--- /dev/null
+From 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 Mon Sep 17 00:00:00 2001
+From: John Lin <john.lin@realtek.com>
+Date: Tue, 11 Aug 2015 14:27:25 +0800
+Subject: ASoC: rt5640: fix line out no sound issue
+
+From: John Lin <john.lin@realtek.com>
+
+commit 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 upstream.
+
+The power for line out was not turned on when line out is enabled.
+So we add "LOUT amp" widget to turn on the power for line out.
+
+Signed-off-by: John Lin <john.lin@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5640.c | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -984,6 +984,35 @@ static int rt5640_hp_event(struct snd_so
+ return 0;
+ }
+
++static int rt5640_lout_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
++
++ switch (event) {
++ case SND_SOC_DAPM_POST_PMU:
++ hp_amp_power_on(codec);
++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1,
++ RT5640_PWR_LM, RT5640_PWR_LM);
++ snd_soc_update_bits(codec, RT5640_OUTPUT,
++ RT5640_L_MUTE | RT5640_R_MUTE, 0);
++ break;
++
++ case SND_SOC_DAPM_PRE_PMD:
++ snd_soc_update_bits(codec, RT5640_OUTPUT,
++ RT5640_L_MUTE | RT5640_R_MUTE,
++ RT5640_L_MUTE | RT5640_R_MUTE);
++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1,
++ RT5640_PWR_LM, 0);
++ break;
++
++ default:
++ return 0;
++ }
++
++ return 0;
++}
++
+ static int rt5640_hp_power_event(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1179,13 +1208,16 @@ static const struct snd_soc_dapm_widget
+ 0, rt5640_spo_l_mix, ARRAY_SIZE(rt5640_spo_l_mix)),
+ SND_SOC_DAPM_MIXER("SPOR MIX", SND_SOC_NOPM, 0,
+ 0, rt5640_spo_r_mix, ARRAY_SIZE(rt5640_spo_r_mix)),
+- SND_SOC_DAPM_MIXER("LOUT MIX", RT5640_PWR_ANLG1, RT5640_PWR_LM_BIT, 0,
++ SND_SOC_DAPM_MIXER("LOUT MIX", SND_SOC_NOPM, 0, 0,
+ rt5640_lout_mix, ARRAY_SIZE(rt5640_lout_mix)),
+ SND_SOC_DAPM_SUPPLY_S("Improve HP Amp Drv", 1, SND_SOC_NOPM,
+ 0, 0, rt5640_hp_power_event, SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_PGA_S("HP Amp", 1, SND_SOC_NOPM, 0, 0,
+ rt5640_hp_event,
+ SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
++ SND_SOC_DAPM_PGA_S("LOUT amp", 1, SND_SOC_NOPM, 0, 0,
++ rt5640_lout_event,
++ SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("HP L Amp", RT5640_PWR_ANLG1,
+ RT5640_PWR_HP_L_BIT, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("HP R Amp", RT5640_PWR_ANLG1,
+@@ -1500,8 +1532,10 @@ static const struct snd_soc_dapm_route r
+ {"HP R Playback", "Switch", "HP Amp"},
+ {"HPOL", NULL, "HP L Playback"},
+ {"HPOR", NULL, "HP R Playback"},
+- {"LOUTL", NULL, "LOUT MIX"},
+- {"LOUTR", NULL, "LOUT MIX"},
++
++ {"LOUT amp", NULL, "LOUT MIX"},
++ {"LOUTL", NULL, "LOUT amp"},
++ {"LOUTR", NULL, "LOUT amp"},
+ };
+
+ static const struct snd_soc_dapm_route rt5640_specific_dapm_routes[] = {
--- /dev/null
+From c1713485f9fc06e1f4de9800b43f6486f2527379 Mon Sep 17 00:00:00 2001
+From: Oder Chiou <oder_chiou@realtek.com>
+Date: Tue, 25 Aug 2015 16:03:48 +0800
+Subject: ASoC: rt5645: Add struct dmi_system_id "Google Celes" for chrome platform
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+commit c1713485f9fc06e1f4de9800b43f6486f2527379 upstream.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5645.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3232,6 +3232,13 @@ static struct dmi_system_id dmi_platform
+ DMI_MATCH(DMI_PRODUCT_NAME, "Strago"),
+ },
+ },
++ {
++ .ident = "Google Celes",
++ .callback = strago_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From 14a500fe1396934c6b3ed8f009459a4723da7862 Mon Sep 17 00:00:00 2001
+From: Vaishali Thakkar <vthakkar1994@gmail.com>
+Date: Thu, 20 Aug 2015 22:11:15 +0530
+Subject: ASoC: samsung: Remove redundant arndale_audio_remove
+
+From: Vaishali Thakkar <vthakkar1994@gmail.com>
+
+commit 14a500fe1396934c6b3ed8f009459a4723da7862 upstream.
+
+There is no use of snd_soc_unregister_card in remove function
+as devm_snd_soc_register_card in probe function automatically
+handles it. So, remove use of snd_soc_unregister_card and with
+this change remove arndale_audio_remove as it is now redundant.
+
+Signed-off-by: Vaishali Thakkar <vthakkar1994@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/samsung/arndale_rt5631.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/sound/soc/samsung/arndale_rt5631.c
++++ b/sound/soc/samsung/arndale_rt5631.c
+@@ -116,15 +116,6 @@ static int arndale_audio_probe(struct pl
+ return ret;
+ }
+
+-static int arndale_audio_remove(struct platform_device *pdev)
+-{
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+-
+- snd_soc_unregister_card(card);
+-
+- return 0;
+-}
+-
+ static const struct of_device_id samsung_arndale_rt5631_of_match[] __maybe_unused = {
+ { .compatible = "samsung,arndale-rt5631", },
+ { .compatible = "samsung,arndale-alc5631", },
+@@ -139,7 +130,6 @@ static struct platform_driver arndale_au
+ .of_match_table = of_match_ptr(samsung_arndale_rt5631_of_match),
+ },
+ .probe = arndale_audio_probe,
+- .remove = arndale_audio_remove,
+ };
+
+ module_platform_driver(arndale_audio_driver);
--- /dev/null
+From f811a38300be3cdb603171aea5ad3fb42b71ca53 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 31 Jul 2015 16:36:30 +0800
+Subject: doc: usb: gadget-testing: using the updated testusb.c
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit f811a38300be3cdb603171aea5ad3fb42b71ca53 upstream.
+
+testusb.c at http://www.linux-usb.org/usbtest/ is out of date,
+using the one at the kernel source folder.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/usb/gadget-testing.txt | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/Documentation/usb/gadget-testing.txt
++++ b/Documentation/usb/gadget-testing.txt
+@@ -237,9 +237,7 @@ Testing the LOOPBACK function
+ -----------------------------
+
+ device: run the gadget
+-host: test-usb
+-
+-http://www.linux-usb.org/usbtest/testusb.c
++host: test-usb (tools/usb/testusb.c)
+
+ 8. MASS STORAGE function
+ ========================
+@@ -586,9 +584,8 @@ Testing the SOURCESINK function
+ -------------------------------
+
+ device: run the gadget
+-host: test-usb
++host: test-usb (tools/usb/testusb.c)
+
+-http://www.linux-usb.org/usbtest/testusb.c
+
+ 16. UAC1 function
+ =================
--- /dev/null
+From 2f123bce18943fff819bc10f8868ffb9149fc622 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Wed, 19 Aug 2015 10:33:58 +1000
+Subject: libxfs: readahead of dir3 data blocks should use the read verifier
+
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+
+commit 2f123bce18943fff819bc10f8868ffb9149fc622 upstream.
+
+In the dir3 data block readahead function, use the regular read
+verifier to check the block's CRC and spot-check the block contents
+instead of directly calling only the spot-checking routine. This
+prevents corrupted directory data blocks from being read into the
+kernel, which can lead to garbage ls output and directory loops (if
+say one of the entries contains slashes and other junk).
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/libxfs/xfs_dir2_data.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/libxfs/xfs_dir2_data.c
++++ b/fs/xfs/libxfs/xfs_dir2_data.c
+@@ -252,7 +252,8 @@ xfs_dir3_data_reada_verify(
+ return;
+ case cpu_to_be32(XFS_DIR2_DATA_MAGIC):
+ case cpu_to_be32(XFS_DIR3_DATA_MAGIC):
+- xfs_dir3_data_verify(bp);
++ bp->b_ops = &xfs_dir3_data_buf_ops;
++ bp->b_ops->verify_read(bp);
+ return;
+ default:
+ xfs_buf_ioerror(bp, -EFSCORRUPTED);
pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch
serial-8250_uniphier-call-clk_disable_unprepare-on-failure-path.patch
tty-serial-8250_omap-do-not-use-rx-dma-if-pause-is-not-supported.patch
+spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch
+spi-fix-regression-in-spi-bitbang-txrx.h.patch
+spi-orion-on-a38x-implement-50mhz-spi-ac-timing-erratum-no.-fe-9144572.patch
+spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch
+spi-img-spfi-check-for-timeout-error-before-proceeding.patch
+spi-img-spfi-fix-multiple-calls-to-request-gpio.patch
+spi-img-spfi-fix-kbuild-test-robot-warning.patch
+spi-omap2-mcspi-add-runtime-pm-to-set_cs.patch
+spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch
+usb-symbolserial-use-usb_get_serial_port_data.patch
+usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch
+usb-ftdi_sio-added-custom-pid-for-customware-products.patch
+usb-pl2303-fix-baud-rate-divisor-calculations.patch
+libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch
+xfs-fix-xfs_attr_leafblock-definition.patch
+xfs-fix-file-type-directory-corruption-for-btree-directories.patch
+xfs-return-errors-from-partial-i-o-failures-to-files.patch
+usb-gadget-m66592-udc-forever-loop-in-set_feature.patch
+doc-usb-gadget-testing-using-the-updated-testusb.c.patch
+usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch
+usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch
+usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch
+tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch
+asoc-rt5640-fix-line-out-no-sound-issue.patch
+asoc-rt5645-add-struct-dmi_system_id-google-celes-for-chrome-platform.patch
+asoc-samsung-remove-redundant-arndale_audio_remove.patch
--- /dev/null
+From acace73df2c1913a526c1b41e4741a4a6704c863 Mon Sep 17 00:00:00 2001
+From: Martin Sperl <kernel@martin.sperl.org>
+Date: Tue, 28 Jul 2015 14:03:12 +0000
+Subject: spi: bcm2835: set up spi-mode before asserting cs-gpio
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+commit acace73df2c1913a526c1b41e4741a4a6704c863 upstream.
+
+When using reverse polarity for clock (spi-cpol) on a device
+the clock line gets altered after chip-select has been asserted
+resulting in an additional clock beat, which confuses hardware.
+
+This did not show when using native-CS, as the same register
+is used to control cs as well as polarity, so the changes came
+into effect at the same time. Unfortunately this is not true
+with gpio-cs.
+
+To avoid this situation this patch moves the setup of polarity
+(spi-cpol and spi-cpha) outside of the chip-select into
+prepare_message, which is run prior to asserting chip-select.
+
+Also fixes resetting 3-wire mode after use of rx-mode, so that
+a 3-Wire sequence TX, RX, TX works as well (right now it runs
+TX, RX, RX instead)
+
+Reported-by: Noralf Tronnes <noralf@tronnes.org>
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm2835.c | 28 +++++++++++++++++++++++-----
+ 1 file changed, 23 insertions(+), 5 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -553,13 +553,11 @@ static int bcm2835_spi_transfer_one(stru
+ spi_used_hz = cdiv ? (clk_hz / cdiv) : (clk_hz / 65536);
+ bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv);
+
+- /* handle all the modes */
++ /* handle all the 3-wire mode */
+ if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf))
+ cs |= BCM2835_SPI_CS_REN;
+- if (spi->mode & SPI_CPOL)
+- cs |= BCM2835_SPI_CS_CPOL;
+- if (spi->mode & SPI_CPHA)
+- cs |= BCM2835_SPI_CS_CPHA;
++ else
++ cs &= ~BCM2835_SPI_CS_REN;
+
+ /* for gpio_cs set dummy CS so that no HW-CS get changed
+ * we can not run this in bcm2835_spi_set_cs, as it does
+@@ -592,6 +590,25 @@ static int bcm2835_spi_transfer_one(stru
+ return bcm2835_spi_transfer_one_irq(master, spi, tfr, cs);
+ }
+
++static int bcm2835_spi_prepare_message(struct spi_master *master,
++ struct spi_message *msg)
++{
++ struct spi_device *spi = msg->spi;
++ struct bcm2835_spi *bs = spi_master_get_devdata(master);
++ u32 cs = bcm2835_rd(bs, BCM2835_SPI_CS);
++
++ cs &= ~(BCM2835_SPI_CS_CPOL | BCM2835_SPI_CS_CPHA);
++
++ if (spi->mode & SPI_CPOL)
++ cs |= BCM2835_SPI_CS_CPOL;
++ if (spi->mode & SPI_CPHA)
++ cs |= BCM2835_SPI_CS_CPHA;
++
++ bcm2835_wr(bs, BCM2835_SPI_CS, cs);
++
++ return 0;
++}
++
+ static void bcm2835_spi_handle_err(struct spi_master *master,
+ struct spi_message *msg)
+ {
+@@ -739,6 +756,7 @@ static int bcm2835_spi_probe(struct plat
+ master->set_cs = bcm2835_spi_set_cs;
+ master->transfer_one = bcm2835_spi_transfer_one;
+ master->handle_err = bcm2835_spi_handle_err;
++ master->prepare_message = bcm2835_spi_prepare_message;
+ master->dev.of_node = pdev->dev.of_node;
+
+ bs = spi_master_get_devdata(master);
--- /dev/null
+From c4fe57f76269dbb2af135071513f260ca40229a3 Mon Sep 17 00:00:00 2001
+From: Michael van der Westhuizen <michael@smart-africa.com>
+Date: Tue, 18 Aug 2015 22:21:53 +0200
+Subject: spi: dw: Allow interface drivers to limit data I/O to word sizes
+
+From: Michael van der Westhuizen <michael@smart-africa.com>
+
+commit c4fe57f76269dbb2af135071513f260ca40229a3 upstream.
+
+The commit dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit
+accesses") changed all 16bit accesses in the DW_apb_ssi driver to 32bit.
+This, unfortunately, breaks data register access on picoXcell, where the
+DW IP needs data register accesses to be word accesses (all other
+accesses appear to be OK).
+
+This change introduces a new master variable to allow interface drivers
+to specify that 16bit data transfer I/O is required. This change also
+introduces the ability to set this variable via device tree bindings in
+the MMIO interface driver. Both the core and the MMIO interface driver
+default to the current 32bit behaviour.
+
+Before this change, on a picoXcell pc3x3:
+ spi_master spi32766: interrupt_transfer: fifo overrun/underrun
+ m25p80 spi32766.0: error -5 reading 9f
+ m25p80: probe of spi32766.0 failed with error -5
+
+After this change:
+ m25p80 spi32766.0: m25p40 (512 Kbytes)
+
+Fixes: dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit accesses")
+Signed-off-by: Michael van der Westhuizen <michael@smart-africa.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-dw-mmio.c | 3 +++
+ drivers/spi/spi-dw.c | 4 ++--
+ drivers/spi/spi-dw.h | 35 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 40 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-dw-mmio.c
++++ b/drivers/spi/spi-dw-mmio.c
+@@ -74,6 +74,9 @@ static int dw_spi_mmio_probe(struct plat
+
+ dws->max_freq = clk_get_rate(dwsmmio->clk);
+
++ of_property_read_u32(pdev->dev.of_node, "reg-io-width",
++ &dws->reg_io_width);
++
+ num_cs = 4;
+
+ if (pdev->dev.of_node)
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -194,7 +194,7 @@ static void dw_writer(struct dw_spi *dws
+ else
+ txw = *(u16 *)(dws->tx);
+ }
+- dw_writel(dws, DW_SPI_DR, txw);
++ dw_write_io_reg(dws, DW_SPI_DR, txw);
+ dws->tx += dws->n_bytes;
+ }
+ }
+@@ -205,7 +205,7 @@ static void dw_reader(struct dw_spi *dws
+ u16 rxw;
+
+ while (max--) {
+- rxw = dw_readl(dws, DW_SPI_DR);
++ rxw = dw_read_io_reg(dws, DW_SPI_DR);
+ /* Care rx only if the transfer's original "rx" is not null */
+ if (dws->rx_end - dws->len) {
+ if (dws->n_bytes == 1)
+--- a/drivers/spi/spi-dw.h
++++ b/drivers/spi/spi-dw.h
+@@ -109,6 +109,7 @@ struct dw_spi {
+ u32 fifo_len; /* depth of the FIFO buffer */
+ u32 max_freq; /* max bus freq supported */
+
++ u32 reg_io_width; /* DR I/O width in bytes */
+ u16 bus_num;
+ u16 num_cs; /* supported slave numbers */
+
+@@ -145,11 +146,45 @@ static inline u32 dw_readl(struct dw_spi
+ return __raw_readl(dws->regs + offset);
+ }
+
++static inline u16 dw_readw(struct dw_spi *dws, u32 offset)
++{
++ return __raw_readw(dws->regs + offset);
++}
++
+ static inline void dw_writel(struct dw_spi *dws, u32 offset, u32 val)
+ {
+ __raw_writel(val, dws->regs + offset);
+ }
+
++static inline void dw_writew(struct dw_spi *dws, u32 offset, u16 val)
++{
++ __raw_writew(val, dws->regs + offset);
++}
++
++static inline u32 dw_read_io_reg(struct dw_spi *dws, u32 offset)
++{
++ switch (dws->reg_io_width) {
++ case 2:
++ return dw_readw(dws, offset);
++ case 4:
++ default:
++ return dw_readl(dws, offset);
++ }
++}
++
++static inline void dw_write_io_reg(struct dw_spi *dws, u32 offset, u32 val)
++{
++ switch (dws->reg_io_width) {
++ case 2:
++ dw_writew(dws, offset, val);
++ break;
++ case 4:
++ default:
++ dw_writel(dws, offset, val);
++ break;
++ }
++}
++
+ static inline void spi_enable_chip(struct dw_spi *dws, int enable)
+ {
+ dw_writel(dws, DW_SPI_SSIENR, (enable ? 1 : 0));
--- /dev/null
+From 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 Mon Sep 17 00:00:00 2001
+From: Lars Persson <lars.persson@axis.com>
+Date: Wed, 29 Jul 2015 09:32:02 +0200
+Subject: spi: Fix regression in spi-bitbang-txrx.h
+
+From: Lars Persson <lars.persson@axis.com>
+
+commit 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 upstream.
+
+This patch fixes a regression introduced by commit 232a5adc5199 ("spi:
+bitbang: only toggle bitchanges"). The attempt to optimize writes of
+consecutive bit patterns broke most of the combinations of word size
+and SPI modes due to selecting the wrong bit as the MSB value.
+
+Fixes: 232a5adc5199 (spi: bitbang: only toggle bitchanges)
+Signed-off-by: Lars Persson <larper@axis.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bitbang-txrx.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-bitbang-txrx.h
++++ b/drivers/spi/spi-bitbang-txrx.h
+@@ -49,7 +49,7 @@ bitbang_txrx_be_cpha0(struct spi_device
+ {
+ /* if (cpol == 0) this is SPI_MODE_0; else this is SPI_MODE_2 */
+
+- bool oldbit = !(word & 1);
++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31;
+ /* clock starts at inactive polarity */
+ for (word <<= (32 - bits); likely(bits); bits--) {
+
+@@ -81,7 +81,7 @@ bitbang_txrx_be_cpha1(struct spi_device
+ {
+ /* if (cpol == 0) this is SPI_MODE_1; else this is SPI_MODE_3 */
+
+- bool oldbit = !(word & (1 << 31));
++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31;
+ /* clock starts at inactive polarity */
+ for (word <<= (32 - bits); likely(bits); bits--) {
+
--- /dev/null
+From 011710e2ab659c7ad6e5e554806414bd7a9508be Mon Sep 17 00:00:00 2001
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+Date: Mon, 27 Jul 2015 13:11:15 +0100
+Subject: spi: img-spfi: check for timeout error before proceeding
+
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+
+commit 011710e2ab659c7ad6e5e554806414bd7a9508be upstream.
+
+Calling spfi_wait_all_done is not required if the transfer has timed
+out before all data is transferred.
+
+spfi_wait_all_done polls for Alldone interrupt which is triggered to
+mark the transfer as complete and to indicate it is now safe to issue
+a new transfer.
+
+Fixes: 8c2c8c0 ("spi: img-spfi: Control CS lines with GPIO")
+Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Reviewed-by: Andrew Bresticker <abrestic@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-img-spfi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -267,15 +267,15 @@ static int img_spfi_start_pio(struct spi
+ cpu_relax();
+ }
+
+- ret = spfi_wait_all_done(spfi);
+- if (ret < 0)
+- return ret;
+-
+ if (rx_bytes > 0 || tx_bytes > 0) {
+ dev_err(spfi->dev, "PIO transfer timed out\n");
+ return -ETIMEDOUT;
+ }
+
++ ret = spfi_wait_all_done(spfi);
++ if (ret < 0)
++ return ret;
++
+ return 0;
+ }
+
--- /dev/null
+From 9176c6657b5c313cf504d157e6d91496ee5c8708 Mon Sep 17 00:00:00 2001
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+Date: Thu, 6 Aug 2015 10:33:01 +0100
+Subject: spi: img-spfi: fix kbuild test robot warning
+
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+
+commit 9176c6657b5c313cf504d157e6d91496ee5c8708 upstream.
+
+drivers/spi/spi-img-spfi.c: In function 'img_spfi_setup':
+drivers/spi/spi-img-spfi.c:446: warning: 'ret' may be used
+uninitialized in this function.
+
+Fixes: commit b03ba9e314c1 ("spi: img-spfi: fix multiple calls to request gpio")
+Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-img-spfi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -444,7 +444,7 @@ static int img_spfi_unprepare(struct spi
+
+ static int img_spfi_setup(struct spi_device *spi)
+ {
+- int ret;
++ int ret = -EINVAL;
+ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi);
+
+ if (!spfi_data) {
--- /dev/null
+From b03ba9e314c12b2127243145b5c1f41b2408de62 Mon Sep 17 00:00:00 2001
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+Date: Wed, 29 Jul 2015 11:55:26 +0100
+Subject: spi: img-spfi: fix multiple calls to request gpio
+
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+
+commit b03ba9e314c12b2127243145b5c1f41b2408de62 upstream.
+
+spfi_setup may be called many times by the spi framework, but
+gpio_request_one can only be called once without freeing, repeatedly
+calling gpio_request_one will cause an error to be thrown, which
+causes the request to spi_setup to be marked as failed.
+
+We can have a per-spi_device flag that indicates whether or not the
+gpio has been requested. If the gpio has already been requested use
+gpio_direction_output to set the direction of the gpio.
+
+Fixes: 8c2c8c03cdcb ("spi: img-spfi: Control CS lines with GPIO")
+Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-img-spfi.c | 47 ++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 40 insertions(+), 7 deletions(-)
+
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -105,6 +105,10 @@ struct img_spfi {
+ bool rx_dma_busy;
+ };
+
++struct img_spfi_device_data {
++ bool gpio_requested;
++};
++
+ static inline u32 spfi_readl(struct img_spfi *spfi, u32 reg)
+ {
+ return readl(spfi->regs + reg);
+@@ -441,20 +445,49 @@ static int img_spfi_unprepare(struct spi
+ static int img_spfi_setup(struct spi_device *spi)
+ {
+ int ret;
++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi);
+
+- ret = gpio_request_one(spi->cs_gpio, (spi->mode & SPI_CS_HIGH) ?
+- GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH,
+- dev_name(&spi->dev));
+- if (ret)
+- dev_err(&spi->dev, "can't request chipselect gpio %d\n",
++ if (!spfi_data) {
++ spfi_data = kzalloc(sizeof(*spfi_data), GFP_KERNEL);
++ if (!spfi_data)
++ return -ENOMEM;
++ spfi_data->gpio_requested = false;
++ spi_set_ctldata(spi, spfi_data);
++ }
++ if (!spfi_data->gpio_requested) {
++ ret = gpio_request_one(spi->cs_gpio,
++ (spi->mode & SPI_CS_HIGH) ?
++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH,
++ dev_name(&spi->dev));
++ if (ret)
++ dev_err(&spi->dev, "can't request chipselect gpio %d\n",
+ spi->cs_gpio);
+-
++ else
++ spfi_data->gpio_requested = true;
++ } else {
++ if (gpio_is_valid(spi->cs_gpio)) {
++ int mode = ((spi->mode & SPI_CS_HIGH) ?
++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH);
++
++ ret = gpio_direction_output(spi->cs_gpio, mode);
++ if (ret)
++ dev_err(&spi->dev, "chipselect gpio %d setup failed (%d)\n",
++ spi->cs_gpio, ret);
++ }
++ }
+ return ret;
+ }
+
+ static void img_spfi_cleanup(struct spi_device *spi)
+ {
+- gpio_free(spi->cs_gpio);
++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi);
++
++ if (spfi_data) {
++ if (spfi_data->gpio_requested)
++ gpio_free(spi->cs_gpio);
++ kfree(spfi_data);
++ spi_set_ctldata(spi, NULL);
++ }
+ }
+
+ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
--- /dev/null
+From 5f74db105b1c0980c9863e7a7d1bc0525e0316e8 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sre@kernel.org>
+Date: Wed, 22 Jul 2015 20:46:09 +0200
+Subject: spi: omap2-mcspi: add runtime PM to set_cs()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Reichel <sre@kernel.org>
+
+commit 5f74db105b1c0980c9863e7a7d1bc0525e0316e8 upstream.
+
+Since commit ddcad7e9068eb omap2_mcspi_set_cs() is called without
+runtime power management requested. This patch fixes the problem by
+requesting runtime power management in omap2_mcspi_set_cs().
+
+Reported-By: Pali Rohár <pali.rohar@gmail.com>
+Fixes: ddcad7e9068eb (spi: omap2-mcspi: Fix native cs with new set_cs)
+Tested-By: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Acked-by: Michael Welling <mwelling@ieee.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-omap2-mcspi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -245,6 +245,7 @@ static void omap2_mcspi_set_enable(const
+
+ static void omap2_mcspi_set_cs(struct spi_device *spi, bool enable)
+ {
++ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+ u32 l;
+
+ /* The controller handles the inverted chip selects
+@@ -255,6 +256,12 @@ static void omap2_mcspi_set_cs(struct sp
+ enable = !enable;
+
+ if (spi->controller_state) {
++ int err = pm_runtime_get_sync(mcspi->dev);
++ if (err < 0) {
++ dev_err(mcspi->dev, "failed to get sync: %d\n", err);
++ return;
++ }
++
+ l = mcspi_cached_chconf0(spi);
+
+ if (enable)
+@@ -263,6 +270,9 @@ static void omap2_mcspi_set_cs(struct sp
+ l |= OMAP2_MCSPI_CHCONF_FORCE;
+
+ mcspi_write_chconf0(spi, l);
++
++ pm_runtime_mark_last_busy(mcspi->dev);
++ pm_runtime_put_autosuspend(mcspi->dev);
+ }
+ }
+
--- /dev/null
+From 38d6211e8565af5855385825a4fdc7261eb3740e Mon Sep 17 00:00:00 2001
+From: Nadav Haklai <nadavh@marvell.com>
+Date: Tue, 11 Aug 2015 11:58:47 +0200
+Subject: spi: orion: On a38x, implement "50MHZ SPI AC timing" Erratum No. FE-9144572
+
+From: Nadav Haklai <nadavh@marvell.com>
+
+commit 38d6211e8565af5855385825a4fdc7261eb3740e upstream.
+
+Description:
+On Armada 38x, the device SPI interface supports frequencies of up to
+50 MHz. However, due to this erratum, when the device core clock is
+250 MHz and the SPI interfaces is configured for 50MHz SPI clock and
+CPOL=CPHA=1, there might occur data corruption on reads from the SPI
+device.
+
+Workaround:
+Work in one of the following configurations:
+1. Set CPOL=CPHA=0 in "SPI Interface Configuration Register".
+2. Set TMISO_SAMPLE value to 0x2 in "SPI Timing Parameters 1 Register"
+before setting the interface.
+
+[gregory.clement@free-electrons.com}: port to v4.2-rc, use
+is_errata_50mhz_ac instead of using a new ARMADA_380_SPI spi type.
+
+Signed-off-by: Nadav Haklai <nadavh@marvell.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-orion.c | 54 +++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 53 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-orion.c
++++ b/drivers/spi/spi-orion.c
+@@ -41,6 +41,11 @@
+ #define ORION_SPI_DATA_OUT_REG 0x08
+ #define ORION_SPI_DATA_IN_REG 0x0c
+ #define ORION_SPI_INT_CAUSE_REG 0x10
++#define ORION_SPI_TIMING_PARAMS_REG 0x18
++
++#define ORION_SPI_TMISO_SAMPLE_MASK (0x3 << 6)
++#define ORION_SPI_TMISO_SAMPLE_1 (1 << 6)
++#define ORION_SPI_TMISO_SAMPLE_2 (2 << 6)
+
+ #define ORION_SPI_MODE_CPOL (1 << 11)
+ #define ORION_SPI_MODE_CPHA (1 << 12)
+@@ -70,6 +75,7 @@ struct orion_spi_dev {
+ unsigned int min_divisor;
+ unsigned int max_divisor;
+ u32 prescale_mask;
++ bool is_errata_50mhz_ac;
+ };
+
+ struct orion_spi {
+@@ -195,6 +201,41 @@ orion_spi_mode_set(struct spi_device *sp
+ writel(reg, spi_reg(orion_spi, ORION_SPI_IF_CONFIG_REG));
+ }
+
++static void
++orion_spi_50mhz_ac_timing_erratum(struct spi_device *spi, unsigned int speed)
++{
++ u32 reg;
++ struct orion_spi *orion_spi;
++
++ orion_spi = spi_master_get_devdata(spi->master);
++
++ /*
++ * Erratum description: (Erratum NO. FE-9144572) The device
++ * SPI interface supports frequencies of up to 50 MHz.
++ * However, due to this erratum, when the device core clock is
++ * 250 MHz and the SPI interfaces is configured for 50MHz SPI
++ * clock and CPOL=CPHA=1 there might occur data corruption on
++ * reads from the SPI device.
++ * Erratum Workaround:
++ * Work in one of the following configurations:
++ * 1. Set CPOL=CPHA=0 in "SPI Interface Configuration
++ * Register".
++ * 2. Set TMISO_SAMPLE value to 0x2 in "SPI Timing Parameters 1
++ * Register" before setting the interface.
++ */
++ reg = readl(spi_reg(orion_spi, ORION_SPI_TIMING_PARAMS_REG));
++ reg &= ~ORION_SPI_TMISO_SAMPLE_MASK;
++
++ if (clk_get_rate(orion_spi->clk) == 250000000 &&
++ speed == 50000000 && spi->mode & SPI_CPOL &&
++ spi->mode & SPI_CPHA)
++ reg |= ORION_SPI_TMISO_SAMPLE_2;
++ else
++ reg |= ORION_SPI_TMISO_SAMPLE_1; /* This is the default value */
++
++ writel(reg, spi_reg(orion_spi, ORION_SPI_TIMING_PARAMS_REG));
++}
++
+ /*
+ * called only when no transfer is active on the bus
+ */
+@@ -216,6 +257,9 @@ orion_spi_setup_transfer(struct spi_devi
+
+ orion_spi_mode_set(spi);
+
++ if (orion_spi->devdata->is_errata_50mhz_ac)
++ orion_spi_50mhz_ac_timing_erratum(spi, speed);
++
+ rc = orion_spi_baudrate_set(spi, speed);
+ if (rc)
+ return rc;
+@@ -413,6 +457,14 @@ static const struct orion_spi_dev armada
+ .prescale_mask = ARMADA_SPI_CLK_PRESCALE_MASK,
+ };
+
++static const struct orion_spi_dev armada_380_spi_dev_data = {
++ .typ = ARMADA_SPI,
++ .max_hz = 50000000,
++ .max_divisor = 1920,
++ .prescale_mask = ARMADA_SPI_CLK_PRESCALE_MASK,
++ .is_errata_50mhz_ac = true,
++};
++
+ static const struct of_device_id orion_spi_of_match_table[] = {
+ {
+ .compatible = "marvell,orion-spi",
+@@ -428,7 +480,7 @@ static const struct of_device_id orion_s
+ },
+ {
+ .compatible = "marvell,armada-380-spi",
+- .data = &armada_xp_spi_dev_data,
++ .data = &armada_380_spi_dev_data,
+ },
+ {
+ .compatible = "marvell,armada-390-spi",
--- /dev/null
+From fe78d0b7691c02744004b15f6979b3f106464bc4 Mon Sep 17 00:00:00 2001
+From: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Date: Mon, 15 Jun 2015 02:25:05 +0900
+Subject: spi: sh-msiof: Fix FIFO size to 64 word from 256 word
+
+From: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+
+commit fe78d0b7691c02744004b15f6979b3f106464bc4 upstream.
+
+The upper limit of Tx/Rx FIFO size is 64 word by the
+specification of H/W. This patch corrects to 64 word from 256 word.
+
+Signed-off-by: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-sh-msiof.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -48,8 +48,8 @@ struct sh_msiof_spi_priv {
+ const struct sh_msiof_chipdata *chipdata;
+ struct sh_msiof_spi_info *info;
+ struct completion done;
+- int tx_fifo_size;
+- int rx_fifo_size;
++ unsigned int tx_fifo_size;
++ unsigned int rx_fifo_size;
+ void *tx_dma_page;
+ void *rx_dma_page;
+ dma_addr_t tx_dma_addr;
+@@ -95,8 +95,6 @@ struct sh_msiof_spi_priv {
+ #define MDR2_WDLEN1(i) (((i) - 1) << 16) /* Word Count (1-64/256 (SH, A1))) */
+ #define MDR2_GRPMASK1 0x00000001 /* Group Output Mask 1 (SH, A1) */
+
+-#define MAX_WDLEN 256U
+-
+ /* TSCR and RSCR */
+ #define SCR_BRPS_MASK 0x1f00 /* Prescaler Setting (1-32) */
+ #define SCR_BRPS(i) (((i) - 1) << 8)
+@@ -850,7 +848,12 @@ static int sh_msiof_transfer_one(struct
+ * DMA supports 32-bit words only, hence pack 8-bit and 16-bit
+ * words, with byte resp. word swapping.
+ */
+- unsigned int l = min(len, MAX_WDLEN * 4);
++ unsigned int l = 0;
++
++ if (tx_buf)
++ l = min(len, p->tx_fifo_size * 4);
++ if (rx_buf)
++ l = min(len, p->rx_fifo_size * 4);
+
+ if (bits <= 8) {
+ if (l & 3)
+@@ -963,7 +966,7 @@ static const struct sh_msiof_chipdata sh
+
+ static const struct sh_msiof_chipdata r8a779x_data = {
+ .tx_fifo_size = 64,
+- .rx_fifo_size = 256,
++ .rx_fifo_size = 64,
+ .master_flags = SPI_MASTER_MUST_TX,
+ };
+
--- /dev/null
+From 8117e347406278fd399b077add4e638cd017ae2d Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Thu, 6 Aug 2015 09:16:37 +0200
+Subject: tty: serial: men_z135_uart.c: Fix race between IRQ and set_termios()
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit 8117e347406278fd399b077add4e638cd017ae2d upstream.
+
+Fix panic caused by a race between men_z135_intr() and men_z135_set_termios().
+
+men_z135_intr() and men_z135_set_termios() both hold the struct uart_port::lock
+spinlock, but men_z135_intr() does a spin_lock_irqsave() and
+men_z135_set_termios() does a normal spin_lock(), which can lead to a deadlock
+when an interrupt is called while the lock is being helt by
+men_z135_set_termios().
+
+This was discovered using a insmod, hardware looppback send/receive, rmmod
+stress test.
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
+Cc: Andreas Werner <andreas.werner@men.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/men_z135_uart.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/tty/serial/men_z135_uart.c
++++ b/drivers/tty/serial/men_z135_uart.c
+@@ -392,7 +392,6 @@ static irqreturn_t men_z135_intr(int irq
+ struct men_z135_port *uart = (struct men_z135_port *)data;
+ struct uart_port *port = &uart->port;
+ bool handled = false;
+- unsigned long flags;
+ int irq_id;
+
+ uart->stat_reg = ioread32(port->membase + MEN_Z135_STAT_REG);
+@@ -401,7 +400,7 @@ static irqreturn_t men_z135_intr(int irq
+ if (!irq_id)
+ goto out;
+
+- spin_lock_irqsave(&port->lock, flags);
++ spin_lock(&port->lock);
+ /* It's save to write to IIR[7:6] RXC[9:8] */
+ iowrite8(irq_id, port->membase + MEN_Z135_STAT_REG);
+
+@@ -427,7 +426,7 @@ static irqreturn_t men_z135_intr(int irq
+ handled = true;
+ }
+
+- spin_unlock_irqrestore(&port->lock, flags);
++ spin_unlock(&port->lock);
+ out:
+ return IRQ_RETVAL(handled);
+ }
+@@ -717,7 +716,7 @@ static void men_z135_set_termios(struct
+
+ baud = uart_get_baud_rate(port, termios, old, 0, uart_freq / 16);
+
+- spin_lock(&port->lock);
++ spin_lock_irq(&port->lock);
+ if (tty_termios_baud_rate(termios))
+ tty_termios_encode_baud_rate(termios, baud, baud);
+
+@@ -725,7 +724,7 @@ static void men_z135_set_termios(struct
+ iowrite32(bd_reg, port->membase + MEN_Z135_BAUD_REG);
+
+ uart_update_timeout(port, termios->c_cflag, baud);
+- spin_unlock(&port->lock);
++ spin_unlock_irq(&port->lock);
+ }
+
+ static const char *men_z135_type(struct uart_port *port)
--- /dev/null
+From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 12:25:27 +0530
+Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.
+
+DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
+the size of bounce buffer is 512 bytes. However if the host initiates OUT
+transfers of size more than 512 bytes (and non max packet aligned), the
+driver throws a WARN dump but still programs the TRB to receive more than
+512 bytes. This will cause bounce buffer to overflow and corrupt the
+adjacent memory locations which can be fatal.
+
+Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
+(512) bytes.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -820,6 +820,11 @@ static void dwc3_ep0_complete_data(struc
+ unsigned maxp = ep0->endpoint.maxpacket;
+
+ transfer_size += (maxp - (transfer_size % maxp));
++
++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++
+ transferred = min_t(u32, ur->length,
+ transfer_size - length);
+ memcpy(ur->buf, dwc->ep0_bounce, transferred);
+@@ -941,11 +946,14 @@ static void __dwc3_ep0_do_control_data(s
+ return;
+ }
+
+- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
+-
+ maxpacket = dep->endpoint.maxpacket;
+ transfer_size = roundup(req->request.length, maxpacket);
+
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++ }
++
+ dwc->ep0_bounced = true;
+
+ /*
--- /dev/null
+From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001
+From: Matthijs Kooijman <matthijs@stdin.nl>
+Date: Tue, 18 Aug 2015 10:33:56 +0200
+Subject: USB: ftdi_sio: Added custom PID for CustomWare products
+
+From: Matthijs Kooijman <matthijs@stdin.nl>
+
+commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream.
+
+CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex
+products.
+
+Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 ++++
+ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -605,6 +605,10 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
+ /*
+ * ELV devices:
+ */
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -568,6 +568,14 @@
+ */
+ #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
++/*
++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
++ */
++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */
++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */
++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */
++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
--- /dev/null
+From 913e4a90b6f9687ac0f543e7b632753e4f51c441 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Thu, 30 Jul 2015 13:13:03 +0800
+Subject: usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 913e4a90b6f9687ac0f543e7b632753e4f51c441 upstream.
+
+According to USB Audio Device 2.0 Spec, Ch4.10.1.1:
+wMaxPacketSize is defined as follows:
+Maximum packet size this endpoint is capable of sending or receiving
+when this configuration is selected.
+This is determined by the audio bandwidth constraints of the endpoint.
+
+In current code, the wMaxPacketSize is defined as the maximum packet size
+for ISO endpoint, and it will let the host reserve much more space than
+it really needs, so that we can't let more endpoints work together at
+one frame.
+
+We find this issue when we try to let 4 f_uac2 gadgets work together [1]
+at FS connection.
+
+[1]http://www.spinics.net/lists/linux-usb/msg123478.html
+
+Acked-by: Daniel Mack <zonque@gmail.com>
+Cc: andrzej.p@samsung.com
+Cc: Daniel Mack <zonque@gmail.com>
+Cc: tiwai@suse.de
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_uac2.c | 31 +++++++++++++++++++++++++++++--
+ 1 file changed, 29 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -975,6 +975,29 @@ free_ep(struct uac2_rtd_params *prm, str
+ "%s:%d Error!\n", __func__, __LINE__);
+ }
+
++static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
++ struct usb_endpoint_descriptor *ep_desc,
++ unsigned int factor, bool is_playback)
++{
++ int chmask, srate, ssize;
++ u16 max_packet_size;
++
++ if (is_playback) {
++ chmask = uac2_opts->p_chmask;
++ srate = uac2_opts->p_srate;
++ ssize = uac2_opts->p_ssize;
++ } else {
++ chmask = uac2_opts->c_chmask;
++ srate = uac2_opts->c_srate;
++ ssize = uac2_opts->c_ssize;
++ }
++
++ max_packet_size = num_channels(chmask) * ssize *
++ DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
++ ep_desc->wMaxPacketSize = cpu_to_le16(min(max_packet_size,
++ le16_to_cpu(ep_desc->wMaxPacketSize)));
++}
++
+ static int
+ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
+ {
+@@ -1070,10 +1093,14 @@ afunc_bind(struct usb_configuration *cfg
+ uac2->p_prm.uac2 = uac2;
+ uac2->c_prm.uac2 = uac2;
+
++ /* Calculate wMaxPacketSize according to audio bandwidth */
++ set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true);
++ set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false);
++ set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true);
++ set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false);
++
+ hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress;
+- hs_epout_desc.wMaxPacketSize = fs_epout_desc.wMaxPacketSize;
+ hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress;
+- hs_epin_desc.wMaxPacketSize = fs_epin_desc.wMaxPacketSize;
+
+ ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL);
+ if (ret)
--- /dev/null
+From 5feb5d2003499b1094d898c010a7604d7afddc4c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 30 Jul 2015 00:30:58 +0300
+Subject: usb: gadget: m66592-udc: forever loop in set_feature()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 5feb5d2003499b1094d898c010a7604d7afddc4c upstream.
+
+There is an "&&" vs "||" typo here so this loops 3000 times or if we get
+unlucky it could loop forever.
+
+Fixes: ceaa0a6eeadf ('usb: gadget: m66592-udc: add support for TEST_MODE')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/m66592-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/m66592-udc.c
++++ b/drivers/usb/gadget/udc/m66592-udc.c
+@@ -1052,7 +1052,7 @@ static void set_feature(struct m66592 *m
+ tmp = m66592_read(m66592, M66592_INTSTS0) &
+ M66592_CTSQ;
+ udelay(1);
+- } while (tmp != M66592_CS_IDST || timeout-- > 0);
++ } while (tmp != M66592_CS_IDST && timeout-- > 0);
+
+ if (tmp == M66592_CS_IDST)
+ m66592_bset(m66592,
--- /dev/null
+From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Mon, 17 Aug 2015 10:23:03 +0800
+Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream.
+
+The ehci platform device's drvdata is the pointer of struct usb_hcd
+already, so we doesn't need to call bus_to_hcd conversion again.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-sysfs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sysfs.c
++++ b/drivers/usb/host/ehci-sysfs.c
+@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev
+ int count = PAGE_SIZE;
+ char *ptr = buf;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ nports = HCS_N_PORTS(ehci->hcs_params);
+
+ for (index = 0; index < nports; ++index) {
+@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de
+ struct ehci_hcd *ehci;
+ int portnum, new_owner;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ new_owner = PORT_OWNER; /* Owned by companion */
+ if (sscanf(buf, "%d", &portnum) != 1)
+ return -EINVAL;
+@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(
+ struct ehci_hcd *ehci;
+ int n;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
+ return n;
+ }
+@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max
+ unsigned long flags;
+ ssize_t ret;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+ return -EINVAL;
+
--- /dev/null
+From 49bda21266fdf195142e8b5dea057f09e96ada9f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Pecio?= <michal.pecio@gmail.com>
+Date: Sun, 26 Jul 2015 11:14:34 +0200
+Subject: USB: pl2303: fix baud-rate divisor calculations
+
+From: =?UTF-8?q?Micha=C5=82=20Pecio?= <michal.pecio@gmail.com>
+
+commit 49bda21266fdf195142e8b5dea057f09e96ada9f upstream.
+
+This commit fixes the following issues:
+
+1. The 9th bit of buf was believed to be the LSB of divisor's
+exponent, but the hardware interprets it as MSB (9th bit) of the
+mantissa. The exponent is actually one bit shorter and applies
+to base 4, not 2 as previously believed.
+
+2. Loop iterations doubled the exponent instead of incrementing.
+
+3. The exponent wasn't checked for overflow.
+
+4. The function returned requested rate instead of actual rate.
+
+Due to issue #2, the old code deviated from the wrong formula
+described in #1 and actually yielded correct rates when divisor
+was lower than 4096 by using exponents of 0, 2 or 4 base-2,
+interpreted as 0, 1, 2 base-4 with the 9th mantissa bit clear.
+However, at 93.75 kbaud or less the rate turned out too slow
+due to #2 or too fast due to #2 and #3.
+
+I tested this patch by sending and validating 0x00,0x01,..,0xff
+to an FTDI dongle at 234, 987, 2401, 9601, 31415, 115199, 250k,
+500k, 750k, 1M, 1.5M, 3M+1 baud. All rates passed.
+
+I also used pv to check speed at some rates unsupported by FTDI:
+45 (the lowest possible), 2M, 4M, 5M and 6M-1. Looked sane.
+
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Fixes: 399aa9a75ad3 ("USB: pl2303: use divisors for unsupported baud
+rates")
+[johan: update summary ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -362,21 +362,38 @@ static speed_t pl2303_encode_baud_rate_d
+ static speed_t pl2303_encode_baud_rate_divisor(unsigned char buf[4],
+ speed_t baud)
+ {
+- unsigned int tmp;
++ unsigned int baseline, mantissa, exponent;
+
+ /*
+ * Apparently the formula is:
+- * baudrate = 12M * 32 / (2^buf[1]) / buf[0]
++ * baudrate = 12M * 32 / (mantissa * 4^exponent)
++ * where
++ * mantissa = buf[8:0]
++ * exponent = buf[11:9]
+ */
+- tmp = 12000000 * 32 / baud;
++ baseline = 12000000 * 32;
++ mantissa = baseline / baud;
++ if (mantissa == 0)
++ mantissa = 1; /* Avoid dividing by zero if baud > 32*12M. */
++ exponent = 0;
++ while (mantissa >= 512) {
++ if (exponent < 7) {
++ mantissa >>= 2; /* divide by 4 */
++ exponent++;
++ } else {
++ /* Exponent is maxed. Trim mantissa and leave. */
++ mantissa = 511;
++ break;
++ }
++ }
++
+ buf[3] = 0x80;
+ buf[2] = 0;
+- buf[1] = (tmp >= 256);
+- while (tmp >= 256) {
+- tmp >>= 2;
+- buf[1] <<= 1;
+- }
+- buf[0] = tmp;
++ buf[1] = exponent << 1 | mantissa >> 8;
++ buf[0] = mantissa & 0xff;
++
++ /* Calculate and return the exact baud rate. */
++ baud = (baseline / mantissa) >> (exponent << 1);
+
+ return baud;
+ }
--- /dev/null
+From 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 Mon Sep 17 00:00:00 2001
+From: David Ward <david.ward@ll.mit.edu>
+Date: Tue, 18 Aug 2015 10:36:23 +0200
+Subject: USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module
+
+From: David Ward <david.ward@ll.mit.edu>
+
+commit 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 upstream.
+
+This is an HP-branded Sierra Wireless EM7355:
+https://bugzilla.redhat.com/show_bug.cgi?id=1223646#c2
+
+Signed-off-by: David Ward <david.ward@ll.mit.edu>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/qcserial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -139,6 +139,7 @@ static const struct usb_device_id id_tab
+ {USB_DEVICE(0x0AF0, 0x8120)}, /* Option GTM681W */
+
+ /* non-Gobi Sierra Wireless devices */
++ {DEVICE_SWI(0x03f0, 0x4e1d)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
+ {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */
+ {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */
+ {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
--- /dev/null
+From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001
+From: Philipp Hachtmann <hachti@hachti.de>
+Date: Mon, 17 Aug 2015 17:31:46 +0200
+Subject: USB: symbolserial: Use usb_get_serial_port_data
+
+From: Philipp Hachtmann <hachti@hachti.de>
+
+commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream.
+
+The driver used usb_get_serial_data(port->serial) which compiled but resulted
+in a NULL pointer being returned (and subsequently used). I did not go deeper
+into this but I guess this is a regression.
+
+Signed-off-by: Philipp Hachtmann <hachti@hachti.de>
+Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to
+port_probe")
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/symbolserial.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -94,7 +94,7 @@ exit:
+
+ static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+ int result = 0;
+
+@@ -120,7 +120,7 @@ static void symbol_close(struct usb_seri
+ static void symbol_throttle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+
+ spin_lock_irq(&priv->lock);
+ priv->throttled = true;
+@@ -130,7 +130,7 @@ static void symbol_throttle(struct tty_s
+ static void symbol_unthrottle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ int result;
+ bool was_throttled;
+
--- /dev/null
+From 037542345a82aaaa228ec280fe6ddff1568d169f Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Tue, 25 Aug 2015 10:05:13 +1000
+Subject: xfs: Fix file type directory corruption for btree directories
+
+From: Jan Kara <jack@suse.com>
+
+commit 037542345a82aaaa228ec280fe6ddff1568d169f upstream.
+
+Users have occasionally reported that file type for some directory
+entries is wrong. This mostly happened after updating libraries some
+libraries. After some debugging the problem was traced down to
+xfs_dir2_node_replace(). The function uses args->filetype as a file type
+to store in the replaced directory entry however it also calls
+xfs_da3_node_lookup_int() which will store file type of the current
+directory entry in args->filetype. Thus we fail to change file type of a
+directory entry to a proper type.
+
+Fix the problem by storing new file type in a local variable before
+calling xfs_da3_node_lookup_int().
+
+Reported-by: Giacomo Comes <comes@naic.edu>
+Signed-off-by: Jan Kara <jack@suse.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/libxfs/xfs_dir2_node.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/libxfs/xfs_dir2_node.c
++++ b/fs/xfs/libxfs/xfs_dir2_node.c
+@@ -2132,6 +2132,7 @@ xfs_dir2_node_replace(
+ int error; /* error return value */
+ int i; /* btree level */
+ xfs_ino_t inum; /* new inode number */
++ int ftype; /* new file type */
+ xfs_dir2_leaf_t *leaf; /* leaf structure */
+ xfs_dir2_leaf_entry_t *lep; /* leaf entry being changed */
+ int rval; /* internal return value */
+@@ -2145,7 +2146,14 @@ xfs_dir2_node_replace(
+ state = xfs_da_state_alloc();
+ state->args = args;
+ state->mp = args->dp->i_mount;
++
++ /*
++ * We have to save new inode number and ftype since
++ * xfs_da3_node_lookup_int() is going to overwrite them
++ */
+ inum = args->inumber;
++ ftype = args->filetype;
++
+ /*
+ * Lookup the entry to change in the btree.
+ */
+@@ -2183,7 +2191,7 @@ xfs_dir2_node_replace(
+ * Fill in the new inode number and log the entry.
+ */
+ dep->inumber = cpu_to_be64(inum);
+- args->dp->d_ops->data_put_ftype(dep, args->filetype);
++ args->dp->d_ops->data_put_ftype(dep, ftype);
+ xfs_dir2_data_log_entry(args, state->extrablk.bp, dep);
+ rval = 0;
+ }
--- /dev/null
+From ffeecc5213024ae663377b442eedcfbacf6d0c5d Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Wed, 19 Aug 2015 10:34:32 +1000
+Subject: xfs: Fix xfs_attr_leafblock definition
+
+From: Jan Kara <jack@suse.com>
+
+commit ffeecc5213024ae663377b442eedcfbacf6d0c5d upstream.
+
+struct xfs_attr_leafblock contains 'entries' array which is declared
+with size 1 altough it can in fact contain much more entries. Since this
+array is followed by further struct members, gcc (at least in version
+4.8.3) thinks that the array has the fixed size of 1 element and thus
+may optimize away all accesses beyond the end of array resulting in
+non-working code. This problem was only observed with userspace code in
+xfsprogs, however it's better to be safe in kernel as well and have
+matching kernel and xfsprogs definitions.
+
+Signed-off-by: Jan Kara <jack@suse.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/libxfs/xfs_da_format.h | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/fs/xfs/libxfs/xfs_da_format.h
++++ b/fs/xfs/libxfs/xfs_da_format.h
+@@ -680,8 +680,15 @@ typedef struct xfs_attr_leaf_name_remote
+ typedef struct xfs_attr_leafblock {
+ xfs_attr_leaf_hdr_t hdr; /* constant-structure header block */
+ xfs_attr_leaf_entry_t entries[1]; /* sorted on key, not name */
+- xfs_attr_leaf_name_local_t namelist; /* grows from bottom of buf */
+- xfs_attr_leaf_name_remote_t valuelist; /* grows from bottom of buf */
++ /*
++ * The rest of the block contains the following structures after the
++ * leaf entries, growing from the bottom up. The variables are never
++ * referenced and definining them can actually make gcc optimize away
++ * accesses to the 'entries' array above index 0 so don't do that.
++ *
++ * xfs_attr_leaf_name_local_t namelist;
++ * xfs_attr_leaf_name_remote_t valuelist;
++ */
+ } xfs_attr_leafblock_t;
+
+ /*
--- /dev/null
+From c9eb256eda4420c06bb10f5e8fbdbe1a34bc98e0 Mon Sep 17 00:00:00 2001
+From: David Jeffery <djeffery@redhat.com>
+Date: Fri, 28 Aug 2015 14:50:45 +1000
+Subject: xfs: return errors from partial I/O failures to files
+
+From: David Jeffery <djeffery@redhat.com>
+
+commit c9eb256eda4420c06bb10f5e8fbdbe1a34bc98e0 upstream.
+
+There is an issue with xfs's error reporting in some cases of I/O partially
+failing and partially succeeding. Calls like fsync() can report success even
+though not all I/O was successful in partial-failure cases such as one disk of
+a RAID0 array being offline.
+
+The issue can occur when there are more than one bio per xfs_ioend struct.
+Each call to xfs_end_bio() for a bio completing will write a value to
+ioend->io_error. If a successful bio completes after any failed bio, no
+error is reported do to it writing 0 over the error code set by any failed bio.
+The I/O error information is now lost and when the ioend is completed
+only success is reported back up the filesystem stack.
+
+xfs_end_bio() should only set ioend->io_error in the case of BIO_UPTODATE
+being clear. ioend->io_error is initialized to 0 at allocation so only needs
+to be updated by a failed bio. Also check that ioend->io_error is 0 so that
+the first error reported will be the error code returned.
+
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_aops.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -356,7 +356,8 @@ xfs_end_bio(
+ {
+ xfs_ioend_t *ioend = bio->bi_private;
+
+- ioend->io_error = test_bit(BIO_UPTODATE, &bio->bi_flags) ? 0 : error;
++ if (!ioend->io_error && !test_bit(BIO_UPTODATE, &bio->bi_flags))
++ ioend->io_error = error;
+
+ /* Toss bio and pass work off to an xfsdatad thread */
+ bio->bi_private = NULL;
projects / thirdparty / kernel / stable-queue.git / commitdiff
