From: Greg Kroah-Hartman Date: Sat, 13 Sep 2014 01:31:58 +0000 (-0700) Subject: 3.16-stable patches X-Git-Tag: v3.10.55~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf9ffb20c7b53f48e89be968ea8528380c6eb7b2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.16-stable patches added patches: acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch acpi-run-fixed-event-device-notifications-in-process-context.patch acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch acpi-video-add-a-disable_native_backlight-quirk.patch acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch acpi-video-fix-use_native_backlight-selection-logic.patch acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch asoc-adau1701-fix-adau1701_reg_read.patch asoc-axi-fix-adi-axi-spdif-specification.patch asoc-blackfin-use-samples-to-set-silence.patch asoc-intel-cleanup-hsw-pcm-format-support.patch asoc-max98090-fix-missing-free_irq.patch asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch asoc-pxa-pxa-ssp-small-leak-in-probe.patch asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch asoc-wm_adsp-add-missing-module_license.patch bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch bq2415x_charger-fix-atomic-sleep-bug.patch fix-ebusy-on-umount-from-mnt_shrinkable.patch get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch mnt-correct-permission-checks-in-do_remount.patch mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch mnt-only-change-user-settable-mount-flags-in-remount.patch ring-buffer-always-reset-iterator-to-reader-page.patch ring-buffer-up-rb_iter_peek-loop-count-to-3.patch spi-pxa2xx-add-acpi-id-for-intel-braswell.patch xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch --- diff --git a/queue-3.16/acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch b/queue-3.16/acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch new file mode 100644 index 00000000000..94f633d9f22 --- /dev/null +++ b/queue-3.16/acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch @@ -0,0 +1,71 @@ +From 6726655dfdd2dc60c035c690d9f10cb69d7ea075 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Wed, 3 Sep 2014 15:04:28 +0200 +Subject: ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock + +From: Jiri Kosina + +commit 6726655dfdd2dc60c035c690d9f10cb69d7ea075 upstream. + +There is a following AB-BA dependency between cpu_hotplug.lock and +cpuidle_lock: + +1) cpu_hotplug.lock -> cpuidle_lock +enable_nonboot_cpus() + _cpu_up() + cpu_hotplug_begin() + LOCK(cpu_hotplug.lock) + cpu_notify() + ... + acpi_processor_hotplug() + cpuidle_pause_and_lock() + LOCK(cpuidle_lock) + +2) cpuidle_lock -> cpu_hotplug.lock +acpi_os_execute_deferred() workqueue + ... + acpi_processor_cst_has_changed() + cpuidle_pause_and_lock() + LOCK(cpuidle_lock) + get_online_cpus() + LOCK(cpu_hotplug.lock) + +Fix this by reversing the order acpi_processor_cst_has_changed() does +thigs -- let it first execute the protection against CPU hotplug by +calling get_online_cpus() and obtain the cpuidle lock only after that (and +perform the symmentric change when allowing CPUs hotplug again and +dropping cpuidle lock). + +Spotted by lockdep. + +Signed-off-by: Jiri Kosina +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/processor_idle.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1071,9 +1071,9 @@ int acpi_processor_cst_has_changed(struc + + if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) { + +- cpuidle_pause_and_lock(); + /* Protect against cpu-hotplug */ + get_online_cpus(); ++ cpuidle_pause_and_lock(); + + /* Disable all cpuidle devices */ + for_each_online_cpu(cpu) { +@@ -1100,8 +1100,8 @@ int acpi_processor_cst_has_changed(struc + cpuidle_enable_device(dev); + } + } +- put_online_cpus(); + cpuidle_resume_and_unlock(); ++ put_online_cpus(); + } + + return 0; diff --git a/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch b/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch new file mode 100644 index 00000000000..7f19278d703 --- /dev/null +++ b/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch @@ -0,0 +1,52 @@ +From 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Thu, 21 Aug 2014 14:41:26 +0800 +Subject: ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC + +From: Lv Zheng + +commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream. + +There is platform refusing to respond QR_EC when SCI_EVT isn't set +which is Acer Aspire V5-573G. + +By disallowing QR_EC to be issued before the previous one has been +completed we are able to reduce the possibilities to trigger issues on +such platforms. + +Note that this fix can only reduce the occurrence rate of this issue, but +this issue may still occur when such a platform doesn't clear SCI_EVT +before or immediately after completing the previous QR_EC transaction. +This patch cannot fix the CLEAR_ON_RESUME quirk which also relies on +the assumption that the platforms are able to respond even when SCI_EVT +isn't set. + +But this patch is still useful as it can help to reduce the number of +scheduled QR_EC work items. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611 +Reported-and-tested-by: Alexander Mezin +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -303,11 +303,11 @@ static int acpi_ec_transaction_unlocked( + /* following two actions should be kept atomic */ + ec->curr = t; + start_transaction(ec); +- if (ec->curr->command == ACPI_EC_COMMAND_QUERY) +- clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); + spin_unlock_irqrestore(&ec->lock, tmp); + ret = ec_poll(ec); + spin_lock_irqsave(&ec->lock, tmp); ++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY) ++ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); + ec->curr = NULL; + spin_unlock_irqrestore(&ec->lock, tmp); + return ret; diff --git a/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch b/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch new file mode 100644 index 00000000000..f03f74bef03 --- /dev/null +++ b/queue-3.16/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch @@ -0,0 +1,83 @@ +From 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Thu, 21 Aug 2014 14:41:13 +0800 +Subject: ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set + +From: Lv Zheng + +commit 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 upstream. + +There is a platform refusing to respond QR_EC when SCI_EVT isn't set +(Acer Aspire V5-573G). + +Currently, we rely on the behaviour that the EC firmware can respond +something (for example, 0x00 to indicate "no outstanding events") to +QR_EC even when SCI_EVT is not set, but the reporter has complained +about AC/battery pluging/unpluging and video brightness change delay +on that platform. + +This is because the work item that has issued QR_EC has to wait until +timeout in this case, and the _Qxx method evaluation work item queued +after QR_EC one is delayed. + +It sounds reasonable to fix this issue by: + 1. Implementing SCI_EVT sanity check before issuing QR_EC in the EC + driver's main state machine. + 2. Moving QR_EC issuing out of the work queue used by _Qxx evaluation + to a seperate IRQ handling thread. + +This patch fixes this issue using solution 1. + +By disallowing QR_EC to be issued when SCI_EVT isn't set, we are able to +handle such platform in the EC driver's main state machine. This patch +enhances the state machine in this way to survive with such malfunctioning +EC firmware. + +Note that this patch can also fix CLEAR_ON_RESUME quirk which also relies +on the assumption that the platforms are able to respond even when SCI_EVT +isn't set. + +Fixes: c0d653412fc8 ACPI / EC: Fix race condition in ec_transaction_completed() +Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611 +Reported-and-tested-by: Alexander Mezin +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -197,6 +197,8 @@ static bool advance_transaction(struct a + t->rdata[t->ri++] = acpi_ec_read_data(ec); + if (t->rlen == t->ri) { + t->flags |= ACPI_EC_COMMAND_COMPLETE; ++ if (t->command == ACPI_EC_COMMAND_QUERY) ++ pr_debug("hardware QR_EC completion\n"); + wakeup = true; + } + } else +@@ -208,7 +210,20 @@ static bool advance_transaction(struct a + } + return wakeup; + } else { +- if ((status & ACPI_EC_FLAG_IBF) == 0) { ++ /* ++ * There is firmware refusing to respond QR_EC when SCI_EVT ++ * is not set, for which case, we complete the QR_EC ++ * without issuing it to the firmware. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=86211 ++ */ ++ if (!(status & ACPI_EC_FLAG_SCI) && ++ (t->command == ACPI_EC_COMMAND_QUERY)) { ++ t->flags |= ACPI_EC_COMMAND_POLL; ++ t->rdata[t->ri++] = 0x00; ++ t->flags |= ACPI_EC_COMMAND_COMPLETE; ++ pr_debug("software QR_EC completion\n"); ++ wakeup = true; ++ } else if ((status & ACPI_EC_FLAG_IBF) == 0) { + acpi_ec_write_cmd(ec, t->command); + t->flags |= ACPI_EC_COMMAND_POLL; + } else diff --git a/queue-3.16/acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch b/queue-3.16/acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch new file mode 100644 index 00000000000..b21aa278788 --- /dev/null +++ b/queue-3.16/acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch @@ -0,0 +1,77 @@ +From dee1592638ab7ea35a32179b73f9284dead49c03 Mon Sep 17 00:00:00 2001 +From: Tang Chen +Date: Fri, 8 Aug 2014 10:30:45 +0800 +Subject: ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove() + +From: Tang Chen + +commit dee1592638ab7ea35a32179b73f9284dead49c03 upstream. + +When ACPI_HOTPLUG_MEMORY is not configured, memory_device_handler.attach +is not set. In acpi_scan_attach_handler(), the acpi_device->handler will +not be initialized. + +In acpi_scan_hot_remove(), it doesn't check if acpi_device->handler is NULL. +If we do memory hot-remove without ACPI_HOTPLUG_MEMORY configured, the kernel +will panic. + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000088 + IP: [] acpi_device_hotplug+0x1d7/0x4c4 + PGD 0 + Oops: 0000 [#1] SMP + Modules linked in: sd_mod(E) sr_mod(E) cdrom(E) crc_t10dif(E) crct10dif_common(E) ata_piix(E) libata(E) + CPU: 0 PID: 41 Comm: kworker/u2:1 Tainted: G E 3.16.0-rc7--3.16-rc7-tangchen+ #20 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014 + Workqueue: kacpi_hotplug acpi_hotplug_work_fn + task: ffff8800182436c0 ti: ffff880018254000 task.ti: ffff880018254000 + RIP: 0010:[] [] acpi_device_hotplug+0x1d7/0x4c4 + RSP: 0000:ffff880018257da8 EFLAGS: 00000246 + RAX: 0000000000000000 RBX: ffff88001cd8d800 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffff88001e40e6f8 RDI: 0000000000000246 + RBP: ffff880018257df0 R08: 0000000000000096 R09: 00000000000011a0 + R10: 63735f6970636120 R11: 725f746f685f6e61 R12: 0000000000000003 + R13: ffff88001cc1c400 R14: ffff88001e062028 R15: 0000000000000040 + FS: 0000000000000000(0000) GS:ffff88001e400000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 0000000000000088 CR3: 000000001a9a2000 CR4: 00000000000006f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000 + Stack: + 00000000523cab58 ffff88001cd8d9f8 ffff88001852d480 00000000523cab58 + ffff88001852d480 ffff880018221e40 ffff88001cc1c400 ffff88001cce2d00 + 0000000000000040 ffff880018257e08 ffffffff813dc31d ffff88001852d480 + Call Trace: + [] acpi_hotplug_work_fn+0x1e/0x29 + [] process_one_work+0x17b/0x460 + [] worker_thread+0x11d/0x5b0 + [] ? rescuer_thread+0x3a0/0x3a0 + [] kthread+0xe1/0x100 + [] ? kthread_create_on_node+0x1a0/0x1a0 + [] ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x1a0/0x1a0 + +This patch fixes this problem by checking if acpi_device->handler is NULL +in acpi_scan_hot_remove(). + +Fixes: d22ddcbc4fb7 (ACPI / hotplug: Add demand_offline hotplug profile flag) +Signed-off-by: Tang Chen +[rjw: Subject] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -351,7 +351,8 @@ static int acpi_scan_hot_remove(struct a + unsigned long long sta; + acpi_status status; + +- if (device->handler->hotplug.demand_offline && !acpi_force_hot_remove) { ++ if (device->handler && device->handler->hotplug.demand_offline ++ && !acpi_force_hot_remove) { + if (!acpi_scan_is_offline(device, true)) + return -EBUSY; + } else { diff --git a/queue-3.16/acpi-run-fixed-event-device-notifications-in-process-context.patch b/queue-3.16/acpi-run-fixed-event-device-notifications-in-process-context.patch new file mode 100644 index 00000000000..d58156e08c6 --- /dev/null +++ b/queue-3.16/acpi-run-fixed-event-device-notifications-in-process-context.patch @@ -0,0 +1,85 @@ +From 236105db632c6279a020f78c83e22eaef746006b Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Tue, 26 Aug 2014 01:29:24 +0200 +Subject: ACPI: Run fixed event device notifications in process context + +From: Lan Tianyu + +commit 236105db632c6279a020f78c83e22eaef746006b upstream. + +Currently, notify callbacks for fixed button events are run from +interrupt context. That is not necessary and after commit 0bf6368ee8f2 +(ACPI / button: Add ACPI Button event via netlink routine) it causes +netlink routines to be called from interrupt context which is not +correct. + +Also, that is different from non-fixed device events (including +non-fixed button events) whose notify callbacks are all executed from +process context. + +For the above reasons, make fixed button device notify callbacks run +in process context which will avoid the deadlock when using netlink +to report button events to user space. + +Fixes: 0bf6368ee8f2 (ACPI / button: Add ACPI Button event via netlink routine) +Link: https://lkml.org/lkml/2014/8/21/606 +Reported-by: Benjamin Block +Reported-by: Knut Petersen +Signed-off-by: Lan Tianyu +[rjw: Function names, subject and changelog.] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -920,12 +920,17 @@ static void acpi_device_notify(acpi_hand + device->driver->ops.notify(device, event); + } + +-static acpi_status acpi_device_notify_fixed(void *data) ++static void acpi_device_notify_fixed(void *data) + { + struct acpi_device *device = data; + + /* Fixed hardware devices have no handles */ + acpi_device_notify(NULL, ACPI_FIXED_HARDWARE_EVENT, device); ++} ++ ++static acpi_status acpi_device_fixed_event(void *data) ++{ ++ acpi_os_execute(OSL_NOTIFY_HANDLER, acpi_device_notify_fixed, data); + return AE_OK; + } + +@@ -936,12 +941,12 @@ static int acpi_device_install_notify_ha + if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) + status = + acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, +- acpi_device_notify_fixed, ++ acpi_device_fixed_event, + device); + else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) + status = + acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, +- acpi_device_notify_fixed, ++ acpi_device_fixed_event, + device); + else + status = acpi_install_notify_handler(device->handle, +@@ -958,10 +963,10 @@ static void acpi_device_remove_notify_ha + { + if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) + acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, +- acpi_device_notify_fixed); ++ acpi_device_fixed_event); + else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) + acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, +- acpi_device_notify_fixed); ++ acpi_device_fixed_event); + else + acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, + acpi_device_notify); diff --git a/queue-3.16/acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch b/queue-3.16/acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch new file mode 100644 index 00000000000..3acf926744e --- /dev/null +++ b/queue-3.16/acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch @@ -0,0 +1,46 @@ +From fc2e0a8326d1b21d11ef8213298e5302867fed2c Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 26 Aug 2014 01:29:21 +0200 +Subject: ACPI / scan: Allow ACPI drivers to bind to PNP device objects + +From: "Rafael J. Wysocki" + +commit fc2e0a8326d1b21d11ef8213298e5302867fed2c upstream. + +We generally don't allow ACPI drivers to bind to ACPI device objects +that companion "physical" device objects are created for to avoid +situations in which two different drivers may attempt to handle one +device at the same time. Recent ACPI device enumeration rework +extended that approach to ACPI PNP devices by starting to use a scan +handler for enumerating them. However, we previously allowed ACPI +drivers to bind to ACPI device objects with existing PNP device +companions and changing that led to functional regressions on some +systems. + +For this reason, add a special check for PNP devices in +acpi_device_probe() so that ACPI drivers can bind to ACPI device +objects having existing PNP device companions as before. + +Fixes: eec15edbb0e1 (ACPI / PNP: use device ID list for PNPACPI device enumeration) +Link: https://bugzilla.kernel.org/show_bug.cgi?id=81511 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=81971 +Reported-by: Gabriele Mazzotta +Reported-by: Dirk Griesbach +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -978,7 +978,7 @@ static int acpi_device_probe(struct devi + struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver); + int ret; + +- if (acpi_dev->handler) ++ if (acpi_dev->handler && !acpi_is_pnp_device(acpi_dev)) + return -EINVAL; + + if (!acpi_drv->ops.add) diff --git a/queue-3.16/acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch b/queue-3.16/acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch new file mode 100644 index 00000000000..b92e73a7801 --- /dev/null +++ b/queue-3.16/acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch @@ -0,0 +1,81 @@ +From a383b68d9fe9864c4d3b86f67ad6488f58136435 Mon Sep 17 00:00:00 2001 +From: Yasuaki Ishimatsu +Date: Wed, 3 Sep 2014 13:39:13 +0900 +Subject: ACPI / scan: not cache _SUN value in struct acpi_device_pnp + +From: Yasuaki Ishimatsu + +commit a383b68d9fe9864c4d3b86f67ad6488f58136435 upstream. + +The _SUN device indentification object is not guaranteed to return +the same value every time it is executed, so we should not cache its +return value, but rather execute it every time as needed. If it is +cached, an incorrect stale value may be used in some situations. + +This issue was exposed by commit 202317a573b2 (ACPI / scan: Add +acpi_device objects for all device nodes in the namespace). Fix it +by avoiding to cache the return value of _SUN. + +Fixes: 202317a573b2 (ACPI / scan: Add acpi_device objects for all device nodes in the namespace) +Signed-off-by: Yasuaki Ishimatsu +[ rjw: Changelog ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 15 ++++++++------- + include/acpi/acpi_bus.h | 1 - + 2 files changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -665,8 +665,14 @@ static ssize_t + acpi_device_sun_show(struct device *dev, struct device_attribute *attr, + char *buf) { + struct acpi_device *acpi_dev = to_acpi_device(dev); ++ acpi_status status; ++ unsigned long long sun; ++ ++ status = acpi_evaluate_integer(acpi_dev->handle, "_SUN", NULL, &sun); ++ if (ACPI_FAILURE(status)) ++ return -ENODEV; + +- return sprintf(buf, "%lu\n", acpi_dev->pnp.sun); ++ return sprintf(buf, "%llu\n", sun); + } + static DEVICE_ATTR(sun, 0444, acpi_device_sun_show, NULL); + +@@ -688,7 +694,6 @@ static int acpi_device_setup_files(struc + { + struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; + acpi_status status; +- unsigned long long sun; + int result = 0; + + /* +@@ -729,14 +734,10 @@ static int acpi_device_setup_files(struc + if (dev->pnp.unique_id) + result = device_create_file(&dev->dev, &dev_attr_uid); + +- status = acpi_evaluate_integer(dev->handle, "_SUN", NULL, &sun); +- if (ACPI_SUCCESS(status)) { +- dev->pnp.sun = (unsigned long)sun; ++ if (acpi_has_method(dev->handle, "_SUN")) { + result = device_create_file(&dev->dev, &dev_attr_sun); + if (result) + goto end; +- } else { +- dev->pnp.sun = (unsigned long)-1; + } + + if (acpi_has_method(dev->handle, "_STA")) { +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -246,7 +246,6 @@ struct acpi_device_pnp { + acpi_device_name device_name; /* Driver-determined */ + acpi_device_class device_class; /* " */ + union acpi_object *str_obj; /* unicode string for _STR method */ +- unsigned long sun; /* _SUN */ + }; + + #define acpi_device_bid(d) ((d)->pnp.bus_id) diff --git a/queue-3.16/acpi-video-add-a-disable_native_backlight-quirk.patch b/queue-3.16/acpi-video-add-a-disable_native_backlight-quirk.patch new file mode 100644 index 00000000000..8b90168053e --- /dev/null +++ b/queue-3.16/acpi-video-add-a-disable_native_backlight-quirk.patch @@ -0,0 +1,73 @@ +From 5f24079b021cd3147c8d24ba65833f7a0df7e80d Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 28 Aug 2014 10:20:46 +0200 +Subject: ACPI / video: Add a disable_native_backlight quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +commit 5f24079b021cd3147c8d24ba65833f7a0df7e80d upstream. + +Some laptops have a working acpi_video backlight control, and using native +backlight on these causes a regression where backlight control does not work +when userspace is not handling brightness key events. Disable native_backlight +on these to fix this. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=81691 +Reported-and-tested-by: Andre Müller +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -415,6 +415,12 @@ static int __init video_set_use_native_b + return 0; + } + ++static int __init video_disable_native_backlight(const struct dmi_system_id *d) ++{ ++ use_native_backlight_dmi = false; ++ return 0; ++} ++ + static struct dmi_system_id video_dmi_table[] __initdata = { + /* + * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121 +@@ -645,6 +651,30 @@ static struct dmi_system_id video_dmi_ta + DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"), + }, + }, ++ ++ /* ++ * These models have a working acpi_video backlight control, and using ++ * native backlight causes a regression where backlight does not work ++ * when userspace is not handling brightness key events. Disable ++ * native_backlight on these to fix this: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=81691 ++ */ ++ { ++ .callback = video_disable_native_backlight, ++ .ident = "ThinkPad T420", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T420"), ++ }, ++ }, ++ { ++ .callback = video_disable_native_backlight, ++ .ident = "ThinkPad T520", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"), ++ }, ++ }, + {} + }; + diff --git a/queue-3.16/acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch b/queue-3.16/acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch new file mode 100644 index 00000000000..bafd0fd5a63 --- /dev/null +++ b/queue-3.16/acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch @@ -0,0 +1,39 @@ +From 84c34858a85ecf9dabd72847d860c7d3fb7536e7 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 28 Aug 2014 10:20:47 +0200 +Subject: ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC + +From: Hans de Goede + +commit 84c34858a85ecf9dabd72847d860c7d3fb7536e7 upstream. + +Link: https://bugs.freedesktop.org/show_bug.cgi?id=81515 +Reported-and-tested-by: Hohahiu +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -675,6 +675,17 @@ static struct dmi_system_id video_dmi_ta + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"), + }, + }, ++ ++ /* The native backlight controls do not work on some older machines */ ++ { ++ /* https://bugs.freedesktop.org/show_bug.cgi?id=81515 */ ++ .callback = video_disable_native_backlight, ++ .ident = "HP ENVY 15 Notebook", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"), ++ }, ++ }, + {} + }; + diff --git a/queue-3.16/acpi-video-fix-use_native_backlight-selection-logic.patch b/queue-3.16/acpi-video-fix-use_native_backlight-selection-logic.patch new file mode 100644 index 00000000000..c0b5f225344 --- /dev/null +++ b/queue-3.16/acpi-video-fix-use_native_backlight-selection-logic.patch @@ -0,0 +1,45 @@ +From 25294e9f00f03b2b4f4c56e913bc8c573972f33b Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 28 Aug 2014 10:20:45 +0200 +Subject: ACPI / video: Fix use_native_backlight selection logic + +From: Hans de Goede + +commit 25294e9f00f03b2b4f4c56e913bc8c573972f33b upstream. + +Commit 751109aad583 ("ACPI / video: Change the default for +video.use_native_backlight to 1") has changed the default for +use_native_backlight from 0 to 1, but instead of changing +use_native_backlight_dmi to true, and leaving use_native_backlight_param at -1, +it has changed use_native_backlight_param to 1. + +This causes acpi_video_use_native_backlight() to always think that a value was +specified through the param, making it impossible to add a dmi based quirk +to force 0 now that the default is 1. + +This fixes this by restoring the use_native_backlight_param default to -1, and +instead setting the use_native_backlight_dmi default to true. + +Fixes: 751109aad583 (ACPI / video: Change the default for video.use_native_backlight to 1) +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -82,9 +82,9 @@ module_param(allow_duplicates, bool, 064 + * For Windows 8 systems: used to decide if video module + * should skip registering backlight interface of its own. + */ +-static int use_native_backlight_param = 1; ++static int use_native_backlight_param = -1; + module_param_named(use_native_backlight, use_native_backlight_param, int, 0444); +-static bool use_native_backlight_dmi = false; ++static bool use_native_backlight_dmi = true; + + static int register_count; + static struct mutex video_list_lock; diff --git a/queue-3.16/acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch b/queue-3.16/acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch new file mode 100644 index 00000000000..88e113cb78e --- /dev/null +++ b/queue-3.16/acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch @@ -0,0 +1,47 @@ +From e23d9b8297546c6ceb7e70771e4915f2a41733cd Mon Sep 17 00:00:00 2001 +From: "David E. Box" +Date: Tue, 8 Jul 2014 10:06:24 +0800 +Subject: ACPICA: Namespace: Properly null terminate objects detached from a namespace node + +From: "David E. Box" + +commit e23d9b8297546c6ceb7e70771e4915f2a41733cd upstream. + +Fixes a bug exposed by an ACPICA unit test around the +acpi_attach_data()/acpi_detach_data() APIs where the failure to null +terminate a detached object led to the creation of a circular linked list +(and infinite looping) when the object is reattached. + +Reported in acpica bugzilla #1063 + +Link: https://bugs.acpica.org/show_bug.cgi?id=1063 +Signed-off-by: David E. Box +Signed-off-by: Bob Moore +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/nsobject.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/acpi/acpica/nsobject.c ++++ b/drivers/acpi/acpica/nsobject.c +@@ -239,6 +239,17 @@ void acpi_ns_detach_object(struct acpi_n + } + } + ++ /* ++ * Detach the object from any data objects (which are still held by ++ * the namespace node) ++ */ ++ ++ if (obj_desc->common.next_object && ++ ((obj_desc->common.next_object)->common.type == ++ ACPI_TYPE_LOCAL_DATA)) { ++ obj_desc->common.next_object = NULL; ++ } ++ + /* Reset the node type to untyped */ + + node->type = ACPI_TYPE_ANY; diff --git a/queue-3.16/acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch b/queue-3.16/acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch new file mode 100644 index 00000000000..d09e29f1cbf --- /dev/null +++ b/queue-3.16/acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch @@ -0,0 +1,42 @@ +From 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce Mon Sep 17 00:00:00 2001 +From: "David E. Box" +Date: Tue, 8 Jul 2014 10:05:52 +0800 +Subject: ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject + +From: "David E. Box" + +commit 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce upstream. + +Adds return status check on copy routines to delete the allocated destination +object if either copy fails. Reported by Colin Ian King on bugs.acpica.org, +Bug 1087. +The last applicable commit: + Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61 + Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro + +Link: https://bugs.acpica.org/show_bug.cgi?id=1087 +Reported-by: Colin Ian King +Signed-off-by: David E. Box +Signed-off-by: Bob Moore +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/utcopy.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/acpi/acpica/utcopy.c ++++ b/drivers/acpi/acpica/utcopy.c +@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union ac + status = acpi_ut_copy_simple_object(source_desc, *dest_desc); + } + ++ /* Delete the allocated object if copy failed */ ++ ++ if (ACPI_FAILURE(status)) { ++ acpi_ut_remove_reference(*dest_desc); ++ } ++ + return_ACPI_STATUS(status); + } diff --git a/queue-3.16/asoc-adau1701-fix-adau1701_reg_read.patch b/queue-3.16/asoc-adau1701-fix-adau1701_reg_read.patch new file mode 100644 index 00000000000..d0187d0b705 --- /dev/null +++ b/queue-3.16/asoc-adau1701-fix-adau1701_reg_read.patch @@ -0,0 +1,37 @@ +From 3ad80b828b2533f37c221e2df155774efd6ed814 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Thu, 3 Jul 2014 16:51:36 +0200 +Subject: ASoC: adau1701: fix adau1701_reg_read() + +From: Daniel Mack + +commit 3ad80b828b2533f37c221e2df155774efd6ed814 upstream. + +Fix a long standing bug in the read register routing of adau1701. +The bytes arrive in the buffer in big-endian, so the result has to be +shifted before and-ing the bytes in the loop. + +Signed-off-by: Daniel Mack +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/adau1701.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/adau1701.c ++++ b/sound/soc/codecs/adau1701.c +@@ -230,8 +230,10 @@ static int adau1701_reg_read(void *conte + + *value = 0; + +- for (i = 0; i < size; i++) +- *value |= recv_buf[i] << (i * 8); ++ for (i = 0; i < size; i++) { ++ *value <<= 8; ++ *value |= recv_buf[i]; ++ } + + return 0; + } diff --git a/queue-3.16/asoc-axi-fix-adi-axi-spdif-specification.patch b/queue-3.16/asoc-axi-fix-adi-axi-spdif-specification.patch new file mode 100644 index 00000000000..1a37e87d2af --- /dev/null +++ b/queue-3.16/asoc-axi-fix-adi-axi-spdif-specification.patch @@ -0,0 +1,38 @@ +From d1555c407a65db42126b295425379acb393ba83a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andreas=20F=C3=A4rber?= +Date: Mon, 28 Jul 2014 15:05:03 +0200 +Subject: ASoC: axi: Fix ADI AXI SPDIF specification +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Andreas=20F=C3=A4rber?= + +commit d1555c407a65db42126b295425379acb393ba83a upstream. + +The specification requires compatible = "adi,axi-spdif-1.00.a" but +driver and example and file name indicate "adi,axi-spdif-tx-1.00.a". +Change the specification to match the implementation. + +Acked-by: Lars-Peter Clausen +Reviewed-by: Michal Simek +Fixes: d7b528eff927 ("dt: Add bindings documentation for the ADI AXI-SPDIF audio controller") +Signed-off-by: Andreas Färber +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt ++++ b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt +@@ -1,7 +1,7 @@ + ADI AXI-SPDIF controller + + Required properties: +- - compatible : Must be "adi,axi-spdif-1.00.a" ++ - compatible : Must be "adi,axi-spdif-tx-1.00.a" + - reg : Must contain SPDIF core's registers location and length + - clocks : Pairs of phandle and specifier referencing the controller's clocks. + The controller expects two clocks, the clock used for the AXI interface and diff --git a/queue-3.16/asoc-blackfin-use-samples-to-set-silence.patch b/queue-3.16/asoc-blackfin-use-samples-to-set-silence.patch new file mode 100644 index 00000000000..335f73d66a1 --- /dev/null +++ b/queue-3.16/asoc-blackfin-use-samples-to-set-silence.patch @@ -0,0 +1,46 @@ +From 30443408fd7201fd1911b09daccf92fae3cc700d Mon Sep 17 00:00:00 2001 +From: Scott Jiang +Date: Fri, 18 Jul 2014 16:14:57 +0800 +Subject: ASoC: blackfin: use samples to set silence + +From: Scott Jiang + +commit 30443408fd7201fd1911b09daccf92fae3cc700d upstream. + +The third parameter for snd_pcm_format_set_silence needs the number +of samples instead of sample bytes. + +Signed-off-by: Scott Jiang +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c ++++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c +@@ -290,19 +290,19 @@ static int bf5xx_pcm_silence(struct snd_ + unsigned int sample_size = runtime->sample_bits / 8; + void *buf = runtime->dma_area; + struct bf5xx_i2s_pcm_data *dma_data; +- unsigned int offset, size; ++ unsigned int offset, samples; + + dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream); + + if (dma_data->tdm_mode) { + offset = pos * 8 * sample_size; +- size = count * 8 * sample_size; ++ samples = count * 8; + } else { + offset = frames_to_bytes(runtime, pos); +- size = frames_to_bytes(runtime, count); ++ samples = count * runtime->channels; + } + +- snd_pcm_format_set_silence(runtime->format, buf + offset, size); ++ snd_pcm_format_set_silence(runtime->format, buf + offset, samples); + + return 0; + } diff --git a/queue-3.16/asoc-intel-cleanup-hsw-pcm-format-support.patch b/queue-3.16/asoc-intel-cleanup-hsw-pcm-format-support.patch new file mode 100644 index 00000000000..cc5f5501246 --- /dev/null +++ b/queue-3.16/asoc-intel-cleanup-hsw-pcm-format-support.patch @@ -0,0 +1,105 @@ +From 8e89761876611f06ef4be865b4780b4361caf4af Mon Sep 17 00:00:00 2001 +From: Jie Yang +Date: Mon, 14 Jul 2014 17:37:36 +0800 +Subject: ASoC: Intel: Cleanup HSW pcm format support + +From: Jie Yang + +commit 8e89761876611f06ef4be865b4780b4361caf4af upstream. + +This change removes unsupported formats from System, +Capture and Loopback FE DAIs. +Also it fixes S24_LE support on all DAIs. +While at this fix 24 bit flag for BYT as well. + +Signed-off-by: Jie Yang +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/sst-baytrail-pcm.c | 2 +- + sound/soc/intel/sst-haswell-pcm.c | 27 ++++++++++++++++++--------- + 2 files changed, 19 insertions(+), 10 deletions(-) + +--- a/sound/soc/intel/sst-baytrail-pcm.c ++++ b/sound/soc/intel/sst-baytrail-pcm.c +@@ -32,7 +32,7 @@ static const struct snd_pcm_hardware sst + SNDRV_PCM_INFO_PAUSE | + SNDRV_PCM_INFO_RESUME, + .formats = SNDRV_PCM_FMTBIT_S16_LE | +- SNDRV_PCM_FORMAT_S24_LE, ++ SNDRV_PCM_FMTBIT_S24_LE, + .period_bytes_min = 384, + .period_bytes_max = 48000, + .periods_min = 2, +--- a/sound/soc/intel/sst-haswell-pcm.c ++++ b/sound/soc/intel/sst-haswell-pcm.c +@@ -80,7 +80,7 @@ static const struct snd_pcm_hardware hsw + SNDRV_PCM_INFO_PAUSE | + SNDRV_PCM_INFO_RESUME | + SNDRV_PCM_INFO_NO_PERIOD_WAKEUP, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_S24_LE | ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | + SNDRV_PCM_FMTBIT_S32_LE, + .period_bytes_min = PAGE_SIZE, + .period_bytes_max = (HSW_PCM_PERIODS_MAX / HSW_PCM_PERIODS_MIN) * PAGE_SIZE, +@@ -400,7 +400,15 @@ static int hsw_pcm_hw_params(struct snd_ + sst_hsw_stream_set_valid(hsw, pcm_data->stream, 16); + break; + case SNDRV_PCM_FORMAT_S24_LE: +- bits = SST_HSW_DEPTH_24BIT; ++ bits = SST_HSW_DEPTH_32BIT; ++ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 24); ++ break; ++ case SNDRV_PCM_FORMAT_S8: ++ bits = SST_HSW_DEPTH_8BIT; ++ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 8); ++ break; ++ case SNDRV_PCM_FORMAT_S32_LE: ++ bits = SST_HSW_DEPTH_32BIT; + sst_hsw_stream_set_valid(hsw, pcm_data->stream, 32); + break; + default: +@@ -685,8 +693,9 @@ static int hsw_pcm_new(struct snd_soc_pc + } + + #define HSW_FORMATS \ +- (SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\ +- SNDRV_PCM_FMTBIT_S32_LE) ++ (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \ ++ SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\ ++ SNDRV_PCM_FMTBIT_S8) + + static struct snd_soc_dai_driver hsw_dais[] = { + { +@@ -696,7 +705,7 @@ static struct snd_soc_dai_driver hsw_dai + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE, ++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE, + }, + }, + { +@@ -727,8 +736,8 @@ static struct snd_soc_dai_driver hsw_dai + .stream_name = "Loopback Capture", + .channels_min = 2, + .channels_max = 2, +- .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = HSW_FORMATS, ++ .rates = SNDRV_PCM_RATE_48000, ++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE, + }, + }, + { +@@ -737,8 +746,8 @@ static struct snd_soc_dai_driver hsw_dai + .stream_name = "Analog Capture", + .channels_min = 2, + .channels_max = 2, +- .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = HSW_FORMATS, ++ .rates = SNDRV_PCM_RATE_48000, ++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE, + }, + }, + }; diff --git a/queue-3.16/asoc-max98090-fix-missing-free_irq.patch b/queue-3.16/asoc-max98090-fix-missing-free_irq.patch new file mode 100644 index 00000000000..281705dba0a --- /dev/null +++ b/queue-3.16/asoc-max98090-fix-missing-free_irq.patch @@ -0,0 +1,34 @@ +From 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Thu, 19 Jun 2014 09:32:05 +0300 +Subject: ASoC: max98090: Fix missing free_irq + +From: Jarkko Nikula + +commit 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 upstream. + +max98090.c doesn't free the threaded interrupt it requests. This causes +an oops when doing "cat /proc/interrupts" after snd-soc-max98090.ko is +unloaded. + +Fix this by requesting the interrupt by using devm_request_threaded_irq(). + +Signed-off-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/max98090.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -2284,7 +2284,7 @@ static int max98090_probe(struct snd_soc + /* Register for interrupts */ + dev_dbg(codec->dev, "irq = %d\n", max98090->irq); + +- ret = request_threaded_irq(max98090->irq, NULL, ++ ret = devm_request_threaded_irq(codec->dev, max98090->irq, NULL, + max98090_interrupt, IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "max98090_interrupt", codec); + if (ret < 0) { diff --git a/queue-3.16/asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch b/queue-3.16/asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch new file mode 100644 index 00000000000..9417321ff14 --- /dev/null +++ b/queue-3.16/asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch @@ -0,0 +1,32 @@ +From fdaf42c0105a24de8aefa60f6f7360842c4e673e Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 29 Aug 2014 13:30:23 +0300 +Subject: ASoC: omap-twl4030: Fix typo in 2nd dai link's platform_name + +From: Peter Ujfalusi + +commit fdaf42c0105a24de8aefa60f6f7360842c4e673e upstream. + +The platform_name should be omap-mcasp3 for the 2nd link which is used for +voice connection. + +Reported-by: Tony Lindgren +Signed-off-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/omap/omap-twl4030.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/omap/omap-twl4030.c ++++ b/sound/soc/omap/omap-twl4030.c +@@ -260,7 +260,7 @@ static struct snd_soc_dai_link omap_twl4 + .stream_name = "TWL4030 Voice", + .cpu_dai_name = "omap-mcbsp.3", + .codec_dai_name = "twl4030-voice", +- .platform_name = "omap-mcbsp.2", ++ .platform_name = "omap-mcbsp.3", + .codec_name = "twl4030-codec", + .dai_fmt = SND_SOC_DAIFMT_DSP_A | SND_SOC_DAIFMT_IB_NF | + SND_SOC_DAIFMT_CBM_CFM, diff --git a/queue-3.16/asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch b/queue-3.16/asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch new file mode 100644 index 00000000000..baba6dd248c --- /dev/null +++ b/queue-3.16/asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch @@ -0,0 +1,31 @@ +From 7ed9de76ff342cbd717a9cf897044b99272cb8f8 Mon Sep 17 00:00:00 2001 +From: Qiao Zhou +Date: Wed, 4 Jun 2014 19:42:06 +0800 +Subject: ASoC: pcm: fix dpcm_path_put in dpcm runtime update + +From: Qiao Zhou + +commit 7ed9de76ff342cbd717a9cf897044b99272cb8f8 upstream. + +we need to release dapm widget list after dpcm_path_get in +soc_dpcm_runtime_update. otherwise, there will be potential memory +leak. add dpcm_path_put to fix it. + +Signed-off-by: Qiao Zhou +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-pcm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2069,6 +2069,7 @@ int soc_dpcm_runtime_update(struct snd_s + dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK); + } + ++ dpcm_path_put(&list); + capture: + /* skip if FE doesn't have capture capability */ + if (!fe->cpu_dai->driver->capture.channels_min) diff --git a/queue-3.16/asoc-pxa-pxa-ssp-small-leak-in-probe.patch b/queue-3.16/asoc-pxa-pxa-ssp-small-leak-in-probe.patch new file mode 100644 index 00000000000..6e25ca1e3b2 --- /dev/null +++ b/queue-3.16/asoc-pxa-pxa-ssp-small-leak-in-probe.patch @@ -0,0 +1,32 @@ +From 4548728981de259d7d37d0ae968a777b09794168 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 31 Jul 2014 15:57:51 +0300 +Subject: ASoC: pxa: pxa-ssp: small leak in probe() + +From: Dan Carpenter + +commit 4548728981de259d7d37d0ae968a777b09794168 upstream. + +There is a small memory leak if probe() fails. + +Fixes: 2023c90c3a2c ('ASoC: pxa: pxa-ssp: add DT bindings') +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/pxa/pxa-ssp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/soc/pxa/pxa-ssp.c ++++ b/sound/soc/pxa/pxa-ssp.c +@@ -723,7 +723,8 @@ static int pxa_ssp_probe(struct snd_soc_ + ssp_handle = of_parse_phandle(dev->of_node, "port", 0); + if (!ssp_handle) { + dev_err(dev, "unable to get 'port' phandle\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_priv; + } + + priv->ssp = pxa_ssp_request_of(ssp_handle, "SoC audio"); diff --git a/queue-3.16/asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch b/queue-3.16/asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch new file mode 100644 index 00000000000..90093931e2f --- /dev/null +++ b/queue-3.16/asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch @@ -0,0 +1,34 @@ +From 9301503af016eb537ccce76adec0c1bb5c84871e Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 13 Aug 2014 21:51:06 +0200 +Subject: ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE + +From: Daniel Mack + +commit 9301503af016eb537ccce76adec0c1bb5c84871e upstream. + +This mode is unsupported, as the DMA controller can't do zero-padding +of samples. + +Signed-off-by: Daniel Mack +Reported-by: Johannes Stezenbach +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/pxa/pxa-ssp.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/sound/soc/pxa/pxa-ssp.c ++++ b/sound/soc/pxa/pxa-ssp.c +@@ -765,9 +765,7 @@ static int pxa_ssp_remove(struct snd_soc + SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \ + SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000) + +-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\ +- SNDRV_PCM_FMTBIT_S24_LE | \ +- SNDRV_PCM_FMTBIT_S32_LE) ++#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE) + + static const struct snd_soc_dai_ops pxa_ssp_dai_ops = { + .startup = pxa_ssp_startup, diff --git a/queue-3.16/asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch b/queue-3.16/asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch new file mode 100644 index 00000000000..11517af6591 --- /dev/null +++ b/queue-3.16/asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch @@ -0,0 +1,30 @@ +From f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Tue, 26 Aug 2014 17:03:13 +0300 +Subject: ASoC: rt5640: Do not allow regmap to use bulk read-write operations + +From: Jarkko Nikula + +commit f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 upstream. + +Debugging showed Realtek RT5642 doesn't support autoincrementing writes so +driver should set the use_single_rw flag for regmap. + +Signed-off-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5640.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/rt5640.c ++++ b/sound/soc/codecs/rt5640.c +@@ -2059,6 +2059,7 @@ static struct snd_soc_codec_driver soc_c + static const struct regmap_config rt5640_regmap = { + .reg_bits = 8, + .val_bits = 16, ++ .use_single_rw = true, + + .max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) * + RT5640_PR_SPACING), diff --git a/queue-3.16/asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch b/queue-3.16/asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch new file mode 100644 index 00000000000..e8fcf7e5156 --- /dev/null +++ b/queue-3.16/asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch @@ -0,0 +1,55 @@ +From d3d4e5247b013008a39e4d5f69ce4c60ed57f997 Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Fri, 4 Jul 2014 16:05:45 +0200 +Subject: ASoC: samsung: Correct I2S DAI suspend/resume ops + +From: Sylwester Nawrocki + +commit d3d4e5247b013008a39e4d5f69ce4c60ed57f997 upstream. + +We should save/restore relevant I2S registers regardless of +the dai->active flag, otherwise some settings are being lost +after system suspend/resume cycle. E.g. I2S slave mode set only +during dai initialization is not preserved and the device ends +up in master mode after system resume. + +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/samsung/i2s.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -920,11 +920,9 @@ static int i2s_suspend(struct snd_soc_da + { + struct i2s_dai *i2s = to_info(dai); + +- if (dai->active) { +- i2s->suspend_i2smod = readl(i2s->addr + I2SMOD); +- i2s->suspend_i2scon = readl(i2s->addr + I2SCON); +- i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR); +- } ++ i2s->suspend_i2smod = readl(i2s->addr + I2SMOD); ++ i2s->suspend_i2scon = readl(i2s->addr + I2SCON); ++ i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR); + + return 0; + } +@@ -933,11 +931,9 @@ static int i2s_resume(struct snd_soc_dai + { + struct i2s_dai *i2s = to_info(dai); + +- if (dai->active) { +- writel(i2s->suspend_i2scon, i2s->addr + I2SCON); +- writel(i2s->suspend_i2smod, i2s->addr + I2SMOD); +- writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR); +- } ++ writel(i2s->suspend_i2scon, i2s->addr + I2SCON); ++ writel(i2s->suspend_i2smod, i2s->addr + I2SMOD); ++ writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR); + + return 0; + } diff --git a/queue-3.16/asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch b/queue-3.16/asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch new file mode 100644 index 00000000000..b7f888b7f76 --- /dev/null +++ b/queue-3.16/asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch @@ -0,0 +1,62 @@ +From a72d2abbe5752f3a773c4d8b7b41ae41f617f772 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 25 Jul 2014 13:12:54 +0300 +Subject: ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init() + +From: Peter Ujfalusi + +commit a72d2abbe5752f3a773c4d8b7b41ae41f617f772 upstream. + +We need to return the error codes from aic31xx_device_init() and return +from the i2c_probe with the error code. +We will have kernel panic (NULL pointer dereference) in +regulator_register_notifier() in case the devm_regulator_bulk_get() fails +(with -EPROBE_DEFER for example). + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tlv320aic31xx.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/tlv320aic31xx.c ++++ b/sound/soc/codecs/tlv320aic31xx.c +@@ -1178,7 +1178,7 @@ static void aic31xx_pdata_from_of(struct + } + #endif /* CONFIG_OF */ + +-static void aic31xx_device_init(struct aic31xx_priv *aic31xx) ++static int aic31xx_device_init(struct aic31xx_priv *aic31xx) + { + int ret, i; + +@@ -1197,7 +1197,7 @@ static void aic31xx_device_init(struct a + "aic31xx-reset-pin"); + if (ret < 0) { + dev_err(aic31xx->dev, "not able to acquire gpio\n"); +- return; ++ return ret; + } + } + +@@ -1210,6 +1210,7 @@ static void aic31xx_device_init(struct a + if (ret != 0) + dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret); + ++ return ret; + } + + static int aic31xx_i2c_probe(struct i2c_client *i2c, +@@ -1239,7 +1240,9 @@ static int aic31xx_i2c_probe(struct i2c_ + + aic31xx->pdata.codec_type = id->driver_data; + +- aic31xx_device_init(aic31xx); ++ ret = aic31xx_device_init(aic31xx); ++ if (ret) ++ return ret; + + return snd_soc_register_codec(&i2c->dev, &soc_codec_driver_aic31xx, + aic31xx_dai_driver, diff --git a/queue-3.16/asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch b/queue-3.16/asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch new file mode 100644 index 00000000000..d0fa5d56ce3 --- /dev/null +++ b/queue-3.16/asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch @@ -0,0 +1,62 @@ +From b38314179c9ccb789e6fe967cff171fa817e8978 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 16 Jun 2014 21:24:03 +0100 +Subject: ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811 + +From: Charles Keepax + +commit b38314179c9ccb789e6fe967cff171fa817e8978 upstream. + +wm1811_micd_stop takes the accdet_lock mutex, and is called from two +places, one of which is already holding the accdet_lock. This obviously +causes a lock up. + +This patch fixes this issue by removing the lock from wm1811_micd_stop +and ensuring that it is always locked externally. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8994.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -3505,6 +3505,7 @@ static irqreturn_t wm8994_mic_irq(int ir + return IRQ_HANDLED; + } + ++/* Should be called with accdet_lock held */ + static void wm1811_micd_stop(struct snd_soc_codec *codec) + { + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); +@@ -3512,14 +3513,10 @@ static void wm1811_micd_stop(struct snd_ + if (!wm8994->jackdet) + return; + +- mutex_lock(&wm8994->accdet_lock); +- + snd_soc_update_bits(codec, WM8958_MIC_DETECT_1, WM8958_MICD_ENA, 0); + + wm1811_jackdet_set_mode(codec, WM1811_JACKDET_MODE_JACK); + +- mutex_unlock(&wm8994->accdet_lock); +- + if (wm8994->wm8994->pdata.jd_ext_cap) + snd_soc_dapm_disable_pin(&codec->dapm, + "MICBIAS2"); +@@ -3560,10 +3557,10 @@ static void wm8958_open_circuit_work(str + open_circuit_work.work); + struct device *dev = wm8994->wm8994->dev; + +- wm1811_micd_stop(wm8994->hubs.codec); +- + mutex_lock(&wm8994->accdet_lock); + ++ wm1811_micd_stop(wm8994->hubs.codec); ++ + dev_dbg(dev, "Reporting open circuit\n"); + + wm8994->jack_mic = false; diff --git a/queue-3.16/asoc-wm_adsp-add-missing-module_license.patch b/queue-3.16/asoc-wm_adsp-add-missing-module_license.patch new file mode 100644 index 00000000000..f25b6b1f4ad --- /dev/null +++ b/queue-3.16/asoc-wm_adsp-add-missing-module_license.patch @@ -0,0 +1,30 @@ +From 0a37c6efec4a2fdc2563c5a8faa472b814deee80 Mon Sep 17 00:00:00 2001 +From: Praveen Diwakar +Date: Fri, 4 Jul 2014 11:17:41 +0530 +Subject: ASoC: wm_adsp: Add missing MODULE_LICENSE + +From: Praveen Diwakar + +commit 0a37c6efec4a2fdc2563c5a8faa472b814deee80 upstream. + +Since MODULE_LICENSE is missing the module load fails, +so add this for module. + +Signed-off-by: Praveen Diwakar +Signed-off-by: Vinod Koul +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_adsp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1758,3 +1758,5 @@ int wm_adsp2_init(struct wm_adsp *adsp, + return 0; + } + EXPORT_SYMBOL_GPL(wm_adsp2_init); ++ ++MODULE_LICENSE("GPL v2"); diff --git a/queue-3.16/bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch b/queue-3.16/bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch new file mode 100644 index 00000000000..c1919e1577d --- /dev/null +++ b/queue-3.16/bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch @@ -0,0 +1,49 @@ +From 03a6c3ff3282ee9fa893089304d951e0be93a144 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Sun, 8 Jun 2014 23:33:25 +0100 +Subject: bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address + +From: Ben Hutchings + +commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream. + +bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits +each way. In two places the argument type is dma_addr_t, which may be +32-bit, in which case the effect of the bit shift is undefined: + +drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq': +drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default] + addr = bfa_sgaddr_le(sg_dma_address(sg)); + ^ +drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default] +drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default] + addr = bfa_sgaddr_le(sg_dma_address(sg)); + ^ +drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default] + +Avoid this by adding casts to u64 in bfa_swap_words(). + +Compile-tested only. + +Signed-off-by: Ben Hutchings +Reviewed-by: Martin K. Petersen +Acked-by: Anil Gurumurthy +Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers') +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/bfa/bfa_ioc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/bfa/bfa_ioc.h ++++ b/drivers/scsi/bfa/bfa_ioc.h +@@ -72,7 +72,7 @@ struct bfa_sge_s { + } while (0) + + #define bfa_swap_words(_x) ( \ +- ((_x) << 32) | ((_x) >> 32)) ++ ((u64)(_x) << 32) | ((u64)(_x) >> 32)) + + #ifdef __BIG_ENDIAN + #define bfa_sge_to_be(_x) diff --git a/queue-3.16/bq2415x_charger-fix-atomic-sleep-bug.patch b/queue-3.16/bq2415x_charger-fix-atomic-sleep-bug.patch new file mode 100644 index 00000000000..6ddee0c7fc9 --- /dev/null +++ b/queue-3.16/bq2415x_charger-fix-atomic-sleep-bug.patch @@ -0,0 +1,69 @@ +From 3c0185046c0ee49a6e55c714612ef3bcd5385df3 Mon Sep 17 00:00:00 2001 +From: Sebastian Reichel +Date: Mon, 7 Apr 2014 13:14:04 +0200 +Subject: bq2415x_charger: Fix Atomic Sleep Bug + +From: Sebastian Reichel + +commit 3c0185046c0ee49a6e55c714612ef3bcd5385df3 upstream. + +Move sysfs_notify and i2c_transfer calls from bq2415x_notifier_call +to bq2415x_timer_work to avoid sleeping in atomic context. + +This fixes the following bug: + +[ 7.667449] Workqueue: events power_supply_changed_work +[ 7.673034] [] (unwind_backtrace+0x0/0xe0) from [] (show_stack+0x10/0x14) +[ 7.682098] [] (show_stack+0x10/0x14) from [] (dump_stack+0x78/0xac) +[ 7.690704] [] (dump_stack+0x78/0xac) from [] (__schedule_bug+0x48/0x60) +[ 7.699645] [] (__schedule_bug+0x48/0x60) from [] (__schedule+0x74/0x638) +[ 7.708618] [] (__schedule+0x74/0x638) from [] (schedule_timeout+0x1dc/0x24c) +[ 7.718017] [] (schedule_timeout+0x1dc/0x24c) from [] (wait_for_common+0x138/0x17c) +[ 7.727966] [] (wait_for_common+0x138/0x17c) from [] (omap_i2c_xfer+0x340/0x4a0) +[ 7.737640] [] (omap_i2c_xfer+0x340/0x4a0) from [] (__i2c_transfer+0x40/0x74) +[ 7.747039] [] (__i2c_transfer+0x40/0x74) from [] (i2c_transfer+0x6c/0x90) +[ 7.756195] [] (i2c_transfer+0x6c/0x90) from [] (bq2415x_i2c_write+0x48/0x78) +[ 7.765563] [] (bq2415x_i2c_write+0x48/0x78) from [] (bq2415x_set_weak_battery_voltage+0x4c/0x50) +[ 7.776824] [] (bq2415x_set_weak_battery_voltage+0x4c/0x50) from [] (bq2415x_set_mode+0xdc/0x14c) +[ 7.788085] [] (bq2415x_set_mode+0xdc/0x14c) from [] (bq2415x_notifier_call+0xa8/0xb4) +[ 7.798309] [] (bq2415x_notifier_call+0xa8/0xb4) from [] (notifier_call_chain+0x38/0x68) +[ 7.808715] [] (notifier_call_chain+0x38/0x68) from [] (__atomic_notifier_call_chain+0x2c/0x3c) +[ 7.819732] [] (__atomic_notifier_call_chain+0x2c/0x3c) from [] (atomic_notifier_call_chain+0x14/0x18) +[ 7.831420] [] (atomic_notifier_call_chain+0x14/0x18) from [] (power_supply_changed_work+0x6c/0xb8) +[ 7.842864] [] (power_supply_changed_work+0x6c/0xb8) from [] (process_one_work+0x248/0x440) +[ 7.853546] [] (process_one_work+0x248/0x440) from [] (worker_thread+0x208/0x350) +[ 7.863372] [] (worker_thread+0x208/0x350) from [] (kthread+0xc8/0xdc) +[ 7.872131] [] (kthread+0xc8/0xdc) from [] (ret_from_fork+0x14/0x3c) + +Fixes: 32260308b4ca ("bq2415x_charger: Use power_supply notifier for automode") +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/bq2415x_charger.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/power/bq2415x_charger.c ++++ b/drivers/power/bq2415x_charger.c +@@ -840,8 +840,7 @@ static int bq2415x_notifier_call(struct + if (bq->automode < 1) + return NOTIFY_OK; + +- sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode"); +- bq2415x_set_mode(bq, bq->reported_mode); ++ schedule_delayed_work(&bq->work, 0); + + return NOTIFY_OK; + } +@@ -892,6 +891,11 @@ static void bq2415x_timer_work(struct wo + int error; + int boost; + ++ if (bq->automode > 0 && (bq->reported_mode != bq->mode)) { ++ sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode"); ++ bq2415x_set_mode(bq, bq->reported_mode); ++ } ++ + if (!bq->autotimer) + return; + diff --git a/queue-3.16/fix-ebusy-on-umount-from-mnt_shrinkable.patch b/queue-3.16/fix-ebusy-on-umount-from-mnt_shrinkable.patch new file mode 100644 index 00000000000..878a5240054 --- /dev/null +++ b/queue-3.16/fix-ebusy-on-umount-from-mnt_shrinkable.patch @@ -0,0 +1,49 @@ +From 81b6b06197606b4bef4e427a197aeb808e8d89e1 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sat, 30 Aug 2014 18:32:05 -0400 +Subject: fix EBUSY on umount() from MNT_SHRINKABLE + +From: Al Viro + +commit 81b6b06197606b4bef4e427a197aeb808e8d89e1 upstream. + +We need the parents of victims alive until namespace_unlock() gets to +dput() of the (ex-)mountpoints. However, that screws up the "is it +busy" checks in case when we have shrinkable mounts that need to be +killed. Solution: go ahead and decrement refcounts of parents right +in umount_tree(), increment them again just before dropping rwsem in +namespace_unlock() (and let the loop in the end of namespace_unlock() +finally drop those references for good, as we do now). Parents can't +get freed until we drop rwsem - at least one reference is kept until +then, both in case when parent is among the victims and when it is +not. So they'll still be around when we get to namespace_unlock(). + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1226,6 +1226,11 @@ static void namespace_unlock(void) + head.first->pprev = &head.first; + INIT_HLIST_HEAD(&unmounted); + ++ /* undo decrements we'd done in umount_tree() */ ++ hlist_for_each_entry(mnt, &head, mnt_hash) ++ if (mnt->mnt_ex_mountpoint.mnt) ++ mntget(mnt->mnt_ex_mountpoint.mnt); ++ + up_write(&namespace_sem); + + synchronize_rcu(); +@@ -1277,6 +1282,7 @@ void umount_tree(struct mount *mnt, int + p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; + if (mnt_has_parent(p)) { + put_mountpoint(p->mnt_mp); ++ mnt_add_count(p->mnt_parent, -1); + /* move the reference to mountpoint into ->mnt_ex_mountpoint */ + p->mnt_ex_mountpoint.dentry = p->mnt_mountpoint; + p->mnt_ex_mountpoint.mnt = &p->mnt_parent->mnt; diff --git a/queue-3.16/get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch b/queue-3.16/get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch new file mode 100644 index 00000000000..cd8a425c72d --- /dev/null +++ b/queue-3.16/get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch @@ -0,0 +1,51 @@ +From 88b368f27a094277143d8ecd5a056116f6a41520 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Mon, 18 Aug 2014 15:09:26 -0400 +Subject: get rid of propagate_umount() mistakenly treating slaves as busy. + +From: Al Viro + +commit 88b368f27a094277143d8ecd5a056116f6a41520 upstream. + +The check in __propagate_umount() ("has somebody explicitly mounted +something on that slave?") is done *before* taking the already doomed +victims out of the child lists. + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 4 +++- + fs/pnode.c | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1262,6 +1262,9 @@ void umount_tree(struct mount *mnt, int + hlist_add_head(&p->mnt_hash, &tmp_list); + } + ++ hlist_for_each_entry(p, &tmp_list, mnt_hash) ++ list_del_init(&p->mnt_child); ++ + if (how) + propagate_umount(&tmp_list); + +@@ -1272,7 +1275,6 @@ void umount_tree(struct mount *mnt, int + p->mnt_ns = NULL; + if (how < 2) + p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; +- list_del_init(&p->mnt_child); + if (mnt_has_parent(p)) { + put_mountpoint(p->mnt_mp); + /* move the reference to mountpoint into ->mnt_ex_mountpoint */ +--- a/fs/pnode.c ++++ b/fs/pnode.c +@@ -381,6 +381,7 @@ static void __propagate_umount(struct mo + * other children + */ + if (child && list_empty(&child->mnt_mounts)) { ++ list_del_init(&child->mnt_child); + hlist_del_init_rcu(&child->mnt_hash); + hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash); + } diff --git a/queue-3.16/mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch b/queue-3.16/mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch new file mode 100644 index 00000000000..315c83913fa --- /dev/null +++ b/queue-3.16/mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch @@ -0,0 +1,309 @@ +From db181ce011e3c033328608299cd6fac06ea50130 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Tue, 29 Jul 2014 15:50:44 -0700 +Subject: mnt: Add tests for unprivileged remount cases that have found to be faulty + +From: "Eric W. Biederman" + +commit db181ce011e3c033328608299cd6fac06ea50130 upstream. + +Kenton Varda discovered that by remounting a +read-only bind mount read-only in a user namespace the +MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user +to the remount a read-only mount read-write. + +Upon review of the code in remount it was discovered that the code allowed +nosuid, noexec, and nodev to be cleared. It was also discovered that +the code was allowing the per mount atime flags to be changed. + +The first naive patch to fix these issues contained the flaw that using +default atime settings when remounting a filesystem could be disallowed. + +To avoid this problems in the future add tests to ensure unprivileged +remounts are succeeding and failing at the appropriate times. + +Acked-by: Serge E. Hallyn +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/Makefile | 1 + tools/testing/selftests/mount/Makefile | 17 + tools/testing/selftests/mount/unprivileged-remount-test.c | 242 ++++++++++++++ + 3 files changed, 260 insertions(+) + +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -4,6 +4,7 @@ TARGETS += efivarfs + TARGETS += kcmp + TARGETS += memory-hotplug + TARGETS += mqueue ++TARGETS += mount + TARGETS += net + TARGETS += ptrace + TARGETS += timers +--- /dev/null ++++ b/tools/testing/selftests/mount/Makefile +@@ -0,0 +1,17 @@ ++# Makefile for mount selftests. ++ ++all: unprivileged-remount-test ++ ++unprivileged-remount-test: unprivileged-remount-test.c ++ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test ++ ++# Allow specific tests to be selected. ++test_unprivileged_remount: unprivileged-remount-test ++ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi ++ ++run_tests: all test_unprivileged_remount ++ ++clean: ++ rm -f unprivileged-remount-test ++ ++.PHONY: all test_unprivileged_remount +--- /dev/null ++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c +@@ -0,0 +1,242 @@ ++#define _GNU_SOURCE ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#ifndef CLONE_NEWNS ++# define CLONE_NEWNS 0x00020000 ++#endif ++#ifndef CLONE_NEWUTS ++# define CLONE_NEWUTS 0x04000000 ++#endif ++#ifndef CLONE_NEWIPC ++# define CLONE_NEWIPC 0x08000000 ++#endif ++#ifndef CLONE_NEWNET ++# define CLONE_NEWNET 0x40000000 ++#endif ++#ifndef CLONE_NEWUSER ++# define CLONE_NEWUSER 0x10000000 ++#endif ++#ifndef CLONE_NEWPID ++# define CLONE_NEWPID 0x20000000 ++#endif ++ ++#ifndef MS_RELATIME ++#define MS_RELATIME (1 << 21) ++#endif ++#ifndef MS_STRICTATIME ++#define MS_STRICTATIME (1 << 24) ++#endif ++ ++static void die(char *fmt, ...) ++{ ++ va_list ap; ++ va_start(ap, fmt); ++ vfprintf(stderr, fmt, ap); ++ va_end(ap); ++ exit(EXIT_FAILURE); ++} ++ ++static void write_file(char *filename, char *fmt, ...) ++{ ++ char buf[4096]; ++ int fd; ++ ssize_t written; ++ int buf_len; ++ va_list ap; ++ ++ va_start(ap, fmt); ++ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); ++ va_end(ap); ++ if (buf_len < 0) { ++ die("vsnprintf failed: %s\n", ++ strerror(errno)); ++ } ++ if (buf_len >= sizeof(buf)) { ++ die("vsnprintf output truncated\n"); ++ } ++ ++ fd = open(filename, O_WRONLY); ++ if (fd < 0) { ++ die("open of %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++ written = write(fd, buf, buf_len); ++ if (written != buf_len) { ++ if (written >= 0) { ++ die("short write to %s\n", filename); ++ } else { ++ die("write to %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++ } ++ if (close(fd) != 0) { ++ die("close of %s failed: %s\n", ++ filename, strerror(errno)); ++ } ++} ++ ++static void create_and_enter_userns(void) ++{ ++ uid_t uid; ++ gid_t gid; ++ ++ uid = getuid(); ++ gid = getgid(); ++ ++ if (unshare(CLONE_NEWUSER) !=0) { ++ die("unshare(CLONE_NEWUSER) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ write_file("/proc/self/uid_map", "0 %d 1", uid); ++ write_file("/proc/self/gid_map", "0 %d 1", gid); ++ ++ if (setgroups(0, NULL) != 0) { ++ die("setgroups failed: %s\n", ++ strerror(errno)); ++ } ++ if (setgid(0) != 0) { ++ die ("setgid(0) failed %s\n", ++ strerror(errno)); ++ } ++ if (setuid(0) != 0) { ++ die("setuid(0) failed %s\n", ++ strerror(errno)); ++ } ++} ++ ++static ++bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags) ++{ ++ pid_t child; ++ ++ child = fork(); ++ if (child == -1) { ++ die("fork failed: %s\n", ++ strerror(errno)); ++ } ++ if (child != 0) { /* parent */ ++ pid_t pid; ++ int status; ++ pid = waitpid(child, &status, 0); ++ if (pid == -1) { ++ die("waitpid failed: %s\n", ++ strerror(errno)); ++ } ++ if (pid != child) { ++ die("waited for %d got %d\n", ++ child, pid); ++ } ++ if (!WIFEXITED(status)) { ++ die("child did not terminate cleanly\n"); ++ } ++ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false; ++ } ++ ++ create_and_enter_userns(); ++ if (unshare(CLONE_NEWNS) != 0) { ++ die("unshare(CLONE_NEWNS) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) { ++ die("mount of /tmp failed: %s\n", ++ strerror(errno)); ++ } ++ ++ create_and_enter_userns(); ++ ++ if (unshare(CLONE_NEWNS) != 0) { ++ die("unshare(CLONE_NEWNS) failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("/tmp", "/tmp", "none", ++ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) { ++ /* system("cat /proc/self/mounts"); */ ++ die("remount of /tmp failed: %s\n", ++ strerror(errno)); ++ } ++ ++ if (mount("/tmp", "/tmp", "none", ++ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) { ++ /* system("cat /proc/self/mounts"); */ ++ die("remount of /tmp with invalid flags " ++ "succeeded unexpectedly\n"); ++ } ++ exit(EXIT_SUCCESS); ++} ++ ++static bool test_unpriv_remount_simple(int mount_flags) ++{ ++ return test_unpriv_remount(mount_flags, mount_flags, 0); ++} ++ ++static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags) ++{ ++ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags); ++} ++ ++int main(int argc, char **argv) ++{ ++ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) { ++ die("MS_RDONLY malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NODEV)) { ++ die("MS_NODEV malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) { ++ die("MS_NOSUID malfunctions\n"); ++ } ++ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) { ++ die("MS_NOEXEC malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_STRICTATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV, ++ MS_STRICTATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV, ++ MS_STRICTATIME|MS_NODEV)) ++ { ++ die("MS_RELATIME malfunctions\n"); ++ } ++ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV, ++ MS_NOATIME|MS_NODEV)) ++ { ++ die("Default atime malfunctions\n"); ++ } ++ return EXIT_SUCCESS; ++} diff --git a/queue-3.16/mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch b/queue-3.16/mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch new file mode 100644 index 00000000000..a95350c9830 --- /dev/null +++ b/queue-3.16/mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch @@ -0,0 +1,57 @@ +From ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Mon, 28 Jul 2014 17:36:04 -0700 +Subject: mnt: Change the default remount atime from relatime to the existing value + +From: "Eric W. Biederman" + +commit ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e upstream. + +Since March 2009 the kernel has treated the state that if no +MS_..ATIME flags are passed then the kernel defaults to relatime. + +Defaulting to relatime instead of the existing atime state during a +remount is silly, and causes problems in practice for people who don't +specify any MS_...ATIME flags and to get the default filesystem atime +setting. Those users may encounter a permission error because the +default atime setting does not work. + +A default that does not work and causes permission problems is +ridiculous, so preserve the existing value to have a default +atime setting that is always guaranteed to work. + +Using the default atime setting in this way is particularly +interesting for applications built to run in restricted userspace +environments without /proc mounted, as the existing atime mount +options of a filesystem can not be read from /proc/mounts. + +In practice this fixes user space that uses the default atime +setting on remount that are broken by the permission checks +keeping less privileged users from changing more privileged users +atime settings. + +Acked-by: Serge E. Hallyn +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2473,6 +2473,14 @@ long do_mount(const char *dev_name, cons + if (flags & MS_RDONLY) + mnt_flags |= MNT_READONLY; + ++ /* The default atime for remount is preservation */ ++ if ((flags & MS_REMOUNT) && ++ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | ++ MS_STRICTATIME)) == 0)) { ++ mnt_flags &= ~MNT_ATIME_MASK; ++ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; ++ } ++ + flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | + MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | + MS_STRICTATIME); diff --git a/queue-3.16/mnt-correct-permission-checks-in-do_remount.patch b/queue-3.16/mnt-correct-permission-checks-in-do_remount.patch new file mode 100644 index 00000000000..2bb2c0652d2 --- /dev/null +++ b/queue-3.16/mnt-correct-permission-checks-in-do_remount.patch @@ -0,0 +1,130 @@ +From 9566d6742852c527bf5af38af5cbb878dad75705 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Mon, 28 Jul 2014 17:26:07 -0700 +Subject: mnt: Correct permission checks in do_remount + +From: "Eric W. Biederman" + +commit 9566d6742852c527bf5af38af5cbb878dad75705 upstream. + +While invesgiating the issue where in "mount --bind -oremount,ro ..." +would result in later "mount --bind -oremount,rw" succeeding even if +the mount started off locked I realized that there are several +additional mount flags that should be locked and are not. + +In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime +flags in addition to MNT_READONLY should all be locked. These +flags are all per superblock, can all be changed with MS_BIND, +and should not be changable if set by a more privileged user. + +The following additions to the current logic are added in this patch. +- nosuid may not be clearable by a less privileged user. +- nodev may not be clearable by a less privielged user. +- noexec may not be clearable by a less privileged user. +- atime flags may not be changeable by a less privileged user. + +The logic with atime is that always setting atime on access is a +global policy and backup software and auditing software could break if +atime bits are not updated (when they are configured to be updated), +and serious performance degradation could result (DOS attack) if atime +updates happen when they have been explicitly disabled. Therefore an +unprivileged user should not be able to mess with the atime bits set +by a more privileged user. + +The additional restrictions are implemented with the addition of +MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME +mnt flags. + +Taken together these changes and the fixes for MNT_LOCK_READONLY +should make it safe for an unprivileged user to create a user +namespace and to call "mount --bind -o remount,... ..." without +the danger of mount flags being changed maliciously. + +Acked-by: Serge E. Hallyn +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 36 +++++++++++++++++++++++++++++++++--- + include/linux/mount.h | 5 +++++ + 2 files changed, 38 insertions(+), 3 deletions(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -890,8 +890,21 @@ static struct mount *clone_mnt(struct mo + + mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); + /* Don't allow unprivileged users to change mount flags */ +- if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY)) +- mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; ++ if (flag & CL_UNPRIVILEGED) { ++ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; ++ ++ if (mnt->mnt.mnt_flags & MNT_READONLY) ++ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; ++ ++ if (mnt->mnt.mnt_flags & MNT_NODEV) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; ++ ++ if (mnt->mnt.mnt_flags & MNT_NOSUID) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; ++ ++ if (mnt->mnt.mnt_flags & MNT_NOEXEC) ++ mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; ++ } + + /* Don't allow unprivileged users to reveal what is under a mount */ + if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire)) +@@ -1931,6 +1944,23 @@ static int do_remount(struct path *path, + !(mnt_flags & MNT_READONLY)) { + return -EPERM; + } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && ++ !(mnt_flags & MNT_NODEV)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && ++ !(mnt_flags & MNT_NOSUID)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && ++ !(mnt_flags & MNT_NOEXEC)) { ++ return -EPERM; ++ } ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && ++ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { ++ return -EPERM; ++ } ++ + err = security_sb_remount(sb, data); + if (err) + return err; +@@ -2129,7 +2159,7 @@ static int do_new_mount(struct path *pat + */ + if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) { + flags |= MS_NODEV; +- mnt_flags |= MNT_NODEV; ++ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; + } + } + +--- a/include/linux/mount.h ++++ b/include/linux/mount.h +@@ -45,12 +45,17 @@ struct mnt_namespace; + #define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ + | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ + | MNT_READONLY) ++#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME ) + + #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ + MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) + + #define MNT_INTERNAL 0x4000 + ++#define MNT_LOCK_ATIME 0x040000 ++#define MNT_LOCK_NOEXEC 0x080000 ++#define MNT_LOCK_NOSUID 0x100000 ++#define MNT_LOCK_NODEV 0x200000 + #define MNT_LOCK_READONLY 0x400000 + #define MNT_LOCKED 0x800000 + #define MNT_DOOMED 0x1000000 diff --git a/queue-3.16/mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch b/queue-3.16/mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch new file mode 100644 index 00000000000..603ab2ac32b --- /dev/null +++ b/queue-3.16/mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch @@ -0,0 +1,54 @@ +From 07b645589dcda8b7a5249e096fece2a67556f0f4 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Mon, 28 Jul 2014 17:10:56 -0700 +Subject: mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount + +From: "Eric W. Biederman" + +commit 07b645589dcda8b7a5249e096fece2a67556f0f4 upstream. + +There are no races as locked mount flags are guaranteed to never change. + +Moving the test into do_remount makes it more visible, and ensures all +filesystem remounts pass the MNT_LOCK_READONLY permission check. This +second case is not an issue today as filesystem remounts are guarded +by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged +mount namespaces, but it could become an issue in the future. + +Acked-by: Serge E. Hallyn +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1896,9 +1896,6 @@ static int change_mount_flags(struct vfs + if (readonly_request == __mnt_is_readonly(mnt)) + return 0; + +- if (mnt->mnt_flags & MNT_LOCK_READONLY) +- return -EPERM; +- + if (readonly_request) + error = mnt_make_readonly(real_mount(mnt)); + else +@@ -1924,6 +1921,16 @@ static int do_remount(struct path *path, + if (path->dentry != path->mnt->mnt_root) + return -EINVAL; + ++ /* Don't allow changing of locked mnt flags. ++ * ++ * No locks need to be held here while testing the various ++ * MNT_LOCK flags because those flags can never be cleared ++ * once they are set. ++ */ ++ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && ++ !(mnt_flags & MNT_READONLY)) { ++ return -EPERM; ++ } + err = security_sb_remount(sb, data); + if (err) + return err; diff --git a/queue-3.16/mnt-only-change-user-settable-mount-flags-in-remount.patch b/queue-3.16/mnt-only-change-user-settable-mount-flags-in-remount.patch new file mode 100644 index 00000000000..fe4d703ecf1 --- /dev/null +++ b/queue-3.16/mnt-only-change-user-settable-mount-flags-in-remount.patch @@ -0,0 +1,53 @@ +From a6138db815df5ee542d848318e5dae681590fccd Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Mon, 28 Jul 2014 16:26:53 -0700 +Subject: mnt: Only change user settable mount flags in remount + +From: "Eric W. Biederman" + +commit a6138db815df5ee542d848318e5dae681590fccd upstream. + +Kenton Varda discovered that by remounting a +read-only bind mount read-only in a user namespace the +MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user +to the remount a read-only mount read-write. + +Correct this by replacing the mask of mount flags to preserve +with a mask of mount flags that may be changed, and preserve +all others. This ensures that any future bugs with this mask and +remount will fail in an easy to detect way where new mount flags +simply won't change. + +Acked-by: Serge E. Hallyn +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 2 +- + include/linux/mount.h | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1937,7 +1937,7 @@ static int do_remount(struct path *path, + err = do_remount_sb(sb, flags, data, 0); + if (!err) { + lock_mount_hash(); +- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK; ++ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; + mnt->mnt.mnt_flags = mnt_flags; + touch_mnt_namespace(mnt->mnt_ns); + unlock_mount_hash(); +--- a/include/linux/mount.h ++++ b/include/linux/mount.h +@@ -42,7 +42,9 @@ struct mnt_namespace; + * flag, consider how it interacts with shared mounts. + */ + #define MNT_SHARED_MASK (MNT_UNBINDABLE) +-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE) ++#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ ++ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ ++ | MNT_READONLY) + + #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ + MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) diff --git a/queue-3.16/ring-buffer-always-reset-iterator-to-reader-page.patch b/queue-3.16/ring-buffer-always-reset-iterator-to-reader-page.patch new file mode 100644 index 00000000000..5213c3baa90 --- /dev/null +++ b/queue-3.16/ring-buffer-always-reset-iterator-to-reader-page.patch @@ -0,0 +1,131 @@ +From 651e22f2701b4113989237c3048d17337dd2185c Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Wed, 6 Aug 2014 14:11:33 -0400 +Subject: ring-buffer: Always reset iterator to reader page + +From: "Steven Rostedt (Red Hat)" + +commit 651e22f2701b4113989237c3048d17337dd2185c upstream. + +When performing a consuming read, the ring buffer swaps out a +page from the ring buffer with a empty page and this page that +was swapped out becomes the new reader page. The reader page +is owned by the reader and since it was swapped out of the ring +buffer, writers do not have access to it (there's an exception +to that rule, but it's out of scope for this commit). + +When reading the "trace" file, it is a non consuming read, which +means that the data in the ring buffer will not be modified. +When the trace file is opened, a ring buffer iterator is allocated +and writes to the ring buffer are disabled, such that the iterator +will not have issues iterating over the data. + +Although the ring buffer disabled writes, it does not disable other +reads, or even consuming reads. If a consuming read happens, then +the iterator is reset and starts reading from the beginning again. + +My tests would sometimes trigger this bug on my i386 box: + +WARNING: CPU: 0 PID: 5175 at kernel/trace/trace.c:1527 __trace_find_cmdline+0x66/0xaa() +Modules linked in: +CPU: 0 PID: 5175 Comm: grep Not tainted 3.16.0-rc3-test+ #8 +Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006 + 00000000 00000000 f09c9e1c c18796b3 c1b5d74c f09c9e4c c103a0e3 c1b5154b + f09c9e78 00001437 c1b5d74c 000005f7 c10bd85a c10bd85a c1cac57c f09c9eb0 + ed0e0000 f09c9e64 c103a185 00000009 f09c9e5c c1b5154b f09c9e78 f09c9e80^M +Call Trace: + [] dump_stack+0x4b/0x75 + [] warn_slowpath_common+0x7e/0x95 + [] ? __trace_find_cmdline+0x66/0xaa + [] ? __trace_find_cmdline+0x66/0xaa + [] warn_slowpath_fmt+0x33/0x35 + [] __trace_find_cmdline+0x66/0xaa^M + [] trace_find_cmdline+0x40/0x64 + [] trace_print_context+0x27/0xec + [] ? trace_seq_printf+0x37/0x5b + [] print_trace_line+0x319/0x39b + [] ? ring_buffer_read+0x47/0x50 + [] s_show+0x192/0x1ab + [] ? s_next+0x5a/0x7c + [] seq_read+0x267/0x34c + [] vfs_read+0x8c/0xef + [] ? seq_lseek+0x154/0x154 + [] SyS_read+0x54/0x7f + [] syscall_call+0x7/0xb +---[ end trace 3f507febd6b4cc83 ]--- +>>>> ##### CPU 1 buffer started #### + +Which was the __trace_find_cmdline() function complaining about the pid +in the event record being negative. + +After adding more test cases, this would trigger more often. Strangely +enough, it would never trigger on a single test, but instead would trigger +only when running all the tests. I believe that was the case because it +required one of the tests to be shutting down via delayed instances while +a new test started up. + +After spending several days debugging this, I found that it was caused by +the iterator becoming corrupted. Debugging further, I found out why +the iterator became corrupted. It happened with the rb_iter_reset(). + +As consuming reads may not read the full reader page, and only part +of it, there's a "read" field to know where the last read took place. +The iterator, must also start at the read position. In the rb_iter_reset() +code, if the reader page was disconnected from the ring buffer, the iterator +would start at the head page within the ring buffer (where writes still +happen). But the mistake there was that it still used the "read" field +to start the iterator on the head page, where it should always start +at zero because readers never read from within the ring buffer where +writes occur. + +I originally wrote a patch to have it set the iter->head to 0 instead +of iter->head_page->read, but then I questioned why it wasn't always +setting the iter to point to the reader page, as the reader page is +still valid. The list_empty(reader_page->list) just means that it was +successful in swapping out. But the reader_page may still have data. + +There was a bug report a long time ago that was not reproducible that +had something about trace_pipe (consuming read) not matching trace +(iterator read). This may explain why that happened. + +Anyway, the correct answer to this bug is to always use the reader page +an not reset the iterator to inside the writable ring buffer. + +Fixes: d769041f8653 "ring_buffer: implement new locking" +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ring_buffer.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3357,21 +3357,16 @@ static void rb_iter_reset(struct ring_bu + struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer; + + /* Iterator usage is expected to have record disabled */ +- if (list_empty(&cpu_buffer->reader_page->list)) { +- iter->head_page = rb_set_head_page(cpu_buffer); +- if (unlikely(!iter->head_page)) +- return; +- iter->head = iter->head_page->read; +- } else { +- iter->head_page = cpu_buffer->reader_page; +- iter->head = cpu_buffer->reader_page->read; +- } ++ iter->head_page = cpu_buffer->reader_page; ++ iter->head = cpu_buffer->reader_page->read; ++ ++ iter->cache_reader_page = iter->head_page; ++ iter->cache_read = iter->head; ++ + if (iter->head) + iter->read_stamp = cpu_buffer->read_stamp; + else + iter->read_stamp = iter->head_page->page->time_stamp; +- iter->cache_reader_page = cpu_buffer->reader_page; +- iter->cache_read = cpu_buffer->read; + } + + /** diff --git a/queue-3.16/ring-buffer-up-rb_iter_peek-loop-count-to-3.patch b/queue-3.16/ring-buffer-up-rb_iter_peek-loop-count-to-3.patch new file mode 100644 index 00000000000..54f4523afd8 --- /dev/null +++ b/queue-3.16/ring-buffer-up-rb_iter_peek-loop-count-to-3.patch @@ -0,0 +1,100 @@ +From 021de3d904b88b1771a3a2cfc5b75023c391e646 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Wed, 6 Aug 2014 15:36:31 -0400 +Subject: ring-buffer: Up rb_iter_peek() loop count to 3 + +From: "Steven Rostedt (Red Hat)" + +commit 021de3d904b88b1771a3a2cfc5b75023c391e646 upstream. + +After writting a test to try to trigger the bug that caused the +ring buffer iterator to become corrupted, I hit another bug: + + WARNING: CPU: 1 PID: 5281 at kernel/trace/ring_buffer.c:3766 rb_iter_peek+0x113/0x238() + Modules linked in: ipt_MASQUERADE sunrpc [...] + CPU: 1 PID: 5281 Comm: grep Tainted: G W 3.16.0-rc3-test+ #143 + Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007 + 0000000000000000 ffffffff81809a80 ffffffff81503fb0 0000000000000000 + ffffffff81040ca1 ffff8800796d6010 ffffffff810c138d ffff8800796d6010 + ffff880077438c80 ffff8800796d6010 ffff88007abbe600 0000000000000003 + Call Trace: + [] ? dump_stack+0x4a/0x75 + [] ? warn_slowpath_common+0x7e/0x97 + [] ? rb_iter_peek+0x113/0x238 + [] ? rb_iter_peek+0x113/0x238 + [] ? ring_buffer_iter_peek+0x2d/0x5c + [] ? tracing_iter_reset+0x6e/0x96 + [] ? s_start+0xd7/0x17b + [] ? kmem_cache_alloc_trace+0xda/0xea + [] ? seq_read+0x148/0x361 + [] ? vfs_read+0x93/0xf1 + [] ? SyS_read+0x60/0x8e + [] ? tracesys+0xdd/0xe2 + +Debugging this bug, which triggers when the rb_iter_peek() loops too +many times (more than 2 times), I discovered there's a case that can +cause that function to legitimately loop 3 times! + +rb_iter_peek() is different than rb_buffer_peek() as the rb_buffer_peek() +only deals with the reader page (it's for consuming reads). The +rb_iter_peek() is for traversing the buffer without consuming it, and as +such, it can loop for one more reason. That is, if we hit the end of +the reader page or any page, it will go to the next page and try again. + +That is, we have this: + + 1. iter->head > iter->head_page->page->commit + (rb_inc_iter() which moves the iter to the next page) + try again + + 2. event = rb_iter_head_event() + event->type_len == RINGBUF_TYPE_TIME_EXTEND + rb_advance_iter() + try again + + 3. read the event. + +But we never get to 3, because the count is greater than 2 and we +cause the WARNING and return NULL. + +Up the counter to 3. + +Fixes: 69d1b839f7ee "ring-buffer: Bind time extend and data events together" +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ring_buffer.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1984,7 +1984,7 @@ rb_add_time_stamp(struct ring_buffer_eve + + /** + * rb_update_event - update event type and data +- * @event: the even to update ++ * @event: the event to update + * @type: the type of event + * @length: the size of the event field in the ring buffer + * +@@ -3759,12 +3759,14 @@ rb_iter_peek(struct ring_buffer_iter *it + return NULL; + + /* +- * We repeat when a time extend is encountered. +- * Since the time extend is always attached to a data event, +- * we should never loop more than once. +- * (We never hit the following condition more than twice). ++ * We repeat when a time extend is encountered or we hit ++ * the end of the page. Since the time extend is always attached ++ * to a data event, we should never loop more than three times. ++ * Once for going to next page, once on time extend, and ++ * finally once to get the event. ++ * (We never hit the following condition more than thrice). + */ +- if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2)) ++ if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3)) + return NULL; + + if (rb_per_cpu_empty(cpu_buffer)) diff --git a/queue-3.16/series b/queue-3.16/series index de7be41b61e..6a9d97e263f 100644 --- a/queue-3.16/series +++ b/queue-3.16/series @@ -74,3 +74,42 @@ mips-octeon-make-get_system_type-thread-safe.patch mips-eva-add-new-eva-header.patch mips-malta-eva-rename-eva_entry-to-platform_eva_init.patch mips-cps-initialize-eva-before-bringing-up-vpes-from-secondary-cores.patch +asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch +asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch +asoc-wm_adsp-add-missing-module_license.patch +asoc-blackfin-use-samples-to-set-silence.patch +asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch +asoc-adau1701-fix-adau1701_reg_read.patch +asoc-max98090-fix-missing-free_irq.patch +asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch +asoc-intel-cleanup-hsw-pcm-format-support.patch +asoc-pxa-pxa-ssp-small-leak-in-probe.patch +asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch +asoc-axi-fix-adi-axi-spdif-specification.patch +asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch +asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch +bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch +bq2415x_charger-fix-atomic-sleep-bug.patch +acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch +acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch +acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch +spi-pxa2xx-add-acpi-id-for-intel-braswell.patch +acpi-run-fixed-event-device-notifications-in-process-context.patch +acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch +acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch +acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch +acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch +acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch +acpi-video-fix-use_native_backlight-selection-logic.patch +acpi-video-add-a-disable_native_backlight-quirk.patch +acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch +xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch +ring-buffer-always-reset-iterator-to-reader-page.patch +ring-buffer-up-rb_iter_peek-loop-count-to-3.patch +mnt-only-change-user-settable-mount-flags-in-remount.patch +mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch +mnt-correct-permission-checks-in-do_remount.patch +mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch +mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch +get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch +fix-ebusy-on-umount-from-mnt_shrinkable.patch diff --git a/queue-3.16/spi-pxa2xx-add-acpi-id-for-intel-braswell.patch b/queue-3.16/spi-pxa2xx-add-acpi-id-for-intel-braswell.patch new file mode 100644 index 00000000000..3bba6528734 --- /dev/null +++ b/queue-3.16/spi-pxa2xx-add-acpi-id-for-intel-braswell.patch @@ -0,0 +1,31 @@ +From aca26364689e00e3b2052072424682231bdae6ae Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Wed, 20 Aug 2014 13:57:26 +0300 +Subject: spi/pxa2xx: Add ACPI ID for Intel Braswell + +From: Alan Cox + +commit aca26364689e00e3b2052072424682231bdae6ae upstream. + +The SPI host controller is the same as used in Baytrail, only the ACPI ID +is different so add this new ID to the list. + +Signed-off-by: Alan Cox +Signed-off-by: Mika Westerberg +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-pxa2xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1074,6 +1074,7 @@ static struct acpi_device_id pxa2xx_spi_ + { "INT3430", 0 }, + { "INT3431", 0 }, + { "80860F0E", 0 }, ++ { "8086228E", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match); diff --git a/queue-3.16/xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch b/queue-3.16/xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch new file mode 100644 index 00000000000..2b50568bdc9 --- /dev/null +++ b/queue-3.16/xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch @@ -0,0 +1,129 @@ +From c12784c3d14a2110468ec4d1383f60cfd2665576 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Thu, 31 Jul 2014 16:22:24 +0100 +Subject: xen/events/fifo: reset control block and local HEADs on resume + +From: David Vrabel + +commit c12784c3d14a2110468ec4d1383f60cfd2665576 upstream. + +When using the FIFO-based event channel ABI, if the control block or +the local HEADs are not reset after resuming the guest may see stale +HEAD values and will fail to traverse the FIFO correctly. + +This may prevent one or more VCPUs from receiving any events following +a resume. + +Signed-off-by: David Vrabel +Reviewed-by: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events/events_fifo.c | 48 ++++++++++++++++++++++----------------- + 1 file changed, 28 insertions(+), 20 deletions(-) + +--- a/drivers/xen/events/events_fifo.c ++++ b/drivers/xen/events/events_fifo.c +@@ -99,6 +99,25 @@ static unsigned evtchn_fifo_nr_channels( + return event_array_pages * EVENT_WORDS_PER_PAGE; + } + ++static int init_control_block(int cpu, ++ struct evtchn_fifo_control_block *control_block) ++{ ++ struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu); ++ struct evtchn_init_control init_control; ++ unsigned int i; ++ ++ /* Reset the control block and the local HEADs. */ ++ clear_page(control_block); ++ for (i = 0; i < EVTCHN_FIFO_MAX_QUEUES; i++) ++ q->head[i] = 0; ++ ++ init_control.control_gfn = virt_to_mfn(control_block); ++ init_control.offset = 0; ++ init_control.vcpu = cpu; ++ ++ return HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control); ++} ++ + static void free_unused_array_pages(void) + { + unsigned i; +@@ -323,7 +342,6 @@ static void evtchn_fifo_resume(void) + + for_each_possible_cpu(cpu) { + void *control_block = per_cpu(cpu_control_block, cpu); +- struct evtchn_init_control init_control; + int ret; + + if (!control_block) +@@ -340,12 +358,7 @@ static void evtchn_fifo_resume(void) + continue; + } + +- init_control.control_gfn = virt_to_mfn(control_block); +- init_control.offset = 0; +- init_control.vcpu = cpu; +- +- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, +- &init_control); ++ ret = init_control_block(cpu, control_block); + if (ret < 0) + BUG(); + } +@@ -373,30 +386,25 @@ static const struct evtchn_ops evtchn_op + .resume = evtchn_fifo_resume, + }; + +-static int evtchn_fifo_init_control_block(unsigned cpu) ++static int evtchn_fifo_alloc_control_block(unsigned cpu) + { +- struct page *control_block = NULL; +- struct evtchn_init_control init_control; ++ void *control_block = NULL; + int ret = -ENOMEM; + +- control_block = alloc_page(GFP_KERNEL|__GFP_ZERO); ++ control_block = (void *)__get_free_page(GFP_KERNEL); + if (control_block == NULL) + goto error; + +- init_control.control_gfn = virt_to_mfn(page_address(control_block)); +- init_control.offset = 0; +- init_control.vcpu = cpu; +- +- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control); ++ ret = init_control_block(cpu, control_block); + if (ret < 0) + goto error; + +- per_cpu(cpu_control_block, cpu) = page_address(control_block); ++ per_cpu(cpu_control_block, cpu) = control_block; + + return 0; + + error: +- __free_page(control_block); ++ free_page((unsigned long)control_block); + return ret; + } + +@@ -410,7 +418,7 @@ static int evtchn_fifo_cpu_notification( + switch (action) { + case CPU_UP_PREPARE: + if (!per_cpu(cpu_control_block, cpu)) +- ret = evtchn_fifo_init_control_block(cpu); ++ ret = evtchn_fifo_alloc_control_block(cpu); + break; + default: + break; +@@ -427,7 +435,7 @@ int __init xen_evtchn_fifo_init(void) + int cpu = get_cpu(); + int ret; + +- ret = evtchn_fifo_init_control_block(cpu); ++ ret = evtchn_fifo_alloc_control_block(cpu); + if (ret < 0) + goto out; +