From 6dd70c6c0827a7a7bdda6a0264c8cd42c65abdba Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 25 Jan 2015 23:00:09 +0800 Subject: [PATCH] 3.10-stable patches added patches: arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch arm-dts-imx25-fix-the-spi1-clocks.patch arm-imx6q-drop-unnecessary-semicolon.patch arm-omap5-dra7xx-fix-frequency-typos.patch arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch decompress_bunzip2-off-by-one-in-get_next_block.patch input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch um-skip-futex_atomic_cmpxchg_inatomic-test.patch x86-um-actually-mark-system-call-tables-readonly.patch --- ...x6q-fix-video-divider-for-rev-t0-1.0.patch | 35 +++++ .../arm-dts-imx25-fix-the-spi1-clocks.patch | 37 ++++++ ...arm-imx6q-drop-unnecessary-semicolon.patch | 30 +++++ ...arm-omap5-dra7xx-fix-frequency-typos.patch | 53 ++++++++ ...trol_parent-for-all-irqpin-instances.patch | 55 ++++++++ ...on-t-free-packets-when-tight-on-urbs.patch | 81 ++++++++++++ ...reset_chip-for-non-existing-channels.patch | 46 +++++++ ...l-urb-tx-contexts-upon-channel-close.patch | 78 +++++++++++ ...bunzip2-off-by-one-in-get_next_block.patch | 40 ++++++ ...d-acer-aspire-7738-to-the-nomux-list.patch | 36 +++++ ...d-to-fix-elantech-touchpad-detection.patch | 124 ++++++++++++++++++ queue-3.10/series | 13 ++ ...p-futex_atomic_cmpxchg_inatomic-test.patch | 35 +++++ ...lly-mark-system-call-tables-readonly.patch | 64 +++++++++ 14 files changed, 727 insertions(+) create mode 100644 queue-3.10/arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch create mode 100644 queue-3.10/arm-dts-imx25-fix-the-spi1-clocks.patch create mode 100644 queue-3.10/arm-imx6q-drop-unnecessary-semicolon.patch create mode 100644 queue-3.10/arm-omap5-dra7xx-fix-frequency-typos.patch create mode 100644 queue-3.10/arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch create mode 100644 queue-3.10/can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch create mode 100644 queue-3.10/can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch create mode 100644 queue-3.10/can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch create mode 100644 queue-3.10/decompress_bunzip2-off-by-one-in-get_next_block.patch create mode 100644 queue-3.10/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch create mode 100644 queue-3.10/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch create mode 100644 queue-3.10/um-skip-futex_atomic_cmpxchg_inatomic-test.patch create mode 100644 queue-3.10/x86-um-actually-mark-system-call-tables-readonly.patch diff --git a/queue-3.10/arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch b/queue-3.10/arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch new file mode 100644 index 00000000000..341ef4f3a1b --- /dev/null +++ b/queue-3.10/arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch @@ -0,0 +1,35 @@ +From 81ef447950bf0955aca46f4a7617d8ce435cf0ce Mon Sep 17 00:00:00 2001 +From: Gary Bisson +Date: Wed, 3 Dec 2014 15:03:51 -0800 +Subject: ARM: clk-imx6q: fix video divider for rev T0 1.0 + +From: Gary Bisson + +commit 81ef447950bf0955aca46f4a7617d8ce435cf0ce upstream. + +The post dividers do not work on i.MX6Q rev T0 1.0 so they must be fixed +to 1. As the table index was wrong, a divider a of 4 could still be +requested which implied the clock not to be set properly. This is the +root cause of the HDMI not working at high resolution on rev T0 1.0 of +the SoC. + +Signed-off-by: Gary Bisson +Cc: +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/clk-imx6q.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-imx/clk-imx6q.c ++++ b/arch/arm/mach-imx/clk-imx6q.c +@@ -301,7 +301,7 @@ int __init mx6q_clocks_init(void) + post_div_table[1].div = 1; + post_div_table[2].div = 1; + video_div_table[1].div = 1; +- video_div_table[2].div = 1; ++ video_div_table[3].div = 1; + } + + /* type name parent_name base div_mask */ diff --git a/queue-3.10/arm-dts-imx25-fix-the-spi1-clocks.patch b/queue-3.10/arm-dts-imx25-fix-the-spi1-clocks.patch new file mode 100644 index 00000000000..1169a49f6e0 --- /dev/null +++ b/queue-3.10/arm-dts-imx25-fix-the-spi1-clocks.patch @@ -0,0 +1,37 @@ +From 7a87e9cbc3a2f0ff0955815335e08c9862359130 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Fri, 5 Dec 2014 16:16:07 -0200 +Subject: ARM: dts: imx25: Fix the SPI1 clocks + +From: Fabio Estevam + +commit 7a87e9cbc3a2f0ff0955815335e08c9862359130 upstream. + +From Documentation/devicetree/bindings/clock/imx25-clock.txt: + + cspi1_ipg 78 + cspi2_ipg 79 + cspi3_ipg 80 + +, so fix the SPI1 clocks accordingly to avoid a kernel hang when trying to +access SPI1. + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx25.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx25.dtsi ++++ b/arch/arm/boot/dts/imx25.dtsi +@@ -141,7 +141,7 @@ + #size-cells = <0>; + compatible = "fsl,imx25-cspi", "fsl,imx35-cspi"; + reg = <0x43fa4000 0x4000>; +- clocks = <&clks 62>, <&clks 62>; ++ clocks = <&clks 78>, <&clks 78>; + clock-names = "ipg", "per"; + interrupts = <14>; + status = "disabled"; diff --git a/queue-3.10/arm-imx6q-drop-unnecessary-semicolon.patch b/queue-3.10/arm-imx6q-drop-unnecessary-semicolon.patch new file mode 100644 index 00000000000..0ba9037cb2e --- /dev/null +++ b/queue-3.10/arm-imx6q-drop-unnecessary-semicolon.patch @@ -0,0 +1,30 @@ +From d2a10a1727b3948019128e83162f22c65859f1fd Mon Sep 17 00:00:00 2001 +From: Dmitry Voytik +Date: Thu, 6 Nov 2014 22:46:20 +0400 +Subject: ARM: imx6q: drop unnecessary semicolon + +From: Dmitry Voytik + +commit d2a10a1727b3948019128e83162f22c65859f1fd upstream. + +Drop unnecessary semicolon after closing curly bracket. + +Signed-off-by: Dmitry Voytik +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/clk-imx6q.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-imx/clk-imx6q.c ++++ b/arch/arm/mach-imx/clk-imx6q.c +@@ -302,7 +302,7 @@ int __init mx6q_clocks_init(void) + post_div_table[2].div = 1; + video_div_table[1].div = 1; + video_div_table[2].div = 1; +- }; ++ } + + /* type name parent_name base div_mask */ + clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f); diff --git a/queue-3.10/arm-omap5-dra7xx-fix-frequency-typos.patch b/queue-3.10/arm-omap5-dra7xx-fix-frequency-typos.patch new file mode 100644 index 00000000000..47fbfc184d6 --- /dev/null +++ b/queue-3.10/arm-omap5-dra7xx-fix-frequency-typos.patch @@ -0,0 +1,53 @@ +From 572b24e6d85d98cdc552f07e9fb9870d9460d81b Mon Sep 17 00:00:00 2001 +From: Lennart Sorensen +Date: Mon, 5 Jan 2015 15:45:45 -0800 +Subject: ARM: omap5/dra7xx: Fix frequency typos + +From: Lennart Sorensen + +commit 572b24e6d85d98cdc552f07e9fb9870d9460d81b upstream. + +The switch statement of the possible list of SYSCLK1 frequencies is +missing a 0 in 4 out of the 7 frequencies. + +Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter") +Signed-off-by: Len Sorensen +Reviewed-by: Lokesh Vutla +Acked-by: Nishanth Menon +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/timer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -503,11 +503,11 @@ static void __init realtime_counter_init + rate = clk_get_rate(sys_clk); + /* Numerator/denumerator values refer TRM Realtime Counter section */ + switch (rate) { +- case 1200000: ++ case 12000000: + num = 64; + den = 125; + break; +- case 1300000: ++ case 13000000: + num = 768; + den = 1625; + break; +@@ -515,11 +515,11 @@ static void __init realtime_counter_init + num = 8; + den = 25; + break; +- case 2600000: ++ case 26000000: + num = 384; + den = 1625; + break; +- case 2700000: ++ case 27000000: + num = 256; + den = 1125; + break; diff --git a/queue-3.10/arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch b/queue-3.10/arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch new file mode 100644 index 00000000000..517f8042ba1 --- /dev/null +++ b/queue-3.10/arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch @@ -0,0 +1,55 @@ +From b0ddb319db3d7a1943445f0de0a45c07a7f3457a Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 6 Jan 2015 14:39:10 +0100 +Subject: ARM: shmobile: sh73a0 legacy: Set .control_parent for all irqpin instances + +From: Geert Uytterhoeven + +commit b0ddb319db3d7a1943445f0de0a45c07a7f3457a upstream. + +The sh73a0 INTC can't mask interrupts properly most likely due to a +hardware bug. Set the .control_parent flag to delegate masking to the +parent interrupt controller, like was already done for irqpin1. + +Without this, accessing the three-axis digital accelerometer ADXL345 +on kzm9g through /dev/input/event1 causes an interrupt storm, which +requires a power-cycle to recover from. + +This was inspired by a patch for arch/arm/boot/dts/sh73a0.dtsi from +Laurent Pinchart . + +Signed-off-by: Geert Uytterhoeven +Fixes: 341eb5465f67437a ("ARM: shmobile: INTC External IRQ pin driver on sh73a0") +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/setup-sh73a0.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/mach-shmobile/setup-sh73a0.c ++++ b/arch/arm/mach-shmobile/setup-sh73a0.c +@@ -814,6 +814,7 @@ static struct platform_device ipmmu_devi + + static struct renesas_intc_irqpin_config irqpin0_platform_data = { + .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */ ++ .control_parent = true, + }; + + static struct resource irqpin0_resources[] = { +@@ -875,6 +876,7 @@ static struct platform_device irqpin1_de + + static struct renesas_intc_irqpin_config irqpin2_platform_data = { + .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */ ++ .control_parent = true, + }; + + static struct resource irqpin2_resources[] = { +@@ -905,6 +907,7 @@ static struct platform_device irqpin2_de + + static struct renesas_intc_irqpin_config irqpin3_platform_data = { + .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */ ++ .control_parent = true, + }; + + static struct resource irqpin3_resources[] = { diff --git a/queue-3.10/can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch b/queue-3.10/can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch new file mode 100644 index 00000000000..c4bea8686dd --- /dev/null +++ b/queue-3.10/can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch @@ -0,0 +1,81 @@ +From b442723fcec445fb0ae1104888dd22cd285e0a91 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 5 Jan 2015 12:49:10 -0500 +Subject: can: kvaser_usb: Don't free packets when tight on URBs + +From: "Ahmed S. Darwish" + +commit b442723fcec445fb0ae1104888dd22cd285e0a91 upstream. + +Flooding the Kvaser CAN to USB dongle with multiple reads and +writes in high frequency caused seemingly-random panics in the +kernel. + +On further inspection, it seems the driver erroneously freed the +to-be-transmitted packet upon getting tight on URBs and returning +NETDEV_TX_BUSY, leading to invalid memory writes and double frees +at a later point in time. + +Note: + +Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY +is a driver bug in and out of itself: it means that our start/stop +queue flow control is broken. + +This patch only fixes the (buggy) error handling code; the root +cause shall be fixed in a later commit. + +Acked-by: Olivier Sobrie +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1286,12 +1286,14 @@ static netdev_tx_t kvaser_usb_start_xmit + if (!urb) { + netdev_err(netdev, "No memory left for URBs\n"); + stats->tx_dropped++; +- goto nourbmem; ++ dev_kfree_skb(skb); ++ return NETDEV_TX_OK; + } + + buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC); + if (!buf) { + stats->tx_dropped++; ++ dev_kfree_skb(skb); + goto nobufmem; + } + +@@ -1326,6 +1328,7 @@ static netdev_tx_t kvaser_usb_start_xmit + } + } + ++ /* This should never happen; it implies a flow control bug */ + if (!context) { + netdev_warn(netdev, "cannot find free context\n"); + ret = NETDEV_TX_BUSY; +@@ -1356,9 +1359,6 @@ static netdev_tx_t kvaser_usb_start_xmit + if (unlikely(err)) { + can_free_echo_skb(netdev, context->echo_index); + +- skb = NULL; /* set to NULL to avoid double free in +- * dev_kfree_skb(skb) */ +- + atomic_dec(&priv->active_tx_urbs); + usb_unanchor_urb(urb); + +@@ -1380,8 +1380,6 @@ releasebuf: + kfree(buf); + nobufmem: + usb_free_urb(urb); +-nourbmem: +- dev_kfree_skb(skb); + return ret; + } + diff --git a/queue-3.10/can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch b/queue-3.10/can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch new file mode 100644 index 00000000000..c6deb32c446 --- /dev/null +++ b/queue-3.10/can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch @@ -0,0 +1,46 @@ +From 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 5 Jan 2015 12:57:13 -0500 +Subject: can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels + +From: "Ahmed S. Darwish" + +commit 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 upstream. + +Recent Leaf firmware versions (>= 3.1.557) do not allow to send +commands for non-existing channels. If a command is sent for a +non-existing channel, the firmware crashes. + +Reported-by: Christopher Storah +Signed-off-by: Olivier Sobrie +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1494,6 +1494,10 @@ static int kvaser_usb_init_one(struct us + struct kvaser_usb_net_priv *priv; + int i, err; + ++ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel); ++ if (err) ++ return err; ++ + netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS); + if (!netdev) { + dev_err(&intf->dev, "Cannot alloc candev\n"); +@@ -1597,9 +1601,6 @@ static int kvaser_usb_probe(struct usb_i + + usb_set_intfdata(intf, dev); + +- for (i = 0; i < MAX_NET_DEVICES; i++) +- kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i); +- + err = kvaser_usb_get_software_info(dev); + if (err) { + dev_err(&intf->dev, diff --git a/queue-3.10/can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch b/queue-3.10/can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch new file mode 100644 index 00000000000..ce16c37badb --- /dev/null +++ b/queue-3.10/can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch @@ -0,0 +1,78 @@ +From 889b77f7fd2bcc922493d73a4c51d8a851505815 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Mon, 5 Jan 2015 12:52:06 -0500 +Subject: can: kvaser_usb: Reset all URB tx contexts upon channel close + +From: "Ahmed S. Darwish" + +commit 889b77f7fd2bcc922493d73a4c51d8a851505815 upstream. + +Flooding the Kvaser CAN to USB dongle with multiple reads and +writes in very high frequency (*), closing the CAN channel while +all the transmissions are on (#), opening the device again (@), +then sending a small number of packets would make the driver +enter an almost infinite loop of: + +[....] +[15959.853988] kvaser_usb 4-3:1.0 can0: cannot find free context +[15959.853990] kvaser_usb 4-3:1.0 can0: cannot find free context +[15959.853991] kvaser_usb 4-3:1.0 can0: cannot find free context +[15959.853993] kvaser_usb 4-3:1.0 can0: cannot find free context +[15959.853994] kvaser_usb 4-3:1.0 can0: cannot find free context +[15959.853995] kvaser_usb 4-3:1.0 can0: cannot find free context +[....] + +_dragging the whole system down_ in the process due to the +excessive logging output. + +Initially, this has caused random panics in the kernel due to a +buggy error recovery path. That got fixed in an earlier commit.(%) +This patch aims at solving the root cause. --> + +16 tx URBs and contexts are allocated per CAN channel per USB +device. Such URBs are protected by: + +a) A simple atomic counter, up to a value of MAX_TX_URBS (16) +b) A flag in each URB context, stating if it's free +c) The fact that ndo_start_xmit calls are themselves protected + by the networking layers higher above + +After grabbing one of the tx URBs, if the driver noticed that all +of them are now taken, it stops the netif transmission queue. +Such queue is worken up again only if an acknowedgment was received +from the firmware on one of our earlier-sent frames. + +Meanwhile, upon channel close (#), the driver sends a CMD_STOP_CHIP +to the firmware, effectively closing all further communication. In +the high traffic case, the atomic counter remains at MAX_TX_URBS, +and all the URB contexts remain marked as active. While opening +the channel again (@), it cannot send any further frames since no +more free tx URB contexts are available. + +Reset all tx URB contexts upon CAN channel close. + +(*) 50 parallel instances of `cangen0 -g 0 -ix` +(#) `ifconfig can0 down` +(@) `ifconfig can0 up` +(%) "can: kvaser_usb: Don't free packets when tight on URBs" + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1238,6 +1238,9 @@ static int kvaser_usb_close(struct net_d + if (err) + netdev_warn(netdev, "Cannot stop device, error %d\n", err); + ++ /* reset tx contexts */ ++ kvaser_usb_unlink_tx_urbs(priv); ++ + priv->can.state = CAN_STATE_STOPPED; + close_candev(priv->netdev); + diff --git a/queue-3.10/decompress_bunzip2-off-by-one-in-get_next_block.patch b/queue-3.10/decompress_bunzip2-off-by-one-in-get_next_block.patch new file mode 100644 index 00000000000..66e55db849f --- /dev/null +++ b/queue-3.10/decompress_bunzip2-off-by-one-in-get_next_block.patch @@ -0,0 +1,40 @@ +From b5c8afe5be51078a979d86ae5ae78c4ac948063d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 12 Dec 2014 16:58:05 -0800 +Subject: decompress_bunzip2: off by one in get_next_block() + +From: Dan Carpenter + +commit b5c8afe5be51078a979d86ae5ae78c4ac948063d upstream. + +"origPtr" is used as an offset into the bd->dbuf[] array. That array is +allocated in start_bunzip() and has "bd->dbufSize" number of elements so +the test here should be >= instead of >. + +Later we check "origPtr" again before using it as an offset so I don't +know if this bug can be triggered in real life. + +Fixes: bc22c17e12c1 ('bzip2/lzma: library support for gzip, bzip2 and lzma decompression') +Signed-off-by: Dan Carpenter +Cc: Alain Knaff +Cc: Yinghai Lu +Cc: "H. Peter Anvin" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/decompress_bunzip2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/decompress_bunzip2.c ++++ b/lib/decompress_bunzip2.c +@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bu + if (get_bits(bd, 1)) + return RETVAL_OBSOLETE_INPUT; + origPtr = get_bits(bd, 24); +- if (origPtr > dbufSize) ++ if (origPtr >= dbufSize) + return RETVAL_DATA_ERROR; + /* mapping table: if some byte values are never used (encoding things + like ascii text), the compression code removes the gaps to have fewer diff --git a/queue-3.10/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch b/queue-3.10/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch new file mode 100644 index 00000000000..fd41f587dfb --- /dev/null +++ b/queue-3.10/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch @@ -0,0 +1,36 @@ +From 9333caeaeae4f831054e0e127a6ed3948b604d3e Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 8 Jan 2015 14:53:23 -0800 +Subject: Input: I8042 - add Acer Aspire 7738 to the nomux list + +From: Dmitry Torokhov + +commit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream. + +When KBC is in active multiplexing mode the touchpad on this laptop does +not work. + +Reported-by: Bilal Koc +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -408,6 +408,13 @@ static const struct dmi_system_id __init + }, + }, + { ++ /* Acer Aspire 7738 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), ++ }, ++ }, ++ { + /* Gericom Bellagio */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), diff --git a/queue-3.10/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch b/queue-3.10/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch new file mode 100644 index 00000000000..2683dd732f4 --- /dev/null +++ b/queue-3.10/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch @@ -0,0 +1,124 @@ +From 148e9a711e034e06310a8c36b64957934ebe30f2 Mon Sep 17 00:00:00 2001 +From: Srihari Vijayaraghavan +Date: Wed, 7 Jan 2015 16:25:53 -0800 +Subject: Input: i8042 - reset keyboard to fix Elantech touchpad detection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srihari Vijayaraghavan + +commit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream. + +On some laptops, keyboard needs to be reset in order to successfully detect +touchpad (e.g., some Gigabyte laptop models with Elantech touchpads). +Without resettin keyboard touchpad pretends to be completely dead. + +Based on the original patch by Mateusz Jończyk this version has been +expanded to include DMI based detection & application of the fix +automatically on the affected models of laptops. This has been confirmed to +fix problem by three users already on three different models of laptops. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331 +Signed-off-by: Srihari Vijayaraghavan +Acked-by: Mateusz Jończyk +Tested-by: Srihari Vijayaraghavan +Tested by: Zakariya Dehlawi +Tested-by: Guillaum Bouchard +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/kernel-parameters.txt | 1 + + drivers/input/serio/i8042-x86ia64io.h | 32 ++++++++++++++++++++++++++++++++ + drivers/input/serio/i8042.c | 14 ++++++++++++++ + 3 files changed, 47 insertions(+) + +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -1061,6 +1061,7 @@ bytes respectively. Such letter suffixes + i8042.notimeout [HW] Ignore timeout condition signalled by controller + i8042.reset [HW] Reset the controller during init and cleanup + i8042.unlock [HW] Unlock (ignore) the keylock ++ i8042.kbdreset [HW] Reset device connected to KBD port + + i810= [HW,DRM] + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -721,6 +721,35 @@ static const struct dmi_system_id __init + { } + }; + ++/* ++ * Some laptops need keyboard reset before probing for the trackpad to get ++ * it detected, initialised & finally work. ++ */ ++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { ++ { ++ /* Gigabyte P35 v2 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), ++ }, ++ }, ++ { ++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"), ++ }, ++ }, ++ { ++ /* Gigabyte P34 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"), ++ }, ++ }, ++ { } ++}; ++ + #endif /* CONFIG_X86 */ + + #ifdef CONFIG_PNP +@@ -1001,6 +1030,9 @@ static int __init i8042_platform_init(vo + if (dmi_check_system(i8042_dmi_dritek_table)) + i8042_dritek = true; + ++ if (dmi_check_system(i8042_dmi_kbdreset_table)) ++ i8042_kbdreset = true; ++ + /* + * A20 was already enabled during early kernel init. But some buggy + * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -67,6 +67,10 @@ static bool i8042_notimeout; + module_param_named(notimeout, i8042_notimeout, bool, 0); + MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); + ++static bool i8042_kbdreset; ++module_param_named(kbdreset, i8042_kbdreset, bool, 0); ++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); ++ + #ifdef CONFIG_X86 + static bool i8042_dritek; + module_param_named(dritek, i8042_dritek, bool, 0); +@@ -783,6 +787,16 @@ static int __init i8042_check_aux(void) + return -1; + + /* ++ * Reset keyboard (needed on some laptops to successfully detect ++ * touchpad, e.g., some Gigabyte laptop models with Elantech ++ * touchpads). ++ */ ++ if (i8042_kbdreset) { ++ pr_warn("Attempting to reset device connected to KBD port\n"); ++ i8042_kbd_write(NULL, (unsigned char) 0xff); ++ } ++ ++/* + * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and + * used it for a PCI card or somethig else. + */ diff --git a/queue-3.10/series b/queue-3.10/series index 28ed81b5092..4904c17a3d0 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -29,3 +29,16 @@ usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch usb-keyspan-fix-null-deref-at-probe.patch +can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch +can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch +can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch +input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch +input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch +arm-dts-imx25-fix-the-spi1-clocks.patch +arm-imx6q-drop-unnecessary-semicolon.patch +arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch +arm-omap5-dra7xx-fix-frequency-typos.patch +arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch +decompress_bunzip2-off-by-one-in-get_next_block.patch +um-skip-futex_atomic_cmpxchg_inatomic-test.patch +x86-um-actually-mark-system-call-tables-readonly.patch diff --git a/queue-3.10/um-skip-futex_atomic_cmpxchg_inatomic-test.patch b/queue-3.10/um-skip-futex_atomic_cmpxchg_inatomic-test.patch new file mode 100644 index 00000000000..4568dab1c21 --- /dev/null +++ b/queue-3.10/um-skip-futex_atomic_cmpxchg_inatomic-test.patch @@ -0,0 +1,35 @@ +From f911d731054ab3d82ee72a16b889e17ca3a2332a Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Wed, 10 Dec 2014 13:53:51 +0100 +Subject: um: Skip futex_atomic_cmpxchg_inatomic() test + +From: Richard Weinberger + +commit f911d731054ab3d82ee72a16b889e17ca3a2332a upstream. + +futex_atomic_cmpxchg_inatomic() does not work on UML because +it triggers a copy_from_user() in kernel context. +On UML copy_from_user() can only be used if the kernel was called +by a real user space process such that UML can use ptrace() +to fetch the value. + +Reported-by: Miklos Szeredi +Suggested-by: Geert Uytterhoeven +Signed-off-by: Richard Weinberger +Tested-by: Daniel Walter +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/Kconfig.common | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/um/Kconfig.common ++++ b/arch/um/Kconfig.common +@@ -8,6 +8,7 @@ config UML + default y + select HAVE_GENERIC_HARDIRQS + select HAVE_UID16 ++ select HAVE_FUTEX_CMPXCHG if FUTEX + select GENERIC_IRQ_SHOW + select GENERIC_CPU_DEVICES + select GENERIC_IO diff --git a/queue-3.10/x86-um-actually-mark-system-call-tables-readonly.patch b/queue-3.10/x86-um-actually-mark-system-call-tables-readonly.patch new file mode 100644 index 00000000000..e5b6305bd9a --- /dev/null +++ b/queue-3.10/x86-um-actually-mark-system-call-tables-readonly.patch @@ -0,0 +1,64 @@ +From b485342bd79af363c77ef1a421c4a0aef2de9812 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Sat, 3 Jan 2015 13:11:10 +0100 +Subject: x86, um: actually mark system call tables readonly + +From: Daniel Borkmann + +commit b485342bd79af363c77ef1a421c4a0aef2de9812 upstream. + +Commit a074335a370e ("x86, um: Mark system call tables readonly") was +supposed to mark the sys_call_table in UML as RO by adding the const, +but it doesn't have the desired effect as it's nevertheless being placed +into the data section since __cacheline_aligned enforces sys_call_table +being placed into .data..cacheline_aligned instead. We need to use +the ____cacheline_aligned version instead to fix this issue. + +Before: + +$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table" + U sys_writev +0000000000000000 D sys_call_table +0000000000000000 D syscall_table_size + +After: + +$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table" + U sys_writev +0000000000000000 R sys_call_table +0000000000000000 D syscall_table_size + +Fixes: a074335a370e ("x86, um: Mark system call tables readonly") +Cc: H. Peter Anvin +Cc: Andrew Morton +Signed-off-by: Daniel Borkmann +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/um/sys_call_table_32.c | 2 +- + arch/x86/um/sys_call_table_64.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/um/sys_call_table_32.c ++++ b/arch/x86/um/sys_call_table_32.c +@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t + + extern asmlinkage void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. +--- a/arch/x86/um/sys_call_table_64.c ++++ b/arch/x86/um/sys_call_table_64.c +@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void); + + extern void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. -- 2.47.3