From: Greg Kroah-Hartman Date: Sat, 8 Aug 2015 21:06:40 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v4.1.5~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3ec1100a28cdc4f9034a8400e5935333d145dc9b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch efi-check-for-null-efi-kernel-parameters.patch efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch input-zforce-don-t-overwrite-the-stack.patch iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch iwlwifi-pcie-prepare-the-device-before-accessing-it.patch md-raid1-fix-test-for-was-read-error-from-last-working-device.patch mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch serial-core-fix-crashes-while-echoing-when-closing.patch spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch spi-imx-fix-small-dma-transfers.patch tile-use-free_bootmem_late-for-initrd.patch usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch xhci-calculate-old-endpoints-correctly-on-device-reset.patch xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch xhci-report-u3-when-link-is-in-resume-state.patch --- diff --git a/queue-4.1/arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch b/queue-4.1/arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch new file mode 100644 index 00000000000..9109a8ffe0c --- /dev/null +++ b/queue-4.1/arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch @@ -0,0 +1,45 @@ +From f91b1feada0b6f0a4d33648155b3ded2c4e0707e Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Sun, 26 Jul 2015 14:59:00 +0200 +Subject: arm64/efi: map the entire UEFI vendor string before reading it + +From: Ard Biesheuvel + +commit f91b1feada0b6f0a4d33648155b3ded2c4e0707e upstream. + +At boot, the UTF-16 UEFI vendor string is copied from the system +table into a char array with a size of 100 bytes. However, this +size of 100 bytes is also used for memremapping() the source, +which may not be sufficient if the vendor string exceeds 50 +UTF-16 characters, and the placement of the vendor string inside +a 4 KB page happens to leave the end unmapped. + +So use the correct '100 * sizeof(efi_char16_t)' for the size of +the mapping. + +Signed-off-by: Ard Biesheuvel +Fixes: f84d02755f5a ("arm64: add EFI runtime services") +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/efi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/efi.c ++++ b/arch/arm64/kernel/efi.c +@@ -122,12 +122,12 @@ static int __init uefi_init(void) + + /* Show what we know for posterity */ + c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor), +- sizeof(vendor)); ++ sizeof(vendor) * sizeof(efi_char16_t)); + if (c16) { + for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i) + vendor[i] = c16[i]; + vendor[i] = '\0'; +- early_memunmap(c16, sizeof(vendor)); ++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t)); + } + + pr_info("EFI v%u.%.02u by %s\n", diff --git a/queue-4.1/ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch b/queue-4.1/ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch new file mode 100644 index 00000000000..f61684a33d7 --- /dev/null +++ b/queue-4.1/ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch @@ -0,0 +1,39 @@ +From 945b47441d83d2392ac9f984e0267ad521f24268 Mon Sep 17 00:00:00 2001 +From: Lior Amsalem +Date: Tue, 30 Jun 2015 16:09:49 +0200 +Subject: ata: pmp: add quirk for Marvell 4140 SATA PMP + +From: Lior Amsalem + +commit 945b47441d83d2392ac9f984e0267ad521f24268 upstream. + +This commit adds the necessary quirk to make the Marvell 4140 SATA PMP +work properly. This PMP doesn't like SRST on port number 4 (the host +port) so this commit marks this port as not supporting SRST. + +Signed-off-by: Lior Amsalem +Reviewed-by: Nadav Haklai +Signed-off-by: Thomas Petazzoni +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-pmp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_p + ATA_LFLAG_NO_SRST | + ATA_LFLAG_ASSUME_ATA; + } ++ } else if (vendor == 0x11ab && devid == 0x4140) { ++ /* Marvell 4140 quirks */ ++ ata_for_each_link(link, ap, EDGE) { ++ /* port 4 is for SEMB device and it doesn't like SRST */ ++ if (link->pmp == 4) ++ link->flags |= ATA_LFLAG_DISABLED; ++ } + } + } + diff --git a/queue-4.1/blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch b/queue-4.1/blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch new file mode 100644 index 00000000000..cbb5051b2b6 --- /dev/null +++ b/queue-4.1/blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch @@ -0,0 +1,37 @@ +From 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 22 Jul 2015 18:05:53 -0400 +Subject: blkcg: fix gendisk reference leak in blkg_conf_prep() + +From: Tejun Heo + +commit 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 upstream. + +When a blkcg configuration is targeted to a partition rather than a +whole device, blkg_conf_prep fails with -EINVAL; unfortunately, it +forgets to put the gendisk ref in that case. Fix it. + +Signed-off-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-cgroup.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, + return -EINVAL; + + disk = get_gendisk(MKDEV(major, minor), &part); +- if (!disk || part) ++ if (!disk) + return -EINVAL; ++ if (part) { ++ put_disk(disk); ++ return -EINVAL; ++ } + + rcu_read_lock(); + spin_lock_irq(disk->queue->queue_lock); diff --git a/queue-4.1/efi-check-for-null-efi-kernel-parameters.patch b/queue-4.1/efi-check-for-null-efi-kernel-parameters.patch new file mode 100644 index 00000000000..0edcd06ec7a --- /dev/null +++ b/queue-4.1/efi-check-for-null-efi-kernel-parameters.patch @@ -0,0 +1,79 @@ +From 9115c7589b11349a1c3099758b4bded579ff69e0 Mon Sep 17 00:00:00 2001 +From: Ricardo Neri +Date: Wed, 15 Jul 2015 19:36:03 -0700 +Subject: efi: Check for NULL efi kernel parameters + +From: Ricardo Neri + +commit 9115c7589b11349a1c3099758b4bded579ff69e0 upstream. + +Even though it is documented how to specifiy efi parameters, it is +possible to cause a kernel panic due to a dereference of a NULL pointer when +parsing such parameters if "efi" alone is given: + +PANIC: early exception 0e rip 10:ffffffff812fb361 error 0 cr2 0 +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.2.0-rc1+ #450 +[ 0.000000] ffffffff81fe20a9 ffffffff81e03d50 ffffffff8184bb0f 00000000000003f8 +[ 0.000000] 0000000000000000 ffffffff81e03e08 ffffffff81f371a1 64656c62616e6520 +[ 0.000000] 0000000000000069 000000000000005f 0000000000000000 0000000000000000 +[ 0.000000] Call Trace: +[ 0.000000] [] dump_stack+0x45/0x57 +[ 0.000000] [] early_idt_handler_common+0x81/0xae +[ 0.000000] [] ? parse_option_str+0x11/0x90 +[ 0.000000] [] arch_parse_efi_cmdline+0x15/0x42 +[ 0.000000] [] do_early_param+0x50/0x8a +[ 0.000000] [] parse_args+0x1e3/0x400 +[ 0.000000] [] parse_early_options+0x24/0x28 +[ 0.000000] [] ? loglevel+0x31/0x31 +[ 0.000000] [] parse_early_param+0x31/0x3d +[ 0.000000] [] setup_arch+0x2de/0xc08 +[ 0.000000] [] ? vprintk_default+0x1a/0x20 +[ 0.000000] [] start_kernel+0x90/0x423 +[ 0.000000] [] x86_64_start_reservations+0x2a/0x2c +[ 0.000000] [] x86_64_start_kernel+0xeb/0xef +[ 0.000000] RIP 0xffffffff81ba2efc + +This panic is not reproducible with "efi=" as this will result in a non-NULL +zero-length string. + +Thus, verify that the pointer to the parameter string is not NULL. This is +consistent with other parameter-parsing functions which check for NULL pointers. + +Signed-off-by: Ricardo Neri +Cc: Dave Young +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/platform/efi/efi.c | 5 +++++ + drivers/firmware/efi/efi.c | 5 +++++ + 2 files changed, 10 insertions(+) + +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phy + + static int __init arch_parse_efi_cmdline(char *str) + { ++ if (!str) { ++ pr_warn("need at least one option\n"); ++ return -EINVAL; ++ } ++ + if (parse_option_str(str, "old_map")) + set_bit(EFI_OLD_MEMMAP, &efi.flags); + if (parse_option_str(str, "debug")) +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void) + + static int __init parse_efi_cmdline(char *str) + { ++ if (!str) { ++ pr_warn("need at least one option\n"); ++ return -EINVAL; ++ } ++ + if (parse_option_str(str, "noruntime")) + disable_runtime = true; + diff --git a/queue-4.1/efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch b/queue-4.1/efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch new file mode 100644 index 00000000000..e3e02bf66a1 --- /dev/null +++ b/queue-4.1/efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch @@ -0,0 +1,102 @@ +From 4c62360d7562a20c996836d163259c87d9378120 Mon Sep 17 00:00:00 2001 +From: "Luck, Tony" +Date: Tue, 30 Jun 2015 15:57:51 -0700 +Subject: efi: Handle memory error structures produced based on old versions of standard + +From: "Luck, Tony" + +commit 4c62360d7562a20c996836d163259c87d9378120 upstream. + +The memory error record structure includes as its first field a +bitmask of which subsequent fields are valid. The allows new fields +to be added to the structure while keeping compatibility with older +software that parses these records. This mechanism was used between +versions 2.2 and 2.3 to add four new fields, growing the size of the +structure from 73 bytes to 80. But Linux just added all the new +fields so this test: + if (gdata->error_data_length >= sizeof(*mem_err)) + cper_print_mem(newpfx, mem_err); + else + goto err_section_too_small; +now make Linux complain about old format records being too short. + +Add a definition for the old format of the structure and use that +for the minimum size check. Pass the actual size to cper_print_mem() +so it can sanity check the validation_bits field to ensure that if +a BIOS using the old format sets bits as if it were new, we won't +access fields beyond the end of the structure. + +Signed-off-by: Tony Luck +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/efi/cper.c | 15 ++++++++++++--- + include/linux/cper.h | 22 +++++++++++++++++++++- + 2 files changed, 33 insertions(+), 4 deletions(-) + +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct t + return ret; + } + +-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem) ++static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem, ++ int len) + { + struct cper_mem_err_compact cmem; + ++ /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */ ++ if (len == sizeof(struct cper_sec_mem_err_old) && ++ (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) { ++ pr_err(FW_WARN "valid bits set for fields beyond structure\n"); ++ return; ++ } + if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS) + printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status); + if (mem->validation_bits & CPER_MEM_VALID_PA) +@@ -405,8 +412,10 @@ static void cper_estatus_print_section( + } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) { + struct cper_sec_mem_err *mem_err = (void *)(gdata + 1); + printk("%s""section_type: memory error\n", newpfx); +- if (gdata->error_data_length >= sizeof(*mem_err)) +- cper_print_mem(newpfx, mem_err); ++ if (gdata->error_data_length >= ++ sizeof(struct cper_sec_mem_err_old)) ++ cper_print_mem(newpfx, mem_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) { +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx { + __u64 mm_reg_addr; + }; + +-/* Memory Error Section */ ++/* Old Memory Error Section UEFI 2.1, 2.2 */ ++struct cper_sec_mem_err_old { ++ __u64 validation_bits; ++ __u64 error_status; ++ __u64 physical_addr; ++ __u64 physical_addr_mask; ++ __u16 node; ++ __u16 card; ++ __u16 module; ++ __u16 bank; ++ __u16 device; ++ __u16 row; ++ __u16 column; ++ __u16 bit_pos; ++ __u64 requestor_id; ++ __u64 responder_id; ++ __u64 target_id; ++ __u8 error_type; ++}; ++ ++/* Memory Error Section UEFI >= 2.3 */ + struct cper_sec_mem_err { + __u64 validation_bits; + __u64 error_status; diff --git a/queue-4.1/input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch b/queue-4.1/input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch new file mode 100644 index 00000000000..3777e55c855 --- /dev/null +++ b/queue-4.1/input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch @@ -0,0 +1,44 @@ +From 968491709e5b1aaf429428814fff3d932fa90b60 Mon Sep 17 00:00:00 2001 +From: Bernhard Bender +Date: Thu, 23 Jul 2015 13:58:08 -0700 +Subject: Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen + +From: Bernhard Bender + +commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream. + +This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30 +touch screen. Due to a missing delay between the RESET and SET_RATE +commands, the touch screen may become unresponsive during system startup or +driver loading. + +According to the DMC documentation, a delay is needed after the RESET +command to allow the chip to complete its internal initialization. As this +delay is not guaranteed, we had a system where the touch screen +occasionally did not send any touch data. There was no other indication of +the problem. + +The patch fixes the problem by adding a 150ms delay between the RESET and +SET_RATE commands. + +Suggested-by: Jakob Mustafa +Signed-off-by: Bernhard Bender +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/usbtouchscreen.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouc + goto err_out; + } + ++ /* TSC-25 data sheet specifies a delay after the RESET command */ ++ msleep(150); ++ + /* set coordinate output rate */ + buf[0] = buf[1] = 0xFF; + ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), diff --git a/queue-4.1/input-zforce-don-t-overwrite-the-stack.patch b/queue-4.1/input-zforce-don-t-overwrite-the-stack.patch new file mode 100644 index 00000000000..8e7c6e523ed --- /dev/null +++ b/queue-4.1/input-zforce-don-t-overwrite-the-stack.patch @@ -0,0 +1,32 @@ +From 7d01cd261c76f95913c81554a751968a1d282d3a Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Mon, 13 Jul 2015 09:54:42 -0700 +Subject: Input: zforce - don't overwrite the stack + +From: Oleksij Rempel + +commit 7d01cd261c76f95913c81554a751968a1d282d3a upstream. + +If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we +will silently overwrite the stack. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Dirk Behme +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/zforce_ts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/zforce_ts.c ++++ b/drivers/input/touchscreen/zforce_ts.c +@@ -430,7 +430,7 @@ static int zforce_read_packet(struct zfo + goto unlock; + } + +- if (buf[PAYLOAD_LENGTH] == 0) { ++ if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) { + dev_err(&client->dev, "invalid payload length: %d\n", + buf[PAYLOAD_LENGTH]); + ret = -EIO; diff --git a/queue-4.1/iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch b/queue-4.1/iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch new file mode 100644 index 00000000000..7e8614a95c6 --- /dev/null +++ b/queue-4.1/iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch @@ -0,0 +1,40 @@ +From 923a8c1d8069104726bde55c37cec66324ccc328 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Sun, 31 May 2015 21:44:22 +0300 +Subject: iwlwifi: mvm: fix antenna selection when BT is active + +From: Emmanuel Grumbach + +commit 923a8c1d8069104726bde55c37cec66324ccc328 upstream. + +When BT is active, we want to avoid the shared antenna for +management frame to make sure we don't disturb BT. There +was a bug in that code because it chose the antenna +BIT(ANT_A) where ANT_A is already a bitmap (0x1). This +means that the antenna chosen in the end was ANT_B. +While this is not optimal on devices with 2 antennas (it'd +disturb BT), it is critical on single antenna devices like +3160 which couldn't connect at all when BT was active. + +This fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=97181 + +Fixes: 34c8b24ff284 ("iwlwifi: mvm: BT Coex - avoid the shared antenna for management frames") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c +@@ -225,7 +225,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_ + + if (info->band == IEEE80211_BAND_2GHZ && + !iwl_mvm_bt_coex_is_shared_ant_avail(mvm)) +- rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS; ++ rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS; + else + rate_flags = + BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS; diff --git a/queue-4.1/iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch b/queue-4.1/iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch new file mode 100644 index 00000000000..2ee1722b74d --- /dev/null +++ b/queue-4.1/iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch @@ -0,0 +1,44 @@ +From be88a1ada9b97bb016196b7f4a1fc2fe2f798529 Mon Sep 17 00:00:00 2001 +From: Liad Kaufman +Date: Wed, 1 Jul 2015 17:28:34 +0300 +Subject: iwlwifi: nvm: remove mac address byte swapping in 8000 family + +From: Liad Kaufman + +commit be88a1ada9b97bb016196b7f4a1fc2fe2f798529 upstream. + +This fixes the byte order copying in the MAO (Mac Override +Section) section from the PNVM, as the byte swapping is not +required anymore in the 8000 family. Due to the byte +swapping, the driver was reporting an incorrect MAC +adddress. + +Signed-off-by: Liad Kaufman +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_80 + hw_addr = (const u8 *)(mac_override + + MAC_ADDRESS_OVERRIDE_FAMILY_8000); + +- /* The byte order is little endian 16 bit, meaning 214365 */ +- data->hw_addr[0] = hw_addr[1]; +- data->hw_addr[1] = hw_addr[0]; +- data->hw_addr[2] = hw_addr[3]; +- data->hw_addr[3] = hw_addr[2]; +- data->hw_addr[4] = hw_addr[5]; +- data->hw_addr[5] = hw_addr[4]; ++ /* ++ * Store the MAC address from MAO section. ++ * No byte swapping is required in MAO section ++ */ ++ memcpy(data->hw_addr, hw_addr, ETH_ALEN); + + /* + * Force the use of the OTP MAC address in case of reserved MAC diff --git a/queue-4.1/iwlwifi-pcie-prepare-the-device-before-accessing-it.patch b/queue-4.1/iwlwifi-pcie-prepare-the-device-before-accessing-it.patch new file mode 100644 index 00000000000..bd3840e1dcb --- /dev/null +++ b/queue-4.1/iwlwifi-pcie-prepare-the-device-before-accessing-it.patch @@ -0,0 +1,37 @@ +From f9e5554cd8ca1d1212ec922755b397a20f737923 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 4 Jun 2015 11:09:47 +0300 +Subject: iwlwifi: pcie: prepare the device before accessing it + +From: Emmanuel Grumbach + +commit f9e5554cd8ca1d1212ec922755b397a20f737923 upstream. + +For 8000 series, we need to access the device to know what +firmware to load. Before we do so, we need to prepare the +device otherwise we might not be able to access the +hardware. + +Fixes: c278754a21e6 ("iwlwifi: mvm: support family 8000 B2/C steps") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/trans.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -2515,6 +2515,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(s + trans->hw_rev = (trans->hw_rev & 0xfff0) | + (CSR_HW_REV_STEP(trans->hw_rev << 2) << 2); + ++ ret = iwl_pcie_prepare_card_hw(trans); ++ if (ret) { ++ IWL_WARN(trans, "Exit HW not ready\n"); ++ goto out_pci_disable_msi; ++ } ++ + /* + * in-order to recognize C step driver should read chip version + * id located at the AUX bus MISC address space. diff --git a/queue-4.1/md-raid1-fix-test-for-was-read-error-from-last-working-device.patch b/queue-4.1/md-raid1-fix-test-for-was-read-error-from-last-working-device.patch new file mode 100644 index 00000000000..7dfaebf353c --- /dev/null +++ b/queue-4.1/md-raid1-fix-test-for-was-read-error-from-last-working-device.patch @@ -0,0 +1,46 @@ +From 34cab6f42003cb06f48f86a86652984dec338ae9 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 24 Jul 2015 09:22:16 +1000 +Subject: md/raid1: fix test for 'was read error from last working device'. + +From: NeilBrown + +commit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream. + +When we get a read error from the last working device, we don't +try to repair it, and don't fail the device. We simple report a +read error to the caller. + +However the current test for 'is this the last working device' is +wrong. +When there is only one fully working device, it assumes that a +non-faulty device is that device. However a spare which is rebuilding +would be non-faulty but so not the only working device. + +So change the test from "!Faulty" to "In_sync". If ->degraded says +there is only one fully working device and this device is in_sync, +this must be the one. + +This bug has existed since we allowed read_balance to read from +a recovering spare in v3.0 + +Reported-and-tested-by: Alexander Lyakas +Fixes: 76073054c95b ("md/raid1: clean up read_balance.") +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -336,7 +336,7 @@ static void raid1_end_read_request(struc + spin_lock_irqsave(&conf->device_lock, flags); + if (r1_bio->mddev->degraded == conf->raid_disks || + (r1_bio->mddev->degraded == conf->raid_disks-1 && +- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) ++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags))) + uptodate = 1; + spin_unlock_irqrestore(&conf->device_lock, flags); + } diff --git a/queue-4.1/mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch b/queue-4.1/mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch new file mode 100644 index 00000000000..b4a9e0420ca --- /dev/null +++ b/queue-4.1/mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch @@ -0,0 +1,33 @@ +From 154322f47376fed6ab1e4b350aa45fffa15a61aa Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Thu, 18 Jun 2015 11:41:03 +0300 +Subject: mei: prevent unloading mei hw modules while the device is opened. + +From: Tomas Winkler + +commit 154322f47376fed6ab1e4b350aa45fffa15a61aa upstream. + +chrdev_open() increases reference counter on cdev->owner. Instead of +assigning the owner to mei subsystem, the owner has to be set to the +underlaying HW module (mei_me or mei_txe), so once the device is opened +the HW module cannot be unloaded. + +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, + /* Fill in the data structures */ + devno = MKDEV(MAJOR(mei_devt), dev->minor); + cdev_init(&dev->cdev, &mei_fops); +- dev->cdev.owner = mei_fops.owner; ++ dev->cdev.owner = parent->driver->owner; + + /* Add the device */ + ret = cdev_add(&dev->cdev, devno, 1); diff --git a/queue-4.1/regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch b/queue-4.1/regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch new file mode 100644 index 00000000000..e049ed5c169 --- /dev/null +++ b/queue-4.1/regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch @@ -0,0 +1,100 @@ +From 32c848e33ace75fce388cceff76223d12b46eaa3 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 24 Jun 2015 19:48:43 +0900 +Subject: regulator: s2mps11: Fix GPIO suspend enable shift wrapping bug + +From: Krzysztof Kozlowski + +commit 32c848e33ace75fce388cceff76223d12b46eaa3 upstream. + +Status of enabling suspend mode for regulator was stored in bitmap-like +long integer. + +However since adding support for S2MPU02 the number of regulators +exceeded 32 so on devices with more than 32 regulators (S2MPU02 and +S2MPS13) overflow happens when shifting the bit. This could lead to +enabling suspend mode for completely different regulator than intended +or to switching different regulator to other mode (e.g. from always +enabled to controlled by PWRHOLD pin). Both cases could result in larger +energy usage and issues when suspending to RAM. + +Fixes: 00e2573d2c10 ("regulator: s2mps11: Add support S2MPU02 regulator device") +Reported-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/s2mps11.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/regulator/s2mps11.c ++++ b/drivers/regulator/s2mps11.c +@@ -34,6 +34,8 @@ + #include + #include + ++/* The highest number of possible regulators for supported devices. */ ++#define S2MPS_REGULATOR_MAX S2MPS13_REGULATOR_MAX + struct s2mps11_info { + unsigned int rdev_num; + int ramp_delay2; +@@ -49,7 +51,7 @@ struct s2mps11_info { + * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether + * the suspend mode was enabled. + */ +- unsigned long long s2mps14_suspend_state:50; ++ DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX); + + /* Array of size rdev_num with GPIO-s for external sleep control */ + int *ext_control_gpio; +@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(stru + switch (s2mps11->dev_type) { + case S2MPS13X: + case S2MPS14X: +- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev))) ++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state)) + val = S2MPS14_ENABLE_SUSPEND; + else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)])) + val = S2MPS14_ENABLE_EXT_CONTROL; +@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(stru + val = rdev->desc->enable_mask; + break; + case S2MPU02: +- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev))) ++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state)) + val = S2MPU02_ENABLE_SUSPEND; + else + val = rdev->desc->enable_mask; +@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend + if (ret < 0) + return ret; + +- s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev)); ++ set_bit(rdev_get_id(rdev), s2mps11->suspend_state); + /* + * Don't enable suspend mode if regulator is already disabled because + * this would effectively for a short time turn on the regulator after +@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct pla + case S2MPS11X: + s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators); + regulators = s2mps11_regulators; ++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num); + break; + case S2MPS13X: + s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators); + regulators = s2mps13_regulators; ++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num); + break; + case S2MPS14X: + s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators); + regulators = s2mps14_regulators; ++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num); + break; + case S2MPU02: + s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators); + regulators = s2mpu02_regulators; ++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num); + break; + default: + dev_err(&pdev->dev, "Invalid device type: %u\n", diff --git a/queue-4.1/revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch b/queue-4.1/revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch new file mode 100644 index 00000000000..53794ee1b20 --- /dev/null +++ b/queue-4.1/revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch @@ -0,0 +1,68 @@ +From 907eda32a36fcdb979bdb91ea097abb3dd2c23c9 Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Fri, 26 Jun 2015 08:11:30 +0200 +Subject: Revert "serial: imx: initialized DMA w/o HW flow enabled" + +From: David Jander + +commit 907eda32a36fcdb979bdb91ea097abb3dd2c23c9 upstream. + +This reverts commit 068500e08dc87ea9a453cc4a500cf3ab28d0f936. + +According to some tests, SDMA support is broken at least for i.MX6 without +HW flow control. Different forms of data-corruption appear either with +the ROM firmware for the SDMA controller as well as when loading Freescale +provided SDMA firmware versions 1.1 or 3.1. + +Signed-off-by: David Jander +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/imx.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1132,11 +1132,6 @@ static int imx_startup(struct uart_port + while (!(readl(sport->port.membase + UCR2) & UCR2_SRST) && (--i > 0)) + udelay(1); + +- /* Can we enable the DMA support? */ +- if (is_imx6q_uart(sport) && !uart_console(port) && +- !sport->dma_is_inited) +- imx_uart_dma_init(sport); +- + spin_lock_irqsave(&sport->port.lock, flags); + + /* +@@ -1145,9 +1140,6 @@ static int imx_startup(struct uart_port + writel(USR1_RTSD, sport->port.membase + USR1); + writel(USR2_ORE, sport->port.membase + USR2); + +- if (sport->dma_is_inited && !sport->dma_is_enabled) +- imx_enable_dma(sport); +- + temp = readl(sport->port.membase + UCR1); + temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN; + +@@ -1318,6 +1310,11 @@ imx_set_termios(struct uart_port *port, + } else { + ucr2 |= UCR2_CTSC; + } ++ ++ /* Can we enable the DMA support? */ ++ if (is_imx6q_uart(sport) && !uart_console(port) ++ && !sport->dma_is_inited) ++ imx_uart_dma_init(sport); + } else { + termios->c_cflag &= ~CRTSCTS; + } +@@ -1434,6 +1431,8 @@ imx_set_termios(struct uart_port *port, + if (UART_ENABLE_MS(&sport->port, termios->c_cflag)) + imx_enable_ms(&sport->port); + ++ if (sport->dma_is_inited && !sport->dma_is_enabled) ++ imx_enable_dma(sport); + spin_unlock_irqrestore(&sport->port.lock, flags); + } + diff --git a/queue-4.1/serial-core-fix-crashes-while-echoing-when-closing.patch b/queue-4.1/serial-core-fix-crashes-while-echoing-when-closing.patch new file mode 100644 index 00000000000..4fee2ce3480 --- /dev/null +++ b/queue-4.1/serial-core-fix-crashes-while-echoing-when-closing.patch @@ -0,0 +1,79 @@ +From e144c58cad6667876173dd76977e9e6557e34941 Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sun, 12 Jul 2015 21:05:26 -0400 +Subject: serial: core: Fix crashes while echoing when closing + +From: Peter Hurley + +commit e144c58cad6667876173dd76977e9e6557e34941 upstream. + +While closing, new rx data may be received after the input buffers +have been flushed but before stop_rx() halts receiving [1]. The +new data might not be processed by flush_to_ldisc() until after +uart_shutdown() and normal input processing is re-enabled (ie., +tty->closing = 0). The race is outlined below: + +CPU 0 | CPU 1 + | +uart_close() | + tty_port_close_start() | + tty->closing = 1 | + tty_ldisc_flush() | + | => IRQ + | while (LSR & data ready) + | uart_insert_char() + | tty_flip_buffer_push() + | <= EOI + stop_rx() | . + uart_shutdown() | . + free xmit.buf | . + tty_port_tty_set(NULL) | . + tty->closing = 0 | . + | flush_to_ldisc() + | n_tty_receive_buf_common() + | __receive_buf() + | ... + | commit_echoes() + | uart_flush_chars() + | __uart_start() + | ** OOPS on port.tty deref ** + tty_ldisc_flush() | + +Input processing must be prevented from echoing (tty->closing = 1) +until _after_ the input buffers have been flushed again at the end +of uart_close(). + +[1] In fact, some input may actually be buffered _after_ stop_rx() +since the rx interrupt may have already triggered but not yet been +handled when stop_rx() disables rx interrupts. + +Fixes: 2e758910832d ("serial: core: Flush ldisc after dropping port +mutex in uart_close()") +Reported-by: Robert Elliott +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1409,7 +1409,7 @@ static void uart_close(struct tty_struct + mutex_lock(&port->mutex); + uart_shutdown(tty, state); + tty_port_tty_set(port, NULL); +- tty->closing = 0; ++ + spin_lock_irqsave(&port->lock, flags); + + if (port->blocked_open) { +@@ -1435,6 +1435,7 @@ static void uart_close(struct tty_struct + mutex_unlock(&port->mutex); + + tty_ldisc_flush(tty); ++ tty->closing = 0; + } + + static void uart_wait_until_sent(struct tty_struct *tty, int timeout) diff --git a/queue-4.1/series b/queue-4.1/series index 3120d96525e..2ee8f7350f4 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -66,3 +66,28 @@ mmc-sdhci-check-parameters-before-call-dma_free_coherent.patch mmc-sdhci-esdhc-make-8bit-bus-work.patch mmc-sdhci-pxav3-fix-platform_data-is-not-initialized.patch hid-cp2112-fix-to-force-single-data-report-reply.patch +iwlwifi-mvm-fix-antenna-selection-when-bt-is-active.patch +iwlwifi-nvm-remove-mac-address-byte-swapping-in-8000-family.patch +iwlwifi-pcie-prepare-the-device-before-accessing-it.patch +md-raid1-fix-test-for-was-read-error-from-last-working-device.patch +spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch +spi-imx-fix-small-dma-transfers.patch +tile-use-free_bootmem_late-for-initrd.patch +input-zforce-don-t-overwrite-the-stack.patch +input-usbtouchscreen-avoid-unresponsive-tsc-30-touch-screen.patch +blkcg-fix-gendisk-reference-leak-in-blkg_conf_prep.patch +regulator-s2mps11-fix-gpio-suspend-enable-shift-wrapping-bug.patch +ata-pmp-add-quirk-for-marvell-4140-sata-pmp.patch +usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch +revert-serial-imx-initialized-dma-w-o-hw-flow-enabled.patch +serial-core-fix-crashes-while-echoing-when-closing.patch +xhci-calculate-old-endpoints-correctly-on-device-reset.patch +xhci-report-u3-when-link-is-in-resume-state.patch +xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch +xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch +mei-prevent-unloading-mei-hw-modules-while-the-device-is-opened.patch +x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch +efi-handle-memory-error-structures-produced-based-on-old-versions-of-standard.patch +arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch +efi-check-for-null-efi-kernel-parameters.patch +x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch diff --git a/queue-4.1/spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch b/queue-4.1/spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch new file mode 100644 index 00000000000..8104a16442f --- /dev/null +++ b/queue-4.1/spi-img-spfi-fix-support-for-speeds-up-to-1-4th-input-clock.patch @@ -0,0 +1,49 @@ +From 6a806a214af42ac951e2d85e64d1bf4463482e16 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Thu, 18 Jun 2015 13:50:54 +0100 +Subject: spi: img-spfi: fix support for speeds up to 1/4th input clock + +From: Sifan Naeem + +commit 6a806a214af42ac951e2d85e64d1bf4463482e16 upstream. + +Setting the Same Edge bit indicates to the spfi block to receive and +transmit data on the same edge of the spfi clock, which in turn +doubles the operating frequency of spfi. + +The maximum supported frequency is limited to 1/4th of the spfi input +clock, but without this bit set the maximum would be 1/8th of the +input clock. + +The current driver calculates the divisor with maximum speed at 1/4th +of the input clock, this would fail if the requested frequency is +higher than 1/8 of the input clock. Any requests for 1/8th of the +input clock would still pass. + +Fixes: 8543d0e72d43 ("spi: img-spfi: Limit bit clock to 1/4th of input clock") +Signed-off-by: Sifan Naeem +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -40,6 +40,7 @@ + #define SPFI_CONTROL_SOFT_RESET BIT(11) + #define SPFI_CONTROL_SEND_DMA BIT(10) + #define SPFI_CONTROL_GET_DMA BIT(9) ++#define SPFI_CONTROL_SE BIT(8) + #define SPFI_CONTROL_TMODE_SHIFT 5 + #define SPFI_CONTROL_TMODE_MASK 0x7 + #define SPFI_CONTROL_TMODE_SINGLE 0 +@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_m + else if (xfer->tx_nbits == SPI_NBITS_QUAD && + xfer->rx_nbits == SPI_NBITS_QUAD) + val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT; ++ val |= SPFI_CONTROL_SE; + spfi_writel(spfi, val, SPFI_CONTROL); + } + diff --git a/queue-4.1/spi-imx-fix-small-dma-transfers.patch b/queue-4.1/spi-imx-fix-small-dma-transfers.patch new file mode 100644 index 00000000000..0c2ad2c683b --- /dev/null +++ b/queue-4.1/spi-imx-fix-small-dma-transfers.patch @@ -0,0 +1,38 @@ +From f6ee9b582d2db652497b73c1f117591dfb6d3a90 Mon Sep 17 00:00:00 2001 +From: Sascha Hauer +Date: Fri, 24 Jul 2015 15:01:08 +0200 +Subject: spi: imx: Fix small DMA transfers + +From: Sascha Hauer + +commit f6ee9b582d2db652497b73c1f117591dfb6d3a90 upstream. + +DMA transfers must be greater than the watermark level size. spi_imx->rx_wml +and spi_imx->tx_wml contain the watermark level in 32bit words whereas struct +spi_transfer contains the transfer len in bytes. Fix the check if DMA is +possible for a transfer accordingly. This fixes transfers with sizes between +33 and 128 bytes for which previously was claimed that DMA is possible. + +Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support) +Signed-off-by: Sascha Hauer +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-imx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_m + { + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); + +- if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml) +- && (transfer->len > spi_imx->tx_wml)) ++ if (spi_imx->dma_is_inited ++ && transfer->len > spi_imx->rx_wml * sizeof(u32) ++ && transfer->len > spi_imx->tx_wml * sizeof(u32)) + return true; + return false; + } diff --git a/queue-4.1/tile-use-free_bootmem_late-for-initrd.patch b/queue-4.1/tile-use-free_bootmem_late-for-initrd.patch new file mode 100644 index 00000000000..2e309319619 --- /dev/null +++ b/queue-4.1/tile-use-free_bootmem_late-for-initrd.patch @@ -0,0 +1,30 @@ +From 3f81d2447b37ac697b3c600039f2c6b628c06e21 Mon Sep 17 00:00:00 2001 +From: Chris Metcalf +Date: Thu, 23 Jul 2015 14:11:09 -0400 +Subject: tile: use free_bootmem_late() for initrd + +From: Chris Metcalf + +commit 3f81d2447b37ac697b3c600039f2c6b628c06e21 upstream. + +We were previously using free_bootmem() and just getting lucky +that nothing too bad happened. + +Signed-off-by: Chris Metcalf +Signed-off-by: Greg Kroah-Hartman + +--- + arch/tile/kernel/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/tile/kernel/setup.c ++++ b/arch/tile/kernel/setup.c +@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void) + + void __init free_initrd_mem(unsigned long begin, unsigned long end) + { +- free_bootmem(__pa(begin), end - begin); ++ free_bootmem_late(__pa(begin), end - begin); + } + + static int __init setup_initrd(char *str) diff --git a/queue-4.1/usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch b/queue-4.1/usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch new file mode 100644 index 00000000000..522641e10ec --- /dev/null +++ b/queue-4.1/usb-storage-ignore-zte-mf-823-card-reader-in-mode-0x1225.patch @@ -0,0 +1,48 @@ +From 5fb2c782f451a4fb9c19c076e2c442839faf0f76 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Mon, 6 Jul 2015 13:12:32 +0200 +Subject: usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 + +From: Oliver Neukum + +commit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 upstream. + +This device automatically switches itself to another mode (0x1405) +unless the specific access pattern of Windows is followed in its +initial mode. That makes a dirty unmount of the internal storage +devices inevitable if they are mounted. So the card reader of +such a device should be ignored, lest an unclean removal become +inevitable. + +This replaces an earlier patch that ignored all LUNs of this device. +That patch was overly broad. + +Signed-off-by: Oliver Neukum +Reviewed-by: Lars Melin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_READ_DISC_INFO ), + ++/* Reported by Oliver Neukum ++ * This device morphes spontaneously into another device if the access ++ * pattern of Windows isn't followed. Thus writable media would be dirty ++ * if the initial instance is used. So the device is limited to its ++ * virtual CD. ++ * And yes, the concept that BCD goes up to 9 is not heeded */ ++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff, ++ "ZTE,Incorporated", ++ "ZTE WCDMA Technologies MSM", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_SINGLE_LUN ), ++ + /* Reported by Sven Geggus + * This encrypted pen drive returns bogus data for the initial READ(10). + */ diff --git a/queue-4.1/x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch b/queue-4.1/x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch new file mode 100644 index 00000000000..567b6d6f647 --- /dev/null +++ b/queue-4.1/x86-efi-use-all-64-bit-of-efi_memmap-in-setup_e820.patch @@ -0,0 +1,44 @@ +From 7cc03e48965453b5df1cce5062c826189b04b960 Mon Sep 17 00:00:00 2001 +From: Dmitry Skorodumov +Date: Tue, 28 Jul 2015 18:38:32 +0400 +Subject: x86/efi: Use all 64 bit of efi_memmap in setup_e820() + +From: Dmitry Skorodumov + +commit 7cc03e48965453b5df1cce5062c826189b04b960 upstream. + +The efi_info structure stores low 32 bits of memory map +in efi_memmap and high 32 bits in efi_memmap_hi. + +While constructing pointer in the setup_e820(), need +to take into account all 64 bit of the pointer. + +It is because on 64bit machine the function +efi_get_memory_map() may return full 64bit pointer and before +the patch that pointer was truncated. + +The issue is triggered on Parallles virtual machine and +fixed with this patch. + +Signed-off-by: Dmitry Skorodumov +Cc: Denis V. Lunev +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/boot/compressed/eboot.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct bo + unsigned int e820_type = 0; + unsigned long m = efi->efi_memmap; + ++#ifdef CONFIG_X86_64 ++ m |= (u64)efi->efi_memmap_hi << 32; ++#endif ++ + d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size)); + switch (d->type) { + case EFI_RESERVED_TYPE: diff --git a/queue-4.1/x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch b/queue-4.1/x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch new file mode 100644 index 00000000000..fb01568a3d5 --- /dev/null +++ b/queue-4.1/x86-mm-add-parenthesis-for-tlb-tracepoint-size-calculation.patch @@ -0,0 +1,40 @@ +From bbc03778b9954a2ec93baed63718e4df0192f130 Mon Sep 17 00:00:00 2001 +From: Dave Hansen +Date: Mon, 20 Jul 2015 16:01:53 -0700 +Subject: x86/mm: Add parenthesis for TLB tracepoint size calculation + +From: Dave Hansen + +commit bbc03778b9954a2ec93baed63718e4df0192f130 upstream. + +flush_tlb_info->flush_start/end are both normal virtual +addresses. When calculating 'nr_pages' (only used for the +tracepoint), I neglected to put parenthesis in. + +Thanks to David Koufaty for pointing this out. + +Signed-off-by: Dave Hansen +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: dave@sr71.net +Link: http://lkml.kernel.org/r/20150720230153.9E834081@viggo.jf.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/tlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info) + } else { + unsigned long addr; + unsigned long nr_pages = +- f->flush_end - f->flush_start / PAGE_SIZE; ++ (f->flush_end - f->flush_start) / PAGE_SIZE; + addr = f->flush_start; + while (addr < f->flush_end) { + __flush_tlb_single(addr); diff --git a/queue-4.1/xhci-calculate-old-endpoints-correctly-on-device-reset.patch b/queue-4.1/xhci-calculate-old-endpoints-correctly-on-device-reset.patch new file mode 100644 index 00000000000..a8675af3716 --- /dev/null +++ b/queue-4.1/xhci-calculate-old-endpoints-correctly-on-device-reset.patch @@ -0,0 +1,44 @@ +From 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 Mon Sep 17 00:00:00 2001 +From: Brian Campbell +Date: Tue, 21 Jul 2015 17:20:28 +0300 +Subject: xhci: Calculate old endpoints correctly on device reset + +From: Brian Campbell + +commit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream. + +When resetting a device the number of active TTs may need to be +corrected by xhci_update_tt_active_eps, but the number of old active +endpoints supplied to it was always zero, so the number of TTs and the +bandwidth reserved for them was not updated, and could rise +unnecessarily. + +This affected systems using Intel's Patherpoint chipset, which rely on +software bandwidth checking. For example, a Lenovo X230 would lose the +ability to use ports on the docking station after enough suspend/resume +cycles because the bandwidth calculated would rise with every cycle when +a suitable device is attached. + +The correct number of active endpoints is calculated in the same way as +in xhci_reserve_bandwidth. + +Signed-off-by: Brian Campbell +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct + return -EINVAL; + } + ++ if (virt_dev->tt_info) ++ old_active_eps = virt_dev->tt_info->active_eps; ++ + if (virt_dev->udev != udev) { + /* If the virt_dev and the udev does not match, this virt_dev + * may belong to another udev. diff --git a/queue-4.1/xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch b/queue-4.1/xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch new file mode 100644 index 00000000000..aa927e1fcd5 --- /dev/null +++ b/queue-4.1/xhci-do-not-report-plc-when-link-is-in-internal-resume-state.patch @@ -0,0 +1,41 @@ +From aca3a0489ac019b58cf32794d5362bb284cb9b94 Mon Sep 17 00:00:00 2001 +From: Zhuang Jin Can +Date: Tue, 21 Jul 2015 17:20:31 +0300 +Subject: xhci: do not report PLC when link is in internal resume state + +From: Zhuang Jin Can + +commit aca3a0489ac019b58cf32794d5362bb284cb9b94 upstream. + +Port link change with port in resume state should not be +reported to usbcore, as this is an internal state to be +handled by xhci driver. Reporting PLC to usbcore may +cause usbcore clearing PLC first and port change event irq +won't be generated. + +Signed-off-by: Zhuang Jin Can +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -591,7 +591,14 @@ static u32 xhci_get_port_status(struct u + status |= USB_PORT_STAT_C_RESET << 16; + /* USB3.0 only */ + if (hcd->speed == HCD_USB3) { +- if ((raw_port_status & PORT_PLC)) ++ /* Port link change with port in resume state should not be ++ * reported to usbcore, as this is an internal state to be ++ * handled by xhci driver. Reporting PLC to usbcore may ++ * cause usbcore clearing PLC first and port change event ++ * irq won't be generated. ++ */ ++ if ((raw_port_status & PORT_PLC) && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) + status |= USB_PORT_STAT_C_LINK_STATE << 16; + if ((raw_port_status & PORT_WRC)) + status |= USB_PORT_STAT_C_BH_RESET << 16; diff --git a/queue-4.1/xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch b/queue-4.1/xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch new file mode 100644 index 00000000000..f06861e13aa --- /dev/null +++ b/queue-4.1/xhci-prevent-bus_suspend-if-ss-port-resuming-in-phase-1.patch @@ -0,0 +1,69 @@ +From fac4271d1126c45ceaceb7f4a336317b771eb121 Mon Sep 17 00:00:00 2001 +From: Zhuang Jin Can +Date: Tue, 21 Jul 2015 17:20:30 +0300 +Subject: xhci: prevent bus_suspend if SS port resuming in phase 1 + +From: Zhuang Jin Can + +commit fac4271d1126c45ceaceb7f4a336317b771eb121 upstream. + +When the link is just waken, it's in Resume state, and driver sets PLS to +U0. This refers to Phase 1. Phase 2 refers to when the link has completed +the transition from Resume state to U0. + +With the fix of xhci: report U3 when link is in resume state, it also +exposes an issue that usb3 roothub and controller can suspend right +after phase 1, and this causes a hard hang in controller. + +To fix the issue, we need to prevent usb3 bus suspend if any port is +resuming in phase 1. + +[merge separate USB2 and USB3 port resume checking to one -Mathias] +Signed-off-by: Zhuang Jin Can +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 6 +++--- + drivers/usb/host/xhci-ring.c | 3 +++ + drivers/usb/host/xhci.h | 1 + + 3 files changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1123,10 +1123,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd + spin_lock_irqsave(&xhci->lock, flags); + + if (hcd->self.root_hub->do_remote_wakeup) { +- if (bus_state->resuming_ports) { ++ if (bus_state->resuming_ports || /* USB2 */ ++ bus_state->port_remote_wakeup) { /* USB3 */ + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "suspend failed because " +- "a port is resuming\n"); ++ xhci_dbg(xhci, "suspend failed because a port is resuming\n"); + return -EBUSY; + } + } +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xh + usb_hcd_resume_root_hub(hcd); + } + ++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE) ++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index); ++ + if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) { + xhci_dbg(xhci, "port resume event for port %d\n", port_id); + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -285,6 +285,7 @@ struct xhci_op_regs { + #define XDEV_U0 (0x0 << 5) + #define XDEV_U2 (0x2 << 5) + #define XDEV_U3 (0x3 << 5) ++#define XDEV_INACTIVE (0x6 << 5) + #define XDEV_RESUME (0xf << 5) + /* true: port has power (see HCC_PPC) */ + #define PORT_POWER (1 << 9) diff --git a/queue-4.1/xhci-report-u3-when-link-is-in-resume-state.patch b/queue-4.1/xhci-report-u3-when-link-is-in-resume-state.patch new file mode 100644 index 00000000000..921df887e35 --- /dev/null +++ b/queue-4.1/xhci-report-u3-when-link-is-in-resume-state.patch @@ -0,0 +1,44 @@ +From 243292a2ad3dc365849b820a64868927168894ac Mon Sep 17 00:00:00 2001 +From: Zhuang Jin Can +Date: Tue, 21 Jul 2015 17:20:29 +0300 +Subject: xhci: report U3 when link is in resume state + +From: Zhuang Jin Can + +commit 243292a2ad3dc365849b820a64868927168894ac upstream. + +xhci_hub_report_usb3_link_state() returns pls as U0 when the link +is in resume state, and this causes usb core to think the link is in +U0 while actually it's in resume state. When usb core transfers +control request on the link, it fails with TRB error as the link +is not ready for transfer. + +To fix the issue, report U3 when the link is in resume state, thus +usb core knows the link it's not ready for transfer. + +Signed-off-by: Zhuang Jin Can +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_st + u32 pls = status_reg & PORT_PLS_MASK; + + /* resume state is a xHCI internal state. +- * Do not report it to usb core. ++ * Do not report it to usb core, instead, pretend to be U3, ++ * thus usb core knows it's not ready for transfer + */ +- if (pls == XDEV_RESUME) ++ if (pls == XDEV_RESUME) { ++ *status |= USB_SS_PORT_LS_U3; + return; ++ } + + /* When the CAS bit is set then warm reset + * should be performed on port