--- /dev/null
+From 2ce39ad15182604beb6c8fa8bed5e46b59fd1082 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 19 Jul 2016 15:07:37 +0100
+Subject: arm64: debug: unmask PSTATE.D earlier
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 2ce39ad15182604beb6c8fa8bed5e46b59fd1082 upstream.
+
+Clearing PSTATE.D is one of the requirements for generating a debug
+exception. The arm64 booting protocol requires that PSTATE.D is set,
+since many of the debug registers (for example, the hw_breakpoint
+registers) are UNKNOWN out of reset and could potentially generate
+spurious, fatal debug exceptions in early boot code if PSTATE.D was
+clear. Once the debug registers have been safely initialised, PSTATE.D
+is cleared, however this is currently broken for two reasons:
+
+(1) The boot CPU clears PSTATE.D in a postcore_initcall and secondary
+ CPUs clear PSTATE.D in secondary_start_kernel. Since the initcall
+ runs after SMP (and the scheduler) have been initialised, there is
+ no guarantee that it is actually running on the boot CPU. In this
+ case, the boot CPU is left with PSTATE.D set and is not capable of
+ generating debug exceptions.
+
+(2) In a preemptible kernel, we may explicitly schedule on the IRQ
+ return path to EL1. If an IRQ occurs with PSTATE.D set in the idle
+ thread, then we may schedule the kthread_init thread, run the
+ postcore_initcall to clear PSTATE.D and then context switch back
+ to the idle thread before returning from the IRQ. The exception
+ return path will then restore PSTATE.D from the stack, and set it
+ again.
+
+This patch fixes the problem by moving the clearing of PSTATE.D earlier
+to proc.S. This has the desirable effect of clearing it in one place for
+all CPUs, long before we have to worry about the scheduler or any
+exception handling. We ensure that the previous reset of MDSCR_EL1 has
+completed before unmasking the exception, so that any spurious
+exceptions resulting from UNKNOWN debug registers are not generated.
+
+Without this patch applied, the kprobes selftests have been seen to fail
+under KVM, where we end up attempting to step the OOL instruction buffer
+with PSTATE.D set and therefore fail to complete the step.
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Tested-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Tested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/debug-monitors.c | 1 -
+ arch/arm64/kernel/smp.c | 1 -
+ arch/arm64/mm/proc.S | 2 ++
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -151,7 +151,6 @@ static int debug_monitors_init(void)
+ /* Clear the OS lock. */
+ on_each_cpu(clear_os_lock, NULL, 1);
+ isb();
+- local_dbg_enable();
+
+ /* Register hotplug handler. */
+ __register_cpu_notifier(&os_lock_nb);
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -267,7 +267,6 @@ asmlinkage void secondary_start_kernel(v
+ set_cpu_online(cpu, true);
+ complete(&cpu_running);
+
+- local_dbg_enable();
+ local_irq_enable();
+ local_async_enable();
+
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -180,6 +180,8 @@ ENTRY(__cpu_setup)
+ msr cpacr_el1, x0 // Enable FP/ASIMD
+ mov x0, #1 << 12 // Reset mdscr_el1 and disable
+ msr mdscr_el1, x0 // access to the DCC from EL0
++ isb // Unmask debug exceptions now,
++ enable_dbg // since this is per-cpu
+ reset_pmuserenr_el0 x0 // Disable PMU access from EL0
+ /*
+ * Memory region attributes for LPAE:
--- /dev/null
+From 9113c2aa05e9848cd4f1154abee17d4f265f012d Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Thu, 21 Jul 2016 11:12:55 +0100
+Subject: arm64: Fix incorrect per-cpu usage for boot CPU
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 9113c2aa05e9848cd4f1154abee17d4f265f012d upstream.
+
+In smp_prepare_boot_cpu(), we invoke cpuinfo_store_boot_cpu to store
+the cpuinfo in a per-cpu ptr, before initialising the per-cpu offset for
+the boot CPU. This patch reorders the sequence to make sure we initialise
+the per-cpu offset before accessing the per-cpu area.
+
+Commit 4b998ff1885eec ("arm64: Delay cpuinfo_store_boot_cpu") fixed the
+issue where we modified the per-cpu area even before the kernel initialises
+the per-cpu areas, but failed to wait until the boot cpu updated it's
+offset.
+
+Fixes: 4b998ff1885e ("arm64: Delay cpuinfo_store_boot_cpu")
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -436,9 +436,9 @@ void __init smp_cpus_done(unsigned int m
+
+ void __init smp_prepare_boot_cpu(void)
+ {
++ set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
+ cpuinfo_store_boot_cpu();
+ save_boot_cpu_run_el();
+- set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
+ }
+
+ static u64 __init of_get_cpu_mpidr(struct device_node *dn)
--- /dev/null
+From e75118a7b581b19b08282c7819c1ec6f68b91b79 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Thu, 21 Jul 2016 11:15:27 +0100
+Subject: arm64: Honor nosmp kernel command line option
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit e75118a7b581b19b08282c7819c1ec6f68b91b79 upstream.
+
+Passing "nosmp" should boot the kernel with a single processor, without
+provision to enable secondary CPUs even if they are present. "nosmp" is
+implemented by setting maxcpus=0. At the moment we still mark the secondary
+CPUs present even with nosmp, which allows the userspace to bring them
+up. This patch corrects the smp_prepare_cpus() to honor the maxcpus == 0.
+
+Commit 44dbcc93ab67145 ("arm64: Fix behavior of maxcpus=N") fixed the
+behavior for maxcpus >= 1, but broke maxcpus = 0.
+
+Fixes: 44dbcc93ab67 ("arm64: Fix behavior of maxcpus=N")
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+[catalin.marinas@arm.com: updated code comment]
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/smp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -693,6 +693,13 @@ void __init smp_prepare_cpus(unsigned in
+ smp_store_cpu_info(smp_processor_id());
+
+ /*
++ * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set
++ * secondary CPUs present.
++ */
++ if (max_cpus == 0)
++ return;
++
++ /*
+ * Initialise the present map (which describes the set of CPUs
+ * actually populated at the present time) and release the
+ * secondaries from the bootloader.
--- /dev/null
+From 4c47eb1c18c38b755eb4894a6ca38f834de3ec23 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Tue, 19 Jul 2016 13:56:54 +0100
+Subject: arm64: KVM: VHE: Context switch MDSCR_EL1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 4c47eb1c18c38b755eb4894a6ca38f834de3ec23 upstream.
+
+The kprobe enablement work has uncovered that changes made by
+a guest to MDSCR_EL1 were propagated to the host when VHE was
+enabled, leading to unexpected exception being delivered.
+
+Moving this register to the list of registers that are always
+context-switched fixes the issue.
+
+Fixes: 9c6c35683286 ("arm64: KVM: VHE: Split save/restore of registers shared between guest and host")
+Reported-by: Tirumalesh Chalamarla <Tirumalesh.Chalamarla@cavium.com>
+Tested-by: Tirumalesh Chalamarla <Tirumalesh.Chalamarla@cavium.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kvm/hyp/sysreg-sr.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/sysreg-sr.c
++++ b/arch/arm64/kvm/hyp/sysreg-sr.c
+@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothi
+ /*
+ * Non-VHE: Both host and guest must save everything.
+ *
+- * VHE: Host must save tpidr*_el[01], actlr_el1, sp0, pc, pstate, and
+- * guest must save everything.
++ * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc,
++ * pstate, and guest must save everything.
+ */
+
+ static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
+@@ -37,6 +37,7 @@ static void __hyp_text __sysreg_save_com
+ ctxt->sys_regs[TPIDR_EL0] = read_sysreg(tpidr_el0);
+ ctxt->sys_regs[TPIDRRO_EL0] = read_sysreg(tpidrro_el0);
+ ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1);
++ ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1);
+ ctxt->gp_regs.regs.sp = read_sysreg(sp_el0);
+ ctxt->gp_regs.regs.pc = read_sysreg_el2(elr);
+ ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr);
+@@ -61,7 +62,6 @@ static void __hyp_text __sysreg_save_sta
+ ctxt->sys_regs[AMAIR_EL1] = read_sysreg_el1(amair);
+ ctxt->sys_regs[CNTKCTL_EL1] = read_sysreg_el1(cntkctl);
+ ctxt->sys_regs[PAR_EL1] = read_sysreg(par_el1);
+- ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1);
+
+ ctxt->gp_regs.sp_el1 = read_sysreg(sp_el1);
+ ctxt->gp_regs.elr_el1 = read_sysreg_el1(elr);
+@@ -90,6 +90,7 @@ static void __hyp_text __sysreg_restore_
+ write_sysreg(ctxt->sys_regs[TPIDR_EL0], tpidr_el0);
+ write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0);
+ write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1);
++ write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1);
+ write_sysreg(ctxt->gp_regs.regs.sp, sp_el0);
+ write_sysreg_el2(ctxt->gp_regs.regs.pc, elr);
+ write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr);
+@@ -114,7 +115,6 @@ static void __hyp_text __sysreg_restore_
+ write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1], amair);
+ write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], cntkctl);
+ write_sysreg(ctxt->sys_regs[PAR_EL1], par_el1);
+- write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1);
+
+ write_sysreg(ctxt->gp_regs.sp_el1, sp_el1);
+ write_sysreg_el1(ctxt->gp_regs.elr_el1, elr);
--- /dev/null
+From b9c220b589daaf140f5b8ebe502c98745b94e65c Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Tue, 26 Jul 2016 10:16:55 -0700
+Subject: arm64: Only select ARM64_MODULE_PLTS if MODULES=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit b9c220b589daaf140f5b8ebe502c98745b94e65c upstream.
+
+Selecting CONFIG_RANDOMIZE_BASE=y and CONFIG_MODULES=n fails to build
+the module PLTs support:
+
+ CC arch/arm64/kernel/module-plts.o
+/work/Linux/linux-2.6-aarch64/arch/arm64/kernel/module-plts.c: In function ‘module_emit_plt_entry’:
+/work/Linux/linux-2.6-aarch64/arch/arm64/kernel/module-plts.c:32:49: error: dereferencing pointer to incomplete type ‘struct module’
+
+This patch selects ARM64_MODULE_PLTS conditionally only if MODULES is
+enabled.
+
+Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR")
+Reported-by: Jeff Vander Stoep <jeffv@google.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -872,7 +872,7 @@ config RELOCATABLE
+
+ config RANDOMIZE_BASE
+ bool "Randomize the address of the kernel image"
+- select ARM64_MODULE_PLTS
++ select ARM64_MODULE_PLTS if MODULES
+ select RELOCATABLE
+ help
+ Randomizes the virtual address at which the kernel image is
--- /dev/null
+From 9cad39fe4e4a4fe95d8ea5a7b0692b0a6e89e38b Mon Sep 17 00:00:00 2001
+From: Konrad Leszczynski <konrad.leszczynski@intel.com>
+Date: Mon, 8 Feb 2016 16:13:12 +0100
+Subject: usb: dwc3: fix for the isoc transfer EP_BUSY flag
+
+From: Konrad Leszczynski <konrad.leszczynski@intel.com>
+
+commit 9cad39fe4e4a4fe95d8ea5a7b0692b0a6e89e38b upstream.
+
+commit f3af36511e60 ("usb: dwc3: gadget: always
+enable IOC on bulk/interrupt transfers") ended up
+regressing Isochronous endpoints by clearing
+DWC3_EP_BUSY flag too early, which resulted in
+choppy audio playback over USB.
+
+Fix that by partially reverting original commit and
+making sure that we check for isochronous endpoints.
+
+Fixes: f3af36511e60 ("usb: dwc3: gadget: always enable IOC
+ on bulk/interrupt transfers")
+Signed-off-by: Konrad Leszczynski <konrad.leszczynski@intel.com>
+Signed-off-by: Rafal Redzimski <rafal.f.redzimski@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2025,6 +2025,10 @@ static int dwc3_cleanup_done_reqs(struct
+ return 1;
+ }
+
++ if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
++ if ((event->status & DEPEVT_STATUS_IOC) &&
++ (trb->ctrl & DWC3_TRB_CTRL_IOC))
++ return 0;
+ return 1;
+ }
+
--- /dev/null
+From ab2a92e7a608c09f13baf1730b9ba24c73c35d52 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 17 May 2016 14:55:58 +0300
+Subject: usb: dwc3: gadget: only resume USB2 PHY in <=HIGHSPEED
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit ab2a92e7a608c09f13baf1730b9ba24c73c35d52 upstream.
+
+As a micro-power optimization, let's only resume the
+USB2 PHY if we're working on <=HIGHSPEED. If we're
+gonna work on SUPERSPEED or SUPERSPEED+, there's no
+point in resuming the USB2 PHY.
+
+Fixes: 2b0f11df84bb ("usb: dwc3: gadget: clear SUSPHY bit before ep cmds")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -258,11 +258,13 @@ int dwc3_send_gadget_ep_cmd(struct dwc3
+ * We will also set SUSPHY bit to what it was before returning as stated
+ * by the same section on Synopsys databook.
+ */
+- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+- if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
+- susphy = true;
+- reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
+- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
++ if (dwc->gadget.speed <= USB_SPEED_HIGH) {
++ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
++ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
++ susphy = true;
++ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
++ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
++ }
+ }
+
+ if (cmd == DWC3_DEPCMD_STARTTRANSFER) {
--- /dev/null
+From 1d23d16a88e6c8143b07339435ba061b131ebb8c Mon Sep 17 00:00:00 2001
+From: Iago Abal <mail@iagoabal.eu>
+Date: Tue, 21 Jun 2016 12:01:11 +0200
+Subject: usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
+
+From: Iago Abal <mail@iagoabal.eu>
+
+commit 1d23d16a88e6c8143b07339435ba061b131ebb8c upstream.
+
+The above commit reordered spin_lock/unlock and now `&dev->lock' is acquired
+(rather than released) before calling `dev->driver->disconnect',
+`dev->driver->setup', `dev->driver->suspend', `usb_gadget_giveback_request', and
+`usb_gadget_udc_reset'.
+
+But this *may* not be the right way to fix the problem pointed by d3cb25a12138.
+
+Note that the other usb/gadget/udc drivers do release the lock before calling
+these functions. There are also inconsistencies within pch_udc.c, where
+`dev->driver->disconnect' is called while holding `&dev->lock' in lines 613 and
+1184, but not in line 2739.
+
+Finally, commit d3cb25a12138 may have introduced several potential deadlocks.
+
+For instance, EBA (https://github.com/models-team/eba) reports:
+
+ Double lock in drivers/usb/gadget/udc/pch_udc.c
+ first at 2791: spin_lock(& dev->lock); [pch_udc_isr]
+ second at 2694: spin_lock(& dev->lock); [pch_udc_svc_cfg_interrupt]
+ after calling from 2793: pch_udc_dev_isr(dev, dev_intr);
+ after calling from 2724: pch_udc_svc_cfg_interrupt(dev);
+
+Similarly, other potential deadlocks are 2791 -> 2793 -> 2721 -> 2657; and
+2791 -> 2793 -> 2711 -> 2573 -> 1499 -> 1480.
+
+Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
+Signed-off-by: Iago Abal <mail@iagoabal.eu>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/pch_udc.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -1477,11 +1477,11 @@ static void complete_req(struct pch_udc_
+ req->dma_mapped = 0;
+ }
+ ep->halted = 1;
+- spin_lock(&dev->lock);
++ spin_unlock(&dev->lock);
+ if (!ep->in)
+ pch_udc_ep_clear_rrdy(ep);
+ usb_gadget_giveback_request(&ep->ep, &req->req);
+- spin_unlock(&dev->lock);
++ spin_lock(&dev->lock);
+ ep->halted = halted;
+ }
+
+@@ -2573,9 +2573,9 @@ static void pch_udc_svc_ur_interrupt(str
+ empty_req_queue(ep);
+ }
+ if (dev->driver) {
+- spin_lock(&dev->lock);
+- usb_gadget_udc_reset(&dev->gadget, dev->driver);
+ spin_unlock(&dev->lock);
++ usb_gadget_udc_reset(&dev->gadget, dev->driver);
++ spin_lock(&dev->lock);
+ }
+ }
+
+@@ -2654,9 +2654,9 @@ static void pch_udc_svc_intf_interrupt(s
+ dev->ep[i].halted = 0;
+ }
+ dev->stall = 0;
+- spin_lock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+ spin_unlock(&dev->lock);
++ dev->driver->setup(&dev->gadget, &dev->setup_data);
++ spin_lock(&dev->lock);
+ }
+
+ /**
+@@ -2691,9 +2691,9 @@ static void pch_udc_svc_cfg_interrupt(st
+ dev->stall = 0;
+
+ /* call gadget zero with setup data received */
+- spin_lock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+ spin_unlock(&dev->lock);
++ dev->driver->setup(&dev->gadget, &dev->setup_data);
++ spin_lock(&dev->lock);
+ }
+
+ /**
--- /dev/null
+From 882bd9fc46321c9d4721b376039a142cbfe8a17a Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Mon, 13 Jun 2016 10:47:30 +0200
+Subject: usb: gadget: udc: atmel: Also get regmap for at91sam9x5-pmc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit 882bd9fc46321c9d4721b376039a142cbfe8a17a upstream.
+
+The "atmel,at91sam9g45-udc" compatible UDC is also used on at91sam9x5 so it
+is also necessary to try to get the syscon for at91sam9x5-pmc.
+
+Fixes: 4747639f01c9 ("usb: gadget: atmel: access the PMC using regmap")
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -1920,6 +1920,8 @@ static struct usba_ep * atmel_udc_of_ini
+
+ udc->errata = match->data;
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
++ if (IS_ERR(udc->pmc))
++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
+ if (udc->errata && IS_ERR(udc->pmc))
+ return ERR_CAST(udc->pmc);
+
--- /dev/null
+From 25b1f9acc452209ae0fcc8c1332be852b5c52f53 Mon Sep 17 00:00:00 2001
+From: Joseph Salisbury <joseph.salisbury@canonical.com>
+Date: Wed, 6 Jul 2016 21:18:51 -0400
+Subject: usb: quirks: Add no-lpm quirk for Elan
+
+From: Joseph Salisbury <joseph.salisbury@canonical.com>
+
+commit 25b1f9acc452209ae0fcc8c1332be852b5c52f53 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1498667
+
+As reported in BugLink, this device has an issue with Linux Power
+Management so adding a quirk. This quirk was reccomended by Alan Stern:
+
+http://lkml.iu.edu/hypermail/linux/kernel/1606.2/05590.html
+
+Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -128,6 +128,9 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+ USB_QUIRK_DEVICE_QUALIFIER },
+
++ { USB_DEVICE(0x04f3, 0x0381), .driver_info =
++ USB_QUIRK_NO_LPM },
++
+ { USB_DEVICE(0x04f3, 0x21b8), .driver_info =
+ USB_QUIRK_DEVICE_QUALIFIER },
+
--- /dev/null
+From 4fdef698383db07d829da567e0e405fc41ff3a89 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 8 Jun 2016 16:32:49 +0900
+Subject: usb: renesas_usbhs: fix NULL pointer dereference in xfer_work()
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 4fdef698383db07d829da567e0e405fc41ff3a89 upstream.
+
+This patch fixes an issue that the xfer_work() is possible to cause
+NULL pointer dereference if the usb cable is disconnected while data
+transfer is running.
+
+In such case, a gadget driver may call usb_ep_disable()) before
+xfer_work() is actually called. In this case, the usbhs_pkt_pop()
+will call usbhsf_fifo_unselect(), and then usbhs_pipe_to_fifo()
+in xfer_work() will return NULL.
+
+Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/fifo.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -810,20 +810,27 @@ static void xfer_work(struct work_struct
+ {
+ struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
+ struct usbhs_pipe *pipe = pkt->pipe;
+- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe);
++ struct usbhs_fifo *fifo;
+ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+ struct dma_async_tx_descriptor *desc;
+- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt);
++ struct dma_chan *chan;
+ struct device *dev = usbhs_priv_to_dev(priv);
+ enum dma_transfer_direction dir;
++ unsigned long flags;
+
++ usbhs_lock(priv, flags);
++ fifo = usbhs_pipe_to_fifo(pipe);
++ if (!fifo)
++ goto xfer_work_end;
++
++ chan = usbhsf_dma_chan_get(fifo, pkt);
+ dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
+
+ desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual,
+ pkt->trans, dir,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc)
+- return;
++ goto xfer_work_end;
+
+ desc->callback = usbhsf_dma_complete;
+ desc->callback_param = pipe;
+@@ -831,7 +838,7 @@ static void xfer_work(struct work_struct
+ pkt->cookie = dmaengine_submit(desc);
+ if (pkt->cookie < 0) {
+ dev_err(dev, "Failed to submit dma descriptor\n");
+- return;
++ goto xfer_work_end;
+ }
+
+ dev_dbg(dev, " %s %d (%d/ %d)\n",
+@@ -842,6 +849,9 @@ static void xfer_work(struct work_struct
+ usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
+ dma_async_issue_pending(chan);
+ usbhs_pipe_enable(pipe);
++
++xfer_work_end:
++ usbhs_unlock(priv, flags);
+ }
+
+ /*
--- /dev/null
+From 15e4292a2d21e9997fdb2b8c014cc461b3f268f0 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 8 Jun 2016 16:32:50 +0900
+Subject: usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable()
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 15e4292a2d21e9997fdb2b8c014cc461b3f268f0 upstream.
+
+This patch fixes an issue that the CFIFOSEL register value is possible
+to be changed by usbhsg_ep_enable() wrongly. And then, a data transfer
+using CFIFO may not work correctly.
+
+For example:
+ # modprobe g_multi file=usb-storage.bin
+ # ifconfig usb0 192.168.1.1 up
+ (During the USB host is sending file to the mass storage)
+ # ifconfig usb0 down
+
+In this case, since the u_ether.c may call usb_ep_enable() in
+eth_stop(), if the renesas_usbhs driver is also using CFIFO for
+mass storage, the mass storage may not work correctly.
+
+So, this patch adds usbhs_lock() and usbhs_unlock() calling in
+usbhsg_ep_enable() to protect CFIFOSEL register. This is because:
+ - CFIFOSEL.CURPIPE = 0 is also needed for the pipe configuration
+ - The CFIFOSEL (fifo->sel) is already protected by usbhs_lock()
+
+Fixes: 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/mod_gadget.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -585,6 +585,9 @@ static int usbhsg_ep_enable(struct usb_e
+ struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
+ struct usbhs_pipe *pipe;
+ int ret = -EIO;
++ unsigned long flags;
++
++ usbhs_lock(priv, flags);
+
+ /*
+ * if it already have pipe,
+@@ -593,7 +596,8 @@ static int usbhsg_ep_enable(struct usb_e
+ if (uep->pipe) {
+ usbhs_pipe_clear(uep->pipe);
+ usbhs_pipe_sequence_data0(uep->pipe);
+- return 0;
++ ret = 0;
++ goto usbhsg_ep_enable_end;
+ }
+
+ pipe = usbhs_pipe_malloc(priv,
+@@ -621,6 +625,9 @@ static int usbhsg_ep_enable(struct usb_e
+ ret = 0;
+ }
+
++usbhsg_ep_enable_end:
++ usbhs_unlock(priv, flags);
++
+ return ret;
+ }
+
--- /dev/null
+From 3c0415fa08548e3bc63ef741762664497ab187ed Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Mon, 6 Jun 2016 12:38:17 +0200
+Subject: USB: serial: option: add support for Telit LE910 PID 0x1206
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 3c0415fa08548e3bc63ef741762664497ab187ed upstream.
+
+This patch adds support for 0x1206 PID of Telit LE910.
+
+Since the interfaces positions are the same than the ones for
+0x1043 PID of Telit LE922, telit_le922_blacklist_usbcfg3 is used.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -273,6 +273,7 @@ static void option_instat_callback(struc
+ #define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
++#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -1198,6 +1199,8 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
projects / thirdparty / kernel / stable-queue.git / commitdiff
