--- /dev/null
+From 90cfde46586d2286488d8ed636929e936c0c9ab2 Mon Sep 17 00:00:00 2001
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Date: Tue, 22 Dec 2015 17:29:16 +0100
+Subject: can: ems_usb: Fix possible tx overflow
+
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+
+commit 90cfde46586d2286488d8ed636929e936c0c9ab2 upstream.
+
+This patch fixes the problem that more CAN messages could be sent to the
+interface as could be send on the CAN bus. This was more likely for slow baud
+rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
+heavy TX load this produced another bulk transfer without checking the
+free_slots variable and hence caused the overflow in the interface.
+
+Signed-off-by: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/ems_usb.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -117,6 +117,9 @@ MODULE_LICENSE("GPL v2");
+ */
+ #define EMS_USB_ARM7_CLOCK 8000000
+
++#define CPC_TX_QUEUE_TRIGGER_LOW 25
++#define CPC_TX_QUEUE_TRIGGER_HIGH 35
++
+ /*
+ * CAN-Message representation in a CPC_MSG. Message object type is
+ * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or
+@@ -278,6 +281,11 @@ static void ems_usb_read_interrupt_callb
+ switch (urb->status) {
+ case 0:
+ dev->free_slots = dev->intr_in_buffer[1];
++ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){
++ if (netif_queue_stopped(netdev)){
++ netif_wake_queue(netdev);
++ }
++ }
+ break;
+
+ case -ECONNRESET: /* unlink */
+@@ -526,8 +534,6 @@ static void ems_usb_write_bulk_callback(
+ /* Release context */
+ context->echo_index = MAX_TX_URBS;
+
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ /*
+@@ -587,7 +593,7 @@ static int ems_usb_start(struct ems_usb
+ int err, i;
+
+ dev->intr_in_buffer[0] = 0;
+- dev->free_slots = 15; /* initial size */
++ dev->free_slots = 50; /* initial size */
+
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+@@ -835,7 +841,7 @@ static netdev_tx_t ems_usb_start_xmit(st
+
+ /* Slow down tx path */
+ if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS ||
+- dev->free_slots < 5) {
++ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) {
+ netif_stop_queue(netdev);
+ }
+ }
--- /dev/null
+From 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <kernel@kyup.com>
+Date: Thu, 17 Dec 2015 18:03:35 +0200
+Subject: dm thin: fix race condition when destroying thin pool workqueue
+
+From: Nikolay Borisov <kernel@kyup.com>
+
+commit 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 upstream.
+
+When a thin pool is being destroyed delayed work items are
+cancelled using cancel_delayed_work(), which doesn't guarantee that on
+return the delayed item isn't running. This can cause the work item to
+requeue itself on an already destroyed workqueue. Fix this by using
+cancel_delayed_work_sync() which guarantees that on return the work item
+is not running anymore.
+
+Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second")
+Fixes: 85ad643b7e7e5 ("dm thin: add timeout to stop out-of-data-space mode holding IO forever")
+Signed-off-by: Nikolay Borisov <kernel@kyup.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -3453,8 +3453,8 @@ static void pool_postsuspend(struct dm_t
+ struct pool_c *pt = ti->private;
+ struct pool *pool = pt->pool;
+
+- cancel_delayed_work(&pool->waker);
+- cancel_delayed_work(&pool->no_space_timeout);
++ cancel_delayed_work_sync(&pool->waker);
++ cancel_delayed_work_sync(&pool->no_space_timeout);
+ flush_workqueue(pool->wq);
+ (void) commit(pool);
+ }
--- /dev/null
+From 7a64cd887fdb97f074c3fda03bee0bfb9faceac3 Mon Sep 17 00:00:00 2001
+From: Lisa Du <cldu@marvell.com>
+Date: Wed, 17 Feb 2016 09:32:52 +0800
+Subject: drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE
+
+From: Lisa Du <cldu@marvell.com>
+
+commit 7a64cd887fdb97f074c3fda03bee0bfb9faceac3 upstream.
+
+There's one point was missed in the patch commit da49889deb34 ("staging:
+binder: Support concurrent 32 bit and 64 bit processes."). When configure
+BINDER_IPC_32BIT, the size of binder_uintptr_t was 32bits, but size of
+void * is 64bit on 64bit system. Correct it here.
+
+Signed-off-by: Lisa Du <cldu@marvell.com>
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Fixes: da49889deb34 ("staging: binder: Support concurrent 32 bit and 64 bit processes.")
+Acked-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/android/binder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2074,7 +2074,7 @@ static int binder_thread_write(struct bi
+ if (get_user(cookie, (binder_uintptr_t __user *)ptr))
+ return -EFAULT;
+
+- ptr += sizeof(void *);
++ ptr += sizeof(cookie);
+ list_for_each_entry(w, &proc->delivered_death, entry) {
+ struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
+
--- /dev/null
+From 97e5ed1111dcc5300a0f59a55248cd243937a8ab Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 23 Oct 2015 10:56:12 +0200
+Subject: drm/i915: shut up gen8+ SDE irq dmesg noise
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 97e5ed1111dcc5300a0f59a55248cd243937a8ab upstream.
+
+We get tons of cases where the master interrupt handler apparently set
+a bit, with the SDEIIR disagreeing. No idea what's going on there, but
+it's consistent on gen8+, no one seems to care about it and it's
+making CI results flaky.
+
+Shut it up.
+
+No idea what's going on here, but we've had fun with PCH interrupts
+before:
+
+commit 44498aea293b37af1d463acd9658cdce1ecdf427
+Author: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Fri Feb 22 17:05:28 2013 -0300
+
+ drm/i915: also disable south interrupts when handling them
+
+Note that there's a regression report in Bugzilla, and other
+regression reports on the mailing lists keep croping up. But no ill
+effects have ever been reported. But for paranoia still keep the
+message at a debug level as a breadcrumb, just in case.
+
+This message was introduced in
+
+commit 38cc46d73ed99dd7002f1406002e52d7975d16cc
+Author: Oscar Mateo <oscar.mateo@intel.com>
+Date: Mon Jun 16 16:10:59 2014 +0100
+
+ drm/i915/bdw: Ack interrupts before handling them (GEN8)
+
+v2: Improve commit message a bit.
+
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1445590572-23631-2-git-send-email-daniel.vetter@ffwll.ch
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92084
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=80896
+Acked-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -2354,9 +2354,13 @@ static irqreturn_t gen8_irq_handler(int
+ spt_irq_handler(dev, pch_iir);
+ else
+ cpt_irq_handler(dev, pch_iir);
+- } else
+- DRM_ERROR("The master control interrupt lied (SDE)!\n");
+-
++ } else {
++ /*
++ * Like on previous PCH there seems to be something
++ * fishy going on with forwarding PCH interrupts.
++ */
++ DRM_DEBUG_DRIVER("The master control interrupt lied (SDE)!\n");
++ }
+ }
+
+ I915_WRITE_FW(GEN8_MASTER_IRQ, GEN8_MASTER_IRQ_CONTROL);
--- /dev/null
+From 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 Mon Sep 17 00:00:00 2001
+From: Hariprasad S <hariprasad@chelsio.com>
+Date: Fri, 11 Dec 2015 13:59:17 +0530
+Subject: iw_cxgb3: Fix incorrectly returning error on success
+
+From: Hariprasad S <hariprasad@chelsio.com>
+
+commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 upstream.
+
+The cxgb3_*_send() functions return NET_XMIT_ values, which are
+positive integers values. So don't treat positive return values
+as an error.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+[a pox on developers and maintainers who do not cc: stable for bug fixes like this - gregkh]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *
+ error = l2t_send(tdev, skb, l2e);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
+@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *
+ error = cxgb3_ofld_send(tdev, skb);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
--- /dev/null
+From 8479eba7781fa9ffb28268840de6facfc12c35a7 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@techsingularity.net>
+Date: Fri, 26 Feb 2016 15:19:31 -0800
+Subject: mm: numa: quickly fail allocations for NUMA balancing on full nodes
+
+From: Mel Gorman <mgorman@techsingularity.net>
+
+commit 8479eba7781fa9ffb28268840de6facfc12c35a7 upstream.
+
+Commit 4167e9b2cf10 ("mm: remove GFP_THISNODE") removed the GFP_THISNODE
+flag combination due to confusing semantics. It noted that
+alloc_misplaced_dst_page() was one such user after changes made by
+commit e97ca8e5b864 ("mm: fix GFP_THISNODE callers and clarify").
+
+Unfortunately when GFP_THISNODE was removed, users of
+alloc_misplaced_dst_page() started waking kswapd and entering direct
+reclaim because the wrong GFP flags are cleared. The consequence is
+that workloads that used to fit into memory now get reclaimed which is
+addressed by this patch.
+
+The problem can be demonstrated with "mutilate" that exercises memcached
+which is software dedicated to memory object caching. The configuration
+uses 80% of memory and is run 3 times for varying numbers of clients.
+The results on a 4-socket NUMA box are
+
+mutilate
+ 4.4.0 4.4.0
+ vanilla numaswap-v1
+Hmean 1 8394.71 ( 0.00%) 8395.32 ( 0.01%)
+Hmean 4 30024.62 ( 0.00%) 34513.54 ( 14.95%)
+Hmean 7 32821.08 ( 0.00%) 70542.96 (114.93%)
+Hmean 12 55229.67 ( 0.00%) 93866.34 ( 69.96%)
+Hmean 21 39438.96 ( 0.00%) 85749.21 (117.42%)
+Hmean 30 37796.10 ( 0.00%) 50231.49 ( 32.90%)
+Hmean 47 18070.91 ( 0.00%) 38530.13 (113.22%)
+
+The metric is queries/second with the more the better. The results are
+way outside of the noise and the reason for the improvement is obvious
+from some of the vmstats
+
+ 4.4.0 4.4.0
+ vanillanumaswap-v1r1
+Minor Faults 1929399272 2146148218
+Major Faults 19746529 3567
+Swap Ins 57307366 9913
+Swap Outs 50623229 17094
+Allocation stalls 35909 443
+DMA allocs 0 0
+DMA32 allocs 72976349 170567396
+Normal allocs 5306640898 5310651252
+Movable allocs 0 0
+Direct pages scanned 404130893 799577
+Kswapd pages scanned 160230174 0
+Kswapd pages reclaimed 55928786 0
+Direct pages reclaimed 1843936 41921
+Page writes file 2391 0
+Page writes anon 50623229 17094
+
+The vanilla kernel is swapping like crazy with large amounts of direct
+reclaim and kswapd activity. The figures are aggregate but it's known
+that the bad activity is throughout the entire test.
+
+Note that simple streaming anon/file memory consumers also see this
+problem but it's not as obvious. In those cases, kswapd is awake when
+it should not be.
+
+As there are at least two reclaim-related bugs out there, it's worth
+spelling out the user-visible impact. This patch only addresses bugs
+related to excessive reclaim on NUMA hardware when the working set is
+larger than a NUMA node. There is a bug related to high kswapd CPU
+usage but the reports are against laptops and other UMA hardware and is
+not addressed by this patch.
+
+Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1578,7 +1578,7 @@ static struct page *alloc_misplaced_dst_
+ (GFP_HIGHUSER_MOVABLE |
+ __GFP_THISNODE | __GFP_NOMEMALLOC |
+ __GFP_NORETRY | __GFP_NOWARN) &
+- ~(__GFP_IO | __GFP_FS), 0);
++ ~__GFP_RECLAIM, 0);
+
+ return newpage;
+ }
--- /dev/null
+From ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 Mon Sep 17 00:00:00 2001
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Fri, 26 Feb 2016 15:19:28 -0800
+Subject: mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED
+
+From: Andrea Arcangeli <aarcange@redhat.com>
+
+commit ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 upstream.
+
+pmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were
+introduced to locklessy (but atomically) detect when a pmd is a regular
+(stable) pmd or when the pmd is unstable and can infinitely transition
+from pmd_none() and pmd_trans_huge() from under us, while only holding
+the mmap_sem for reading (for writing not).
+
+While holding the mmap_sem only for reading, MADV_DONTNEED can run from
+under us and so before we can assume the pmd to be a regular stable pmd
+we need to compare it against pmd_none() and pmd_trans_huge() in an
+atomic way, with pmd_trans_unstable(). The old pmd_trans_huge() left a
+tiny window for a race.
+
+Useful applications are unlikely to notice the difference as doing
+MADV_DONTNEED concurrently with a page fault would lead to undefined
+behavior.
+
+[akpm@linux-foundation.org: tidy up comment grammar/layout]
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3399,8 +3399,18 @@ static int __handle_mm_fault(struct mm_s
+ if (unlikely(pmd_none(*pmd)) &&
+ unlikely(__pte_alloc(mm, vma, pmd, address)))
+ return VM_FAULT_OOM;
+- /* if an huge pmd materialized from under us just retry later */
+- if (unlikely(pmd_trans_huge(*pmd)))
++ /*
++ * If a huge pmd materialized under us just retry later. Use
++ * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
++ * didn't become pmd_trans_huge under us and then back to pmd_none, as
++ * a result of MADV_DONTNEED running immediately after a huge pmd fault
++ * in a different thread of this mm, in turn leading to a misleading
++ * pmd_trans_huge() retval. All we have to ensure is that it is a
++ * regular pmd that we can walk with pte_offset_map() and we can do that
++ * through an atomic read in C, which is what pmd_trans_unstable()
++ * provides.
++ */
++ if (unlikely(pmd_trans_unstable(pmd)))
+ return 0;
+ /*
+ * A regular pmd is established and it can't morph into a huge pmd
--- /dev/null
+From a4a8481ff68a8a324a878e281bc37f18665224f7 Mon Sep 17 00:00:00 2001
+From: Guozhonghua <guozhonghua@h3c.com>
+Date: Fri, 26 Feb 2016 15:19:40 -0800
+Subject: ocfs2: unlock inode if deleting inode from orphan fails
+
+From: Guozhonghua <guozhonghua@h3c.com>
+
+commit a4a8481ff68a8a324a878e281bc37f18665224f7 upstream.
+
+When doing append direct io cleanup, if deleting inode fails, it goes
+out without unlocking inode, which will cause the inode deadlock.
+
+This issue was introduced by commit cf1776a9e834 ("ocfs2: fix a tiny
+race when truncate dio orohaned entry").
+
+Signed-off-by: Guozhonghua <guozhonghua@h3c.com>
+Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
+Reviewed-by: Gang He <ghe@suse.com>
+Cc: Mark Fasheh <mfasheh@suse.de>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ocfs2/aops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -956,6 +956,7 @@ clean_orphan:
+ tmp_ret = ocfs2_del_inode_from_orphan(osb, inode, di_bh,
+ update_isize, end);
+ if (tmp_ret < 0) {
++ ocfs2_inode_unlock(inode, 1);
+ ret = tmp_ret;
+ mlog_errno(ret);
+ brelse(di_bh);
bcache-allows-use-of-register-in-udev-to-avoid-device_busy-error.patch
bcache-prevent-crash-on-changing-writeback_running.patch
bcache-change-refill_dirty-to-always-scan-entire-disk-if-necessary.patch
+dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch
+can-ems_usb-fix-possible-tx-overflow.patch
+usb-dwc3-fix-assignment-of-ep-transfer-resources.patch
+usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch
+usb-option-add-support-for-sim7100e.patch
+usb-option-add-4g-lte-usb-modem-u901.patch
+drivers-android-correct-the-size-of-struct-binder_uintptr_t-for-bc_dead_binder_done.patch
+spi-omap2-mcspi-prevent-duplicate-gpio_request.patch
+iw_cxgb3-fix-incorrectly-returning-error-on-success.patch
+drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch
+ocfs2-unlock-inode-if-deleting-inode-from-orphan-fails.patch
+mm-thp-fix-smp-race-condition-between-thp-page-fault-and-madv_dontneed.patch
+mm-numa-quickly-fail-allocations-for-numa-balancing-on-full-nodes.patch
--- /dev/null
+From 2f538c017e1a8620d19553931199c6d6a6d31bb2 Mon Sep 17 00:00:00 2001
+From: Michael Welling <mwelling@ieee.org>
+Date: Mon, 30 Nov 2015 09:02:39 -0600
+Subject: spi: omap2-mcspi: Prevent duplicate gpio_request
+
+From: Michael Welling <mwelling@ieee.org>
+
+commit 2f538c017e1a8620d19553931199c6d6a6d31bb2 upstream.
+
+Occasionally the setup function will be called multiple times. Only request
+the gpio the first time otherwise -EBUSY will occur on subsequent calls to
+setup.
+
+Reported-by: Joseph Bell <joe@iachieved.it>
+
+Signed-off-by: Michael Welling <mwelling@ieee.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-omap2-mcspi.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -1024,6 +1024,16 @@ static int omap2_mcspi_setup(struct spi_
+ spi->controller_state = cs;
+ /* Link this to context save list */
+ list_add_tail(&cs->node, &ctx->cs);
++
++ if (gpio_is_valid(spi->cs_gpio)) {
++ ret = gpio_request(spi->cs_gpio, dev_name(&spi->dev));
++ if (ret) {
++ dev_err(&spi->dev, "failed to request gpio\n");
++ return ret;
++ }
++ gpio_direction_output(spi->cs_gpio,
++ !(spi->mode & SPI_CS_HIGH));
++ }
+ }
+
+ if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) {
+@@ -1032,15 +1042,6 @@ static int omap2_mcspi_setup(struct spi_
+ return ret;
+ }
+
+- if (gpio_is_valid(spi->cs_gpio)) {
+- ret = gpio_request(spi->cs_gpio, dev_name(&spi->dev));
+- if (ret) {
+- dev_err(&spi->dev, "failed to request gpio\n");
+- return ret;
+- }
+- gpio_direction_output(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH));
+- }
+-
+ ret = pm_runtime_get_sync(mcspi->dev);
+ if (ret < 0)
+ return ret;
--- /dev/null
+From 6627ae19385283b89356a199d7f03c75ba35fb29 Mon Sep 17 00:00:00 2001
+From: Ken Lin <ken.lin@advantech.com.tw>
+Date: Mon, 1 Feb 2016 14:57:25 -0500
+Subject: USB: cp210x: add IDs for GE B650V3 and B850V3 boards
+
+From: Ken Lin <ken.lin@advantech.com.tw>
+
+commit 6627ae19385283b89356a199d7f03c75ba35fb29 upstream.
+
+Add USB ID for cp2104/5 devices on GE B650v3 and B850v3 boards.
+
+Signed-off-by: Ken Lin <ken.lin@advantech.com.tw>
+Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -162,6 +162,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
++ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
++ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
--- /dev/null
+From c450960187f45d4260db87c7dd4fc0bceb5565d8 Mon Sep 17 00:00:00 2001
+From: John Youn <John.Youn@synopsys.com>
+Date: Tue, 16 Feb 2016 20:10:53 -0800
+Subject: usb: dwc3: Fix assignment of EP transfer resources
+
+From: John Youn <John.Youn@synopsys.com>
+
+commit c450960187f45d4260db87c7dd4fc0bceb5565d8 upstream.
+
+The assignement of EP transfer resources was not handled properly in the
+dwc3 driver. Commit aebda6187181 ("usb: dwc3: Reset the transfer
+resource index on SET_INTERFACE") previously fixed one aspect of this
+where resources may be exhausted with multiple calls to SET_INTERFACE.
+However, it introduced an issue where composite devices with multiple
+interfaces can be assigned the same transfer resources for different
+endpoints. This patch solves both issues.
+
+The assignment of transfer resources cannot perfectly follow the data
+book due to the fact that the controller driver does not have all
+knowledge of the configuration in advance. It is given this information
+piecemeal by the composite gadget framework after every
+SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
+programming model in this scenario can cause errors. For two reasons:
+
+1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION and
+SET_INTERFACE (8.1.5). This is incorrect in the scenario of multiple
+interfaces.
+
+2) The databook does not mention doing more DEPXFERCFG for new endpoint
+on alt setting (8.1.6).
+
+The following simplified method is used instead:
+
+All hardware endpoints can be assigned a transfer resource and this
+setting will stay persistent until either a core reset or hibernation.
+So whenever we do a DEPSTARTCFG(0) we can go ahead and do DEPXFERCFG for
+every hardware endpoint as well. We are guaranteed that there are as
+many transfer resources as endpoints.
+
+This patch triggers off of the calling dwc3_gadget_start_config() for
+EP0-out, which always happens first, and which should only happen in one
+of the above conditions.
+
+Fixes: aebda6187181 ("usb: dwc3: Reset the transfer resource index on SET_INTERFACE")
+Reported-by: Ravi Babu <ravibabu@ti.com>
+Signed-off-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/core.h | 1
+ drivers/usb/dwc3/ep0.c | 5 ---
+ drivers/usb/dwc3/gadget.c | 70 ++++++++++++++++++++++++++++++++++------------
+ 3 files changed, 52 insertions(+), 24 deletions(-)
+
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -853,7 +853,6 @@ struct dwc3 {
+ unsigned pullups_connected:1;
+ unsigned resize_fifos:1;
+ unsigned setup_packet_pending:1;
+- unsigned start_config_issued:1;
+ unsigned three_stage_setup:1;
+ unsigned usb3_lpm_capable:1;
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -555,7 +555,6 @@ static int dwc3_ep0_set_config(struct dw
+ int ret;
+ u32 reg;
+
+- dwc->start_config_issued = false;
+ cfg = le16_to_cpu(ctrl->wValue);
+
+ switch (state) {
+@@ -737,10 +736,6 @@ static int dwc3_ep0_std_request(struct d
+ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
+ ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
+ break;
+- case USB_REQ_SET_INTERFACE:
+- dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
+- dwc->start_config_issued = false;
+- /* Fall through */
+ default:
+ dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
+ ret = dwc3_ep0_delegate_req(dwc, ctrl);
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -388,24 +388,66 @@ static void dwc3_free_trb_pool(struct dw
+ dep->trb_pool_dma = 0;
+ }
+
++static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
++
++/**
++ * dwc3_gadget_start_config - Configure EP resources
++ * @dwc: pointer to our controller context structure
++ * @dep: endpoint that is being enabled
++ *
++ * The assignment of transfer resources cannot perfectly follow the
++ * data book due to the fact that the controller driver does not have
++ * all knowledge of the configuration in advance. It is given this
++ * information piecemeal by the composite gadget framework after every
++ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
++ * programming model in this scenario can cause errors. For two
++ * reasons:
++ *
++ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
++ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
++ * multiple interfaces.
++ *
++ * 2) The databook does not mention doing more DEPXFERCFG for new
++ * endpoint on alt setting (8.1.6).
++ *
++ * The following simplified method is used instead:
++ *
++ * All hardware endpoints can be assigned a transfer resource and this
++ * setting will stay persistent until either a core reset or
++ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
++ * do DEPXFERCFG for every hardware endpoint as well. We are
++ * guaranteed that there are as many transfer resources as endpoints.
++ *
++ * This function is called for each endpoint when it is being enabled
++ * but is triggered only when called for EP0-out, which always happens
++ * first, and which should only happen in one of the above conditions.
++ */
+ static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+ u32 cmd;
++ int i;
++ int ret;
++
++ if (dep->number)
++ return 0;
+
+ memset(¶ms, 0x00, sizeof(params));
++ cmd = DWC3_DEPCMD_DEPSTARTCFG;
+
+- if (dep->number != 1) {
+- cmd = DWC3_DEPCMD_DEPSTARTCFG;
+- /* XferRscIdx == 0 for ep0 and 2 for the remaining */
+- if (dep->number > 1) {
+- if (dwc->start_config_issued)
+- return 0;
+- dwc->start_config_issued = true;
+- cmd |= DWC3_DEPCMD_PARAM(2);
+- }
++ ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ if (ret)
++ return ret;
++
++ for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
++ struct dwc3_ep *dep = dwc->eps[i];
+
+- return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ if (!dep)
++ continue;
++
++ ret = dwc3_gadget_set_xfer_resource(dwc, dep);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+@@ -519,10 +561,6 @@ static int __dwc3_gadget_ep_enable(struc
+ struct dwc3_trb *trb_st_hw;
+ struct dwc3_trb *trb_link;
+
+- ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+- if (ret)
+- return ret;
+-
+ dep->endpoint.desc = desc;
+ dep->comp_desc = comp_desc;
+ dep->type = usb_endpoint_type(desc);
+@@ -1604,8 +1642,6 @@ static int dwc3_gadget_start(struct usb_
+ }
+ dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+
+- dwc->start_config_issued = false;
+-
+ /* Start with SuperSpeed Default */
+ dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
+
+@@ -2202,7 +2238,6 @@ static void dwc3_gadget_disconnect_inter
+ dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+
+ dwc3_disconnect_gadget(dwc);
+- dwc->start_config_issued = false;
+
+ dwc->gadget.speed = USB_SPEED_UNKNOWN;
+ dwc->setup_packet_pending = false;
+@@ -2253,7 +2288,6 @@ static void dwc3_gadget_reset_interrupt(
+
+ dwc3_stop_active_transfers(dwc);
+ dwc3_clear_stall_all_ep(dwc);
+- dwc->start_config_issued = false;
+
+ /* Reset device address to zero */
+ reg = dwc3_readl(dwc->regs, DWC3_DCFG);
--- /dev/null
+From d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Fri, 12 Feb 2016 16:40:00 +0100
+Subject: USB: option: add "4G LTE usb-modem U901"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 upstream.
+
+Thomas reports:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=05c6 ProdID=6001 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Reported-by: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1127,6 +1127,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
++ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
--- /dev/null
+From 3158a8d416f4e1b79dcc867d67cb50013140772c Mon Sep 17 00:00:00 2001
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Date: Fri, 29 Jan 2016 00:07:30 +0300
+Subject: USB: option: add support for SIM7100E
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+commit 3158a8d416f4e1b79dcc867d67cb50013140772c upstream.
+
+$ lsusb:
+Bus 001 Device 101: ID 1e0e:9001 Qualcomm / Option
+
+$ usb-devices:
+T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=101 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 2
+P: Vendor=1e0e ProdID=9001 Rev= 2.32
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+The last interface (6) is used for Android Composite ADB interface.
+
+Serial port layout:
+0: QCDM/DIAG
+1: NMEA
+2: AT
+3: AT/PPP
+4: audio
+
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -315,6 +315,7 @@ static void option_instat_callback(struc
+ #define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
++#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */
+ #define ALINK_PRODUCT_PH300 0x9100
+ #define ALINK_PRODUCT_3GU 0x9200
+
+@@ -607,6 +608,10 @@ static const struct option_blacklist_inf
+ .reserved = BIT(3) | BIT(4),
+ };
+
++static const struct option_blacklist_info simcom_sim7100e_blacklist = {
++ .reserved = BIT(5) | BIT(6),
++};
++
+ static const struct option_blacklist_info telit_le910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(2),
+@@ -1645,6 +1650,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
++ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
projects / thirdparty / kernel / stable-queue.git / commitdiff
