From: Greg Kroah-Hartman Date: Sun, 25 Jan 2015 14:01:44 +0000 (+0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.66~27 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ed3670909aedd8e65c73f12fef03763de2ad8134;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: af9005-fix-kernel-panic-on-init-if-compiled-without.patch arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch ftrace-check-both-notrace-and-filter-for-old-hash.patch ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch i40e-adds-fcoe-configure-option.patch img-ir-hw-always-read-data-to-clear-buffer.patch img-ir-hw-fix-potential-deadlock-stopping-timer.patch iwlwifi-mvm-fix-rx-with-both-chains.patch leds-netxbig-fix-oops-at-probe-time.patch locks-fix-null-deref-in-generic_delete_lease.patch mei-clean-reset-bit-before-reset.patch mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch nfsv4.1-fix-client-id-trunking-on-linux.patch powernv-fix-opal-tracepoint-code.patch smiapp-pll-correct-clock-debug-prints.patch smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch sound-simplify-au0828-quirk-table.patch sound-update-au0828-quirks-table.patch uvcvideo-fix-destruction-order-in-uvc_delete.patch vfio-pci-fix-the-check-on-pci-device-type-in.patch video-fbdev-fix-defio-s-fsync.patch video-logo-prevent-use-of-logos-after-they-have-been-freed.patch vivid-fix-crop_bounds-typo-for-video-output.patch --- diff --git a/queue-3.18/af9005-fix-kernel-panic-on-init-if-compiled-without.patch b/queue-3.18/af9005-fix-kernel-panic-on-init-if-compiled-without.patch new file mode 100644 index 00000000000..2c41307aed1 --- /dev/null +++ b/queue-3.18/af9005-fix-kernel-panic-on-init-if-compiled-without.patch @@ -0,0 +1,97 @@ +From 2279948735609d0d17d7384e776b674619f792ef Mon Sep 17 00:00:00 2001 +From: Frank Schaefer +Date: Mon, 29 Sep 2014 15:17:35 -0300 +Subject: [media] af9005: fix kernel panic on init if compiled without + IR +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Schaefer + +commit 2279948735609d0d17d7384e776b674619f792ef upstream. + +This patches fixes an ancient bug in the dvb_usb_af9005 driver, which +has been reported at least in the following threads: +https://lkml.org/lkml/2009/2/4/350 +https://lkml.org/lkml/2014/9/18/558 + +If the driver is compiled in without any IR support (neither +DVB_USB_AF9005_REMOTE nor custom symbols), the symbol_request calls in +af9005_usb_module_init() return pointers != NULL although the IR +symbols are not available. + +This leads to the following oops: +... +[ 8.529751] usbcore: registered new interface driver dvb_usb_af9005 +[ 8.531584] BUG: unable to handle kernel paging request at 02e00000 +[ 8.533385] IP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d +[ 8.535613] *pde = 00000000 +[ 8.536416] Oops: 0000 [#1] PREEMPT PREEMPT DEBUG_PAGEALLOCDEBUG_PAGEALLOC +[ 8.537863] CPU: 0 PID: 1 Comm: swapper Not tainted 3.15.0-rc6-00151-ga5c075c #1 +[ 8.539827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 +[ 8.541519] task: 89c9a670 ti: 89c9c000 task.ti: 89c9c000 +[ 8.541519] EIP: 0060:[<7d9d67c6>] EFLAGS: 00010206 CPU: 0 +[ 8.541519] EIP is at af9005_usb_module_init+0x6b/0x9d +[ 8.541519] EAX: 02e00000 EBX: 00000000 ECX: 00000006 EDX: 00000000 +[ 8.541519] ESI: 00000000 EDI: 7da33ec8 EBP: 89c9df30 ESP: 89c9df2c +[ 8.541519] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068 +[ 8.541519] CR0: 8005003b CR2: 02e00000 CR3: 05a54000 CR4: 00000690 +[ 8.541519] Stack: +[ 8.541519] 7d9d675b 89c9df90 7d992a49 7d7d5914 89c9df4c 7be3a800 7d08c58c 8a4c3968 +[ 8.541519] 89c9df80 7be3a966 00000192 00000006 00000006 7d7d3ff4 8a4c397a 00000200 +[ 8.541519] 7d6b1280 8a4c3979 00000006 000009a6 7da32db8 b13eec81 00000006 000009a6 +[ 8.541519] Call Trace: +[ 8.541519] [<7d9d675b>] ? ttusb2_driver_init+0x16/0x16 +[ 8.541519] [<7d992a49>] do_one_initcall+0x77/0x106 +[ 8.541519] [<7be3a800>] ? parameqn+0x2/0x35 +[ 8.541519] [<7be3a966>] ? parse_args+0x113/0x25c +[ 8.541519] [<7d992bc2>] kernel_init_freeable+0xea/0x167 +[ 8.541519] [<7cf01070>] kernel_init+0x8/0xb8 +[ 8.541519] [<7cf27ec0>] ret_from_kernel_thread+0x20/0x30 +[ 8.541519] [<7cf01068>] ? rest_init+0x10c/0x10c +[ 8.541519] Code: 08 c2 c7 05 44 ed f9 7d 00 00 e0 02 c7 05 40 ed f9 7d 00 00 e0 02 c7 05 3c ed f9 7d 00 00 e0 02 75 1f b8 00 00 e0 02 85 c0 74 16 00 00 e0 02 c7 05 54 84 8e 7d 00 00 e0 02 a3 58 84 8e 7d eb +[ 8.541519] EIP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d SS:ESP 0068:89c9df2c +[ 8.541519] CR2: 0000000002e00000 +[ 8.541519] ---[ end trace 768b6faf51370fc7 ]--- + +The prefered fix would be to convert the whole IR code to use the kernel IR +infrastructure (which wasn't available at the time this driver had been created). + +Until anyone who still has this old hardware steps up an does the conversion, +fix it by not calling the symbol_request calls if the driver is compiled in +without the default IR symbols (CONFIG_DVB_USB_AF9005_REMOTE). +Due to the IR related pointers beeing NULL by default, IR support will then be disabled. + +The downside of this solution is, that it will no longer be possible to +compile custom IR symbols (not using CONFIG_DVB_USB_AF9005_REMOTE) in. + +Please note that this patch has NOT been tested with all possible cases. +I don't have the hardware and could only verify that it fixes the reported +bug. + +Reported-by: Fengguag Wu +Signed-off-by: Frank Schäfer +Acked-by: Luca Olivetti +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb/af9005.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/usb/dvb-usb/af9005.c ++++ b/drivers/media/usb/dvb-usb/af9005.c +@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init + err("usb_register failed. (%d)", result); + return result; + } ++#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE) ++ /* FIXME: convert to todays kernel IR infrastructure */ + rc_decode = symbol_request(af9005_rc_decode); + rc_keys = symbol_request(rc_map_af9005_table); + rc_keys_size = symbol_request(rc_map_af9005_table_size); ++#endif + if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) { + err("af9005_rc_decode function not found, disabling remote"); + af9005_properties.rc.legacy.rc_query = NULL; diff --git a/queue-3.18/arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch b/queue-3.18/arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch new file mode 100644 index 00000000000..27aef45dd99 --- /dev/null +++ b/queue-3.18/arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch @@ -0,0 +1,43 @@ +From 0145058c3d30b4319d747f64caa16a9cb15f0581 Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Fri, 16 Jan 2015 13:56:38 +0000 +Subject: arm64: partially revert "ARM: 8167/1: extend the reserved memory for initrd to be page aligned" + +From: Catalin Marinas + +commit 0145058c3d30b4319d747f64caa16a9cb15f0581 upstream. + +This patch partially reverts commit 421520ba98290a73b35b7644e877a48f18e06004 +(only the arm64 part). There is no guarantee that the boot-loader places other +images like dtb in a different page than initrd start/end, especially when the +kernel is built with 64KB pages. When this happens, such pages must not be +freed. The free_reserved_area() already takes care of rounding up "start" and +rounding down "end" to avoid freeing partially used pages. + +Reported-by: Peter Maydell +Signed-off-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/mm/init.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -333,14 +333,8 @@ static int keep_initrd; + + void free_initrd_mem(unsigned long start, unsigned long end) + { +- if (!keep_initrd) { +- if (start == initrd_start) +- start = round_down(start, PAGE_SIZE); +- if (end == initrd_end) +- end = round_up(end, PAGE_SIZE); +- ++ if (!keep_initrd) + free_reserved_area((void *)start, (void *)end, 0, "initrd"); +- } + } + + static int __init keepinitrd_setup(char *__unused) diff --git a/queue-3.18/drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch b/queue-3.18/drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch new file mode 100644 index 00000000000..255181aa364 --- /dev/null +++ b/queue-3.18/drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch @@ -0,0 +1,98 @@ +From 25906052d953d3fbdb7e19480b9de5e6bb949f3f Mon Sep 17 00:00:00 2001 +From: Mugunthan V N +Date: Tue, 13 Jan 2015 17:35:49 +0530 +Subject: drivers: net: cpsw: fix multicast flush in dual emac mode + +From: Mugunthan V N + +commit 25906052d953d3fbdb7e19480b9de5e6bb949f3f upstream. + +Since ALE table is a common resource for both the interfaces in Dual EMAC +mode and while bringing up the second interface in cpsw_ndo_set_rx_mode() +all the multicast entries added by the first interface is flushed out and +only second interface multicast addresses are added. Fixing this by +flushing multicast addresses based on dual EMAC port vlans which will not +affect the other emac port multicast addresses. + +Fixes: d9ba8f9 (driver: net: ethernet: cpsw: dual emac interface implementation) +Signed-off-by: Mugunthan V N +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/cpsw.c | 11 +++++++++-- + drivers/net/ethernet/ti/cpsw_ale.c | 10 +++++++++- + drivers/net/ethernet/ti/cpsw_ale.h | 2 +- + 3 files changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -610,7 +610,7 @@ static void cpsw_set_promiscious(struct + + /* Clear all mcast from ALE */ + cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS << +- priv->host_port); ++ priv->host_port, -1); + + /* Flood All Unicast Packets to Host port */ + cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1); +@@ -634,6 +634,12 @@ static void cpsw_set_promiscious(struct + static void cpsw_ndo_set_rx_mode(struct net_device *ndev) + { + struct cpsw_priv *priv = netdev_priv(ndev); ++ int vid; ++ ++ if (priv->data.dual_emac) ++ vid = priv->slaves[priv->emac_port].port_vlan; ++ else ++ vid = priv->data.default_vlan; + + if (ndev->flags & IFF_PROMISC) { + /* Enable promiscuous mode */ +@@ -649,7 +655,8 @@ static void cpsw_ndo_set_rx_mode(struct + cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI); + + /* Clear all mcast from ALE */ +- cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port); ++ cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port, ++ vid); + + if (!netdev_mc_empty(ndev)) { + struct netdev_hw_addr *ha; +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -234,7 +234,7 @@ static void cpsw_ale_flush_mcast(struct + cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE); + } + +-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask) ++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid) + { + u32 ale_entry[ALE_ENTRY_WORDS]; + int ret, idx; +@@ -245,6 +245,14 @@ int cpsw_ale_flush_multicast(struct cpsw + if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR) + continue; + ++ /* if vid passed is -1 then remove all multicast entry from ++ * the table irrespective of vlan id, if a valid vlan id is ++ * passed then remove only multicast added to that vlan id. ++ * if vlan id doesn't match then move on to next entry. ++ */ ++ if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid) ++ continue; ++ + if (cpsw_ale_get_mcast(ale_entry)) { + u8 addr[6]; + +--- a/drivers/net/ethernet/ti/cpsw_ale.h ++++ b/drivers/net/ethernet/ti/cpsw_ale.h +@@ -92,7 +92,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale) + + int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout); + int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask); +-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask); ++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid); + int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port, + int flags, u16 vid); + int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port, diff --git a/queue-3.18/ftrace-check-both-notrace-and-filter-for-old-hash.patch b/queue-3.18/ftrace-check-both-notrace-and-filter-for-old-hash.patch new file mode 100644 index 00000000000..c8e0e3ac713 --- /dev/null +++ b/queue-3.18/ftrace-check-both-notrace-and-filter-for-old-hash.patch @@ -0,0 +1,142 @@ +From 7485058eea40783ac142a60c3e799fc66ce72583 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Tue, 13 Jan 2015 14:03:38 -0500 +Subject: ftrace: Check both notrace and filter for old hash + +From: "Steven Rostedt (Red Hat)" + +commit 7485058eea40783ac142a60c3e799fc66ce72583 upstream. + +Using just the filter for checking for trampolines or regs is not enough +when updating the code against the records that represent all functions. +Both the filter hash and the notrace hash need to be checked. + +To trigger this bug (using trace-cmd and perf): + + # perf probe -a do_fork + # trace-cmd start -B foo -e probe + # trace-cmd record -p function_graph -n do_fork sleep 1 + +The trace-cmd record at the end clears the filter before it disables +function_graph tracing and then that causes the accounting of the +ftrace function records to become incorrect and causes ftrace to bug. + +Link: http://lkml.kernel.org/r/20150114154329.358378039@goodmis.org + +[ still need to switch old_hash_ops to old_ops_hash ] +Reviewed-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ftrace.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -2308,12 +2308,14 @@ static void ftrace_run_update_code(int c + } + + static void ftrace_run_modify_code(struct ftrace_ops *ops, int command, +- struct ftrace_hash *old_hash) ++ struct ftrace_ops_hash *old_hash) + { + ops->flags |= FTRACE_OPS_FL_MODIFYING; +- ops->old_hash.filter_hash = old_hash; ++ ops->old_hash.filter_hash = old_hash->filter_hash; ++ ops->old_hash.notrace_hash = old_hash->notrace_hash; + ftrace_run_update_code(command); + ops->old_hash.filter_hash = NULL; ++ ops->old_hash.notrace_hash = NULL; + ops->flags &= ~FTRACE_OPS_FL_MODIFYING; + } + +@@ -3357,7 +3359,7 @@ static struct ftrace_ops trace_probe_ops + + static int ftrace_probe_registered; + +-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash) ++static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash) + { + int ret; + int i; +@@ -3415,6 +3417,7 @@ int + register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, + void *data) + { ++ struct ftrace_ops_hash old_hash_ops; + struct ftrace_func_probe *entry; + struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash; + struct ftrace_hash *old_hash = *orig_hash; +@@ -3436,6 +3439,10 @@ register_ftrace_function_probe(char *glo + + mutex_lock(&trace_probe_ops.func_hash->regex_lock); + ++ old_hash_ops.filter_hash = old_hash; ++ /* Probes only have filters */ ++ old_hash_ops.notrace_hash = NULL; ++ + hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash); + if (!hash) { + count = -ENOMEM; +@@ -3496,7 +3503,7 @@ register_ftrace_function_probe(char *glo + + ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash); + +- __enable_ftrace_function_probe(old_hash); ++ __enable_ftrace_function_probe(&old_hash_ops); + + if (!ret) + free_ftrace_hash_rcu(old_hash); +@@ -3784,7 +3791,7 @@ ftrace_match_addr(struct ftrace_hash *ha + } + + static void ftrace_ops_update_code(struct ftrace_ops *ops, +- struct ftrace_hash *old_hash) ++ struct ftrace_ops_hash *old_hash) + { + struct ftrace_ops *op; + +@@ -3819,6 +3826,7 @@ ftrace_set_hash(struct ftrace_ops *ops, + unsigned long ip, int remove, int reset, int enable) + { + struct ftrace_hash **orig_hash; ++ struct ftrace_ops_hash old_hash_ops; + struct ftrace_hash *old_hash; + struct ftrace_hash *hash; + int ret; +@@ -3855,9 +3863,11 @@ ftrace_set_hash(struct ftrace_ops *ops, + + mutex_lock(&ftrace_lock); + old_hash = *orig_hash; ++ old_hash_ops.filter_hash = ops->func_hash->filter_hash; ++ old_hash_ops.notrace_hash = ops->func_hash->notrace_hash; + ret = ftrace_hash_move(ops, enable, orig_hash, hash); + if (!ret) { +- ftrace_ops_update_code(ops, old_hash); ++ ftrace_ops_update_code(ops, &old_hash_ops); + free_ftrace_hash_rcu(old_hash); + } + mutex_unlock(&ftrace_lock); +@@ -4066,6 +4076,7 @@ static void __init set_ftrace_early_filt + int ftrace_regex_release(struct inode *inode, struct file *file) + { + struct seq_file *m = (struct seq_file *)file->private_data; ++ struct ftrace_ops_hash old_hash_ops; + struct ftrace_iterator *iter; + struct ftrace_hash **orig_hash; + struct ftrace_hash *old_hash; +@@ -4099,10 +4110,12 @@ int ftrace_regex_release(struct inode *i + + mutex_lock(&ftrace_lock); + old_hash = *orig_hash; ++ old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash; ++ old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash; + ret = ftrace_hash_move(iter->ops, filter_hash, + orig_hash, iter->hash); + if (!ret) { +- ftrace_ops_update_code(iter->ops, old_hash); ++ ftrace_ops_update_code(iter->ops, &old_hash_ops); + free_ftrace_hash_rcu(old_hash); + } + mutex_unlock(&ftrace_lock); diff --git a/queue-3.18/ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch b/queue-3.18/ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch new file mode 100644 index 00000000000..5633cd7a81e --- /dev/null +++ b/queue-3.18/ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch @@ -0,0 +1,71 @@ +From 8f86f83709c585742dea5dd7f0d2b79c43f992ec Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Tue, 13 Jan 2015 11:20:43 -0500 +Subject: ftrace: Fix updating of filters for shared global_ops filters + +From: "Steven Rostedt (Red Hat)" + +commit 8f86f83709c585742dea5dd7f0d2b79c43f992ec upstream. + +As the set_ftrace_filter affects both the function tracer as well as the +function graph tracer, the ops that represent each have a shared +ftrace_ops_hash structure. This allows both to be updated when the filter +files are updated. + +But if function graph is enabled and the global_ops (function tracing) ops +is not, then it is possible that the filter could be changed without the +update happening for the function graph ops. This will cause the changes +to not take place and may even cause a ftrace_bug to occur as it could mess +with the trampoline accounting. + +The solution is to check if the ops uses the shared global_ops filter and +if the ops itself is not enabled, to check if there's another ops that is +enabled and also shares the global_ops filter. In that case, the +modification still needs to be executed. + +Link: http://lkml.kernel.org/r/20150114154329.055980438@goodmis.org + +Reviewed-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ftrace.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -3786,8 +3786,32 @@ ftrace_match_addr(struct ftrace_hash *ha + static void ftrace_ops_update_code(struct ftrace_ops *ops, + struct ftrace_hash *old_hash) + { +- if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled) ++ struct ftrace_ops *op; ++ ++ if (!ftrace_enabled) ++ return; ++ ++ if (ops->flags & FTRACE_OPS_FL_ENABLED) { + ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash); ++ return; ++ } ++ ++ /* ++ * If this is the shared global_ops filter, then we need to ++ * check if there is another ops that shares it, is enabled. ++ * If so, we still need to run the modify code. ++ */ ++ if (ops->func_hash != &global_ops.local_hash) ++ return; ++ ++ do_for_each_ftrace_op(op, ftrace_ops_list) { ++ if (op->func_hash == &global_ops.local_hash && ++ op->flags & FTRACE_OPS_FL_ENABLED) { ++ ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash); ++ /* Only need to do this once */ ++ return; ++ } ++ } while_for_each_ftrace_op(op); + } + + static int diff --git a/queue-3.18/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch b/queue-3.18/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch new file mode 100644 index 00000000000..2cfee889a81 --- /dev/null +++ b/queue-3.18/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch @@ -0,0 +1,113 @@ +From 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Mon, 12 Jan 2015 12:12:03 -0500 +Subject: ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing + +From: "Steven Rostedt (Red Hat)" + +commit 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc upstream. + +If the function graph tracer traces a jprobe callback, the system will +crash. This can easily be demonstrated by compiling the jprobe +sample module that is in the kernel tree, loading it and running the +function graph tracer. + + # modprobe jprobe_example.ko + # echo function_graph > /sys/kernel/debug/tracing/current_tracer + # ls + +The first two commands end up in a nice crash after the first fork. +(do_fork has a jprobe attached to it, so "ls" just triggers that fork) + +The problem is caused by the jprobe_return() that all jprobe callbacks +must end with. The way jprobes works is that the function a jprobe +is attached to has a breakpoint placed at the start of it (or it uses +ftrace if fentry is supported). The breakpoint handler (or ftrace callback) +will copy the stack frame and change the ip address to return to the +jprobe handler instead of the function. The jprobe handler must end +with jprobe_return() which swaps the stack and does an int3 (breakpoint). +This breakpoint handler will then put back the saved stack frame, +simulate the instruction at the beginning of the function it added +a breakpoint to, and then continue on. + +For function tracing to work, it hijakes the return address from the +stack frame, and replaces it with a hook function that will trace +the end of the call. This hook function will restore the return +address of the function call. + +If the function tracer traces the jprobe handler, the hook function +for that handler will not be called, and its saved return address +will be used for the next function. This will result in a kernel crash. + +To solve this, pause function tracing before the jprobe handler is called +and unpause it before it returns back to the function it probed. + +Some other updates: + +Used a variable "saved_sp" to hold kcb->jprobe_saved_sp. This makes the +code look a bit cleaner and easier to understand (various tries to fix +this bug required this change). + +Note, if fentry is being used, jprobes will change the ip address before +the function graph tracer runs and it will not be able to trace the +function that the jprobe is probing. + +Link: http://lkml.kernel.org/r/20150114154329.552437962@goodmis.org + +Acked-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/kprobes/core.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -1018,6 +1018,15 @@ int setjmp_pre_handler(struct kprobe *p, + regs->flags &= ~X86_EFLAGS_IF; + trace_hardirqs_off(); + regs->ip = (unsigned long)(jp->entry); ++ ++ /* ++ * jprobes use jprobe_return() which skips the normal return ++ * path of the function, and this messes up the accounting of the ++ * function graph tracer to get messed up. ++ * ++ * Pause function graph tracing while performing the jprobe function. ++ */ ++ pause_graph_tracing(); + return 1; + } + NOKPROBE_SYMBOL(setjmp_pre_handler); +@@ -1046,24 +1055,25 @@ int longjmp_break_handler(struct kprobe + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + u8 *addr = (u8 *) (regs->ip - 1); + struct jprobe *jp = container_of(p, struct jprobe, kp); ++ void *saved_sp = kcb->jprobe_saved_sp; + + if ((addr > (u8 *) jprobe_return) && + (addr < (u8 *) jprobe_return_end)) { +- if (stack_addr(regs) != kcb->jprobe_saved_sp) { ++ if (stack_addr(regs) != saved_sp) { + struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; + printk(KERN_ERR + "current sp %p does not match saved sp %p\n", +- stack_addr(regs), kcb->jprobe_saved_sp); ++ stack_addr(regs), saved_sp); + printk(KERN_ERR "Saved registers for jprobe %p\n", jp); + show_regs(saved_regs); + printk(KERN_ERR "Current registers\n"); + show_regs(regs); + BUG(); + } ++ /* It's OK to start function graph tracing again */ ++ unpause_graph_tracing(); + *regs = kcb->jprobe_saved_regs; +- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), +- kcb->jprobes_stack, +- MIN_STACK_SIZE(kcb->jprobe_saved_sp)); ++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); + preempt_enable_no_resched(); + return 1; + } diff --git a/queue-3.18/i40e-adds-fcoe-configure-option.patch b/queue-3.18/i40e-adds-fcoe-configure-option.patch new file mode 100644 index 00000000000..2a322327255 --- /dev/null +++ b/queue-3.18/i40e-adds-fcoe-configure-option.patch @@ -0,0 +1,70 @@ +From 776d4e9f5c0229037707f692b386b1f2a5bac054 Mon Sep 17 00:00:00 2001 +From: Vasu Dev +Date: Wed, 14 Jan 2015 05:14:07 -0800 +Subject: i40e: adds FCoE configure option + +From: Vasu Dev + +commit 776d4e9f5c0229037707f692b386b1f2a5bac054 upstream. + +Adds FCoE config option I40E_FCOE, so that FCoE can be enabled +as needed but otherwise have it disabled by default. + +This also eliminate multiple FCoE config checks, instead now just +one config check for CONFIG_I40E_FCOE. + +The I40E FCoE was added with 3.17 kernel and therefore this patch +shall be applied to stable 3.17 kernel also. + +Signed-off-by: Vasu Dev +Tested-by: Jim Young +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig +index 5b8300a32bf5..4d61ef50b465 100644 +--- a/drivers/net/ethernet/intel/Kconfig ++++ b/drivers/net/ethernet/intel/Kconfig +@@ -281,6 +281,17 @@ config I40E_DCB + + If unsure, say N. + ++config I40E_FCOE ++ bool "Fibre Channel over Ethernet (FCoE)" ++ default n ++ depends on I40E && DCB && FCOE ++ ---help--- ++ Say Y here if you want to use Fibre Channel over Ethernet (FCoE) ++ in the driver. This will create new netdev for exclusive FCoE ++ use with XL710 FCoE offloads enabled. ++ ++ If unsure, say N. ++ + config I40EVF + tristate "Intel(R) XL710 X710 Virtual Function Ethernet support" + depends on PCI_MSI +diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile +index 4b94ddb29c24..c40581999121 100644 +--- a/drivers/net/ethernet/intel/i40e/Makefile ++++ b/drivers/net/ethernet/intel/i40e/Makefile +@@ -44,4 +44,4 @@ i40e-objs := i40e_main.o \ + i40e_virtchnl_pf.o + + i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o +-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o ++i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o +diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h +index 045b5c4b98b3..ad802dd0f67a 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h +@@ -78,7 +78,7 @@ do { \ + } while (0) + + typedef enum i40e_status_code i40e_status; +-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE) ++#ifdef CONFIG_I40E_FCOE + #define I40E_FCOE +-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */ ++#endif + #endif /* _I40E_OSDEP_H_ */ diff --git a/queue-3.18/img-ir-hw-always-read-data-to-clear-buffer.patch b/queue-3.18/img-ir-hw-always-read-data-to-clear-buffer.patch new file mode 100644 index 00000000000..aa3b3caee09 --- /dev/null +++ b/queue-3.18/img-ir-hw-always-read-data-to-clear-buffer.patch @@ -0,0 +1,54 @@ +From ea0de4ec5489da0fe738b274effac4f950e93d76 Mon Sep 17 00:00:00 2001 +From: Dylan Rajaratnam +Date: Mon, 17 Nov 2014 09:17:45 -0300 +Subject: [media] img-ir/hw: Always read data to clear buffer + +From: Dylan Rajaratnam + +commit ea0de4ec5489da0fe738b274effac4f950e93d76 upstream. + +A problem was found on Polaris where if the unit it booted via the power +button on the infrared remote then the next button press on the remote +would return the key code used to power on the unit. + +The sequence is: + - The polaris powered off but with the powerdown controller (PDC) block + still powered. + - Press power key on remote, IR block receives the key. + - Kernel starts, IR code is in IMG_IR_DATA_x but neither IMG_IR_RXDVAL + or IMG_IR_RXDVALD2 are set. + - Wait any amount of time. + - Press any key. + - IMG_IR_RXDVAL or IMG_IR_RXDVALD2 is set but IMG_IR_DATA_x is + unchanged since the powerup key data was never read. + +This is worked around by always reading the IMG_IR_DATA_x in +img_ir_set_decoder(), rather than only when the IMG_IR_RXDVAL or +IMG_IR_RXDVALD2 bit is set. + +Signed-off-by: Dylan Rajaratnam +Signed-off-by: James Hogan +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/img-ir/img-ir-hw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/media/rc/img-ir/img-ir-hw.c ++++ b/drivers/media/rc/img-ir/img-ir-hw.c +@@ -541,10 +541,12 @@ static void img_ir_set_decoder(struct im + if (ir_status & (IMG_IR_RXDVAL | IMG_IR_RXDVALD2)) { + ir_status &= ~(IMG_IR_RXDVAL | IMG_IR_RXDVALD2); + img_ir_write(priv, IMG_IR_STATUS, ir_status); +- img_ir_read(priv, IMG_IR_DATA_LW); +- img_ir_read(priv, IMG_IR_DATA_UP); + } + ++ /* always read data to clear buffer if IR wakes the device */ ++ img_ir_read(priv, IMG_IR_DATA_LW); ++ img_ir_read(priv, IMG_IR_DATA_UP); ++ + /* stop the end timer and switch back to normal mode */ + del_timer_sync(&hw->end_timer); + hw->mode = IMG_IR_M_NORMAL; diff --git a/queue-3.18/img-ir-hw-fix-potential-deadlock-stopping-timer.patch b/queue-3.18/img-ir-hw-fix-potential-deadlock-stopping-timer.patch new file mode 100644 index 00000000000..d4e4340a010 --- /dev/null +++ b/queue-3.18/img-ir-hw-fix-potential-deadlock-stopping-timer.patch @@ -0,0 +1,151 @@ +From ac03086067a5524ae9e020ba5712a208c67b2736 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Mon, 1 Dec 2014 09:55:10 -0300 +Subject: [media] img-ir/hw: Fix potential deadlock stopping timer + +From: James Hogan + +commit ac03086067a5524ae9e020ba5712a208c67b2736 upstream. + +The end timer is used for switching back from repeat code timings when +no repeat codes have been received for a certain amount of time. When +the protocol is changed, the end timer is deleted synchronously with +del_timer_sync(), however this takes place while holding the main spin +lock, and the timer handler also needs to acquire the spin lock. + +This opens the possibility of a deadlock on an SMP system if the +protocol is changed just as the repeat timer is expiring. One CPU could +end up in img_ir_set_decoder() holding the lock and waiting for the end +timer to complete, while the other CPU is stuck in the timer handler +spinning on the lock held by the first CPU. + +Lockdep also spots a possible lock inversion in the same code, since +img_ir_set_decoder() acquires the img-ir lock before the timer lock, but +the timer handler will try and acquire them the other way around: + +========================================================= +[ INFO: possible irq lock inversion dependency detected ] +3.18.0-rc5+ #957 Not tainted +--------------------------------------------------------- +swapper/0/0 just changed the state of lock: + (((&hw->end_timer))){+.-...}, at: [<4006ae5c>] _call_timer_fn+0x0/0xfc +but this lock was taken by another, HARDIRQ-safe lock in the past: + (&(&priv->lock)->rlock#2){-.....} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(((&hw->end_timer))); + local_irq_disable(); + lock(&(&priv->lock)->rlock#2); + lock(((&hw->end_timer))); + + lock(&(&priv->lock)->rlock#2); + + *** DEADLOCK *** + +This is fixed by releasing the main spin lock while performing the +del_timer_sync() call. The timer is prevented from restarting before the +lock is reacquired by a new "stopping" flag which img_ir_handle_data() +checks before updating the timer. + +--------------------------------------------------------- +swapper/0/0 just changed the state of lock: + (((&hw->end_timer))){+.-...}, at: [<4006ae5c>] _call_timer_fn+0x0/0xfc +but this lock was taken by another, HARDIRQ-safe lock in the past: + (&(&priv->lock)->rlock#2){-.....} +and interrupts could create inverse lock ordering between them. +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + CPU0 CPU1 + ---- ---- + lock(((&hw->end_timer))); + local_irq_disable(); + lock(&(&priv->lock)->rlock#2); + lock(((&hw->end_timer))); + + lock(&(&priv->lock)->rlock#2); + *** DEADLOCK *** +This is fixed by releasing the main spin lock while performing the +del_timer_sync() call. The timer is prevented from restarting before the +lock is reacquired by a new "stopping" flag which img_ir_handle_data() +checks before updating the timer. + +Signed-off-by: James Hogan +Cc: Sifan Naeem +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/img-ir/img-ir-hw.c | 22 +++++++++++++++++++--- + drivers/media/rc/img-ir/img-ir-hw.h | 3 +++ + 2 files changed, 22 insertions(+), 3 deletions(-) + +--- a/drivers/media/rc/img-ir/img-ir-hw.c ++++ b/drivers/media/rc/img-ir/img-ir-hw.c +@@ -530,6 +530,22 @@ static void img_ir_set_decoder(struct im + u32 ir_status, irq_en; + spin_lock_irq(&priv->lock); + ++ /* ++ * First record that the protocol is being stopped so that the end timer ++ * isn't restarted while we're trying to stop it. ++ */ ++ hw->stopping = true; ++ ++ /* ++ * Release the lock to stop the end timer, since the end timer handler ++ * acquires the lock and we don't want to deadlock waiting for it. ++ */ ++ spin_unlock_irq(&priv->lock); ++ del_timer_sync(&hw->end_timer); ++ spin_lock_irq(&priv->lock); ++ ++ hw->stopping = false; ++ + /* switch off and disable interrupts */ + img_ir_write(priv, IMG_IR_CONTROL, 0); + irq_en = img_ir_read(priv, IMG_IR_IRQ_ENABLE); +@@ -547,8 +563,7 @@ static void img_ir_set_decoder(struct im + img_ir_read(priv, IMG_IR_DATA_LW); + img_ir_read(priv, IMG_IR_DATA_UP); + +- /* stop the end timer and switch back to normal mode */ +- del_timer_sync(&hw->end_timer); ++ /* switch back to normal mode */ + hw->mode = IMG_IR_M_NORMAL; + + /* clear the wakeup scancode filter */ +@@ -819,7 +834,8 @@ static void img_ir_handle_data(struct im + } + + +- if (dec->repeat) { ++ /* we mustn't update the end timer while trying to stop it */ ++ if (dec->repeat && !hw->stopping) { + unsigned long interval; + + img_ir_begin_repeat(priv); +--- a/drivers/media/rc/img-ir/img-ir-hw.h ++++ b/drivers/media/rc/img-ir/img-ir-hw.h +@@ -214,6 +214,8 @@ enum img_ir_mode { + * @flags: IMG_IR_F_*. + * @filters: HW filters (derived from scancode filters). + * @mode: Current decode mode. ++ * @stopping: Indicates that decoder is being taken down and timers ++ * should not be restarted. + * @suspend_irqen: Saved IRQ enable mask over suspend. + */ + struct img_ir_priv_hw { +@@ -229,6 +231,7 @@ struct img_ir_priv_hw { + struct img_ir_filter filters[RC_FILTER_MAX]; + + enum img_ir_mode mode; ++ bool stopping; + u32 suspend_irqen; + }; + diff --git a/queue-3.18/iwlwifi-mvm-fix-rx-with-both-chains.patch b/queue-3.18/iwlwifi-mvm-fix-rx-with-both-chains.patch new file mode 100644 index 00000000000..5960b166df7 --- /dev/null +++ b/queue-3.18/iwlwifi-mvm-fix-rx-with-both-chains.patch @@ -0,0 +1,33 @@ +From c93edc639392df733c7d72db4376a9add775d18a Mon Sep 17 00:00:00 2001 +From: Eyal Shapira +Date: Wed, 31 Dec 2014 19:30:15 +0200 +Subject: iwlwifi: mvm: fix Rx with both chains + +From: Eyal Shapira + +commit c93edc639392df733c7d72db4376a9add775d18a upstream. + +commit 5c90422439d6 +"iwlwifi: mvm: don't allow diversity if BT Coex / TT forbid it" +broke Rx with 2 chains for diversity. +This had an impact on throughput where we're using only a single +stream (11a/b/g APs, single stream APs, static SMPS). + +Fixes: 5c90422439d6 ("iwlwifi: mvm: don't allow diversity if BT Coex / TT forbid it") +Signed-off-by: Eyal Shapira +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c +index e56e77ef5d2e..917431e30f74 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c +@@ -665,7 +665,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm) + if (num_of_ant(mvm->fw->valid_rx_ant) == 1) + return false; + +- if (!mvm->cfg->rx_with_siso_diversity) ++ if (mvm->cfg->rx_with_siso_diversity) + return false; + + ieee80211_iterate_active_interfaces_atomic( diff --git a/queue-3.18/leds-netxbig-fix-oops-at-probe-time.patch b/queue-3.18/leds-netxbig-fix-oops-at-probe-time.patch new file mode 100644 index 00000000000..067ff6975e2 --- /dev/null +++ b/queue-3.18/leds-netxbig-fix-oops-at-probe-time.patch @@ -0,0 +1,64 @@ +From 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 Mon Sep 17 00:00:00 2001 +From: Simon Guinot +Date: Tue, 2 Dec 2014 07:32:10 -0800 +Subject: leds: netxbig: fix oops at probe time + +From: Simon Guinot + +commit 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 upstream. + +This patch fixes a NULL pointer dereference on led_dat->mode_val. Due to +this bug, a kernel oops can be observed at probe time on the LaCie 2Big +and 5Big v2 boards: + +Unable to handle kernel NULL pointer dereference at virtual address 00000008 +[...] +[] (netxbig_led_probe) from [] (platform_drv_probe+0x4c/0x9c) +[] (platform_drv_probe) from [] (driver_probe_device+0x98/0x25c) +[] (driver_probe_device) from [] (__driver_attach+0x8c/0x90) +[] (__driver_attach) from [] (bus_for_each_dev+0x68/0x94) +[] (bus_for_each_dev) from [] (bus_add_driver+0x124/0x1dc) +[] (bus_add_driver) from [] (driver_register+0x78/0xf8) +[] (driver_register) from [] (do_one_initcall+0x80/0x1cc) +[] (do_one_initcall) from [] (kernel_init_freeable+0xe4/0x1b4) +[] (kernel_init_freeable) from [] (kernel_init+0xc/0xec) +[] (kernel_init) from [] (ret_from_fork+0x14/0x24) +[...] + +This bug was introduced by commit 588a6a99286ae30afb1339d8bc2163517b1b7dd1 +("leds: netxbig: fix attribute-creation race"). + +Signed-off-by: Simon Guinot +Acked-by: Johan Hovold +Signed-off-by: Bryan Wu +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c +index 26515c27ea8c..25e419752a7b 100644 +--- a/drivers/leds/leds-netxbig.c ++++ b/drivers/leds/leds-netxbig.c +@@ -330,18 +330,18 @@ create_netxbig_led(struct platform_device *pdev, + led_dat->sata = 0; + led_dat->cdev.brightness = LED_OFF; + led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME; +- /* +- * If available, expose the SATA activity blink capability through +- * a "sata" sysfs attribute. +- */ +- if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE) +- led_dat->cdev.groups = netxbig_led_groups; + led_dat->mode_addr = template->mode_addr; + led_dat->mode_val = template->mode_val; + led_dat->bright_addr = template->bright_addr; + led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1; + led_dat->timer = pdata->timer; + led_dat->num_timer = pdata->num_timer; ++ /* ++ * If available, expose the SATA activity blink capability through ++ * a "sata" sysfs attribute. ++ */ ++ if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE) ++ led_dat->cdev.groups = netxbig_led_groups; + + return led_classdev_register(&pdev->dev, &led_dat->cdev); + } diff --git a/queue-3.18/locks-fix-null-deref-in-generic_delete_lease.patch b/queue-3.18/locks-fix-null-deref-in-generic_delete_lease.patch new file mode 100644 index 00000000000..4ba4b442786 --- /dev/null +++ b/queue-3.18/locks-fix-null-deref-in-generic_delete_lease.patch @@ -0,0 +1,40 @@ +From 52d304eb4eaced9ad04b64ba7cd6ceb5153bbf18 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Tue, 13 Jan 2015 15:17:43 +1300 +Subject: locks: fix NULL-deref in generic_delete_lease + +From: NeilBrown + +commit 52d304eb4eaced9ad04b64ba7cd6ceb5153bbf18 upstream. + +commit 0efaa7e82f02fe69c05ad28e905f31fc86e6f08e + locks: generic_delete_lease doesn't need a file_lock at all + +moves the call to fl->fl_lmops->lm_change() to a place in the +code where fl might be a non-lease lock. +When that happens, fl_lmops is NULL and an Oops ensures. + +So add an extra test to restore correct functioning. + +Reported-by: Linda Walsh +Link: https://bugzilla.suse.com/show_bug.cgi?id=912569 +Fixes: 0efaa7e82f02fe69c05ad28e905f31fc86e6f08e +Signed-off-by: NeilBrown +Signed-off-by: Jeff Layton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/locks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -1702,7 +1702,7 @@ static int generic_delete_lease(struct f + break; + } + trace_generic_delete_lease(inode, fl); +- if (fl) ++ if (fl && IS_LEASE(fl)) + error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose); + spin_unlock(&inode->i_lock); + locks_dispose_list(&dispose); diff --git a/queue-3.18/mei-clean-reset-bit-before-reset.patch b/queue-3.18/mei-clean-reset-bit-before-reset.patch new file mode 100644 index 00000000000..bd77e0fcd05 --- /dev/null +++ b/queue-3.18/mei-clean-reset-bit-before-reset.patch @@ -0,0 +1,44 @@ +From b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Thu, 25 Dec 2014 00:37:46 +0200 +Subject: mei: clean reset bit before reset + +From: Alexander Usyskin + +commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 upstream. + +H_RST bit in H_CSR register may be found lit before reset is started, +for example if preceding reset flow hasn't completed. +In that case asserting H_RST will be ignored, therefore we need to clean +H_RST bit to start a successful reset sequence. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -234,6 +234,18 @@ static int mei_me_hw_reset(struct mei_de + struct mei_me_hw *hw = to_me_hw(dev); + u32 hcsr = mei_hcsr_read(hw); + ++ /* H_RST may be found lit before reset is started, ++ * for example if preceding reset flow hasn't completed. ++ * In that case asserting H_RST will be ignored, therefore ++ * we need to clean H_RST bit to start a successful reset sequence. ++ */ ++ if ((hcsr & H_RST) == H_RST) { ++ dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr); ++ hcsr &= ~H_RST; ++ mei_me_reg_write(hw, H_CSR, hcsr); ++ hcsr = mei_hcsr_read(hw); ++ } ++ + hcsr |= H_RST | H_IG | H_IS; + + if (intr_enable) diff --git a/queue-3.18/mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch b/queue-3.18/mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch new file mode 100644 index 00000000000..29298fc93e3 --- /dev/null +++ b/queue-3.18/mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch @@ -0,0 +1,42 @@ +From 3cbc6123a93dc91b99b58f7ea37d267fe93e1cad Mon Sep 17 00:00:00 2001 +From: Tim Kryger +Date: Wed, 14 Jan 2015 07:24:12 +0100 +Subject: mmc: sdhci: Set SDHCI_POWER_ON with external vmmc + +From: Tim Kryger + +commit 3cbc6123a93dc91b99b58f7ea37d267fe93e1cad upstream. + +Host controllers lacking the required internal vmmc regulator may still +follow the spec with regard to the LSB of SDHCI_POWER_CONTROL. Set the +SDHCI_POWER_ON bit when vmmc is enabled to encourage the controller to +to drive CMD, DAT, SDCLK. + +This fixes a regression observed on some Qualcomm and Nvidia boards +caused by 5222161 mmc: sdhci: Improve external VDD regulator support. + +Fixes: 52221610dd84 (mmc: sdhci: Improve external VDD regulator support) +Signed-off-by: Tim Kryger +Tested-by: Bjorn Andersson +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1239,6 +1239,12 @@ static void sdhci_set_power(struct sdhci + spin_unlock_irq(&host->lock); + mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); + spin_lock_irq(&host->lock); ++ ++ if (mode != MMC_POWER_OFF) ++ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL); ++ else ++ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); ++ + return; + } + diff --git a/queue-3.18/nfsv4.1-fix-client-id-trunking-on-linux.patch b/queue-3.18/nfsv4.1-fix-client-id-trunking-on-linux.patch new file mode 100644 index 00000000000..81d87773d04 --- /dev/null +++ b/queue-3.18/nfsv4.1-fix-client-id-trunking-on-linux.patch @@ -0,0 +1,66 @@ +From 1fc0703af3143914a389bfa081c7acb09502ed5d Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 2 Jan 2015 16:25:08 -0500 +Subject: NFSv4.1: Fix client id trunking on Linux + +From: Trond Myklebust + +commit 1fc0703af3143914a389bfa081c7acb09502ed5d upstream. + +Currently, our trunking code will check for session trunking, but will +fail to detect client id trunking. This is a problem, because it means +that the client will fail to recognise that the two connections represent +shared state, even if they do not permit a shared session. +By removing the check for the server minor id, and only checking the +major id, we will end up doing the right thing in both cases: we close +down the new nfs_client and fall back to using the existing one. + +Fixes: 05f4c350ee02e ("NFS: Discover NFSv4 server trunking when mounting") +Cc: Chuck Lever +Tested-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4client.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -572,20 +572,14 @@ static bool nfs4_match_clientids(struct + } + + /* +- * Returns true if the server owners match ++ * Returns true if the server major ids match + */ + static bool +-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b) ++nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b) + { + struct nfs41_server_owner *o1 = a->cl_serverowner; + struct nfs41_server_owner *o2 = b->cl_serverowner; + +- if (o1->minor_id != o2->minor_id) { +- dprintk("NFS: --> %s server owner minor IDs do not match\n", +- __func__); +- return false; +- } +- + if (o1->major_id_sz != o2->major_id_sz) + goto out_major_mismatch; + if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0) +@@ -661,7 +655,12 @@ int nfs41_walk_client_list(struct nfs_cl + if (!nfs4_match_clientids(pos, new)) + continue; + +- if (!nfs4_match_serverowners(pos, new)) ++ /* ++ * Note that session trunking is just a special subcase of ++ * client id trunking. In either case, we want to fall back ++ * to using the existing nfs_client. ++ */ ++ if (!nfs4_check_clientid_trunking(pos, new)) + continue; + + atomic_inc(&pos->cl_count); diff --git a/queue-3.18/powernv-fix-opal-tracepoint-code.patch b/queue-3.18/powernv-fix-opal-tracepoint-code.patch new file mode 100644 index 00000000000..298279862dd --- /dev/null +++ b/queue-3.18/powernv-fix-opal-tracepoint-code.patch @@ -0,0 +1,42 @@ +From bfe5fda8e7ced129716f5741cf7ed2592a338824 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Tue, 6 Jan 2015 21:12:08 +1100 +Subject: powernv: Fix OPAL tracepoint code + +From: Anton Blanchard + +commit bfe5fda8e7ced129716f5741cf7ed2592a338824 upstream. + +Patch c49f63530bb6 ("powernv: Add OPAL tracepoints") has a spurious +store to the stack: + + ld r12,opal_tracepoint_refcount@toc(r2); \ + std r12,32(r1); \ + +The store was originally used to save the current tracepoint status +so the entry and the exit tracepoints were always balanced. In the +end I just created a separate path when tracepoints are enabled. + +The offset on the stack used for this store is not valid for ABIv2 +and it causes strange issues. I noticed it because OPAL console input +was broken. + +Fixes: c49f63530bb6 ("powernv: Add OPAL tracepoints") +Signed-off-by: Anton Blanchard +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powernv/opal-wrappers.S | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/powerpc/platforms/powernv/opal-wrappers.S ++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S +@@ -40,7 +40,6 @@ BEGIN_FTR_SECTION; \ + b 1f; \ + END_FTR_SECTION(0, 1); \ + ld r12,opal_tracepoint_refcount@toc(r2); \ +- std r12,32(r1); \ + cmpdi r12,0; \ + bne- LABEL; \ + 1: diff --git a/queue-3.18/series b/queue-3.18/series index 273cbbdd529..c77d8b8795e 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -99,3 +99,28 @@ serial-fix-parisc-boot-hang.patch storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch net-ethernet-cpsw-fix-hangs-with-interrupts.patch x86-build-clean-auto-generated-processor-feature-files.patch +video-logo-prevent-use-of-logos-after-they-have-been-freed.patch +video-fbdev-fix-defio-s-fsync.patch +smiapp-pll-correct-clock-debug-prints.patch +af9005-fix-kernel-panic-on-init-if-compiled-without.patch +smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch +sound-simplify-au0828-quirk-table.patch +sound-update-au0828-quirks-table.patch +uvcvideo-fix-destruction-order-in-uvc_delete.patch +img-ir-hw-always-read-data-to-clear-buffer.patch +img-ir-hw-fix-potential-deadlock-stopping-timer.patch +vivid-fix-crop_bounds-typo-for-video-output.patch +vfio-pci-fix-the-check-on-pci-device-type-in.patch +locks-fix-null-deref-in-generic_delete_lease.patch +powernv-fix-opal-tracepoint-code.patch +mmc-sdhci-set-sdhci_power_on-with-external-vmmc.patch +arm64-partially-revert-arm-8167-1-extend-the-reserved-memory-for-initrd-to-be-page-aligned.patch +iwlwifi-mvm-fix-rx-with-both-chains.patch +i40e-adds-fcoe-configure-option.patch +drivers-net-cpsw-fix-multicast-flush-in-dual-emac-mode.patch +leds-netxbig-fix-oops-at-probe-time.patch +ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch +ftrace-fix-updating-of-filters-for-shared-global_ops-filters.patch +ftrace-check-both-notrace-and-filter-for-old-hash.patch +nfsv4.1-fix-client-id-trunking-on-linux.patch +mei-clean-reset-bit-before-reset.patch diff --git a/queue-3.18/smiapp-pll-correct-clock-debug-prints.patch b/queue-3.18/smiapp-pll-correct-clock-debug-prints.patch new file mode 100644 index 00000000000..50820df610d --- /dev/null +++ b/queue-3.18/smiapp-pll-correct-clock-debug-prints.patch @@ -0,0 +1,40 @@ +From bc47150ab93988714d1fab7bc82fe5f505a107ad Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Tue, 1 Apr 2014 10:22:46 -0300 +Subject: [media] smiapp-pll: Correct clock debug prints + +From: Sakari Ailus + +commit bc47150ab93988714d1fab7bc82fe5f505a107ad upstream. + +The PLL flags were not used correctly. + +Signed-off-by: Sakari Ailus +Acked-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/smiapp-pll.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/smiapp-pll.c ++++ b/drivers/media/i2c/smiapp-pll.c +@@ -67,7 +67,7 @@ static void print_pll(struct device *dev + { + dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div); + dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier); +- if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { ++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { + dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div); + dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div); + } +@@ -77,7 +77,7 @@ static void print_pll(struct device *dev + dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz); + dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz); + dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz); +- if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { ++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { + dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n", + pll->op_sys_clk_freq_hz); + dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n", diff --git a/queue-3.18/smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch b/queue-3.18/smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch new file mode 100644 index 00000000000..7dce0b07dd5 --- /dev/null +++ b/queue-3.18/smiapp-take-mutex-during-pll-update-in-sensor-initialisation.patch @@ -0,0 +1,33 @@ +From f85698cd296f08218a7750f321e94607da128600 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Tue, 16 Sep 2014 15:57:07 -0300 +Subject: [media] smiapp: Take mutex during PLL update in sensor initialisation + +From: Sakari Ailus + +commit f85698cd296f08218a7750f321e94607da128600 upstream. + +The mutex does not serialise anything in this case but avoids a lockdep +warning from the control framework. + +Signed-off-by: Sakari Ailus +Acked-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/smiapp/smiapp-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -2677,7 +2677,9 @@ static int smiapp_registered(struct v4l2 + pll->flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS; + pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN]; + ++ mutex_lock(&sensor->mutex); + rval = smiapp_update_mode(sensor); ++ mutex_unlock(&sensor->mutex); + if (rval) { + dev_err(&client->dev, "update mode failed\n"); + goto out_nvm_release; diff --git a/queue-3.18/sound-simplify-au0828-quirk-table.patch b/queue-3.18/sound-simplify-au0828-quirk-table.patch new file mode 100644 index 00000000000..cd790e93ee5 --- /dev/null +++ b/queue-3.18/sound-simplify-au0828-quirk-table.patch @@ -0,0 +1,201 @@ +From 5d1f00a20d2d56ed480e64e938a2391353ee565b Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Thu, 30 Oct 2014 07:53:04 -0300 +Subject: [media] sound: simplify au0828 quirk table + +From: Mauro Carvalho Chehab + +commit 5d1f00a20d2d56ed480e64e938a2391353ee565b upstream. + +Add a macro to simplify au0828 quirk table. That makes easier +to check it against the USB IDs at drivers/media/usb/au0828/au0828-cards.c. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/au0828/au0828-cards.c | 5 + + sound/usb/quirks-table.h | 158 ++++++-------------------------- + 2 files changed, 36 insertions(+), 127 deletions(-) + +--- a/drivers/media/usb/au0828/au0828-cards.c ++++ b/drivers/media/usb/au0828/au0828-cards.c +@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *p + au0828_clear(dev, REG_000, 0x10); + } + ++/* ++ * WARNING: There's a quirks table at sound/usb/quirks-table.h ++ * that should also be updated every time a new device with V4L2 support ++ * is added here. ++ */ + struct au0828_board au0828_boards[] = { + [AU0828_BOARD_UNKNOWN] = { + .name = "Unknown board", +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2804,133 +2804,37 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + +-/* Hauppauge HVR-950Q and HVR-850 */ +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-850", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, +-{ +- USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008), +- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +- USB_DEVICE_ID_MATCH_INT_CLASS | +- USB_DEVICE_ID_MATCH_INT_SUBCLASS, +- .bInterfaceClass = USB_CLASS_AUDIO, +- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, +- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { +- .vendor_name = "Hauppauge", +- .product_name = "HVR-950Q", +- .ifnum = QUIRK_ANY_INTERFACE, +- .type = QUIRK_AUDIO_ALIGN_TRANSFER, +- } +-}, ++/* ++ * Auvitek au0828 devices with audio interface. ++ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c ++ * Please notice that some drivers are DVB only, and don't need to be ++ * here. That's the case, for example, of DVICO_FUSIONHDTV7. ++ */ ++ ++#define AU0828_DEVICE(vid, pid, vname, pname) { \ ++ USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ ++ USB_DEVICE_ID_MATCH_INT_CLASS | \ ++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ ++ .bInterfaceClass = USB_CLASS_AUDIO, \ ++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \ ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \ ++ .vendor_name = vname, \ ++ .product_name = pname, \ ++ .ifnum = QUIRK_ANY_INTERFACE, \ ++ .type = QUIRK_AUDIO_ALIGN_TRANSFER, \ ++ } \ ++} ++ ++AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"), ++AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"), + + /* Digidesign Mbox */ + { diff --git a/queue-3.18/sound-update-au0828-quirks-table.patch b/queue-3.18/sound-update-au0828-quirks-table.patch new file mode 100644 index 00000000000..beff06b2440 --- /dev/null +++ b/queue-3.18/sound-update-au0828-quirks-table.patch @@ -0,0 +1,49 @@ +From 678fa12fb8e75c6dc1e781a02e3ddbbba7e1a904 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Thu, 30 Oct 2014 07:53:05 -0300 +Subject: [media] sound: Update au0828 quirks table + +From: Mauro Carvalho Chehab + +commit 678fa12fb8e75c6dc1e781a02e3ddbbba7e1a904 upstream. + +The au0828 quirks table is currently not in sync with the au0828 +media driver. + +Syncronize it and put them on the same order as found at au0828 +driver, as all the au0828 devices with analog TV need the +same quirks. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks-table.h | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2827,14 +2827,22 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + + AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"), + AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"), + AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"), + AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"), + AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"), + AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"), +-AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"), + AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"), + AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"), ++AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"), ++AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"), ++AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"), ++AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + + /* Digidesign Mbox */ + { diff --git a/queue-3.18/uvcvideo-fix-destruction-order-in-uvc_delete.patch b/queue-3.18/uvcvideo-fix-destruction-order-in-uvc_delete.patch new file mode 100644 index 00000000000..e101014d3ea --- /dev/null +++ b/queue-3.18/uvcvideo-fix-destruction-order-in-uvc_delete.patch @@ -0,0 +1,84 @@ +From 2228d80dd05a4fc5a410fde847677b8fb3eb23d7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 24 Oct 2014 05:10:20 -0300 +Subject: [media] uvcvideo: Fix destruction order in uvc_delete() + +From: Takashi Iwai + +commit 2228d80dd05a4fc5a410fde847677b8fb3eb23d7 upstream. + +We've got a bug report at disconnecting a Webcam, where the kernel +spews warnings like below: + WARNING: CPU: 0 PID: 8385 at ../fs/sysfs/group.c:219 sysfs_remove_group+0x87/0x90() + sysfs group c0b2350c not found for kobject 'event3' + CPU: 0 PID: 8385 Comm: queue2:src Not tainted 3.16.2-1.gdcee397-default #1 + Hardware name: ASUSTeK Computer INC. A7N8X-E/A7N8X-E, BIOS ASUS A7N8X-E Deluxe ACPI BIOS Rev 1013 11/12/2004 + c08d0705 ddc75cbc c0718c5b ddc75ccc c024b654 c08c6d44 ddc75ce8 000020c1 + c08d0705 000000db c03d1ec7 c03d1ec7 00000009 00000000 c0b2350c d62c9064 + ddc75cd4 c024b6a3 00000009 ddc75ccc c08c6d44 ddc75ce8 ddc75cfc c03d1ec7 + Call Trace: + [] try_stack_unwind+0x156/0x170 + [] dump_trace+0x53/0x180 + [] show_trace_log_lvl+0x46/0x50 + [] show_stack_log_lvl+0x51/0xe0 + [] show_stack+0x27/0x50 + [] dump_stack+0x3e/0x4e + [] warn_slowpath_common+0x84/0xa0 + [] warn_slowpath_fmt+0x33/0x40 + [] sysfs_remove_group+0x87/0x90 + [] device_del+0x34/0x180 + [] evdev_disconnect+0x19/0x50 + [] __input_unregister_device+0x9a/0x140 + [] input_unregister_device+0x45/0x80 + [] uvc_delete+0x26/0x110 [uvcvideo] + [] v4l2_device_release+0x98/0xc0 [videodev] + [] device_release+0x2b/0x90 + [] kobject_cleanup+0x6f/0x1a0 + [] v4l2_release+0x43/0x70 [videodev] + [] __fput+0xb1/0x1b0 + [] task_work_run+0x91/0xb0 + [] do_exit+0x265/0x910 + [] do_group_exit+0x34/0xa0 + [] get_signal_to_deliver+0x17f/0x590 + [] do_signal+0x3a/0x960 + [] do_notify_resume+0x67/0x90 + [] work_notifysig+0x30/0x3b + [] 0xb7739e5f + ---[ end trace b1e56095a485b631 ]--- + +The cause is that uvc_status_cleanup() is called after usb_put_*() in +uvc_delete(). usb_put_*() removes the sysfs parent and eventually +removes the children recursively, so the later device_del() can't find +its sysfs. The fix is simply rearrange the call orders in +uvc_delete() so that the child is removed before the parent. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=897736 +Reported-and-tested-by: Martin Pluskal + +Signed-off-by: Takashi Iwai +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/uvc/uvc_driver.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1623,12 +1623,12 @@ static void uvc_delete(struct uvc_device + { + struct list_head *p, *n; + +- usb_put_intf(dev->intf); +- usb_put_dev(dev->udev); +- + uvc_status_cleanup(dev); + uvc_ctrl_cleanup_device(dev); + ++ usb_put_intf(dev->intf); ++ usb_put_dev(dev->udev); ++ + if (dev->vdev.dev) + v4l2_device_unregister(&dev->vdev); + #ifdef CONFIG_MEDIA_CONTROLLER diff --git a/queue-3.18/vfio-pci-fix-the-check-on-pci-device-type-in.patch b/queue-3.18/vfio-pci-fix-the-check-on-pci-device-type-in.patch new file mode 100644 index 00000000000..85966c4a076 --- /dev/null +++ b/queue-3.18/vfio-pci-fix-the-check-on-pci-device-type-in.patch @@ -0,0 +1,42 @@ +From 7c2e211f3c95b91912a92a8c6736343690042e2e Mon Sep 17 00:00:00 2001 +From: Wei Yang +Date: Wed, 7 Jan 2015 10:29:11 -0700 +Subject: vfio-pci: Fix the check on pci device type in + vfio_pci_probe() + +From: Wei Yang + +commit 7c2e211f3c95b91912a92a8c6736343690042e2e upstream. + +Current vfio-pci just supports normal pci device, so vfio_pci_probe() will +return if the pci device is not a normal device. While current code makes a +mistake. PCI_HEADER_TYPE is the offset in configuration space of the device +type, but we use this value to mask the type value. + +This patch fixs this by do the check directly on the pci_dev->hdr_type. + +Signed-off-by: Wei Yang +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/vfio/pci/vfio_pci.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -839,13 +839,11 @@ static const struct vfio_device_ops vfio + + static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { +- u8 type; + struct vfio_pci_device *vdev; + struct iommu_group *group; + int ret; + +- pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type); +- if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) ++ if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL) + return -EINVAL; + + group = iommu_group_get(&pdev->dev); diff --git a/queue-3.18/video-fbdev-fix-defio-s-fsync.patch b/queue-3.18/video-fbdev-fix-defio-s-fsync.patch new file mode 100644 index 00000000000..ca627fef320 --- /dev/null +++ b/queue-3.18/video-fbdev-fix-defio-s-fsync.patch @@ -0,0 +1,37 @@ +From 30ea9c5218651bc11cbdba7820be78f04e2d83bc Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Fri, 19 Dec 2014 13:55:41 +0200 +Subject: video/fbdev: fix defio's fsync + +From: Tomi Valkeinen + +commit 30ea9c5218651bc11cbdba7820be78f04e2d83bc upstream. + +fb_deferred_io_fsync() returns the value of schedule_delayed_work() as +an error code, but schedule_delayed_work() does not return an error. It +returns true/false depending on whether the work was already queued. + +Fix this by ignoring the return value of schedule_delayed_work(). + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/core/fb_defio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/core/fb_defio.c ++++ b/drivers/video/fbdev/core/fb_defio.c +@@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *fi + cancel_delayed_work_sync(&info->deferred_work); + + /* Run it immediately */ +- err = schedule_delayed_work(&info->deferred_work, 0); ++ schedule_delayed_work(&info->deferred_work, 0); + mutex_unlock(&inode->i_mutex); +- return err; ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(fb_deferred_io_fsync); + diff --git a/queue-3.18/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch b/queue-3.18/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch new file mode 100644 index 00000000000..a723eea1bfd --- /dev/null +++ b/queue-3.18/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch @@ -0,0 +1,64 @@ +From 92b004d1aa9f367c372511ca0330f58216b25703 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 18 Dec 2014 13:40:06 +0200 +Subject: video/logo: prevent use of logos after they have been freed + +From: Tomi Valkeinen + +commit 92b004d1aa9f367c372511ca0330f58216b25703 upstream. + +If the probe of an fb driver has been deferred due to missing +dependencies, and the probe is later ran when a module is loaded, the +fbdev framework will try to find a logo to use. + +However, the logos are __initdata, and have already been freed. This +causes sometimes page faults, if the logo memory is not mapped, +sometimes other random crashes as the logo data is invalid, and +sometimes nothing, if the fbdev decides to reject the logo (e.g. the +random value depicting the logo's height is too big). + +This patch adds a late_initcall function to mark the logos as freed. In +reality the logos are freed later, and fbdev probe may be ran between +this late_initcall and the freeing of the logos. In that case we will +miss drawing the logo, even if it would be possible. + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/logo/logo.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/video/logo/logo.c ++++ b/drivers/video/logo/logo.c +@@ -21,6 +21,21 @@ static bool nologo; + module_param(nologo, bool, 0); + MODULE_PARM_DESC(nologo, "Disables startup logo"); + ++/* ++ * Logos are located in the initdata, and will be freed in kernel_init. ++ * Use late_init to mark the logos as freed to prevent any further use. ++ */ ++ ++static bool logos_freed; ++ ++static int __init fb_logo_late_init(void) ++{ ++ logos_freed = true; ++ return 0; ++} ++ ++late_initcall(fb_logo_late_init); ++ + /* logo's are marked __initdata. Use __init_refok to tell + * modpost that it is intended that this function uses data + * marked __initdata. +@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok f + { + const struct linux_logo *logo = NULL; + +- if (nologo) ++ if (nologo || logos_freed) + return NULL; + + if (depth >= 1) { diff --git a/queue-3.18/vivid-fix-crop_bounds-typo-for-video-output.patch b/queue-3.18/vivid-fix-crop_bounds-typo-for-video-output.patch new file mode 100644 index 00000000000..3b2bb19b3fb --- /dev/null +++ b/queue-3.18/vivid-fix-crop_bounds-typo-for-video-output.patch @@ -0,0 +1,33 @@ +From bb9ff078860f9d2f79d3a6bea3af9f48354ddb75 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sat, 6 Dec 2014 07:30:03 -0300 +Subject: [media] vivid: fix CROP_BOUNDS typo for video output + +From: Hans Verkuil + +commit bb9ff078860f9d2f79d3a6bea3af9f48354ddb75 upstream. + +An error was returned if composing was not supported, instead of if +cropping was not supported. + +A classic copy-and-paste bug. Found with v4l2-compliance. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/vivid/vivid-vid-out.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/vivid/vivid-vid-out.c ++++ b/drivers/media/platform/vivid/vivid-vid-out.c +@@ -612,7 +612,7 @@ int vivid_vid_out_g_selection(struct fil + sel->r = dev->fmt_out_rect; + break; + case V4L2_SEL_TGT_CROP_BOUNDS: +- if (!dev->has_compose_out) ++ if (!dev->has_crop_out) + return -EINVAL; + sel->r = vivid_max_rect; + break;