--- /dev/null
+From f91b1feada0b6f0a4d33648155b3ded2c4e0707e Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Sun, 26 Jul 2015 14:59:00 +0200
+Subject: arm64/efi: map the entire UEFI vendor string before reading it
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit f91b1feada0b6f0a4d33648155b3ded2c4e0707e upstream.
+
+At boot, the UTF-16 UEFI vendor string is copied from the system
+table into a char array with a size of 100 bytes. However, this
+size of 100 bytes is also used for memremapping() the source,
+which may not be sufficient if the vendor string exceeds 50
+UTF-16 characters, and the placement of the vendor string inside
+a 4 KB page happens to leave the end unmapped.
+
+So use the correct '100 * sizeof(efi_char16_t)' for the size of
+the mapping.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Fixes: f84d02755f5a ("arm64: add EFI runtime services")
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/efi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -122,12 +122,12 @@ static int __init uefi_init(void)
+
+ /* Show what we know for posterity */
+ c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
+- sizeof(vendor));
++ sizeof(vendor) * sizeof(efi_char16_t));
+ if (c16) {
+ for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
+ vendor[i] = c16[i];
+ vendor[i] = '\0';
+- early_memunmap(c16, sizeof(vendor));
++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
+ }
+
+ pr_info("EFI v%u.%.02u by %s\n",
--- /dev/null
+From 945b47441d83d2392ac9f984e0267ad521f24268 Mon Sep 17 00:00:00 2001
+From: Lior Amsalem <alior@marvell.com>
+Date: Tue, 30 Jun 2015 16:09:49 +0200
+Subject: ata: pmp: add quirk for Marvell 4140 SATA PMP
+
+From: Lior Amsalem <alior@marvell.com>
+
+commit 945b47441d83d2392ac9f984e0267ad521f24268 upstream.
+
+This commit adds the necessary quirk to make the Marvell 4140 SATA PMP
+work properly. This PMP doesn't like SRST on port number 4 (the host
+port) so this commit marks this port as not supporting SRST.
+
+Signed-off-by: Lior Amsalem <alior@marvell.com>
+Reviewed-by: Nadav Haklai <nadavh@marvell.com>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-pmp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_p
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
--- /dev/null
+From 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 22 Jul 2015 18:05:53 -0400
+Subject: blkcg: fix gendisk reference leak in blkg_conf_prep()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 upstream.
+
+When a blkcg configuration is targeted to a partition rather than a
+whole device, blkg_conf_prep fails with -EINVAL; unfortunately, it
+forgets to put the gendisk ref in that case. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-cgroup.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg,
+ return -EINVAL;
+
+ disk = get_gendisk(MKDEV(major, minor), &part);
+- if (!disk || part)
++ if (!disk)
+ return -EINVAL;
++ if (part) {
++ put_disk(disk);
++ return -EINVAL;
++ }
+
+ rcu_read_lock();
+ spin_lock_irq(disk->queue->queue_lock);
--- /dev/null
+From 9115c7589b11349a1c3099758b4bded579ff69e0 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Wed, 15 Jul 2015 19:36:03 -0700
+Subject: efi: Check for NULL efi kernel parameters
+
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+
+commit 9115c7589b11349a1c3099758b4bded579ff69e0 upstream.
+
+Even though it is documented how to specifiy efi parameters, it is
+possible to cause a kernel panic due to a dereference of a NULL pointer when
+parsing such parameters if "efi" alone is given:
+
+PANIC: early exception 0e rip 10:ffffffff812fb361 error 0 cr2 0
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.2.0-rc1+ #450
+[ 0.000000] ffffffff81fe20a9 ffffffff81e03d50 ffffffff8184bb0f 00000000000003f8
+[ 0.000000] 0000000000000000 ffffffff81e03e08 ffffffff81f371a1 64656c62616e6520
+[ 0.000000] 0000000000000069 000000000000005f 0000000000000000 0000000000000000
+[ 0.000000] Call Trace:
+[ 0.000000] [<ffffffff8184bb0f>] dump_stack+0x45/0x57
+[ 0.000000] [<ffffffff81f371a1>] early_idt_handler_common+0x81/0xae
+[ 0.000000] [<ffffffff812fb361>] ? parse_option_str+0x11/0x90
+[ 0.000000] [<ffffffff81f4dd69>] arch_parse_efi_cmdline+0x15/0x42
+[ 0.000000] [<ffffffff81f376e1>] do_early_param+0x50/0x8a
+[ 0.000000] [<ffffffff8106b1b3>] parse_args+0x1e3/0x400
+[ 0.000000] [<ffffffff81f37a43>] parse_early_options+0x24/0x28
+[ 0.000000] [<ffffffff81f37691>] ? loglevel+0x31/0x31
+[ 0.000000] [<ffffffff81f37a78>] parse_early_param+0x31/0x3d
+[ 0.000000] [<ffffffff81f3ae98>] setup_arch+0x2de/0xc08
+[ 0.000000] [<ffffffff8109629a>] ? vprintk_default+0x1a/0x20
+[ 0.000000] [<ffffffff81f37b20>] start_kernel+0x90/0x423
+[ 0.000000] [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
+[ 0.000000] [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
+[ 0.000000] RIP 0xffffffff81ba2efc
+
+This panic is not reproducible with "efi=" as this will result in a non-NULL
+zero-length string.
+
+Thus, verify that the pointer to the parameter string is not NULL. This is
+consistent with other parameter-parsing functions which check for NULL pointers.
+
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Cc: Dave Young <dyoung@redhat.com>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi.c | 5 +++++
+ drivers/firmware/efi/efi.c | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phy
+
+ static int __init arch_parse_efi_cmdline(char *str)
+ {
++ if (!str) {
++ pr_warn("need at least one option\n");
++ return -EINVAL;
++ }
++
+ if (parse_option_str(str, "old_map"))
+ set_bit(EFI_OLD_MEMMAP, &efi.flags);
+ if (parse_option_str(str, "debug"))
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
+
+ static int __init parse_efi_cmdline(char *str)
+ {
++ if (!str) {
++ pr_warn("need at least one option\n");
++ return -EINVAL;
++ }
++
+ if (parse_option_str(str, "noruntime"))
+ disable_runtime = true;
+
--- /dev/null
+From 4c62360d7562a20c996836d163259c87d9378120 Mon Sep 17 00:00:00 2001
+From: "Luck, Tony" <tony.luck@intel.com>
+Date: Tue, 30 Jun 2015 15:57:51 -0700
+Subject: efi: Handle memory error structures produced based on old versions of standard
+
+From: "Luck, Tony" <tony.luck@intel.com>
+
+commit 4c62360d7562a20c996836d163259c87d9378120 upstream.
+
+The memory error record structure includes as its first field a
+bitmask of which subsequent fields are valid. The allows new fields
+to be added to the structure while keeping compatibility with older
+software that parses these records. This mechanism was used between
+versions 2.2 and 2.3 to add four new fields, growing the size of the
+structure from 73 bytes to 80. But Linux just added all the new
+fields so this test:
+ if (gdata->error_data_length >= sizeof(*mem_err))
+ cper_print_mem(newpfx, mem_err);
+ else
+ goto err_section_too_small;
+now make Linux complain about old format records being too short.
+
+Add a definition for the old format of the structure and use that
+for the minimum size check. Pass the actual size to cper_print_mem()
+so it can sanity check the validation_bits field to ensure that if
+a BIOS using the old format sets bits as if it were new, we won't
+access fields beyond the end of the structure.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/efi/cper.c | 15 ++++++++++++---
+ include/linux/cper.h | 22 +++++++++++++++++++++-
+ 2 files changed, 33 insertions(+), 4 deletions(-)
+
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct t
+ return ret;
+ }
+
+-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
++static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
++ int len)
+ {
+ struct cper_mem_err_compact cmem;
+
++ /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
++ if (len == sizeof(struct cper_sec_mem_err_old) &&
++ (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
++ pr_err(FW_WARN "valid bits set for fields beyond structure\n");
++ return;
++ }
+ if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
+ printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
+ if (mem->validation_bits & CPER_MEM_VALID_PA)
+@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
+ } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
+ struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
+ printk("%s""section_type: memory error\n", newpfx);
+- if (gdata->error_data_length >= sizeof(*mem_err))
+- cper_print_mem(newpfx, mem_err);
++ if (gdata->error_data_length >=
++ sizeof(struct cper_sec_mem_err_old))
++ cper_print_mem(newpfx, mem_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
+ __u64 mm_reg_addr;
+ };
+
+-/* Memory Error Section */
++/* Old Memory Error Section UEFI 2.1, 2.2 */
++struct cper_sec_mem_err_old {
++ __u64 validation_bits;
++ __u64 error_status;
++ __u64 physical_addr;
++ __u64 physical_addr_mask;
++ __u16 node;
++ __u16 card;
++ __u16 module;
++ __u16 bank;
++ __u16 device;
++ __u16 row;
++ __u16 column;
++ __u16 bit_pos;
++ __u64 requestor_id;
++ __u64 responder_id;
++ __u64 target_id;
++ __u8 error_type;
++};
++
++/* Memory Error Section UEFI >= 2.3 */
+ struct cper_sec_mem_err {
+ __u64 validation_bits;
+ __u64 error_status;
--- /dev/null
+From 968491709e5b1aaf429428814fff3d932fa90b60 Mon Sep 17 00:00:00 2001
+From: Bernhard Bender <bernhard.bender@bytecmed.com>
+Date: Thu, 23 Jul 2015 13:58:08 -0700
+Subject: Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen
+
+From: Bernhard Bender <bernhard.bender@bytecmed.com>
+
+commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.
+
+This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30
+touch screen. Due to a missing delay between the RESET and SET_RATE
+commands, the touch screen may become unresponsive during system startup or
+driver loading.
+
+According to the DMC documentation, a delay is needed after the RESET
+command to allow the chip to complete its internal initialization. As this
+delay is not guaranteed, we had a system where the touch screen
+occasionally did not send any touch data. There was no other indication of
+the problem.
+
+The patch fixes the problem by adding a 150ms delay between the RESET and
+SET_RATE commands.
+
+Suggested-by: Jakob Mustafa <jakob.mustafa@bytecmed.com>
+Signed-off-by: Bernhard Bender <bernhard.bender@bytecmed.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/usbtouchscreen.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouc
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
--- /dev/null
+From 7d01cd261c76f95913c81554a751968a1d282d3a Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
+Date: Mon, 13 Jul 2015 09:54:42 -0700
+Subject: Input: zforce - don't overwrite the stack
+
+From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
+
+commit 7d01cd261c76f95913c81554a751968a1d282d3a upstream.
+
+If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
+will silently overwrite the stack.
+
+Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
+Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/zforce_ts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/zforce_ts.c
++++ b/drivers/input/touchscreen/zforce_ts.c
+@@ -430,7 +430,7 @@ static int zforce_read_packet(struct zfo
+ goto unlock;
+ }
+
+- if (buf[PAYLOAD_LENGTH] == 0) {
++ if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
+ dev_err(&client->dev, "invalid payload length: %d\n",
+ buf[PAYLOAD_LENGTH]);
+ ret = -EIO;
--- /dev/null
+From 923a8c1d8069104726bde55c37cec66324ccc328 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 31 May 2015 21:44:22 +0300
+Subject: iwlwifi: mvm: fix antenna selection when BT is active
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 923a8c1d8069104726bde55c37cec66324ccc328 upstream.
+
+When BT is active, we want to avoid the shared antenna for
+management frame to make sure we don't disturb BT. There
+was a bug in that code because it chose the antenna
+BIT(ANT_A) where ANT_A is already a bitmap (0x1). This
+means that the antenna chosen in the end was ANT_B.
+While this is not optimal on devices with 2 antennas (it'd
+disturb BT), it is critical on single antenna devices like
+3160 which couldn't connect at all when BT was active.
+
+This fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=97181
+
+Fixes: 34c8b24ff284 ("iwlwifi: mvm: BT Coex - avoid the shared antenna for management frames")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -225,7 +225,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_
+
+ if (info->band == IEEE80211_BAND_2GHZ &&
+ !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
+- rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
++ rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
+ else
+ rate_flags =
+ BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
--- /dev/null
+From be88a1ada9b97bb016196b7f4a1fc2fe2f798529 Mon Sep 17 00:00:00 2001
+From: Liad Kaufman <liad.kaufman@intel.com>
+Date: Wed, 1 Jul 2015 17:28:34 +0300
+Subject: iwlwifi: nvm: remove mac address byte swapping in 8000 family
+
+From: Liad Kaufman <liad.kaufman@intel.com>
+
+commit be88a1ada9b97bb016196b7f4a1fc2fe2f798529 upstream.
+
+This fixes the byte order copying in the MAO (Mac Override
+Section) section from the PNVM, as the byte swapping is not
+required anymore in the 8000 family. Due to the byte
+swapping, the driver was reporting an incorrect MAC
+adddress.
+
+Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_80
+ hw_addr = (const u8 *)(mac_override +
+ MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+
+- /* The byte order is little endian 16 bit, meaning 214365 */
+- data->hw_addr[0] = hw_addr[1];
+- data->hw_addr[1] = hw_addr[0];
+- data->hw_addr[2] = hw_addr[3];
+- data->hw_addr[3] = hw_addr[2];
+- data->hw_addr[4] = hw_addr[5];
+- data->hw_addr[5] = hw_addr[4];
++ /*
++ * Store the MAC address from MAO section.
++ * No byte swapping is required in MAO section
++ */
++ memcpy(data->hw_addr, hw_addr, ETH_ALEN);
+
+ /*
+ * Force the use of the OTP MAC address in case of reserved MAC
--- /dev/null
+From f9e5554cd8ca1d1212ec922755b397a20f737923 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 4 Jun 2015 11:09:47 +0300
+Subject: iwlwifi: pcie: prepare the device before accessing it
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit f9e5554cd8ca1d1212ec922755b397a20f737923 upstream.
+
+For 8000 series, we need to access the device to know what
+firmware to load. Before we do so, we need to prepare the
+device otherwise we might not be able to access the
+hardware.
+
+Fixes: c278754a21e6 ("iwlwifi: mvm: support family 8000 B2/C steps")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -2515,6 +2515,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ trans->hw_rev = (trans->hw_rev & 0xfff0) |
+ (CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
+
++ ret = iwl_pcie_prepare_card_hw(trans);
++ if (ret) {
++ IWL_WARN(trans, "Exit HW not ready\n");
++ goto out_pci_disable_msi;
++ }
++
+ /*
+ * in-order to recognize C step driver should read chip version
+ * id located at the AUX bus MISC address space.
--- /dev/null
+From 34cab6f42003cb06f48f86a86652984dec338ae9 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 24 Jul 2015 09:22:16 +1000
+Subject: md/raid1: fix test for 'was read error from last working device'.
+
+From: NeilBrown <neilb@suse.com>
+
+commit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream.
+
+When we get a read error from the last working device, we don't
+try to repair it, and don't fail the device. We simple report a
+read error to the caller.
+
+However the current test for 'is this the last working device' is
+wrong.
+When there is only one fully working device, it assumes that a
+non-faulty device is that device. However a spare which is rebuilding
+would be non-faulty but so not the only working device.
+
+So change the test from "!Faulty" to "In_sync". If ->degraded says
+there is only one fully working device and this device is in_sync,
+this must be the one.
+
+This bug has existed since we allowed read_balance to read from
+a recovering spare in v3.0
+
+Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
+Fixes: 76073054c95b ("md/raid1: clean up read_balance.")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struc
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
--- /dev/null
+From 154322f47376fed6ab1e4b350aa45fffa15a61aa Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Thu, 18 Jun 2015 11:41:03 +0300
+Subject: mei: prevent unloading mei hw modules while the device is opened.
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 154322f47376fed6ab1e4b350aa45fffa15a61aa upstream.
+
+chrdev_open() increases reference counter on cdev->owner. Instead of
+assigning the owner to mei subsystem, the owner has to be set to the
+underlaying HW module (mei_me or mei_txe), so once the device is opened
+the HW module cannot be unloaded.
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev,
+ /* Fill in the data structures */
+ devno = MKDEV(MAJOR(mei_devt), dev->minor);
+ cdev_init(&dev->cdev, &mei_fops);
+- dev->cdev.owner = mei_fops.owner;
++ dev->cdev.owner = parent->driver->owner;
+
+ /* Add the device */
+ ret = cdev_add(&dev->cdev, devno, 1);
--- /dev/null
+From 32c848e33ace75fce388cceff76223d12b46eaa3 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 24 Jun 2015 19:48:43 +0900
+Subject: regulator: s2mps11: Fix GPIO suspend enable shift wrapping bug
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 32c848e33ace75fce388cceff76223d12b46eaa3 upstream.
+
+Status of enabling suspend mode for regulator was stored in bitmap-like
+long integer.
+
+However since adding support for S2MPU02 the number of regulators
+exceeded 32 so on devices with more than 32 regulators (S2MPU02 and
+S2MPS13) overflow happens when shifting the bit. This could lead to
+enabling suspend mode for completely different regulator than intended
+or to switching different regulator to other mode (e.g. from always
+enabled to controlled by PWRHOLD pin). Both cases could result in larger
+energy usage and issues when suspending to RAM.
+
+Fixes: 00e2573d2c10 ("regulator: s2mps11: Add support S2MPU02 regulator device")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/s2mps11.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -34,6 +34,8 @@
+ #include <linux/mfd/samsung/s2mps14.h>
+ #include <linux/mfd/samsung/s2mpu02.h>
+
++/* The highest number of possible regulators for supported devices. */
++#define S2MPS_REGULATOR_MAX S2MPS13_REGULATOR_MAX
+ struct s2mps11_info {
+ unsigned int rdev_num;
+ int ramp_delay2;
+@@ -49,7 +51,7 @@ struct s2mps11_info {
+ * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
+ * the suspend mode was enabled.
+ */
+- unsigned long long s2mps14_suspend_state:50;
++ DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
+
+ /* Array of size rdev_num with GPIO-s for external sleep control */
+ int *ext_control_gpio;
+@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(stru
+ switch (s2mps11->dev_type) {
+ case S2MPS13X:
+ case S2MPS14X:
+- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ val = S2MPS14_ENABLE_SUSPEND;
+ else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
+ val = S2MPS14_ENABLE_EXT_CONTROL;
+@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(stru
+ val = rdev->desc->enable_mask;
+ break;
+ case S2MPU02:
+- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ val = S2MPU02_ENABLE_SUSPEND;
+ else
+ val = rdev->desc->enable_mask;
+@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend
+ if (ret < 0)
+ return ret;
+
+- s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
++ set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
+ /*
+ * Don't enable suspend mode if regulator is already disabled because
+ * this would effectively for a short time turn on the regulator after
+@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct pla
+ case S2MPS11X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
+ regulators = s2mps11_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPS13X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
+ regulators = s2mps13_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPS14X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
+ regulators = s2mps14_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPU02:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
+ regulators = s2mpu02_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ default:
+ dev_err(&pdev->dev, "Invalid device type: %u\n",
--- /dev/null
+From 907eda32a36fcdb979bdb91ea097abb3dd2c23c9 Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Fri, 26 Jun 2015 08:11:30 +0200
+Subject: Revert "serial: imx: initialized DMA w/o HW flow enabled"
+
+From: David Jander <david@protonic.nl>
+
+commit 907eda32a36fcdb979bdb91ea097abb3dd2c23c9 upstream.
+
+This reverts commit 068500e08dc87ea9a453cc4a500cf3ab28d0f936.
+
+According to some tests, SDMA support is broken at least for i.MX6 without
+HW flow control. Different forms of data-corruption appear either with
+the ROM firmware for the SDMA controller as well as when loading Freescale
+provided SDMA firmware versions 1.1 or 3.1.
+
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/imx.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1132,11 +1132,6 @@ static int imx_startup(struct uart_port
+ while (!(readl(sport->port.membase + UCR2) & UCR2_SRST) && (--i > 0))
+ udelay(1);
+
+- /* Can we enable the DMA support? */
+- if (is_imx6q_uart(sport) && !uart_console(port) &&
+- !sport->dma_is_inited)
+- imx_uart_dma_init(sport);
+-
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ /*
+@@ -1145,9 +1140,6 @@ static int imx_startup(struct uart_port
+ writel(USR1_RTSD, sport->port.membase + USR1);
+ writel(USR2_ORE, sport->port.membase + USR2);
+
+- if (sport->dma_is_inited && !sport->dma_is_enabled)
+- imx_enable_dma(sport);
+-
+ temp = readl(sport->port.membase + UCR1);
+ temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
+
+@@ -1318,6 +1310,11 @@ imx_set_termios(struct uart_port *port,
+ } else {
+ ucr2 |= UCR2_CTSC;
+ }
++
++ /* Can we enable the DMA support? */
++ if (is_imx6q_uart(sport) && !uart_console(port)
++ && !sport->dma_is_inited)
++ imx_uart_dma_init(sport);
+ } else {
+ termios->c_cflag &= ~CRTSCTS;
+ }
+@@ -1434,6 +1431,8 @@ imx_set_termios(struct uart_port *port,
+ if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
+ imx_enable_ms(&sport->port);
+
++ if (sport->dma_is_inited && !sport->dma_is_enabled)
++ imx_enable_dma(sport);
+ spin_unlock_irqrestore(&sport->port.lock, flags);
+ }
+
--- /dev/null
+From e144c58cad6667876173dd76977e9e6557e34941 Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sun, 12 Jul 2015 21:05:26 -0400
+Subject: serial: core: Fix crashes while echoing when closing
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit e144c58cad6667876173dd76977e9e6557e34941 upstream.
+
+While closing, new rx data may be received after the input buffers
+have been flushed but before stop_rx() halts receiving [1]. The
+new data might not be processed by flush_to_ldisc() until after
+uart_shutdown() and normal input processing is re-enabled (ie.,
+tty->closing = 0). The race is outlined below:
+
+CPU 0 | CPU 1
+ |
+uart_close() |
+ tty_port_close_start() |
+ tty->closing = 1 |
+ tty_ldisc_flush() |
+ | => IRQ
+ | while (LSR & data ready)
+ | uart_insert_char()
+ | tty_flip_buffer_push()
+ | <= EOI
+ stop_rx() | .
+ uart_shutdown() | .
+ free xmit.buf | .
+ tty_port_tty_set(NULL) | .
+ tty->closing = 0 | .
+ | flush_to_ldisc()
+ | n_tty_receive_buf_common()
+ | __receive_buf()
+ | ...
+ | commit_echoes()
+ | uart_flush_chars()
+ | __uart_start()
+ | ** OOPS on port.tty deref **
+ tty_ldisc_flush() |
+
+Input processing must be prevented from echoing (tty->closing = 1)
+until _after_ the input buffers have been flushed again at the end
+of uart_close().
+
+[1] In fact, some input may actually be buffered _after_ stop_rx()
+since the rx interrupt may have already triggered but not yet been
+handled when stop_rx() disables rx interrupts.
+
+Fixes: 2e758910832d ("serial: core: Flush ldisc after dropping port
+mutex in uart_close()")
+Reported-by: Robert Elliott <elliott@hp.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1409,7 +1409,7 @@ static void uart_close(struct tty_struct
+ mutex_lock(&port->mutex);
+ uart_shutdown(tty, state);
+ tty_port_tty_set(port, NULL);
+- tty->closing = 0;
++
+ spin_lock_irqsave(&port->lock, flags);
+
+ if (port->blocked_open) {
+@@ -1435,6 +1435,7 @@ static void uart_close(struct tty_struct
+ mutex_unlock(&port->mutex);
+
+ tty_ldisc_flush(tty);
++ tty->closing = 0;
+ }
+
+ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
mmc-sdhci-esdhc-make-8bit-bus-work.patch
mmc-sdhci-pxav3-fix-platform_data-is-not-initialized.patch
hid-cp2112-fix-to-force-single-data-report-reply.patch
+iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch
+iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch
+iwlwifi-pcie-prepare-the-device-before-accessing-it.patch
+md-raid1-fix-test-for-was-read-error-from-last-working-device.patch
+spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch
+spi-imx-fix-small-dma-transfers.patch
+tile-use-free_bootmem_late-for-initrd.patch
+input-zforce-don-t-overwrite-the-stack.patch
+input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch
+blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch
+regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch
+ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch
+usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch
+revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch
+serial-core-fix-crashes-while-echoing-when-closing.patch
+xhci-calculate-old-endpoints-correctly-on-device-reset.patch
+xhci-report-u3-when-link-is-in-resume-state.patch
+xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch
+xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch
+mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch
+x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch
+efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch
+arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch
+efi-check-for-null-efi-kernel-parameters.patch
+x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch
--- /dev/null
+From 6a806a214af42ac951e2d85e64d1bf4463482e16 Mon Sep 17 00:00:00 2001
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+Date: Thu, 18 Jun 2015 13:50:54 +0100
+Subject: spi: img-spfi: fix support for speeds up to 1/4th input clock
+
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+
+commit 6a806a214af42ac951e2d85e64d1bf4463482e16 upstream.
+
+Setting the Same Edge bit indicates to the spfi block to receive and
+transmit data on the same edge of the spfi clock, which in turn
+doubles the operating frequency of spfi.
+
+The maximum supported frequency is limited to 1/4th of the spfi input
+clock, but without this bit set the maximum would be 1/8th of the
+input clock.
+
+The current driver calculates the divisor with maximum speed at 1/4th
+of the input clock, this would fail if the requested frequency is
+higher than 1/8 of the input clock. Any requests for 1/8th of the
+input clock would still pass.
+
+Fixes: 8543d0e72d43 ("spi: img-spfi: Limit bit clock to 1/4th of input clock")
+Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-img-spfi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -40,6 +40,7 @@
+ #define SPFI_CONTROL_SOFT_RESET BIT(11)
+ #define SPFI_CONTROL_SEND_DMA BIT(10)
+ #define SPFI_CONTROL_GET_DMA BIT(9)
++#define SPFI_CONTROL_SE BIT(8)
+ #define SPFI_CONTROL_TMODE_SHIFT 5
+ #define SPFI_CONTROL_TMODE_MASK 0x7
+ #define SPFI_CONTROL_TMODE_SINGLE 0
+@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_m
+ else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
+ xfer->rx_nbits == SPI_NBITS_QUAD)
+ val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
++ val |= SPFI_CONTROL_SE;
+ spfi_writel(spfi, val, SPFI_CONTROL);
+ }
+
--- /dev/null
+From f6ee9b582d2db652497b73c1f117591dfb6d3a90 Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Fri, 24 Jul 2015 15:01:08 +0200
+Subject: spi: imx: Fix small DMA transfers
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit f6ee9b582d2db652497b73c1f117591dfb6d3a90 upstream.
+
+DMA transfers must be greater than the watermark level size. spi_imx->rx_wml
+and spi_imx->tx_wml contain the watermark level in 32bit words whereas struct
+spi_transfer contains the transfer len in bytes. Fix the check if DMA is
+possible for a transfer accordingly. This fixes transfers with sizes between
+33 and 128 bytes for which previously was claimed that DMA is possible.
+
+Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support)
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-imx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_m
+ {
+ struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+
+- if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
+- && (transfer->len > spi_imx->tx_wml))
++ if (spi_imx->dma_is_inited
++ && transfer->len > spi_imx->rx_wml * sizeof(u32)
++ && transfer->len > spi_imx->tx_wml * sizeof(u32))
+ return true;
+ return false;
+ }
--- /dev/null
+From 3f81d2447b37ac697b3c600039f2c6b628c06e21 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@ezchip.com>
+Date: Thu, 23 Jul 2015 14:11:09 -0400
+Subject: tile: use free_bootmem_late() for initrd
+
+From: Chris Metcalf <cmetcalf@ezchip.com>
+
+commit 3f81d2447b37ac697b3c600039f2c6b628c06e21 upstream.
+
+We were previously using free_bootmem() and just getting lucky
+that nothing too bad happened.
+
+Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/kernel/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ static int __init setup_initrd(char *str)
--- /dev/null
+From 5fb2c782f451a4fb9c19c076e2c442839faf0f76 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Mon, 6 Jul 2015 13:12:32 +0200
+Subject: usb-storage: ignore ZTE MF 823 card reader in mode 0x1225
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 upstream.
+
+This device automatically switches itself to another mode (0x1405)
+unless the specific access pattern of Windows is followed in its
+initial mode. That makes a dirty unmount of the internal storage
+devices inevitable if they are mounted. So the card reader of
+such a device should be ignored, lest an unclean removal become
+inevitable.
+
+This replaces an earlier patch that ignored all LUNs of this device.
+That patch was overly broad.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Reviewed-by: Lars Melin <larsm17@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
--- /dev/null
+From 7cc03e48965453b5df1cce5062c826189b04b960 Mon Sep 17 00:00:00 2001
+From: Dmitry Skorodumov <sdmitry@parallels.com>
+Date: Tue, 28 Jul 2015 18:38:32 +0400
+Subject: x86/efi: Use all 64 bit of efi_memmap in setup_e820()
+
+From: Dmitry Skorodumov <sdmitry@parallels.com>
+
+commit 7cc03e48965453b5df1cce5062c826189b04b960 upstream.
+
+The efi_info structure stores low 32 bits of memory map
+in efi_memmap and high 32 bits in efi_memmap_hi.
+
+While constructing pointer in the setup_e820(), need
+to take into account all 64 bit of the pointer.
+
+It is because on 64bit machine the function
+efi_get_memory_map() may return full 64bit pointer and before
+the patch that pointer was truncated.
+
+The issue is triggered on Parallles virtual machine and
+fixed with this patch.
+
+Signed-off-by: Dmitry Skorodumov <sdmitry@parallels.com>
+Cc: Denis V. Lunev <den@openvz.org>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/boot/compressed/eboot.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct bo
+ unsigned int e820_type = 0;
+ unsigned long m = efi->efi_memmap;
+
++#ifdef CONFIG_X86_64
++ m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ switch (d->type) {
+ case EFI_RESERVED_TYPE:
--- /dev/null
+From bbc03778b9954a2ec93baed63718e4df0192f130 Mon Sep 17 00:00:00 2001
+From: Dave Hansen <dave.hansen@linux.intel.com>
+Date: Mon, 20 Jul 2015 16:01:53 -0700
+Subject: x86/mm: Add parenthesis for TLB tracepoint size calculation
+
+From: Dave Hansen <dave.hansen@linux.intel.com>
+
+commit bbc03778b9954a2ec93baed63718e4df0192f130 upstream.
+
+flush_tlb_info->flush_start/end are both normal virtual
+addresses. When calculating 'nr_pages' (only used for the
+tracepoint), I neglected to put parenthesis in.
+
+Thanks to David Koufaty for pointing this out.
+
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: dave@sr71.net
+Link: http://lkml.kernel.org/r/20150720230153.9E834081@viggo.jf.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/mm/tlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
+ } else {
+ unsigned long addr;
+ unsigned long nr_pages =
+- f->flush_end - f->flush_start / PAGE_SIZE;
++ (f->flush_end - f->flush_start) / PAGE_SIZE;
+ addr = f->flush_start;
+ while (addr < f->flush_end) {
+ __flush_tlb_single(addr);
--- /dev/null
+From 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 Mon Sep 17 00:00:00 2001
+From: Brian Campbell <bacam@z273.org.uk>
+Date: Tue, 21 Jul 2015 17:20:28 +0300
+Subject: xhci: Calculate old endpoints correctly on device reset
+
+From: Brian Campbell <bacam@z273.org.uk>
+
+commit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream.
+
+When resetting a device the number of active TTs may need to be
+corrected by xhci_update_tt_active_eps, but the number of old active
+endpoints supplied to it was always zero, so the number of TTs and the
+bandwidth reserved for them was not updated, and could rise
+unnecessarily.
+
+This affected systems using Intel's Patherpoint chipset, which rely on
+software bandwidth checking. For example, a Lenovo X230 would lose the
+ability to use ports on the docking station after enough suspend/resume
+cycles because the bandwidth calculated would rise with every cycle when
+a suitable device is attached.
+
+The correct number of active endpoints is calculated in the same way as
+in xhci_reserve_bandwidth.
+
+Signed-off-by: Brian Campbell <bacam@z273.org.uk>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
--- /dev/null
+From aca3a0489ac019b58cf32794d5362bb284cb9b94 Mon Sep 17 00:00:00 2001
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Date: Tue, 21 Jul 2015 17:20:31 +0300
+Subject: xhci: do not report PLC when link is in internal resume state
+
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+
+commit aca3a0489ac019b58cf32794d5362bb284cb9b94 upstream.
+
+Port link change with port in resume state should not be
+reported to usbcore, as this is an internal state to be
+handled by xhci driver. Reporting PLC to usbcore may
+cause usbcore clearing PLC first and port change event irq
+won't be generated.
+
+Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -591,7 +591,14 @@ static u32 xhci_get_port_status(struct u
+ status |= USB_PORT_STAT_C_RESET << 16;
+ /* USB3.0 only */
+ if (hcd->speed == HCD_USB3) {
+- if ((raw_port_status & PORT_PLC))
++ /* Port link change with port in resume state should not be
++ * reported to usbcore, as this is an internal state to be
++ * handled by xhci driver. Reporting PLC to usbcore may
++ * cause usbcore clearing PLC first and port change event
++ * irq won't be generated.
++ */
++ if ((raw_port_status & PORT_PLC) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
--- /dev/null
+From fac4271d1126c45ceaceb7f4a336317b771eb121 Mon Sep 17 00:00:00 2001
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Date: Tue, 21 Jul 2015 17:20:30 +0300
+Subject: xhci: prevent bus_suspend if SS port resuming in phase 1
+
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+
+commit fac4271d1126c45ceaceb7f4a336317b771eb121 upstream.
+
+When the link is just waken, it's in Resume state, and driver sets PLS to
+U0. This refers to Phase 1. Phase 2 refers to when the link has completed
+the transition from Resume state to U0.
+
+With the fix of xhci: report U3 when link is in resume state, it also
+exposes an issue that usb3 roothub and controller can suspend right
+after phase 1, and this causes a hard hang in controller.
+
+To fix the issue, we need to prevent usb3 bus suspend if any port is
+resuming in phase 1.
+
+[merge separate USB2 and USB3 port resume checking to one -Mathias]
+Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 6 +++---
+ drivers/usb/host/xhci-ring.c | 3 +++
+ drivers/usb/host/xhci.h | 1 +
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1123,10 +1123,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (hcd->self.root_hub->do_remote_wakeup) {
+- if (bus_state->resuming_ports) {
++ if (bus_state->resuming_ports || /* USB2 */
++ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because "
+- "a port is resuming\n");
++ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ return -EBUSY;
+ }
+ }
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xh
+ usb_hcd_resume_root_hub(hcd);
+ }
+
++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0 (0x0 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
++#define XDEV_INACTIVE (0x6 << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
--- /dev/null
+From 243292a2ad3dc365849b820a64868927168894ac Mon Sep 17 00:00:00 2001
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Date: Tue, 21 Jul 2015 17:20:29 +0300
+Subject: xhci: report U3 when link is in resume state
+
+From: Zhuang Jin Can <jin.can.zhuang@intel.com>
+
+commit 243292a2ad3dc365849b820a64868927168894ac upstream.
+
+xhci_hub_report_usb3_link_state() returns pls as U0 when the link
+is in resume state, and this causes usb core to think the link is in
+U0 while actually it's in resume state. When usb core transfers
+control request on the link, it fails with TRB error as the link
+is not ready for transfer.
+
+To fix the issue, report U3 when the link is in resume state, thus
+usb core knows the link it's not ready for transfer.
+
+Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_st
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
projects / thirdparty / kernel / stable-queue.git / commitdiff
