--- /dev/null
+From 8a4023c5b5e30b11f1f383186f4a7222b3b823cf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:26 +0200
+Subject: batman-adv: Fix potential synchronization issues in mcast tvlv handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+
+commit 8a4023c5b5e30b11f1f383186f4a7222b3b823cf upstream.
+
+So far the mcast tvlv handler did not anticipate the processing of
+multiple incoming OGMs from the same originator at the same time. This
+can lead to various issues:
+
+* Broken refcounting: For instance two mcast handlers might both assume
+ that an originator just got multicast capabilities and will together
+ wrongly decrease mcast.num_disabled by two, potentially leading to
+ an integer underflow.
+
+* Potential kernel panic on hlist_del_rcu(): Two mcast handlers might
+ one after another try to do an
+ hlist_del_rcu(&orig->mcast_want_all_*_node). The second one will
+ cause memory corruption / crashes.
+ (Reported by: Sven Eckelmann <sven@narfation.org>)
+
+Right in the beginning the code path makes assumptions about the current
+multicast related state of an originator and bases all updates on that. The
+easiest and least error prune way to fix the issues in this case is to
+serialize multiple mcast handler invocations with a spinlock.
+
+Fixes: 60432d756cf0 ("batman-adv: Announce new capability via multicast TVLV")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/multicast.c | 63 ++++++++++++++++++++++++++++++++++----------
+ net/batman-adv/originator.c | 5 +++
+ net/batman-adv/types.h | 3 ++
+ 3 files changed, 58 insertions(+), 13 deletions(-)
+
+--- a/net/batman-adv/multicast.c
++++ b/net/batman-adv/multicast.c
+@@ -16,6 +16,7 @@
+ */
+
+ #include <linux/bitops.h>
++#include <linux/bug.h>
+ #include "main.h"
+ #include "multicast.h"
+ #include "originator.h"
+@@ -566,19 +567,26 @@ batadv_mcast_forw_mode(struct batadv_pri
+ *
+ * If the BATADV_MCAST_WANT_ALL_UNSNOOPABLES flag of this originator,
+ * orig, has toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+ */
+ static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
+ struct batadv_orig_node *orig,
+ uint8_t mcast_flags)
+ {
++ struct hlist_node *node = &orig->mcast_want_all_unsnoopables_node;
++ struct hlist_head *head = &bat_priv->mcast.want_all_unsnoopables_list;
++
+ /* switched from flag unset to set */
+ if (mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES &&
+ !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES)) {
+ atomic_inc(&bat_priv->mcast.num_want_all_unsnoopables);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_add_head_rcu(&orig->mcast_want_all_unsnoopables_node,
+- &bat_priv->mcast.want_all_unsnoopables_list);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(!hlist_unhashed(node));
++
++ hlist_add_head_rcu(node, head);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ /* switched from flag set to unset */
+ } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES) &&
+@@ -586,7 +594,10 @@ static void batadv_mcast_want_unsnoop_up
+ atomic_dec(&bat_priv->mcast.num_want_all_unsnoopables);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_del_rcu(&orig->mcast_want_all_unsnoopables_node);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(hlist_unhashed(node));
++
++ hlist_del_init_rcu(node);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ }
+ }
+@@ -599,19 +610,26 @@ static void batadv_mcast_want_unsnoop_up
+ *
+ * If the BATADV_MCAST_WANT_ALL_IPV4 flag of this originator, orig, has
+ * toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+ */
+ static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,
+ struct batadv_orig_node *orig,
+ uint8_t mcast_flags)
+ {
++ struct hlist_node *node = &orig->mcast_want_all_ipv4_node;
++ struct hlist_head *head = &bat_priv->mcast.want_all_ipv4_list;
++
+ /* switched from flag unset to set */
+ if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV4 &&
+ !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV4)) {
+ atomic_inc(&bat_priv->mcast.num_want_all_ipv4);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_add_head_rcu(&orig->mcast_want_all_ipv4_node,
+- &bat_priv->mcast.want_all_ipv4_list);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(!hlist_unhashed(node));
++
++ hlist_add_head_rcu(node, head);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ /* switched from flag set to unset */
+ } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV4) &&
+@@ -619,7 +637,10 @@ static void batadv_mcast_want_ipv4_updat
+ atomic_dec(&bat_priv->mcast.num_want_all_ipv4);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_del_rcu(&orig->mcast_want_all_ipv4_node);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(hlist_unhashed(node));
++
++ hlist_del_init_rcu(node);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ }
+ }
+@@ -632,19 +653,26 @@ static void batadv_mcast_want_ipv4_updat
+ *
+ * If the BATADV_MCAST_WANT_ALL_IPV6 flag of this originator, orig, has
+ * toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+ */
+ static void batadv_mcast_want_ipv6_update(struct batadv_priv *bat_priv,
+ struct batadv_orig_node *orig,
+ uint8_t mcast_flags)
+ {
++ struct hlist_node *node = &orig->mcast_want_all_ipv6_node;
++ struct hlist_head *head = &bat_priv->mcast.want_all_ipv6_list;
++
+ /* switched from flag unset to set */
+ if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV6 &&
+ !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV6)) {
+ atomic_inc(&bat_priv->mcast.num_want_all_ipv6);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_add_head_rcu(&orig->mcast_want_all_ipv6_node,
+- &bat_priv->mcast.want_all_ipv6_list);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(!hlist_unhashed(node));
++
++ hlist_add_head_rcu(node, head);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ /* switched from flag set to unset */
+ } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) &&
+@@ -652,7 +680,10 @@ static void batadv_mcast_want_ipv6_updat
+ atomic_dec(&bat_priv->mcast.num_want_all_ipv6);
+
+ spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+- hlist_del_rcu(&orig->mcast_want_all_ipv6_node);
++ /* flag checks above + mcast_handler_lock prevents this */
++ WARN_ON(hlist_unhashed(node));
++
++ hlist_del_init_rcu(node);
+ spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ }
+ }
+@@ -675,6 +706,11 @@ static void batadv_mcast_tvlv_ogm_handle
+ uint8_t mcast_flags = BATADV_NO_FLAGS;
+ bool orig_initialized;
+
++ if (orig_mcast_enabled && tvlv_value &&
++ (tvlv_value_len >= sizeof(mcast_flags)))
++ mcast_flags = *(uint8_t *)tvlv_value;
++
++ spin_lock_bh(&orig->mcast_handler_lock);
+ orig_initialized = test_bit(BATADV_ORIG_CAPA_HAS_MCAST,
+ &orig->capa_initialized);
+
+@@ -700,15 +736,12 @@ static void batadv_mcast_tvlv_ogm_handle
+
+ set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized);
+
+- if (orig_mcast_enabled && tvlv_value &&
+- (tvlv_value_len >= sizeof(mcast_flags)))
+- mcast_flags = *(uint8_t *)tvlv_value;
+-
+ batadv_mcast_want_unsnoop_update(bat_priv, orig, mcast_flags);
+ batadv_mcast_want_ipv4_update(bat_priv, orig, mcast_flags);
+ batadv_mcast_want_ipv6_update(bat_priv, orig, mcast_flags);
+
+ orig->mcast_flags = mcast_flags;
++ spin_unlock_bh(&orig->mcast_handler_lock);
+ }
+
+ /**
+@@ -742,6 +775,8 @@ void batadv_mcast_purge_orig(struct bata
+ {
+ struct batadv_priv *bat_priv = orig->bat_priv;
+
++ spin_lock_bh(&orig->mcast_handler_lock);
++
+ if (!test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) &&
+ test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized))
+ atomic_dec(&bat_priv->mcast.num_disabled);
+@@ -749,4 +784,6 @@ void batadv_mcast_purge_orig(struct bata
+ batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
+ batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
+ batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
++
++ spin_unlock_bh(&orig->mcast_handler_lock);
+ }
+--- a/net/batman-adv/originator.c
++++ b/net/batman-adv/originator.c
+@@ -678,8 +678,13 @@ struct batadv_orig_node *batadv_orig_nod
+ orig_node->last_seen = jiffies;
+ reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
+ orig_node->bcast_seqno_reset = reset_time;
++
+ #ifdef CONFIG_BATMAN_ADV_MCAST
+ orig_node->mcast_flags = BATADV_NO_FLAGS;
++ INIT_HLIST_NODE(&orig_node->mcast_want_all_unsnoopables_node);
++ INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv4_node);
++ INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv6_node);
++ spin_lock_init(&orig_node->mcast_handler_lock);
+ #endif
+
+ /* create a vlan object for the "untagged" LAN */
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -204,6 +204,7 @@ struct batadv_orig_bat_iv {
+ * @batadv_dat_addr_t: address of the orig node in the distributed hash
+ * @last_seen: time when last packet from this node was received
+ * @bcast_seqno_reset: time when the broadcast seqno window was reset
++ * @mcast_handler_lock: synchronizes mcast-capability and -flag changes
+ * @mcast_flags: multicast flags announced by the orig node
+ * @mcast_want_all_unsnoop_node: a list node for the
+ * mcast.want_all_unsnoopables list
+@@ -251,6 +252,8 @@ struct batadv_orig_node {
+ unsigned long last_seen;
+ unsigned long bcast_seqno_reset;
+ #ifdef CONFIG_BATMAN_ADV_MCAST
++ /* synchronizes mcast tvlv specific orig changes */
++ spinlock_t mcast_handler_lock;
+ uint8_t mcast_flags;
+ struct hlist_node mcast_want_all_unsnoopables_node;
+ struct hlist_node mcast_want_all_ipv4_node;
--- /dev/null
+From 53cf037bf846417fd92dc92ddf97267f69b110f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 30 Jun 2015 23:45:26 +0200
+Subject: batman-adv: Fix potentially broken skb network header access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+
+commit 53cf037bf846417fd92dc92ddf97267f69b110f4 upstream.
+
+The two commits noted below added calls to ip_hdr() and ipv6_hdr(). They
+need a correctly set skb network header.
+
+Unfortunately we cannot rely on the device drivers to set it for us.
+Therefore setting it in the beginning of the according ndo_start_xmit
+handler.
+
+Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
+Fixes: ab49886e3da7 ("batman-adv: Add IPv4 link-local/IPv6-ll-all-nodes multicast support")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/soft-interface.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -172,6 +172,7 @@ static int batadv_interface_tx(struct sk
+ int gw_mode;
+ enum batadv_forw_mode forw_mode;
+ struct batadv_orig_node *mcast_single_orig = NULL;
++ int network_offset = ETH_HLEN;
+
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+@@ -184,14 +185,18 @@ static int batadv_interface_tx(struct sk
+ case ETH_P_8021Q:
+ vhdr = vlan_eth_hdr(skb);
+
+- if (vhdr->h_vlan_encapsulated_proto != ethertype)
++ if (vhdr->h_vlan_encapsulated_proto != ethertype) {
++ network_offset += VLAN_HLEN;
+ break;
++ }
+
+ /* fall through */
+ case ETH_P_BATMAN:
+ goto dropped;
+ }
+
++ skb_set_network_header(skb, network_offset);
++
+ if (batadv_bla_tx(bat_priv, skb, vid))
+ goto dropped;
+
--- /dev/null
+From 9c936e3f4c4fad07abb6c082a89508b8f724c88f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:25 +0200
+Subject: batman-adv: Make MCAST capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+
+commit 9c936e3f4c4fad07abb6c082a89508b8f724c88f upstream.
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions.
+
+Fixes: 60432d756cf0 ("batman-adv: Announce new capability via multicast TVLV")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/multicast.c | 18 ++++++++++--------
+ net/batman-adv/types.h | 2 +-
+ 2 files changed, 11 insertions(+), 9 deletions(-)
+
+--- a/net/batman-adv/multicast.c
++++ b/net/batman-adv/multicast.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include "main.h"
+ #include "multicast.h"
+ #include "originator.h"
+@@ -674,29 +675,30 @@ static void batadv_mcast_tvlv_ogm_handle
+ uint8_t mcast_flags = BATADV_NO_FLAGS;
+ bool orig_initialized;
+
+- orig_initialized = orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST;
++ orig_initialized = test_bit(BATADV_ORIG_CAPA_HAS_MCAST,
++ &orig->capa_initialized);
+
+ /* If mcast support is turned on decrease the disabled mcast node
+ * counter only if we had increased it for this node before. If this
+ * is a completely new orig_node no need to decrease the counter.
+ */
+ if (orig_mcast_enabled &&
+- !(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST)) {
++ !test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities)) {
+ if (orig_initialized)
+ atomic_dec(&bat_priv->mcast.num_disabled);
+- orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
++ set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities);
+ /* If mcast support is being switched off or if this is an initial
+ * OGM without mcast support then increase the disabled mcast
+ * node counter.
+ */
+ } else if (!orig_mcast_enabled &&
+- (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
++ (test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) ||
+ !orig_initialized)) {
+ atomic_inc(&bat_priv->mcast.num_disabled);
+- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
++ clear_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities);
+ }
+
+- orig->capa_initialized |= BATADV_ORIG_CAPA_HAS_MCAST;
++ set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized);
+
+ if (orig_mcast_enabled && tvlv_value &&
+ (tvlv_value_len >= sizeof(mcast_flags)))
+@@ -740,8 +742,8 @@ void batadv_mcast_purge_orig(struct bata
+ {
+ struct batadv_priv *bat_priv = orig->bat_priv;
+
+- if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+- orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
++ if (!test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) &&
++ test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized))
+ atomic_dec(&bat_priv->mcast.num_disabled);
+
+ batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -299,7 +299,7 @@ enum batadv_orig_capabilities {
+ BATADV_ORIG_CAPA_HAS_DAT,
+ BATADV_ORIG_CAPA_HAS_NC,
+ BATADV_ORIG_CAPA_HAS_TT,
+- BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
++ BATADV_ORIG_CAPA_HAS_MCAST,
+ };
+
+ /**
--- /dev/null
+From 4635469f5c617282f18c69643af36cd8c0acf707 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:23 +0200
+Subject: batman-adv: Make NC capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+
+commit 4635469f5c617282f18c69643af36cd8c0acf707 upstream.
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions.
+
+Fixes: 3f4841ffb336 ("batman-adv: tvlv - add network coding container")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/network-coding.c | 7 ++++---
+ net/batman-adv/types.h | 2 +-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/batman-adv/network-coding.c
++++ b/net/batman-adv/network-coding.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include <linux/debugfs.h>
+
+ #include "main.h"
+@@ -105,9 +106,9 @@ static void batadv_nc_tvlv_ogm_handler_v
+ uint16_t tvlv_value_len)
+ {
+ if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
+- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_NC;
++ clear_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ else
+- orig->capabilities |= BATADV_ORIG_CAPA_HAS_NC;
++ set_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ }
+
+ /**
+@@ -871,7 +872,7 @@ void batadv_nc_update_nc_node(struct bat
+ goto out;
+
+ /* check if orig node is network coding enabled */
+- if (!(orig_node->capabilities & BATADV_ORIG_CAPA_HAS_NC))
++ if (!test_bit(BATADV_ORIG_CAPA_HAS_NC, &orig_node->capabilities))
+ goto out;
+
+ /* accept ogms from 'good' neighbors and single hop neighbors */
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -297,7 +297,7 @@ struct batadv_orig_node {
+ */
+ enum batadv_orig_capabilities {
+ BATADV_ORIG_CAPA_HAS_DAT,
+- BATADV_ORIG_CAPA_HAS_NC = BIT(1),
++ BATADV_ORIG_CAPA_HAS_NC,
+ BATADV_ORIG_CAPA_HAS_TT = BIT(2),
+ BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
+ };
--- /dev/null
+From ac4eebd48461ec993e7cb614d5afe7df8c72e6b7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:24 +0200
+Subject: batman-adv: Make TT capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+
+commit ac4eebd48461ec993e7cb614d5afe7df8c72e6b7 upstream.
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions.
+
+Fixes: e17931d1a61d ("batman-adv: introduce capability initialization bitfield")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/translation-table.c | 8 +++++---
+ net/batman-adv/types.h | 4 ++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include "main.h"
+ #include "translation-table.h"
+ #include "soft-interface.h"
+@@ -1860,7 +1861,7 @@ void batadv_tt_global_del_orig(struct ba
+ }
+ spin_unlock_bh(list_lock);
+ }
+- orig_node->capa_initialized &= ~BATADV_ORIG_CAPA_HAS_TT;
++ clear_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+
+ static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global,
+@@ -2819,7 +2820,7 @@ static void _batadv_tt_update_changes(st
+ return;
+ }
+ }
+- orig_node->capa_initialized |= BATADV_ORIG_CAPA_HAS_TT;
++ set_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+
+ static void batadv_tt_fill_gtable(struct batadv_priv *bat_priv,
+@@ -3321,7 +3322,8 @@ static void batadv_tt_update_orig(struct
+ bool has_tt_init;
+
+ tt_vlan = (struct batadv_tvlv_tt_vlan_data *)tt_buff;
+- has_tt_init = orig_node->capa_initialized & BATADV_ORIG_CAPA_HAS_TT;
++ has_tt_init = test_bit(BATADV_ORIG_CAPA_HAS_TT,
++ &orig_node->capa_initialized);
+
+ /* orig table not initialised AND first diff is in the OGM OR the ttvn
+ * increased by one -> we can apply the attached changes
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -257,7 +257,7 @@ struct batadv_orig_node {
+ struct hlist_node mcast_want_all_ipv6_node;
+ #endif
+ unsigned long capabilities;
+- uint8_t capa_initialized;
++ unsigned long capa_initialized;
+ atomic_t last_ttvn;
+ unsigned char *tt_buff;
+ int16_t tt_buff_len;
+@@ -298,7 +298,7 @@ struct batadv_orig_node {
+ enum batadv_orig_capabilities {
+ BATADV_ORIG_CAPA_HAS_DAT,
+ BATADV_ORIG_CAPA_HAS_NC,
+- BATADV_ORIG_CAPA_HAS_TT = BIT(2),
++ BATADV_ORIG_CAPA_HAS_TT,
+ BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
+ };
+
--- /dev/null
+From 2110d70c5e58326a10e93cfefdc0b3686e2ada12 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Sat, 8 Aug 2015 10:46:02 +0200
+Subject: cpu/cacheinfo: Fix teardown path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Borislav Petkov <bp@suse.de>
+
+commit 2110d70c5e58326a10e93cfefdc0b3686e2ada12 upstream.
+
+Philip Müller reported a hang when booting 32-bit 4.1 kernel on an AMD
+box. A fragment of the splat was enough to pinpoint the issue:
+
+ task: f58e0000 ti: f58e8000 task.ti: f58e800
+ EIP: 0060:[<c135a903>] EFLAGS: 00010206 CPU: 0
+ EIP is at free_cache_attributes+0x83/0xd0
+ EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000
+ ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+ CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0
+
+cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo descriptor
+while the respective teardown path cache_shared_cpu_map_remove() didn't.
+Fix that.
+
+>From tglx's version: to be on the safe side, move the cacheinfo
+descriptor check to free_cache_attributes(), thus cleaning up the
+hotplug path a little and making this even more robust.
+
+Reported-and-tested-by: Philip Müller <philm@manjaro.org>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Andre Przywara <andre.przywara@arm.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: manjaro-dev@manjaro.org
+Cc: Philip Müller <philm@manjaro.org>
+Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/cacheinfo.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(
+
+ if (sibling == cpu) /* skip itself */
+ continue;
++
+ sib_cpu_ci = get_cpu_cacheinfo(sibling);
++ if (!sib_cpu_ci->info_list)
++ continue;
++
+ sib_leaf = sib_cpu_ci->info_list + index;
+ cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
+ cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
+@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(
+
+ static void free_cache_attributes(unsigned int cpu)
+ {
++ if (!per_cpu_cacheinfo(cpu))
++ return;
++
+ cache_shared_cpu_map_remove(cpu);
+
+ kfree(per_cpu_cacheinfo(cpu));
+@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct
+ break;
+ case CPU_DEAD:
+ cache_remove_dev(cpu);
+- if (per_cpu_cacheinfo(cpu))
+- free_cache_attributes(cpu);
++ free_cache_attributes(cpu);
+ break;
+ }
+ return notifier_from_errno(rc);
--- /dev/null
+From a2022001cebd0825b96aa0f3345ea3ad44ae79d4 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Wed, 2 Sep 2015 14:36:50 +0530
+Subject: cpufreq: dt: Tolerance applies on both sides of target voltage
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit a2022001cebd0825b96aa0f3345ea3ad44ae79d4 upstream.
+
+Tolerance applies on both sides of the target voltage, i.e. both min and
+max sides. But while checking if a voltage is supported by the regulator
+or not, we haven't taken care of tolerance on the lower side. Fix that.
+
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Fixes: 045ee45c4ff2 ("cpufreq: cpufreq-dt: disable unsupported OPPs")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq-dt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -255,7 +255,8 @@ static int cpufreq_init(struct cpufreq_p
+ rcu_read_unlock();
+
+ tol_uV = opp_uV * priv->voltage_tolerance / 100;
+- if (regulator_is_supported_voltage(cpu_reg, opp_uV,
++ if (regulator_is_supported_voltage(cpu_reg,
++ opp_uV - tol_uV,
+ opp_uV + tol_uV)) {
+ if (opp_uV < min_uV)
+ min_uV = opp_uV;
+++ /dev/null
-From 89c1a8cf63f8c69dfddb6e377c04df8b25ab1c88 Mon Sep 17 00:00:00 2001
-From: Dong Aisheng <aisheng.dong@freescale.com>
-Date: Wed, 22 Jul 2015 20:53:02 +0800
-Subject: dts: imx6: fix sd card gpio polarity specified in device tree
-
-From: Dong Aisheng <aisheng.dong@freescale.com>
-
-commit 89c1a8cf63f8c69dfddb6e377c04df8b25ab1c88 upstream.
-
-cd-gpios polarity should be changed to GPIO_ACTIVE_LOW and wp-gpios
-should be changed to GPIO_ACTIVE_HIGH.
-Otherwise, the SD may not work properly due to wrong polarity inversion
-specified in DT after switch to common parsing function mmc_of_parse().
-
-Signed-off-by: Dong Aisheng <aisheng.dong@freescale.com>
-Acked-by: Shawn Guo <shawnguo@kernel.org>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts
-index 43cb3fd76be7..5111f5170d53 100644
---- a/arch/arm/boot/dts/imx6dl-riotboard.dts
-+++ b/arch/arm/boot/dts/imx6dl-riotboard.dts
-@@ -305,8 +305,8 @@
- &usdhc2 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
-- cd-gpios = <&gpio1 4 0>;
-- wp-gpios = <&gpio1 2 0>;
-+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-@@ -314,8 +314,8 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 0>;
-- wp-gpios = <&gpio7 1 0>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6q-arm2.dts b/arch/arm/boot/dts/imx6q-arm2.dts
-index 78df05e9d1ce..d6515f7a56c4 100644
---- a/arch/arm/boot/dts/imx6q-arm2.dts
-+++ b/arch/arm/boot/dts/imx6q-arm2.dts
-@@ -11,6 +11,7 @@
- */
-
- /dts-v1/;
-+#include <dt-bindings/gpio/gpio.h>
- #include "imx6q.dtsi"
-
- / {
-@@ -196,8 +197,8 @@
- };
-
- &usdhc3 {
-- cd-gpios = <&gpio6 11 0>;
-- wp-gpios = <&gpio6 14 0>;
-+ cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
- vmmc-supply = <®_3p3v>;
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3
-diff --git a/arch/arm/boot/dts/imx6q-gk802.dts b/arch/arm/boot/dts/imx6q-gk802.dts
-index 703539cf36d3..00bd63e63d0c 100644
---- a/arch/arm/boot/dts/imx6q-gk802.dts
-+++ b/arch/arm/boot/dts/imx6q-gk802.dts
-@@ -7,6 +7,7 @@
- */
-
- /dts-v1/;
-+#include <dt-bindings/gpio/gpio.h>
- #include "imx6q.dtsi"
-
- / {
-@@ -161,7 +162,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
- bus-width = <4>;
-- cd-gpios = <&gpio6 11 0>;
-+ cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
-index a43abfa21e33..5645d52850a7 100644
---- a/arch/arm/boot/dts/imx6q-tbs2910.dts
-+++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
-@@ -251,7 +251,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
- bus-width = <4>;
-- cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-@@ -260,7 +260,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
- bus-width = <4>;
-- cd-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
- wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
-diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
-index e6d9195a1da7..f4d6ae564ead 100644
---- a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
-@@ -173,7 +173,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc1>;
- vmmc-supply = <®_3p3v>;
-- cd-gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-
-@@ -181,7 +181,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
- vmmc-supply = <®_3p3v>;
-- cd-gpios = <&gpio4 8 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio4 8 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-
-diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
-index 1d85de2befb3..a47a0399a172 100644
---- a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
-@@ -392,7 +392,7 @@
- &usdhc1 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc1>;
-- cd-gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
- no-1-8-v;
- status = "okay";
- };
-@@ -400,7 +400,7 @@
- &usdhc2 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
-- cd-gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio4 5 GPIO_ACTIVE_LOW>;
- wp-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
- no-1-8-v;
- status = "okay";
-diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
-index 59e5d15e3ec4..ff41f83551de 100644
---- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
-@@ -258,6 +258,6 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_cubox_i_usdhc2_aux &pinctrl_cubox_i_usdhc2>;
- vmmc-supply = <®_3p3v>;
-- cd-gpios = <&gpio1 4 0>;
-+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
-index 2c253d6d20bd..45e7c39e80d5 100644
---- a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
-@@ -1,3 +1,5 @@
-+#include <dt-bindings/gpio/gpio.h>
-+
- / {
- regulators {
- compatible = "simple-bus";
-@@ -181,7 +183,7 @@
- &usdhc2 { /* module slot */
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
-- cd-gpios = <&gpio2 2 0>;
-+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-
-diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
-index b5756c21ea1d..4493f6e99330 100644
---- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
-@@ -318,7 +318,7 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
-index 86f03c1b147c..a857d1294609 100644
---- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
-@@ -324,7 +324,7 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
-index 4a8d97f47759..1afe3385e2d2 100644
---- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
-@@ -417,7 +417,7 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
-index 62a82f3eba88..6dd0b764e036 100644
---- a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
-@@ -299,6 +299,6 @@
- &pinctrl_hummingboard_usdhc2
- >;
- vmmc-supply = <®_3p3v>;
-- cd-gpios = <&gpio1 4 0>;
-+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
-index 3af16dfe417b..d7fe6672d00c 100644
---- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
-@@ -453,7 +453,7 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 0>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-@@ -461,7 +461,7 @@
- &usdhc4 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc4>;
-- cd-gpios = <&gpio2 6 0>;
-+ cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
-index 1ce6133b67f5..9e6ecd99b472 100644
---- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
-@@ -409,8 +409,8 @@
- &usdhc2 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
-- cd-gpios = <&gpio1 4 0>;
-- wp-gpios = <&gpio1 2 0>;
-+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
- status = "disabled";
- };
-
-@@ -418,7 +418,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3
- &pinctrl_usdhc3_cdwp>;
-- cd-gpios = <&gpio1 27 0>;
-- wp-gpios = <&gpio1 29 0>;
-+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
- status = "disabled";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
-index 488a640796ac..3373fd958e95 100644
---- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
-@@ -342,7 +342,7 @@
- pinctrl-0 = <&pinctrl_usdhc2>;
- bus-width = <4>;
- cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
-- wp-gpios = <&gpio2 3 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-@@ -351,6 +351,6 @@
- pinctrl-0 = <&pinctrl_usdhc3>;
- bus-width = <4>;
- cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
-- wp-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
-index 3b24b12651b2..e329ca5c3322 100644
---- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
-@@ -467,8 +467,8 @@
- pinctrl-0 = <&pinctrl_usdhc3>;
- pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-- cd-gpios = <&gpio6 15 0>;
-- wp-gpios = <&gpio1 13 0>;
-+ cd-gpios = <&gpio6 15 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio1 13 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-diff --git a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
-index e00c44f6a0df..782379320517 100644
---- a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
-@@ -448,8 +448,8 @@
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio7 0 0>;
-- wp-gpios = <&gpio7 1 0>;
-+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-@@ -457,7 +457,7 @@
- &usdhc4 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc4>;
-- cd-gpios = <&gpio2 6 0>;
-+ cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
- vmmc-supply = <®_3p3v>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-index a626e6dd8022..944eb81cb2b8 100644
---- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-@@ -562,8 +562,8 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc2>;
- bus-width = <8>;
-- cd-gpios = <&gpio2 2 0>;
-- wp-gpios = <&gpio2 3 0>;
-+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-@@ -571,8 +571,8 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
- bus-width = <8>;
-- cd-gpios = <&gpio2 0 0>;
-- wp-gpios = <&gpio2 1 0>;
-+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
-index f02b80b41d4f..da08de324e9e 100644
---- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
-@@ -680,7 +680,7 @@
- pinctrl-0 = <&pinctrl_usdhc1>;
- bus-width = <4>;
- no-1-8-v;
-- cd-gpios = <&gpio7 2 0>;
-+ cd-gpios = <&gpio7 2 GPIO_ACTIVE_LOW>;
- fsl,wp-controller;
- status = "okay";
- };
-@@ -690,7 +690,7 @@
- pinctrl-0 = <&pinctrl_usdhc2>;
- bus-width = <4>;
- no-1-8-v;
-- cd-gpios = <&gpio7 3 0>;
-+ cd-gpios = <&gpio7 3 GPIO_ACTIVE_LOW>;
- fsl,wp-controller;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
-index 5fb091675582..9e096d811bed 100644
---- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
-@@ -9,6 +9,8 @@
- *
- */
-
-+#include <dt-bindings/gpio/gpio.h>
-+
- / {
- regulators {
- compatible = "simple-bus";
-@@ -250,13 +252,13 @@
- &usdhc1 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc1>;
-- cd-gpios = <&gpio1 2 0>;
-+ cd-gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-
- &usdhc3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc3>;
-- cd-gpios = <&gpio3 9 0>;
-+ cd-gpios = <&gpio3 9 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
-index 945887d3fdb3..b84dff2e94ea 100644
---- a/arch/arm/boot/dts/imx6sl-evk.dts
-+++ b/arch/arm/boot/dts/imx6sl-evk.dts
-@@ -617,8 +617,8 @@
- pinctrl-1 = <&pinctrl_usdhc1_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc1_200mhz>;
- bus-width = <8>;
-- cd-gpios = <&gpio4 7 0>;
-- wp-gpios = <&gpio4 6 0>;
-+ cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-@@ -627,8 +627,8 @@
- pinctrl-0 = <&pinctrl_usdhc2>;
- pinctrl-1 = <&pinctrl_usdhc2_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc2_200mhz>;
-- cd-gpios = <&gpio5 0 0>;
-- wp-gpios = <&gpio4 29 0>;
-+ cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
-+ wp-gpios = <&gpio4 29 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
-
-@@ -637,6 +637,6 @@
- pinctrl-0 = <&pinctrl_usdhc3>;
- pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-- cd-gpios = <&gpio3 22 0>;
-+ cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
- status = "okay";
- };
-diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
-index e3c0b63c2205..115f3fd78971 100644
---- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
-+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
-@@ -49,7 +49,7 @@
- pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
- bus-width = <8>;
-- cd-gpios = <&gpio7 10 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio7 10 GPIO_ACTIVE_LOW>;
- wp-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
- keep-power-in-suspend;
- enable-sdio-wakeup;
-@@ -61,7 +61,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc4>;
- bus-width = <8>;
-- cd-gpios = <&gpio7 11 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
- no-1-8-v;
- keep-power-in-suspend;
- enable-sdio-wakup;
-diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
-index cef04cef3a80..ac88c3467078 100644
---- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
-+++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
-@@ -293,7 +293,7 @@
- pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
- pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
- bus-width = <8>;
-- cd-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>;
- wp-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>;
- keep-power-in-suspend;
- enable-sdio-wakeup;
-@@ -304,7 +304,7 @@
- &usdhc4 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc4>;
-- cd-gpios = <&gpio6 21 GPIO_ACTIVE_HIGH>;
-+ cd-gpios = <&gpio6 21 GPIO_ACTIVE_LOW>;
- wp-gpios = <&gpio6 20 GPIO_ACTIVE_HIGH>;
- status = "okay";
- };
--- /dev/null
+From 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 13 Aug 2015 15:44:51 -0700
+Subject: inet: fix potential deadlock in reqsk_queue_unlink()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af upstream.
+
+When replacing del_timer() with del_timer_sync(), I introduced
+a deadlock condition :
+
+reqsk_queue_unlink() is called from inet_csk_reqsk_queue_drop()
+
+inet_csk_reqsk_queue_drop() can be called from many contexts,
+one being the timer handler itself (reqsk_timer_handler()).
+
+In this case, del_timer_sync() loops forever.
+
+Simple fix is to test if timer is pending.
+
+Fixes: 2235f2ac75fd ("inet: fix races with reqsk timers")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
+Cc: Andre Tomt <andre@tomt.net>
+Cc: Chris Caputo <ccaputo@alt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -584,7 +584,7 @@ static bool reqsk_queue_unlink(struct re
+ }
+
+ spin_unlock(&queue->syn_wait_lock);
+- if (del_timer_sync(&req->rsk_timer))
++ if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
+ reqsk_put(req);
+ return found;
+ }
--- /dev/null
+From 53960059d56ecef67d4ddd546731623641a3d2d1 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Fri, 27 Mar 2015 08:33:43 +0000
+Subject: MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 53960059d56ecef67d4ddd546731623641a3d2d1 upstream.
+
+If there is a DMA zone (usually 24bit = 16MB I believe), but no DMA32
+zone, as is the case for some 32-bit kernels, then massage_gfp_flags()
+will cause DMA memory allocated for devices with a 32..63-bit
+coherent_dma_mask to fall back to using __GFP_DMA, even though there may
+only be 32-bits of physical address available anyway.
+
+Correct that case to compare against a mask the size of phys_addr_t
+instead of always using a 64-bit mask.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Fixes: a2e715a86c6d ("MIPS: DMA: Fix computation of DMA flags from device's coherent_dma_mask.")
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9610/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/dma-default.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/mm/dma-default.c
++++ b/arch/mips/mm/dma-default.c
+@@ -100,7 +100,7 @@ static gfp_t massage_gfp_flags(const str
+ else
+ #endif
+ #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
+ dma_flag = __GFP_DMA;
+ else
+ #endif
--- /dev/null
+From e297c939b745e420ef0b9dc989cb87bda617b399 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Thu, 10 Sep 2015 14:36:21 +1000
+Subject: powerpc/MSI: Fix race condition in tearing down MSI interrupts
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream.
+
+This fixes a race which can result in the same virtual IRQ number
+being assigned to two different MSI interrupts. The most visible
+consequence of that is usually a warning and stack trace from the
+sysfs code about an attempt to create a duplicate entry in sysfs.
+
+The race happens when one CPU (say CPU 0) is disposing of an MSI
+while another CPU (say CPU 1) is setting up an MSI. CPU 0 calls
+(for example) pnv_teardown_msi_irqs(), which calls
+msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its
+hardware IRQ number) is no longer in use. Then, before CPU 0 gets
+to calling irq_dispose_mapping() to free up the virtal IRQ number,
+CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an
+MSI, and gets the same hardware IRQ number that CPU 0 just freed.
+CPU 1 then calls irq_create_mapping() to get a virtual IRQ number,
+which sees that there is currently a mapping for that hardware IRQ
+number and returns the corresponding virtual IRQ number (which is
+the same virtual IRQ number that CPU 0 was using). CPU 0 then
+calls irq_dispose_mapping() and frees that virtual IRQ number.
+Now, if another CPU comes along and calls irq_create_mapping(), it
+is likely to get the virtual IRQ number that was just freed,
+resulting in the same virtual IRQ number apparently being used for
+two different hardware interrupts.
+
+To fix this race, we just move the call to msi_bitmap_free_hwirqs()
+to after the call to irq_dispose_mapping(). Since virq_to_hw()
+doesn't work for the virtual IRQ number after irq_dispose_mapping()
+has been called, we need to call it before irq_dispose_mapping() and
+remember the result for the msi_bitmap_free_hwirqs() call.
+
+The pattern of calling msi_bitmap_free_hwirqs() before
+irq_dispose_mapping() appears in 5 places under arch/powerpc, and
+appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC
+U3/U4 MSI backend") from 2007.
+
+Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend")
+Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/powerpc/platforms/powernv/pci.c | 5 +++--
+ arch/powerpc/sysdev/fsl_msi.c | 5 +++--
+ arch/powerpc/sysdev/mpic_pasemi_msi.c | 6 ++++--
+ arch/powerpc/sysdev/mpic_u3msi.c | 5 +++--
+ arch/powerpc/sysdev/ppc4xx_msi.c | 5 +++--
+ 5 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -99,6 +99,7 @@ static void pnv_teardown_msi_irqs(struct
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ if (WARN_ON(!phb))
+ return;
+@@ -106,10 +107,10 @@ static void pnv_teardown_msi_irqs(struct
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&phb->msi_bmp,
+- virq_to_hw(entry->irq) - phb->msi_base, 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1);
+ }
+ }
+ #endif /* CONFIG_PCI_MSI */
+--- a/arch/powerpc/sysdev/fsl_msi.c
++++ b/arch/powerpc/sysdev/fsl_msi.c
+@@ -128,15 +128,16 @@ static void fsl_teardown_msi_irqs(struct
+ {
+ struct msi_desc *entry;
+ struct fsl_msi *msi_data;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ msi_data = irq_get_chip_data(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+
+ return;
+--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
++++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
+@@ -65,6 +65,7 @@ static struct irq_chip mpic_pasemi_msi_c
+ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
+
+@@ -72,10 +73,11 @@ static void pasemi_msi_teardown_msi_irqs
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), ALLOC_CHUNK);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
++ hwirq, ALLOC_CHUNK);
+ }
+
+ return;
+--- a/arch/powerpc/sysdev/mpic_u3msi.c
++++ b/arch/powerpc/sysdev/mpic_u3msi.c
+@@ -107,15 +107,16 @@ static u64 find_u4_magic_addr(struct pci
+ static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
+ }
+
+ return;
+--- a/arch/powerpc/sysdev/ppc4xx_msi.c
++++ b/arch/powerpc/sysdev/ppc4xx_msi.c
+@@ -124,16 +124,17 @@ void ppc4xx_teardown_msi_irqs(struct pci
+ {
+ struct msi_desc *entry;
+ struct ppc4xx_msi *msi_data = &ppc4xx_msi;
++ irq_hw_number_t hwirq;
+
+ dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
+
+ list_for_each_entry(entry, &dev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+ }
+
--- /dev/null
+From a8b9774571d46506a0774b1ced3493b1245cf893 Mon Sep 17 00:00:00 2001
+From: Christian Engelmayer <cengelma@gmx.at>
+Date: Fri, 21 Aug 2015 23:14:26 +0200
+Subject: rsi: Fix possible leak when loading firmware
+
+From: Christian Engelmayer <cengelma@gmx.at>
+
+commit a8b9774571d46506a0774b1ced3493b1245cf893 upstream.
+
+Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory
+leak fix and fix the leak") also added a check on the allocation of
+DMA-accessible memory that may directly return. In that case the
+already allocated firmware data is leaked. Make sure the data is
+always freed correctly. Detected by Coverity CID 1316519.
+
+Fixes: 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak")
+Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 ++++++--
+ drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 8 ++++++--
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(stru
+
+ /* Copy firmware into DMA-accessible memory */
+ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+- if (!fw)
+- return -ENOMEM;
++ if (!fw) {
++ status = -ENOMEM;
++ goto out;
++ }
+ len = fw_entry->size;
+
+ if (len % 4)
+@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(stru
+
+ status = rsi_copy_to_card(common, fw, len, num_blocks);
+ kfree(fw);
++
++out:
+ release_firmware(fw_entry);
+ return status;
+ }
+--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(stru
+
+ /* Copy firmware into DMA-accessible memory */
+ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+- if (!fw)
+- return -ENOMEM;
++ if (!fw) {
++ status = -ENOMEM;
++ goto out;
++ }
+ len = fw_entry->size;
+
+ if (len % 4)
+@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(stru
+
+ status = rsi_copy_to_card(common, fw, len, num_blocks);
+ kfree(fw);
++
++out:
+ release_firmware(fw_entry);
+ return status;
+ }
regmap-debugfs-ensure-we-don-t-underflow-when-printing-access-masks.patch
regmap-debugfs-don-t-bother-actually-printing-when-calculating-max-length.patch
security-fix-typo-in-security_task_prctl.patch
-dts-imx6-fix-sd-card-gpio-polarity-specified-in-device-tree.patch
+usb-musb-dsps-fix-polling-in-device-only-mode.patch
+usb-chipidea-udc-using-the-correct-stall-implementation.patch
+usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch
+usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch
+usb-musb-cppi41-allow-it-to-work-again.patch
+usb-chaoskey-read-offset-bug.patch
+usb-add-device-quirk-for-logitech-ptz-cameras.patch
+usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch
+cpu-cacheinfo-fix-teardown-path.patch
+cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch
+mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch
+batman-adv-make-nc-capability-changes-atomic.patch
+batman-adv-make-tt-capability-changes-atomic.patch
+batman-adv-make-mcast-capability-changes-atomic.patch
+batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch
+batman-adv-fix-potentially-broken-skb-network-header-access.patch
+tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch
+powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch
+rsi-fix-possible-leak-when-loading-firmware.patch
+inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch
--- /dev/null
+From c2e4b24ff848bb180f9b9cd873a38327cd219ad2 Mon Sep 17 00:00:00 2001
+From: Kapileshwar Singh <kapileshwar.singh@arm.com>
+Date: Tue, 22 Sep 2015 14:22:03 +0100
+Subject: tools lib traceevent: Fix string handling in heterogeneous arch environments
+
+From: Kapileshwar Singh <kapileshwar.singh@arm.com>
+
+commit c2e4b24ff848bb180f9b9cd873a38327cd219ad2 upstream.
+
+When a trace recorded on a 32-bit device is processed with a 64-bit
+binary, the higher 32-bits of the address need to ignored.
+
+The lack of this results in the output of the 64-bit pointer
+value to the trace as the 32-bit address lookup fails in find_printk().
+
+Before:
+
+ burn-1778 [003] 548.600305: bputs: 0xc0046db2s: 2cec5c058d98c
+
+After:
+
+ burn-1778 [003] 548.600305: bputs: 0xc0046db2s: RT throttling activated
+
+The problem occurs in PRINT_FIELD when the field is recognized as a
+pointer to a string (of the type const char *)
+
+Heterogeneous architectures cases below can arise and should be handled:
+
+* Traces recorded using 32-bit addresses processed on a 64-bit machine
+* Traces recorded using 64-bit addresses processed on a 32-bit machine
+
+Reported-by: Juri Lelli <juri.lelli@arm.com>
+Signed-off-by: Kapileshwar Singh <kapileshwar.singh@arm.com>
+Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Javi Merino <javi.merino@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lkml.kernel.org/r/1442928123-13824-1-git-send-email-kapileshwar.singh@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/lib/traceevent/event-parse.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -3721,7 +3721,7 @@ static void print_str_arg(struct trace_s
+ struct format_field *field;
+ struct printk_map *printk;
+ long long val, fval;
+- unsigned long addr;
++ unsigned long long addr;
+ char *str;
+ unsigned char *hex;
+ int print;
+@@ -3754,13 +3754,30 @@ static void print_str_arg(struct trace_s
+ */
+ if (!(field->flags & FIELD_IS_ARRAY) &&
+ field->size == pevent->long_size) {
+- addr = *(unsigned long *)(data + field->offset);
++
++ /* Handle heterogeneous recording and processing
++ * architectures
++ *
++ * CASE I:
++ * Traces recorded on 32-bit devices (32-bit
++ * addressing) and processed on 64-bit devices:
++ * In this case, only 32 bits should be read.
++ *
++ * CASE II:
++ * Traces recorded on 64 bit devices and processed
++ * on 32-bit devices:
++ * In this case, 64 bits must be read.
++ */
++ addr = (pevent->long_size == 8) ?
++ *(unsigned long long *)(data + field->offset) :
++ (unsigned long long)*(unsigned int *)(data + field->offset);
++
+ /* Check if it matches a print format */
+ printk = find_printk(pevent, addr);
+ if (printk)
+ trace_seq_puts(s, printk->printk);
+ else
+- trace_seq_printf(s, "%lx", addr);
++ trace_seq_printf(s, "%llx", addr);
+ break;
+ }
+ str = malloc(len + 1);
--- /dev/null
+From 72194739f54607bbf8cfded159627a2015381557 Mon Sep 17 00:00:00 2001
+From: Vincent Palatin <vpalatin@chromium.org>
+Date: Thu, 1 Oct 2015 14:10:22 -0700
+Subject: usb: Add device quirk for Logitech PTZ cameras
+
+From: Vincent Palatin <vpalatin@chromium.org>
+
+commit 72194739f54607bbf8cfded159627a2015381557 upstream.
+
+Add a device quirk for the Logitech PTZ Pro Camera and its sibling the
+ConferenceCam CC3000e Camera.
+This fixes the failed camera enumeration on some boot, particularly on
+machines with fast CPU.
+
+Tested by connecting a Logitech PTZ Pro Camera to a machine with a
+Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles
+while recording the kernel logs and taking camera picture after each boot.
+Before the patch, more than 7% of the boots show some enumeration transfer
+failures and in a few of them, the kernel is giving up before actually
+enumerating the webcam. After the patch, the enumeration has been correct
+on every reboot.
+
+Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Logitech ConferenceCam CC3000e */
++ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
++
++ /* Logitech PTZ Pro Camera */
++ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Logitech Quickcam Fusion */
+ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 8484bf2981b3d006426ac052a3642c9ce1d8d980 Mon Sep 17 00:00:00 2001
+From: Yao-Wen Mao <yaowen@google.com>
+Date: Mon, 31 Aug 2015 14:24:09 +0800
+Subject: USB: Add reset-resume quirk for two Plantronics usb headphones.
+
+From: Yao-Wen Mao <yaowen@google.com>
+
+commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.
+
+These two headphones need a reset-resume quirk to properly resume to
+original volume level.
+
+Signed-off-by: Yao-Wen Mao <yaowen@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -85,6 +85,12 @@ static const struct usb_device_id usb_qu
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Plantronic Audio 655 DSP */
++ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
++
++ /* Plantronic Audio 648 USB */
++ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Artisman Watchdog Dongle */
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
--- /dev/null
+From 1d5c47f555c5ae050fad22e4a99f88856cae5d05 Mon Sep 17 00:00:00 2001
+From: Alexander Inyukhin <shurick@sectorb.msk.ru>
+Date: Sat, 26 Sep 2015 15:24:21 +0300
+Subject: USB: chaoskey read offset bug
+
+From: Alexander Inyukhin <shurick@sectorb.msk.ru>
+
+commit 1d5c47f555c5ae050fad22e4a99f88856cae5d05 upstream.
+
+Rng reads in chaoskey driver could return the same data under
+the certain conditions.
+
+Signed-off-by: Alexander Inyukhin <shurick@sectorb.msk.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/chaoskey.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/chaoskey.c
++++ b/drivers/usb/misc/chaoskey.c
+@@ -472,7 +472,7 @@ static int chaoskey_rng_read(struct hwrn
+ if (this_time > max)
+ this_time = max;
+
+- memcpy(data, dev->buf, this_time);
++ memcpy(data, dev->buf + dev->used, this_time);
+
+ dev->used += this_time;
+
--- /dev/null
+From 56ffa1d154c7e12af16273f0cdc42690dd05caf5 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Mon, 24 Aug 2015 14:10:07 +0800
+Subject: usb: chipidea: udc: using the correct stall implementation
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 56ffa1d154c7e12af16273f0cdc42690dd05caf5 upstream.
+
+According to spec, there are functional and protocol stalls.
+
+For functional stall, it is for bulk and interrupt endpoints,
+below are cases for it:
+- Host sends SET_FEATURE request for Set-Halt, the udc driver
+needs to set stall, and return true unconditionally.
+- The gadget driver may call usb_ep_set_halt to stall certain
+endpoints, if there is a transfer in pending, the udc driver
+should not set stall, and return -EAGAIN accordingly.
+These two kinds of stall need to be cleared by host using CLEAR_FEATURE
+request (Clear-Halt).
+
+For protocol stall, it is for control endpoint, this stall will
+be set if the control request has failed. This stall will be
+cleared by next setup request (hardware will do it).
+
+It fixed usbtest (drivers/usb/misc/usbtest.c) Test 13 "set/clear halt"
+test failure, meanwhile, this change has been verified by
+USB2 CV Compliance Test and MSC Tests.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 84 +++++++++++++++++++++++----------------------
+ 1 file changed, 44 insertions(+), 40 deletions(-)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -656,6 +656,44 @@ __acquires(hwep->lock)
+ return 0;
+ }
+
++static int _ep_set_halt(struct usb_ep *ep, int value, bool check_transfer)
++{
++ struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
++ int direction, retval = 0;
++ unsigned long flags;
++
++ if (ep == NULL || hwep->ep.desc == NULL)
++ return -EINVAL;
++
++ if (usb_endpoint_xfer_isoc(hwep->ep.desc))
++ return -EOPNOTSUPP;
++
++ spin_lock_irqsave(hwep->lock, flags);
++
++ if (value && hwep->dir == TX && check_transfer &&
++ !list_empty(&hwep->qh.queue) &&
++ !usb_endpoint_xfer_control(hwep->ep.desc)) {
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return -EAGAIN;
++ }
++
++ direction = hwep->dir;
++ do {
++ retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
++
++ if (!value)
++ hwep->wedge = 0;
++
++ if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
++ hwep->dir = (hwep->dir == TX) ? RX : TX;
++
++ } while (hwep->dir != direction);
++
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return retval;
++}
++
++
+ /**
+ * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts
+ * @gadget: gadget
+@@ -1051,7 +1089,7 @@ __acquires(ci->lock)
+ num += ci->hw_ep_max / 2;
+
+ spin_unlock(&ci->lock);
+- err = usb_ep_set_halt(&ci->ci_hw_ep[num].ep);
++ err = _ep_set_halt(&ci->ci_hw_ep[num].ep, 1, false);
+ spin_lock(&ci->lock);
+ if (!err)
+ isr_setup_status_phase(ci);
+@@ -1110,8 +1148,8 @@ delegate:
+
+ if (err < 0) {
+ spin_unlock(&ci->lock);
+- if (usb_ep_set_halt(&hwep->ep))
+- dev_err(ci->dev, "error: ep_set_halt\n");
++ if (_ep_set_halt(&hwep->ep, 1, false))
++ dev_err(ci->dev, "error: _ep_set_halt\n");
+ spin_lock(&ci->lock);
+ }
+ }
+@@ -1142,9 +1180,9 @@ __acquires(ci->lock)
+ err = isr_setup_status_phase(ci);
+ if (err < 0) {
+ spin_unlock(&ci->lock);
+- if (usb_ep_set_halt(&hwep->ep))
++ if (_ep_set_halt(&hwep->ep, 1, false))
+ dev_err(ci->dev,
+- "error: ep_set_halt\n");
++ "error: _ep_set_halt\n");
+ spin_lock(&ci->lock);
+ }
+ }
+@@ -1390,41 +1428,7 @@ static int ep_dequeue(struct usb_ep *ep,
+ */
+ static int ep_set_halt(struct usb_ep *ep, int value)
+ {
+- struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
+- int direction, retval = 0;
+- unsigned long flags;
+-
+- if (ep == NULL || hwep->ep.desc == NULL)
+- return -EINVAL;
+-
+- if (usb_endpoint_xfer_isoc(hwep->ep.desc))
+- return -EOPNOTSUPP;
+-
+- spin_lock_irqsave(hwep->lock, flags);
+-
+-#ifndef STALL_IN
+- /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
+- if (value && hwep->type == USB_ENDPOINT_XFER_BULK && hwep->dir == TX &&
+- !list_empty(&hwep->qh.queue)) {
+- spin_unlock_irqrestore(hwep->lock, flags);
+- return -EAGAIN;
+- }
+-#endif
+-
+- direction = hwep->dir;
+- do {
+- retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
+-
+- if (!value)
+- hwep->wedge = 0;
+-
+- if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
+- hwep->dir = (hwep->dir == TX) ? RX : TX;
+-
+- } while (hwep->dir != direction);
+-
+- spin_unlock_irqrestore(hwep->lock, flags);
+- return retval;
++ return _ep_set_halt(ep, value, true);
+ }
+
+ /**
--- /dev/null
+From b0a688ddcc5015eb26000c63841db7c46cfb380a Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Thu, 6 Aug 2015 10:51:29 -0500
+Subject: usb: musb: cppi41: allow it to work again
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit b0a688ddcc5015eb26000c63841db7c46cfb380a upstream.
+
+since commit 33c300cb90a6 ("usb: musb: dsps:
+don't fake of_node to musb core") we have been
+preventing CPPI 4.1 from probing due to NULL
+of_node. We can't revert said commit otherwise
+a different regression would show up, so the fix
+is to look for the parent device's (glue layer's)
+of_node instead, since that's the thing which
+is actually described in DTS.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_cppi41.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -614,7 +614,7 @@ static int cppi41_dma_controller_start(s
+ {
+ struct musb *musb = controller->musb;
+ struct device *dev = musb->controller;
+- struct device_node *np = dev->of_node;
++ struct device_node *np = dev->parent->of_node;
+ struct cppi41_dma_channel *cppi41_channel;
+ int count;
+ int i;
+@@ -664,7 +664,7 @@ static int cppi41_dma_controller_start(s
+ musb_dma->status = MUSB_DMA_STATUS_FREE;
+ musb_dma->max_len = SZ_4M;
+
+- dc = dma_request_slave_channel(dev, str);
++ dc = dma_request_slave_channel(dev->parent, str);
+ if (!dc) {
+ dev_err(dev, "Failed to request %s.\n", str);
+ ret = -EPROBE_DEFER;
+@@ -694,7 +694,7 @@ struct dma_controller *dma_controller_cr
+ struct cppi41_dma_controller *controller;
+ int ret = 0;
+
+- if (!musb->controller->of_node) {
++ if (!musb->controller->parent->of_node) {
+ dev_err(musb->controller, "Need DT for the DMA engine.\n");
+ return NULL;
+ }
--- /dev/null
+From b8239dcc03afbd0886c1d9b91ba8fee7c6c9a6cb Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Wed, 16 Sep 2015 14:49:28 -0500
+Subject: usb: musb: dsps: fix polling in device-only mode
+
+From: Bin Liu <b-liu@ti.com>
+
+commit b8239dcc03afbd0886c1d9b91ba8fee7c6c9a6cb upstream.
+
+Fix the regression caused by commit ad78c918602 ("usb: musb: dsps: just
+start polling already") which causes polling the ID pin status even in
+device-only mode.
+
+Fixes: ad78c918602c ("usb: musb: dsps: just start polling already")
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_dsps.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -225,8 +225,11 @@ static void dsps_musb_enable(struct musb
+
+ dsps_writel(reg_base, wrp->epintr_set, epmask);
+ dsps_writel(reg_base, wrp->coreintr_set, coremask);
+- /* start polling for ID change. */
+- mod_timer(&glue->timer, jiffies + msecs_to_jiffies(wrp->poll_timeout));
++ /* start polling for ID change in dual-role idle mode */
++ if (musb->xceiv->otg->state == OTG_STATE_B_IDLE &&
++ musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
++ mod_timer(&glue->timer, jiffies +
++ msecs_to_jiffies(wrp->poll_timeout));
+ dsps_musb_try_idle(musb, 0);
+ }
+
--- /dev/null
+From 762982db33b23029e98c844611e2e8beeb75bc0d Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 13 Aug 2015 13:28:42 +0300
+Subject: usb: phy: phy-generic: Fix reset behaviour on legacy boot
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit 762982db33b23029e98c844611e2e8beeb75bc0d upstream.
+
+The gpio-desc migration done in v4.0 caused a regression
+with legacy boots due to reversed reset logic.
+e.g. omap3-beagle USB host breaks on legacy boot.
+
+Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that
+it matches the driver logic and pin behaviour.
+
+Fixes: e9f2cefb0cdc ("usb: phy: generic: migrate to gpio_desc")
+Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/phy/phy-generic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/phy/phy-generic.c
++++ b/drivers/usb/phy/phy-generic.c
+@@ -230,7 +230,8 @@ int usb_phy_gen_create_phy(struct device
+ clk_rate = pdata->clk_rate;
+ needs_vcc = pdata->needs_vcc;
+ if (gpio_is_valid(pdata->gpio_reset)) {
+- err = devm_gpio_request_one(dev, pdata->gpio_reset, 0,
++ err = devm_gpio_request_one(dev, pdata->gpio_reset,
++ GPIOF_ACTIVE_LOW,
+ dev_name(dev));
+ if (!err)
+ nop->gpiod_reset =
--- /dev/null
+From ff30cbc8da425754e8ab96904db1d295bd034f27 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 21 Sep 2015 17:46:09 +0300
+Subject: usb: Use the USB_SS_MULT() macro to get the burst multiplier.
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.
+
+Bits 1:0 of the bmAttributes are used for the burst multiplier.
+The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
+into use.
+
+Use the existing USB_SS_MULT() macro instead to make sure the mult value
+and hence max packet calculations are correct for USB3.1 devices.
+
+Note that burst multiplier in bmAttributes is zero based and that
+the USB_SS_MULT() macro adds one.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -112,7 +112,7 @@ static void usb_parse_ss_endpoint_compan
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 16;
+ } else if (usb_endpoint_xfer_isoc(&ep->desc) &&
+- desc->bmAttributes > 2) {
++ USB_SS_MULT(desc->bmAttributes) > 3) {
+ dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+ "config %d interface %d altsetting %d ep %d: "
+ "setting to 3\n", desc->bmAttributes + 1,
+@@ -121,7 +121,8 @@ static void usb_parse_ss_endpoint_compan
+ }
+
+ if (usb_endpoint_xfer_isoc(&ep->desc))
+- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
++ max_tx = (desc->bMaxBurst + 1) *
++ (USB_SS_MULT(desc->bmAttributes)) *
+ usb_endpoint_maxp(&ep->desc);
+ else if (usb_endpoint_xfer_int(&ep->desc))
+ max_tx = usb_endpoint_maxp(&ep->desc) *
projects / thirdparty / kernel / stable-queue.git / commitdiff
