiback_device_action(pending_req, TMR_LUN_RESET, 0); diff --git a/queue-3.18/xfs-ensure-buffer-types-are-set-correctly.patch b/queue-3.18/xfs-ensure-buffer-types-are-set-correctly.patch new file mode 100644 index 00000000000..0627d90efed --- /dev/null +++ b/queue-3.18/xfs-ensure-buffer-types-are-set-correctly.patch @@ -0,0 +1,44 @@ +From 0d612fb570b71ea2e49554a770cff4c489018b2c Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Thu, 22 Jan 2015 09:29:05 +1100 +Subject: xfs: ensure buffer types are set correctly + +From: Dave Chinner + +commit 0d612fb570b71ea2e49554a770cff4c489018b2c upstream. + +Jan Kara reported that log recovery was finding buffers with invalid +types in them. This should not happen, and indicates a bug in the +logging of buffers. To catch this, add asserts to the buffer +formatting code to ensure that the buffer type is in range when the +transaction is committed. + +We don't set a type on buffers being marked stale - they are not +going to get replayed, the format item exists only for recovery to +be able to prevent replay of the buffer, so the type does not +matter. Hence that needs special casing here. + +Reported-by: Jan Kara +Tested-by: Jan Kara +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_buf_item.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/xfs/xfs_buf_item.c ++++ b/fs/xfs/xfs_buf_item.c +@@ -319,6 +319,10 @@ xfs_buf_item_format( + ASSERT(atomic_read(&bip->bli_refcount) > 0); + ASSERT((bip->bli_flags & XFS_BLI_LOGGED) || + (bip->bli_flags & XFS_BLI_STALE)); ++ ASSERT((bip->bli_flags & XFS_BLI_STALE) || ++ (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF ++ && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF)); ++ + + /* + * If it is an inode buffer, transfer the in-memory state to the diff --git a/queue-3.18/xfs-inode-unlink-does-not-set-agi-buffer-type.patch b/queue-3.18/xfs-inode-unlink-does-not-set-agi-buffer-type.patch new file mode 100644 index 00000000000..673e79e720c --- /dev/null +++ b/queue-3.18/xfs-inode-unlink-does-not-set-agi-buffer-type.patch @@ -0,0 +1,50 @@ +From f19b872b086711bb4b22c3a0f52f16aa920bcc61 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Thu, 22 Jan 2015 09:29:40 +1100 +Subject: xfs: inode unlink does not set AGI buffer type + +From: Dave Chinner + +commit f19b872b086711bb4b22c3a0f52f16aa920bcc61 upstream. + +This leads to log recovery throwing errors like: + +XFS (md0): Mounting V5 Filesystem +XFS (md0): Starting recovery (logdev: internal) +XFS (md0): Unknown buffer type 0! +XFS (md0): _xfs_buf_ioapply: no ops on block 0xaea8802/0x1 +ffff8800ffc53800: 58 41 47 49 ..... + +Which is the AGI buffer magic number. + +Ensure that we set the type appropriately in both unlink list +addition and removal. + +Tested-by: Jan Kara +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -2000,6 +2000,7 @@ xfs_iunlink( + agi->agi_unlinked[bucket_index] = cpu_to_be32(agino); + offset = offsetof(xfs_agi_t, agi_unlinked) + + (sizeof(xfs_agino_t) * bucket_index); ++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); + xfs_trans_log_buf(tp, agibp, offset, + (offset + sizeof(xfs_agino_t) - 1)); + return 0; +@@ -2091,6 +2092,7 @@ xfs_iunlink_remove( + agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino); + offset = offsetof(xfs_agi_t, agi_unlinked) + + (sizeof(xfs_agino_t) * bucket_index); ++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); + xfs_trans_log_buf(tp, agibp, offset, + (offset + sizeof(xfs_agino_t) - 1)); + } else { diff --git a/queue-3.18/xfs-set-buf-types-when-converting-extent-formats.patch b/queue-3.18/xfs-set-buf-types-when-converting-extent-formats.patch new file mode 100644 index 00000000000..5c3ebffe9ee --- /dev/null +++ b/queue-3.18/xfs-set-buf-types-when-converting-extent-formats.patch @@ -0,0 +1,54 @@ +From fe22d552b82d7cc7de1851233ae8bef579198637 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Thu, 22 Jan 2015 09:30:06 +1100 +Subject: xfs: set buf types when converting extent formats + +From: Dave Chinner + +commit fe22d552b82d7cc7de1851233ae8bef579198637 upstream. + +Conversion from local to extent format does not set the buffer type +correctly on the new extent buffer when a symlink data is moved out +of line. + +Fix the symlink code and leave a comment in the generic bmap code +reminding us that the format-specific data copy needs to set the +destination buffer type appropriately. + +Tested-by: Jan Kara +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_bmap.c | 6 +++++- + fs/xfs/libxfs/xfs_symlink_remote.c | 2 ++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -976,7 +976,11 @@ xfs_bmap_local_to_extents( + *firstblock = args.fsbno; + bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0); + +- /* initialise the block and copy the data */ ++ /* ++ * Initialise the block and copy the data ++ * ++ * Note: init_fn must set the buffer log item type correctly! ++ */ + init_fn(tp, bp, ip, ifp); + + /* account for the change in fork size and log everything */ +--- a/fs/xfs/libxfs/xfs_symlink_remote.c ++++ b/fs/xfs/libxfs/xfs_symlink_remote.c +@@ -180,6 +180,8 @@ xfs_symlink_local_to_remote( + struct xfs_mount *mp = ip->i_mount; + char *buf; + ++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SYMLINK_BUF); ++ + if (!xfs_sb_version_hascrc(&mp->m_sb)) { + bp->b_ops = NULL; + memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes); diff --git a/queue-3.18/xfs-set-superblock-buffer-type-correctly.patch b/queue-3.18/xfs-set-superblock-buffer-type-correctly.patch new file mode 100644 index 00000000000..be6eeee42d4 --- /dev/null +++ b/queue-3.18/xfs-set-superblock-buffer-type-correctly.patch @@ -0,0 +1,42 @@ +From 3443a3bca54588f43286b725d8648d33a38c86f1 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Thu, 22 Jan 2015 09:30:23 +1100 +Subject: xfs: set superblock buffer type correctly + +From: Dave Chinner + +commit 3443a3bca54588f43286b725d8648d33a38c86f1 upstream. + +When the superblock is modified in a transaction, the commonly +modified fields are not actually copied to the superblock buffer to +avoid the buffer lock becoming a serialisation point. However, there +are some other operations that modify the superblock fields within +the transaction that don't directly log to the superblock but rely +on the changes to be applied during the transaction commit (to +minimise the buffer lock hold time). + +When we do this, we fail to mark the buffer log item as being a +superblock buffer and that can lead to the buffer not being marked +with the corect type in the log and hence causing recovery issues. +Fix it by setting the type correctly, similar to xfs_mod_sb()... + +Tested-by: Jan Kara +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_trans.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/xfs/xfs_trans.c ++++ b/fs/xfs/xfs_trans.c +@@ -474,6 +474,7 @@ xfs_trans_apply_sb_deltas( + whole = 1; + } + ++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF); + if (whole) + /* + * Log the whole thing, the fields are noncontiguous.