From: Greg Kroah-Hartman Date: Wed, 16 Sep 2015 18:30:46 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v3.10.89~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=64b5c3e7de0b5938d29ad3ec40aae6fa709926dd;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: asoc-rt5640-fix-line-out-no-sound-issue.patch asoc-samsung-remove-redundant-arndale_audio_remove.patch doc-usb-gadget-testing-using-the-updated-testusb.c.patch libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch spi-fix-regression-in-spi-bitbang-txrx.h.patch spi-img-spfi-check-for-timeout-error-before-proceeding.patch spi-img-spfi-fix-kbuild-test-robot-warning.patch spi-img-spfi-fix-multiple-calls-to-request-gpio.patch spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch usb-ftdi_sio-added-custom-pid-for-customware-products.patch usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch usb-gadget-m66592-udc-forever-loop-in-set_feature.patch usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch usb-pl2303-fix-baud-rate-divisor-calculations.patch usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch usb-symbolserial-use-usb_get_serial_port_data.patch xfs-fix-file-type-directory-corruption-for-btree-directories.patch xfs-fix-xfs_attr_leafblock-definition.patch --- diff --git a/queue-4.1/asoc-rt5640-fix-line-out-no-sound-issue.patch b/queue-4.1/asoc-rt5640-fix-line-out-no-sound-issue.patch new file mode 100644 index 00000000000..c26be5c7d1a --- /dev/null +++ b/queue-4.1/asoc-rt5640-fix-line-out-no-sound-issue.patch @@ -0,0 +1,89 @@ +From 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 Mon Sep 17 00:00:00 2001 +From: John Lin +Date: Tue, 11 Aug 2015 14:27:25 +0800 +Subject: ASoC: rt5640: fix line out no sound issue + +From: John Lin + +commit 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 upstream. + +The power for line out was not turned on when line out is enabled. +So we add "LOUT amp" widget to turn on the power for line out. + +Signed-off-by: John Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5640.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/rt5640.c ++++ b/sound/soc/codecs/rt5640.c +@@ -985,6 +985,35 @@ static int rt5640_hp_event(struct snd_so + return 0; + } + ++static int rt5640_lout_event(struct snd_soc_dapm_widget *w, ++ struct snd_kcontrol *kcontrol, int event) ++{ ++ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm); ++ ++ switch (event) { ++ case SND_SOC_DAPM_POST_PMU: ++ hp_amp_power_on(codec); ++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1, ++ RT5640_PWR_LM, RT5640_PWR_LM); ++ snd_soc_update_bits(codec, RT5640_OUTPUT, ++ RT5640_L_MUTE | RT5640_R_MUTE, 0); ++ break; ++ ++ case SND_SOC_DAPM_PRE_PMD: ++ snd_soc_update_bits(codec, RT5640_OUTPUT, ++ RT5640_L_MUTE | RT5640_R_MUTE, ++ RT5640_L_MUTE | RT5640_R_MUTE); ++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1, ++ RT5640_PWR_LM, 0); ++ break; ++ ++ default: ++ return 0; ++ } ++ ++ return 0; ++} ++ + static int rt5640_hp_power_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { +@@ -1180,13 +1209,16 @@ static const struct snd_soc_dapm_widget + 0, rt5640_spo_l_mix, ARRAY_SIZE(rt5640_spo_l_mix)), + SND_SOC_DAPM_MIXER("SPOR MIX", SND_SOC_NOPM, 0, + 0, rt5640_spo_r_mix, ARRAY_SIZE(rt5640_spo_r_mix)), +- SND_SOC_DAPM_MIXER("LOUT MIX", RT5640_PWR_ANLG1, RT5640_PWR_LM_BIT, 0, ++ SND_SOC_DAPM_MIXER("LOUT MIX", SND_SOC_NOPM, 0, 0, + rt5640_lout_mix, ARRAY_SIZE(rt5640_lout_mix)), + SND_SOC_DAPM_SUPPLY_S("Improve HP Amp Drv", 1, SND_SOC_NOPM, + 0, 0, rt5640_hp_power_event, SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_PGA_S("HP Amp", 1, SND_SOC_NOPM, 0, 0, + rt5640_hp_event, + SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), ++ SND_SOC_DAPM_PGA_S("LOUT amp", 1, SND_SOC_NOPM, 0, 0, ++ rt5640_lout_event, ++ SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("HP L Amp", RT5640_PWR_ANLG1, + RT5640_PWR_HP_L_BIT, 0, NULL, 0), + SND_SOC_DAPM_SUPPLY("HP R Amp", RT5640_PWR_ANLG1, +@@ -1501,8 +1533,10 @@ static const struct snd_soc_dapm_route r + {"HP R Playback", "Switch", "HP Amp"}, + {"HPOL", NULL, "HP L Playback"}, + {"HPOR", NULL, "HP R Playback"}, +- {"LOUTL", NULL, "LOUT MIX"}, +- {"LOUTR", NULL, "LOUT MIX"}, ++ ++ {"LOUT amp", NULL, "LOUT MIX"}, ++ {"LOUTL", NULL, "LOUT amp"}, ++ {"LOUTR", NULL, "LOUT amp"}, + }; + + static const struct snd_soc_dapm_route rt5640_specific_dapm_routes[] = { diff --git a/queue-4.1/asoc-samsung-remove-redundant-arndale_audio_remove.patch b/queue-4.1/asoc-samsung-remove-redundant-arndale_audio_remove.patch new file mode 100644 index 00000000000..ea815142fd6 --- /dev/null +++ b/queue-4.1/asoc-samsung-remove-redundant-arndale_audio_remove.patch @@ -0,0 +1,48 @@ +From 14a500fe1396934c6b3ed8f009459a4723da7862 Mon Sep 17 00:00:00 2001 +From: Vaishali Thakkar +Date: Thu, 20 Aug 2015 22:11:15 +0530 +Subject: ASoC: samsung: Remove redundant arndale_audio_remove + +From: Vaishali Thakkar + +commit 14a500fe1396934c6b3ed8f009459a4723da7862 upstream. + +There is no use of snd_soc_unregister_card in remove function +as devm_snd_soc_register_card in probe function automatically +handles it. So, remove use of snd_soc_unregister_card and with +this change remove arndale_audio_remove as it is now redundant. + +Signed-off-by: Vaishali Thakkar +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/samsung/arndale_rt5631.c | 10 ---------- + 1 file changed, 10 deletions(-) + +--- a/sound/soc/samsung/arndale_rt5631.c ++++ b/sound/soc/samsung/arndale_rt5631.c +@@ -116,15 +116,6 @@ static int arndale_audio_probe(struct pl + return ret; + } + +-static int arndale_audio_remove(struct platform_device *pdev) +-{ +- struct snd_soc_card *card = platform_get_drvdata(pdev); +- +- snd_soc_unregister_card(card); +- +- return 0; +-} +- + static const struct of_device_id samsung_arndale_rt5631_of_match[] __maybe_unused = { + { .compatible = "samsung,arndale-rt5631", }, + { .compatible = "samsung,arndale-alc5631", }, +@@ -139,7 +130,6 @@ static struct platform_driver arndale_au + .of_match_table = of_match_ptr(samsung_arndale_rt5631_of_match), + }, + .probe = arndale_audio_probe, +- .remove = arndale_audio_remove, + }; + + module_platform_driver(arndale_audio_driver); diff --git a/queue-4.1/doc-usb-gadget-testing-using-the-updated-testusb.c.patch b/queue-4.1/doc-usb-gadget-testing-using-the-updated-testusb.c.patch new file mode 100644 index 00000000000..0864b1a391d --- /dev/null +++ b/queue-4.1/doc-usb-gadget-testing-using-the-updated-testusb.c.patch @@ -0,0 +1,44 @@ +From f811a38300be3cdb603171aea5ad3fb42b71ca53 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 31 Jul 2015 16:36:30 +0800 +Subject: doc: usb: gadget-testing: using the updated testusb.c + +From: Peter Chen + +commit f811a38300be3cdb603171aea5ad3fb42b71ca53 upstream. + +testusb.c at http://www.linux-usb.org/usbtest/ is out of date, +using the one at the kernel source folder. + +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/usb/gadget-testing.txt | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/Documentation/usb/gadget-testing.txt ++++ b/Documentation/usb/gadget-testing.txt +@@ -237,9 +237,7 @@ Testing the LOOPBACK function + ----------------------------- + + device: run the gadget +-host: test-usb +- +-http://www.linux-usb.org/usbtest/testusb.c ++host: test-usb (tools/usb/testusb.c) + + 8. MASS STORAGE function + ======================== +@@ -588,9 +586,8 @@ Testing the SOURCESINK function + ------------------------------- + + device: run the gadget +-host: test-usb ++host: test-usb (tools/usb/testusb.c) + +-http://www.linux-usb.org/usbtest/testusb.c + + 16. UAC1 function + ================= diff --git a/queue-4.1/libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch b/queue-4.1/libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch new file mode 100644 index 00000000000..9c225d164ea --- /dev/null +++ b/queue-4.1/libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch @@ -0,0 +1,37 @@ +From 2f123bce18943fff819bc10f8868ffb9149fc622 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Wed, 19 Aug 2015 10:33:58 +1000 +Subject: libxfs: readahead of dir3 data blocks should use the read verifier + +From: "Darrick J. Wong" + +commit 2f123bce18943fff819bc10f8868ffb9149fc622 upstream. + +In the dir3 data block readahead function, use the regular read +verifier to check the block's CRC and spot-check the block contents +instead of directly calling only the spot-checking routine. This +prevents corrupted directory data blocks from being read into the +kernel, which can lead to garbage ls output and directory loops (if +say one of the entries contains slashes and other junk). + +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_dir2_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_dir2_data.c ++++ b/fs/xfs/libxfs/xfs_dir2_data.c +@@ -252,7 +252,8 @@ xfs_dir3_data_reada_verify( + return; + case cpu_to_be32(XFS_DIR2_DATA_MAGIC): + case cpu_to_be32(XFS_DIR3_DATA_MAGIC): +- xfs_dir3_data_verify(bp); ++ bp->b_ops = &xfs_dir3_data_buf_ops; ++ bp->b_ops->verify_read(bp); + return; + default: + xfs_buf_ioerror(bp, -EFSCORRUPTED); diff --git a/queue-4.1/series b/queue-4.1/series index 59384255f83..e3cfb111bc2 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -39,3 +39,25 @@ pci-fix-ti816x-class-code-quirk.patch pci-add-dev_flags-bit-to-access-vpd-through-function-0.patch pci-add-vpd-function-0-quirk-for-intel-ethernet-devices.patch pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch +spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch +spi-fix-regression-in-spi-bitbang-txrx.h.patch +spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch +spi-img-spfi-check-for-timeout-error-before-proceeding.patch +spi-img-spfi-fix-multiple-calls-to-request-gpio.patch +spi-img-spfi-fix-kbuild-test-robot-warning.patch +spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch +usb-symbolserial-use-usb_get_serial_port_data.patch +usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch +usb-ftdi_sio-added-custom-pid-for-customware-products.patch +usb-pl2303-fix-baud-rate-divisor-calculations.patch +libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch +xfs-fix-xfs_attr_leafblock-definition.patch +xfs-fix-file-type-directory-corruption-for-btree-directories.patch +usb-gadget-m66592-udc-forever-loop-in-set_feature.patch +doc-usb-gadget-testing-using-the-updated-testusb.c.patch +usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch +usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch +usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch +tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch +asoc-rt5640-fix-line-out-no-sound-issue.patch +asoc-samsung-remove-redundant-arndale_audio_remove.patch diff --git a/queue-4.1/spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch b/queue-4.1/spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch new file mode 100644 index 00000000000..f72761dbde8 --- /dev/null +++ b/queue-4.1/spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch @@ -0,0 +1,88 @@ +From acace73df2c1913a526c1b41e4741a4a6704c863 Mon Sep 17 00:00:00 2001 +From: Martin Sperl +Date: Tue, 28 Jul 2015 14:03:12 +0000 +Subject: spi: bcm2835: set up spi-mode before asserting cs-gpio + +From: Martin Sperl + +commit acace73df2c1913a526c1b41e4741a4a6704c863 upstream. + +When using reverse polarity for clock (spi-cpol) on a device +the clock line gets altered after chip-select has been asserted +resulting in an additional clock beat, which confuses hardware. + +This did not show when using native-CS, as the same register +is used to control cs as well as polarity, so the changes came +into effect at the same time. Unfortunately this is not true +with gpio-cs. + +To avoid this situation this patch moves the setup of polarity +(spi-cpol and spi-cpha) outside of the chip-select into +prepare_message, which is run prior to asserting chip-select. + +Also fixes resetting 3-wire mode after use of rx-mode, so that +a 3-Wire sequence TX, RX, TX works as well (right now it runs +TX, RX, RX instead) + +Reported-by: Noralf Tronnes +Signed-off-by: Martin Sperl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -257,13 +257,11 @@ static int bcm2835_spi_transfer_one(stru + spi_used_hz = cdiv ? (clk_hz / cdiv) : (clk_hz / 65536); + bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv); + +- /* handle all the modes */ ++ /* handle all the 3-wire mode */ + if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf)) + cs |= BCM2835_SPI_CS_REN; +- if (spi->mode & SPI_CPOL) +- cs |= BCM2835_SPI_CS_CPOL; +- if (spi->mode & SPI_CPHA) +- cs |= BCM2835_SPI_CS_CPHA; ++ else ++ cs &= ~BCM2835_SPI_CS_REN; + + /* for gpio_cs set dummy CS so that no HW-CS get changed + * we can not run this in bcm2835_spi_set_cs, as it does +@@ -291,6 +289,25 @@ static int bcm2835_spi_transfer_one(stru + return bcm2835_spi_transfer_one_irq(master, spi, tfr, cs); + } + ++static int bcm2835_spi_prepare_message(struct spi_master *master, ++ struct spi_message *msg) ++{ ++ struct spi_device *spi = msg->spi; ++ struct bcm2835_spi *bs = spi_master_get_devdata(master); ++ u32 cs = bcm2835_rd(bs, BCM2835_SPI_CS); ++ ++ cs &= ~(BCM2835_SPI_CS_CPOL | BCM2835_SPI_CS_CPHA); ++ ++ if (spi->mode & SPI_CPOL) ++ cs |= BCM2835_SPI_CS_CPOL; ++ if (spi->mode & SPI_CPHA) ++ cs |= BCM2835_SPI_CS_CPHA; ++ ++ bcm2835_wr(bs, BCM2835_SPI_CS, cs); ++ ++ return 0; ++} ++ + static void bcm2835_spi_handle_err(struct spi_master *master, + struct spi_message *msg) + { +@@ -429,6 +446,7 @@ static int bcm2835_spi_probe(struct plat + master->set_cs = bcm2835_spi_set_cs; + master->transfer_one = bcm2835_spi_transfer_one; + master->handle_err = bcm2835_spi_handle_err; ++ master->prepare_message = bcm2835_spi_prepare_message; + master->dev.of_node = pdev->dev.of_node; + + bs = spi_master_get_devdata(master); diff --git a/queue-4.1/spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch b/queue-4.1/spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch new file mode 100644 index 00000000000..092f7550022 --- /dev/null +++ b/queue-4.1/spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch @@ -0,0 +1,129 @@ +From c4fe57f76269dbb2af135071513f260ca40229a3 Mon Sep 17 00:00:00 2001 +From: Michael van der Westhuizen +Date: Tue, 18 Aug 2015 22:21:53 +0200 +Subject: spi: dw: Allow interface drivers to limit data I/O to word sizes + +From: Michael van der Westhuizen + +commit c4fe57f76269dbb2af135071513f260ca40229a3 upstream. + +The commit dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit +accesses") changed all 16bit accesses in the DW_apb_ssi driver to 32bit. +This, unfortunately, breaks data register access on picoXcell, where the +DW IP needs data register accesses to be word accesses (all other +accesses appear to be OK). + +This change introduces a new master variable to allow interface drivers +to specify that 16bit data transfer I/O is required. This change also +introduces the ability to set this variable via device tree bindings in +the MMIO interface driver. Both the core and the MMIO interface driver +default to the current 32bit behaviour. + +Before this change, on a picoXcell pc3x3: + spi_master spi32766: interrupt_transfer: fifo overrun/underrun + m25p80 spi32766.0: error -5 reading 9f + m25p80: probe of spi32766.0 failed with error -5 + +After this change: + m25p80 spi32766.0: m25p40 (512 Kbytes) + +Fixes: dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit accesses") +Signed-off-by: Michael van der Westhuizen +Reviewed-by: Andy Shevchenko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-dw-mmio.c | 3 +++ + drivers/spi/spi-dw.c | 4 ++-- + drivers/spi/spi-dw.h | 35 +++++++++++++++++++++++++++++++++++ + 3 files changed, 40 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-dw-mmio.c ++++ b/drivers/spi/spi-dw-mmio.c +@@ -74,6 +74,9 @@ static int dw_spi_mmio_probe(struct plat + + dws->max_freq = clk_get_rate(dwsmmio->clk); + ++ of_property_read_u32(pdev->dev.of_node, "reg-io-width", ++ &dws->reg_io_width); ++ + num_cs = 4; + + if (pdev->dev.of_node) +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -194,7 +194,7 @@ static void dw_writer(struct dw_spi *dws + else + txw = *(u16 *)(dws->tx); + } +- dw_writel(dws, DW_SPI_DR, txw); ++ dw_write_io_reg(dws, DW_SPI_DR, txw); + dws->tx += dws->n_bytes; + } + } +@@ -205,7 +205,7 @@ static void dw_reader(struct dw_spi *dws + u16 rxw; + + while (max--) { +- rxw = dw_readl(dws, DW_SPI_DR); ++ rxw = dw_read_io_reg(dws, DW_SPI_DR); + /* Care rx only if the transfer's original "rx" is not null */ + if (dws->rx_end - dws->len) { + if (dws->n_bytes == 1) +--- a/drivers/spi/spi-dw.h ++++ b/drivers/spi/spi-dw.h +@@ -109,6 +109,7 @@ struct dw_spi { + u32 fifo_len; /* depth of the FIFO buffer */ + u32 max_freq; /* max bus freq supported */ + ++ u32 reg_io_width; /* DR I/O width in bytes */ + u16 bus_num; + u16 num_cs; /* supported slave numbers */ + +@@ -145,11 +146,45 @@ static inline u32 dw_readl(struct dw_spi + return __raw_readl(dws->regs + offset); + } + ++static inline u16 dw_readw(struct dw_spi *dws, u32 offset) ++{ ++ return __raw_readw(dws->regs + offset); ++} ++ + static inline void dw_writel(struct dw_spi *dws, u32 offset, u32 val) + { + __raw_writel(val, dws->regs + offset); + } + ++static inline void dw_writew(struct dw_spi *dws, u32 offset, u16 val) ++{ ++ __raw_writew(val, dws->regs + offset); ++} ++ ++static inline u32 dw_read_io_reg(struct dw_spi *dws, u32 offset) ++{ ++ switch (dws->reg_io_width) { ++ case 2: ++ return dw_readw(dws, offset); ++ case 4: ++ default: ++ return dw_readl(dws, offset); ++ } ++} ++ ++static inline void dw_write_io_reg(struct dw_spi *dws, u32 offset, u32 val) ++{ ++ switch (dws->reg_io_width) { ++ case 2: ++ dw_writew(dws, offset, val); ++ break; ++ case 4: ++ default: ++ dw_writel(dws, offset, val); ++ break; ++ } ++} ++ + static inline void spi_enable_chip(struct dw_spi *dws, int enable) + { + dw_writel(dws, DW_SPI_SSIENR, (enable ? 1 : 0)); diff --git a/queue-4.1/spi-fix-regression-in-spi-bitbang-txrx.h.patch b/queue-4.1/spi-fix-regression-in-spi-bitbang-txrx.h.patch new file mode 100644 index 00000000000..696409b6f08 --- /dev/null +++ b/queue-4.1/spi-fix-regression-in-spi-bitbang-txrx.h.patch @@ -0,0 +1,43 @@ +From 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 Mon Sep 17 00:00:00 2001 +From: Lars Persson +Date: Wed, 29 Jul 2015 09:32:02 +0200 +Subject: spi: Fix regression in spi-bitbang-txrx.h + +From: Lars Persson + +commit 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 upstream. + +This patch fixes a regression introduced by commit 232a5adc5199 ("spi: +bitbang: only toggle bitchanges"). The attempt to optimize writes of +consecutive bit patterns broke most of the combinations of word size +and SPI modes due to selecting the wrong bit as the MSB value. + +Fixes: 232a5adc5199 (spi: bitbang: only toggle bitchanges) +Signed-off-by: Lars Persson +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bitbang-txrx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-bitbang-txrx.h ++++ b/drivers/spi/spi-bitbang-txrx.h +@@ -49,7 +49,7 @@ bitbang_txrx_be_cpha0(struct spi_device + { + /* if (cpol == 0) this is SPI_MODE_0; else this is SPI_MODE_2 */ + +- bool oldbit = !(word & 1); ++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31; + /* clock starts at inactive polarity */ + for (word <<= (32 - bits); likely(bits); bits--) { + +@@ -81,7 +81,7 @@ bitbang_txrx_be_cpha1(struct spi_device + { + /* if (cpol == 0) this is SPI_MODE_1; else this is SPI_MODE_3 */ + +- bool oldbit = !(word & (1 << 31)); ++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31; + /* clock starts at inactive polarity */ + for (word <<= (32 - bits); likely(bits); bits--) { + diff --git a/queue-4.1/spi-img-spfi-check-for-timeout-error-before-proceeding.patch b/queue-4.1/spi-img-spfi-check-for-timeout-error-before-proceeding.patch new file mode 100644 index 00000000000..782241336c5 --- /dev/null +++ b/queue-4.1/spi-img-spfi-check-for-timeout-error-before-proceeding.patch @@ -0,0 +1,48 @@ +From 011710e2ab659c7ad6e5e554806414bd7a9508be Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Mon, 27 Jul 2015 13:11:15 +0100 +Subject: spi: img-spfi: check for timeout error before proceeding + +From: Sifan Naeem + +commit 011710e2ab659c7ad6e5e554806414bd7a9508be upstream. + +Calling spfi_wait_all_done is not required if the transfer has timed +out before all data is transferred. + +spfi_wait_all_done polls for Alldone interrupt which is triggered to +mark the transfer as complete and to indicate it is now safe to issue +a new transfer. + +Fixes: 8c2c8c0 ("spi: img-spfi: Control CS lines with GPIO") +Signed-off-by: Sifan Naeem +Reviewed-by: Andrew Bresticker +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -267,15 +267,15 @@ static int img_spfi_start_pio(struct spi + cpu_relax(); + } + +- ret = spfi_wait_all_done(spfi); +- if (ret < 0) +- return ret; +- + if (rx_bytes > 0 || tx_bytes > 0) { + dev_err(spfi->dev, "PIO transfer timed out\n"); + return -ETIMEDOUT; + } + ++ ret = spfi_wait_all_done(spfi); ++ if (ret < 0) ++ return ret; ++ + return 0; + } + diff --git a/queue-4.1/spi-img-spfi-fix-kbuild-test-robot-warning.patch b/queue-4.1/spi-img-spfi-fix-kbuild-test-robot-warning.patch new file mode 100644 index 00000000000..af8febbe744 --- /dev/null +++ b/queue-4.1/spi-img-spfi-fix-kbuild-test-robot-warning.patch @@ -0,0 +1,33 @@ +From 9176c6657b5c313cf504d157e6d91496ee5c8708 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Thu, 6 Aug 2015 10:33:01 +0100 +Subject: spi: img-spfi: fix kbuild test robot warning + +From: Sifan Naeem + +commit 9176c6657b5c313cf504d157e6d91496ee5c8708 upstream. + +drivers/spi/spi-img-spfi.c: In function 'img_spfi_setup': +drivers/spi/spi-img-spfi.c:446: warning: 'ret' may be used +uninitialized in this function. + +Fixes: commit b03ba9e314c1 ("spi: img-spfi: fix multiple calls to request gpio") +Signed-off-by: Sifan Naeem +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -444,7 +444,7 @@ static int img_spfi_unprepare(struct spi + + static int img_spfi_setup(struct spi_device *spi) + { +- int ret; ++ int ret = -EINVAL; + struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); + + if (!spfi_data) { diff --git a/queue-4.1/spi-img-spfi-fix-multiple-calls-to-request-gpio.patch b/queue-4.1/spi-img-spfi-fix-multiple-calls-to-request-gpio.patch new file mode 100644 index 00000000000..681604686ae --- /dev/null +++ b/queue-4.1/spi-img-spfi-fix-multiple-calls-to-request-gpio.patch @@ -0,0 +1,97 @@ +From b03ba9e314c12b2127243145b5c1f41b2408de62 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Wed, 29 Jul 2015 11:55:26 +0100 +Subject: spi: img-spfi: fix multiple calls to request gpio + +From: Sifan Naeem + +commit b03ba9e314c12b2127243145b5c1f41b2408de62 upstream. + +spfi_setup may be called many times by the spi framework, but +gpio_request_one can only be called once without freeing, repeatedly +calling gpio_request_one will cause an error to be thrown, which +causes the request to spi_setup to be marked as failed. + +We can have a per-spi_device flag that indicates whether or not the +gpio has been requested. If the gpio has already been requested use +gpio_direction_output to set the direction of the gpio. + +Fixes: 8c2c8c03cdcb ("spi: img-spfi: Control CS lines with GPIO") +Signed-off-by: Sifan Naeem +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 47 ++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 40 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -105,6 +105,10 @@ struct img_spfi { + bool rx_dma_busy; + }; + ++struct img_spfi_device_data { ++ bool gpio_requested; ++}; ++ + static inline u32 spfi_readl(struct img_spfi *spfi, u32 reg) + { + return readl(spfi->regs + reg); +@@ -441,20 +445,49 @@ static int img_spfi_unprepare(struct spi + static int img_spfi_setup(struct spi_device *spi) + { + int ret; ++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); + +- ret = gpio_request_one(spi->cs_gpio, (spi->mode & SPI_CS_HIGH) ? +- GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH, +- dev_name(&spi->dev)); +- if (ret) +- dev_err(&spi->dev, "can't request chipselect gpio %d\n", ++ if (!spfi_data) { ++ spfi_data = kzalloc(sizeof(*spfi_data), GFP_KERNEL); ++ if (!spfi_data) ++ return -ENOMEM; ++ spfi_data->gpio_requested = false; ++ spi_set_ctldata(spi, spfi_data); ++ } ++ if (!spfi_data->gpio_requested) { ++ ret = gpio_request_one(spi->cs_gpio, ++ (spi->mode & SPI_CS_HIGH) ? ++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH, ++ dev_name(&spi->dev)); ++ if (ret) ++ dev_err(&spi->dev, "can't request chipselect gpio %d\n", + spi->cs_gpio); +- ++ else ++ spfi_data->gpio_requested = true; ++ } else { ++ if (gpio_is_valid(spi->cs_gpio)) { ++ int mode = ((spi->mode & SPI_CS_HIGH) ? ++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH); ++ ++ ret = gpio_direction_output(spi->cs_gpio, mode); ++ if (ret) ++ dev_err(&spi->dev, "chipselect gpio %d setup failed (%d)\n", ++ spi->cs_gpio, ret); ++ } ++ } + return ret; + } + + static void img_spfi_cleanup(struct spi_device *spi) + { +- gpio_free(spi->cs_gpio); ++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); ++ ++ if (spfi_data) { ++ if (spfi_data->gpio_requested) ++ gpio_free(spi->cs_gpio); ++ kfree(spfi_data); ++ spi_set_ctldata(spi, NULL); ++ } + } + + static void img_spfi_config(struct spi_master *master, struct spi_device *spi, diff --git a/queue-4.1/spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch b/queue-4.1/spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch new file mode 100644 index 00000000000..d29a98862a0 --- /dev/null +++ b/queue-4.1/spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch @@ -0,0 +1,66 @@ +From fe78d0b7691c02744004b15f6979b3f106464bc4 Mon Sep 17 00:00:00 2001 +From: Koji Matsuoka +Date: Mon, 15 Jun 2015 02:25:05 +0900 +Subject: spi: sh-msiof: Fix FIFO size to 64 word from 256 word + +From: Koji Matsuoka + +commit fe78d0b7691c02744004b15f6979b3f106464bc4 upstream. + +The upper limit of Tx/Rx FIFO size is 64 word by the +specification of H/W. This patch corrects to 64 word from 256 word. + +Signed-off-by: Koji Matsuoka +Signed-off-by: Yoshihiro Kaneko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-sh-msiof.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -48,8 +48,8 @@ struct sh_msiof_spi_priv { + const struct sh_msiof_chipdata *chipdata; + struct sh_msiof_spi_info *info; + struct completion done; +- int tx_fifo_size; +- int rx_fifo_size; ++ unsigned int tx_fifo_size; ++ unsigned int rx_fifo_size; + void *tx_dma_page; + void *rx_dma_page; + dma_addr_t tx_dma_addr; +@@ -95,8 +95,6 @@ struct sh_msiof_spi_priv { + #define MDR2_WDLEN1(i) (((i) - 1) << 16) /* Word Count (1-64/256 (SH, A1))) */ + #define MDR2_GRPMASK1 0x00000001 /* Group Output Mask 1 (SH, A1) */ + +-#define MAX_WDLEN 256U +- + /* TSCR and RSCR */ + #define SCR_BRPS_MASK 0x1f00 /* Prescaler Setting (1-32) */ + #define SCR_BRPS(i) (((i) - 1) << 8) +@@ -850,7 +848,12 @@ static int sh_msiof_transfer_one(struct + * DMA supports 32-bit words only, hence pack 8-bit and 16-bit + * words, with byte resp. word swapping. + */ +- unsigned int l = min(len, MAX_WDLEN * 4); ++ unsigned int l = 0; ++ ++ if (tx_buf) ++ l = min(len, p->tx_fifo_size * 4); ++ if (rx_buf) ++ l = min(len, p->rx_fifo_size * 4); + + if (bits <= 8) { + if (l & 3) +@@ -963,7 +966,7 @@ static const struct sh_msiof_chipdata sh + + static const struct sh_msiof_chipdata r8a779x_data = { + .tx_fifo_size = 64, +- .rx_fifo_size = 256, ++ .rx_fifo_size = 64, + .master_flags = SPI_MASTER_MUST_TX, + }; + diff --git a/queue-4.1/tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch b/queue-4.1/tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch new file mode 100644 index 00000000000..9cf49bd7003 --- /dev/null +++ b/queue-4.1/tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch @@ -0,0 +1,75 @@ +From 8117e347406278fd399b077add4e638cd017ae2d Mon Sep 17 00:00:00 2001 +From: Johannes Thumshirn +Date: Thu, 6 Aug 2015 09:16:37 +0200 +Subject: tty: serial: men_z135_uart.c: Fix race between IRQ and set_termios() + +From: Johannes Thumshirn + +commit 8117e347406278fd399b077add4e638cd017ae2d upstream. + +Fix panic caused by a race between men_z135_intr() and men_z135_set_termios(). + +men_z135_intr() and men_z135_set_termios() both hold the struct uart_port::lock +spinlock, but men_z135_intr() does a spin_lock_irqsave() and +men_z135_set_termios() does a normal spin_lock(), which can lead to a deadlock +when an interrupt is called while the lock is being helt by +men_z135_set_termios(). + +This was discovered using a insmod, hardware looppback send/receive, rmmod +stress test. + +Signed-off-by: Johannes Thumshirn +Reviewed-by: Peter Hurley +Cc: Andreas Werner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/men_z135_uart.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/tty/serial/men_z135_uart.c ++++ b/drivers/tty/serial/men_z135_uart.c +@@ -392,7 +392,6 @@ static irqreturn_t men_z135_intr(int irq + struct men_z135_port *uart = (struct men_z135_port *)data; + struct uart_port *port = &uart->port; + bool handled = false; +- unsigned long flags; + int irq_id; + + uart->stat_reg = ioread32(port->membase + MEN_Z135_STAT_REG); +@@ -401,7 +400,7 @@ static irqreturn_t men_z135_intr(int irq + if (!irq_id) + goto out; + +- spin_lock_irqsave(&port->lock, flags); ++ spin_lock(&port->lock); + /* It's save to write to IIR[7:6] RXC[9:8] */ + iowrite8(irq_id, port->membase + MEN_Z135_STAT_REG); + +@@ -427,7 +426,7 @@ static irqreturn_t men_z135_intr(int irq + handled = true; + } + +- spin_unlock_irqrestore(&port->lock, flags); ++ spin_unlock(&port->lock); + out: + return IRQ_RETVAL(handled); + } +@@ -717,7 +716,7 @@ static void men_z135_set_termios(struct + + baud = uart_get_baud_rate(port, termios, old, 0, uart_freq / 16); + +- spin_lock(&port->lock); ++ spin_lock_irq(&port->lock); + if (tty_termios_baud_rate(termios)) + tty_termios_encode_baud_rate(termios, baud, baud); + +@@ -725,7 +724,7 @@ static void men_z135_set_termios(struct + iowrite32(bd_reg, port->membase + MEN_Z135_BAUD_REG); + + uart_update_timeout(port, termios->c_cflag, baud); +- spin_unlock(&port->lock); ++ spin_unlock_irq(&port->lock); + } + + static const char *men_z135_type(struct uart_port *port) diff --git a/queue-4.1/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch b/queue-4.1/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch new file mode 100644 index 00000000000..3828d961f3b --- /dev/null +++ b/queue-4.1/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch @@ -0,0 +1,58 @@ +From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 12:25:27 +0530 +Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes + +From: Kishon Vijay Abraham I + +commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. + +DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and +the size of bounce buffer is 512 bytes. However if the host initiates OUT +transfers of size more than 512 bytes (and non max packet aligned), the +driver throws a WARN dump but still programs the TRB to receive more than +512 bytes. This will cause bounce buffer to overflow and corrupt the +adjacent memory locations which can be fatal. + +Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE +(512) bytes. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -820,6 +820,11 @@ static void dwc3_ep0_complete_data(struc + unsigned maxp = ep0->endpoint.maxpacket; + + transfer_size += (maxp - (transfer_size % maxp)); ++ ++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ + transferred = min_t(u32, ur->length, + transfer_size - length); + memcpy(ur->buf, dwc->ep0_bounce, transferred); +@@ -941,11 +946,14 @@ static void __dwc3_ep0_do_control_data(s + return; + } + +- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); +- + maxpacket = dep->endpoint.maxpacket; + transfer_size = roundup(req->request.length, maxpacket); + ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { ++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ } ++ + dwc->ep0_bounced = true; + + /* diff --git a/queue-4.1/usb-ftdi_sio-added-custom-pid-for-customware-products.patch b/queue-4.1/usb-ftdi_sio-added-custom-pid-for-customware-products.patch new file mode 100644 index 00000000000..9529398b322 --- /dev/null +++ b/queue-4.1/usb-ftdi_sio-added-custom-pid-for-customware-products.patch @@ -0,0 +1,51 @@ +From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001 +From: Matthijs Kooijman +Date: Tue, 18 Aug 2015 10:33:56 +0200 +Subject: USB: ftdi_sio: Added custom PID for CustomWare products + +From: Matthijs Kooijman + +commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream. + +CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex +products. + +Signed-off-by: Matthijs Kooijman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ++++ + drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -605,6 +605,10 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) }, + /* + * ELV devices: + */ +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -568,6 +568,14 @@ + */ + #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ + ++/* ++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID) ++ */ ++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */ ++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */ ++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */ ++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */ ++ + + /********************************/ + /** third-party VID/PID combos **/ diff --git a/queue-4.1/usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch b/queue-4.1/usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch new file mode 100644 index 00000000000..4dd324c3ad9 --- /dev/null +++ b/queue-4.1/usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch @@ -0,0 +1,87 @@ +From 913e4a90b6f9687ac0f543e7b632753e4f51c441 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 30 Jul 2015 13:13:03 +0800 +Subject: usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth + +From: Peter Chen + +commit 913e4a90b6f9687ac0f543e7b632753e4f51c441 upstream. + +According to USB Audio Device 2.0 Spec, Ch4.10.1.1: +wMaxPacketSize is defined as follows: +Maximum packet size this endpoint is capable of sending or receiving +when this configuration is selected. +This is determined by the audio bandwidth constraints of the endpoint. + +In current code, the wMaxPacketSize is defined as the maximum packet size +for ISO endpoint, and it will let the host reserve much more space than +it really needs, so that we can't let more endpoints work together at +one frame. + +We find this issue when we try to let 4 f_uac2 gadgets work together [1] +at FS connection. + +[1]http://www.spinics.net/lists/linux-usb/msg123478.html + +Acked-by: Daniel Mack +Cc: andrzej.p@samsung.com +Cc: Daniel Mack +Cc: tiwai@suse.de +Cc: Alan Stern +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_uac2.c | 31 +++++++++++++++++++++++++++++-- + 1 file changed, 29 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -975,6 +975,29 @@ free_ep(struct uac2_rtd_params *prm, str + "%s:%d Error!\n", __func__, __LINE__); + } + ++static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, ++ struct usb_endpoint_descriptor *ep_desc, ++ unsigned int factor, bool is_playback) ++{ ++ int chmask, srate, ssize; ++ u16 max_packet_size; ++ ++ if (is_playback) { ++ chmask = uac2_opts->p_chmask; ++ srate = uac2_opts->p_srate; ++ ssize = uac2_opts->p_ssize; ++ } else { ++ chmask = uac2_opts->c_chmask; ++ srate = uac2_opts->c_srate; ++ ssize = uac2_opts->c_ssize; ++ } ++ ++ max_packet_size = num_channels(chmask) * ssize * ++ DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1))); ++ ep_desc->wMaxPacketSize = cpu_to_le16(min(max_packet_size, ++ le16_to_cpu(ep_desc->wMaxPacketSize))); ++} ++ + static int + afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + { +@@ -1070,10 +1093,14 @@ afunc_bind(struct usb_configuration *cfg + uac2->p_prm.uac2 = uac2; + uac2->c_prm.uac2 = uac2; + ++ /* Calculate wMaxPacketSize according to audio bandwidth */ ++ set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true); ++ set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false); ++ set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true); ++ set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false); ++ + hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress; +- hs_epout_desc.wMaxPacketSize = fs_epout_desc.wMaxPacketSize; + hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress; +- hs_epin_desc.wMaxPacketSize = fs_epin_desc.wMaxPacketSize; + + ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL); + if (ret) diff --git a/queue-4.1/usb-gadget-m66592-udc-forever-loop-in-set_feature.patch b/queue-4.1/usb-gadget-m66592-udc-forever-loop-in-set_feature.patch new file mode 100644 index 00000000000..49845a102a2 --- /dev/null +++ b/queue-4.1/usb-gadget-m66592-udc-forever-loop-in-set_feature.patch @@ -0,0 +1,32 @@ +From 5feb5d2003499b1094d898c010a7604d7afddc4c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 30 Jul 2015 00:30:58 +0300 +Subject: usb: gadget: m66592-udc: forever loop in set_feature() + +From: Dan Carpenter + +commit 5feb5d2003499b1094d898c010a7604d7afddc4c upstream. + +There is an "&&" vs "||" typo here so this loops 3000 times or if we get +unlucky it could loop forever. + +Fixes: ceaa0a6eeadf ('usb: gadget: m66592-udc: add support for TEST_MODE') +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/m66592-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/m66592-udc.c ++++ b/drivers/usb/gadget/udc/m66592-udc.c +@@ -1052,7 +1052,7 @@ static void set_feature(struct m66592 *m + tmp = m66592_read(m66592, M66592_INTSTS0) & + M66592_CTSQ; + udelay(1); +- } while (tmp != M66592_CS_IDST || timeout-- > 0); ++ } while (tmp != M66592_CS_IDST && timeout-- > 0); + + if (tmp == M66592_CS_IDST) + m66592_bset(m66592, diff --git a/queue-4.1/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch b/queue-4.1/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch new file mode 100644 index 00000000000..67707230721 --- /dev/null +++ b/queue-4.1/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch @@ -0,0 +1,58 @@ +From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Mon, 17 Aug 2015 10:23:03 +0800 +Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion + +From: Peter Chen + +commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream. + +The ehci platform device's drvdata is the pointer of struct usb_hcd +already, so we doesn't need to call bus_to_hcd conversion again. + +Signed-off-by: Peter Chen +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sysfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sysfs.c ++++ b/drivers/usb/host/ehci-sysfs.c +@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev + int count = PAGE_SIZE; + char *ptr = buf; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + nports = HCS_N_PORTS(ehci->hcs_params); + + for (index = 0; index < nports; ++index) { +@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de + struct ehci_hcd *ehci; + int portnum, new_owner; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + new_owner = PORT_OWNER; /* Owned by companion */ + if (sscanf(buf, "%d", &portnum) != 1) + return -EINVAL; +@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max( + struct ehci_hcd *ehci; + int n; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max); + return n; + } +@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max + unsigned long flags; + ssize_t ret; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + if (kstrtouint(buf, 0, &uframe_periodic_max) < 0) + return -EINVAL; + diff --git a/queue-4.1/usb-pl2303-fix-baud-rate-divisor-calculations.patch b/queue-4.1/usb-pl2303-fix-baud-rate-divisor-calculations.patch new file mode 100644 index 00000000000..c9a2fc29e3c --- /dev/null +++ b/queue-4.1/usb-pl2303-fix-baud-rate-divisor-calculations.patch @@ -0,0 +1,97 @@ +From 49bda21266fdf195142e8b5dea057f09e96ada9f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Pecio?= +Date: Sun, 26 Jul 2015 11:14:34 +0200 +Subject: USB: pl2303: fix baud-rate divisor calculations + +From: =?UTF-8?q?Micha=C5=82=20Pecio?= + +commit 49bda21266fdf195142e8b5dea057f09e96ada9f upstream. + +This commit fixes the following issues: + +1. The 9th bit of buf was believed to be the LSB of divisor's +exponent, but the hardware interprets it as MSB (9th bit) of the +mantissa. The exponent is actually one bit shorter and applies +to base 4, not 2 as previously believed. + +2. Loop iterations doubled the exponent instead of incrementing. + +3. The exponent wasn't checked for overflow. + +4. The function returned requested rate instead of actual rate. + +Due to issue #2, the old code deviated from the wrong formula +described in #1 and actually yielded correct rates when divisor +was lower than 4096 by using exponents of 0, 2 or 4 base-2, +interpreted as 0, 1, 2 base-4 with the 9th mantissa bit clear. +However, at 93.75 kbaud or less the rate turned out too slow +due to #2 or too fast due to #2 and #3. + +I tested this patch by sending and validating 0x00,0x01,..,0xff +to an FTDI dongle at 234, 987, 2401, 9601, 31415, 115199, 250k, +500k, 750k, 1M, 1.5M, 3M+1 baud. All rates passed. + +I also used pv to check speed at some rates unsupported by FTDI: +45 (the lowest possible), 2M, 4M, 5M and 6M-1. Looked sane. + +Signed-off-by: Michal Pecio +Fixes: 399aa9a75ad3 ("USB: pl2303: use divisors for unsupported baud +rates") +[johan: update summary ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -362,21 +362,38 @@ static speed_t pl2303_encode_baud_rate_d + static speed_t pl2303_encode_baud_rate_divisor(unsigned char buf[4], + speed_t baud) + { +- unsigned int tmp; ++ unsigned int baseline, mantissa, exponent; + + /* + * Apparently the formula is: +- * baudrate = 12M * 32 / (2^buf[1]) / buf[0] ++ * baudrate = 12M * 32 / (mantissa * 4^exponent) ++ * where ++ * mantissa = buf[8:0] ++ * exponent = buf[11:9] + */ +- tmp = 12000000 * 32 / baud; ++ baseline = 12000000 * 32; ++ mantissa = baseline / baud; ++ if (mantissa == 0) ++ mantissa = 1; /* Avoid dividing by zero if baud > 32*12M. */ ++ exponent = 0; ++ while (mantissa >= 512) { ++ if (exponent < 7) { ++ mantissa >>= 2; /* divide by 4 */ ++ exponent++; ++ } else { ++ /* Exponent is maxed. Trim mantissa and leave. */ ++ mantissa = 511; ++ break; ++ } ++ } ++ + buf[3] = 0x80; + buf[2] = 0; +- buf[1] = (tmp >= 256); +- while (tmp >= 256) { +- tmp >>= 2; +- buf[1] <<= 1; +- } +- buf[0] = tmp; ++ buf[1] = exponent << 1 | mantissa >> 8; ++ buf[0] = mantissa & 0xff; ++ ++ /* Calculate and return the exact baud rate. */ ++ baud = (baseline / mantissa) >> (exponent << 1); + + return baud; + } diff --git a/queue-4.1/usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch b/queue-4.1/usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch new file mode 100644 index 00000000000..b07e2064221 --- /dev/null +++ b/queue-4.1/usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch @@ -0,0 +1,30 @@ +From 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Tue, 18 Aug 2015 10:36:23 +0200 +Subject: USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module + +From: David Ward + +commit 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 upstream. + +This is an HP-branded Sierra Wireless EM7355: +https://bugzilla.redhat.com/show_bug.cgi?id=1223646#c2 + +Signed-off-by: David Ward +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -139,6 +139,7 @@ static const struct usb_device_id id_tab + {USB_DEVICE(0x0AF0, 0x8120)}, /* Option GTM681W */ + + /* non-Gobi Sierra Wireless devices */ ++ {DEVICE_SWI(0x03f0, 0x4e1d)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ + {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */ + {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */ + {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */ diff --git a/queue-4.1/usb-symbolserial-use-usb_get_serial_port_data.patch b/queue-4.1/usb-symbolserial-use-usb_get_serial_port_data.patch new file mode 100644 index 00000000000..e5e182bb343 --- /dev/null +++ b/queue-4.1/usb-symbolserial-use-usb_get_serial_port_data.patch @@ -0,0 +1,52 @@ +From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001 +From: Philipp Hachtmann +Date: Mon, 17 Aug 2015 17:31:46 +0200 +Subject: USB: symbolserial: Use usb_get_serial_port_data + +From: Philipp Hachtmann + +commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream. + +The driver used usb_get_serial_data(port->serial) which compiled but resulted +in a NULL pointer being returned (and subsequently used). I did not go deeper +into this but I guess this is a regression. + +Signed-off-by: Philipp Hachtmann +Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to +port_probe") +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/symbolserial.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/symbolserial.c ++++ b/drivers/usb/serial/symbolserial.c +@@ -94,7 +94,7 @@ exit: + + static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + int result = 0; + +@@ -120,7 +120,7 @@ static void symbol_close(struct usb_seri + static void symbol_throttle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + + spin_lock_irq(&priv->lock); + priv->throttled = true; +@@ -130,7 +130,7 @@ static void symbol_throttle(struct tty_s + static void symbol_unthrottle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + int result; + bool was_throttled; + diff --git a/queue-4.1/xfs-fix-file-type-directory-corruption-for-btree-directories.patch b/queue-4.1/xfs-fix-file-type-directory-corruption-for-btree-directories.patch new file mode 100644 index 00000000000..1db4d92a26c --- /dev/null +++ b/queue-4.1/xfs-fix-file-type-directory-corruption-for-btree-directories.patch @@ -0,0 +1,65 @@ +From 037542345a82aaaa228ec280fe6ddff1568d169f Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 25 Aug 2015 10:05:13 +1000 +Subject: xfs: Fix file type directory corruption for btree directories + +From: Jan Kara + +commit 037542345a82aaaa228ec280fe6ddff1568d169f upstream. + +Users have occasionally reported that file type for some directory +entries is wrong. This mostly happened after updating libraries some +libraries. After some debugging the problem was traced down to +xfs_dir2_node_replace(). The function uses args->filetype as a file type +to store in the replaced directory entry however it also calls +xfs_da3_node_lookup_int() which will store file type of the current +directory entry in args->filetype. Thus we fail to change file type of a +directory entry to a proper type. + +Fix the problem by storing new file type in a local variable before +calling xfs_da3_node_lookup_int(). + +Reported-by: Giacomo Comes +Signed-off-by: Jan Kara +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_dir2_node.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_dir2_node.c ++++ b/fs/xfs/libxfs/xfs_dir2_node.c +@@ -2132,6 +2132,7 @@ xfs_dir2_node_replace( + int error; /* error return value */ + int i; /* btree level */ + xfs_ino_t inum; /* new inode number */ ++ int ftype; /* new file type */ + xfs_dir2_leaf_t *leaf; /* leaf structure */ + xfs_dir2_leaf_entry_t *lep; /* leaf entry being changed */ + int rval; /* internal return value */ +@@ -2145,7 +2146,14 @@ xfs_dir2_node_replace( + state = xfs_da_state_alloc(); + state->args = args; + state->mp = args->dp->i_mount; ++ ++ /* ++ * We have to save new inode number and ftype since ++ * xfs_da3_node_lookup_int() is going to overwrite them ++ */ + inum = args->inumber; ++ ftype = args->filetype; ++ + /* + * Lookup the entry to change in the btree. + */ +@@ -2183,7 +2191,7 @@ xfs_dir2_node_replace( + * Fill in the new inode number and log the entry. + */ + dep->inumber = cpu_to_be64(inum); +- args->dp->d_ops->data_put_ftype(dep, args->filetype); ++ args->dp->d_ops->data_put_ftype(dep, ftype); + xfs_dir2_data_log_entry(args, state->extrablk.bp, dep); + rval = 0; + } diff --git a/queue-4.1/xfs-fix-xfs_attr_leafblock-definition.patch b/queue-4.1/xfs-fix-xfs_attr_leafblock-definition.patch new file mode 100644 index 00000000000..f6edaf25c31 --- /dev/null +++ b/queue-4.1/xfs-fix-xfs_attr_leafblock-definition.patch @@ -0,0 +1,47 @@ +From ffeecc5213024ae663377b442eedcfbacf6d0c5d Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 19 Aug 2015 10:34:32 +1000 +Subject: xfs: Fix xfs_attr_leafblock definition + +From: Jan Kara + +commit ffeecc5213024ae663377b442eedcfbacf6d0c5d upstream. + +struct xfs_attr_leafblock contains 'entries' array which is declared +with size 1 altough it can in fact contain much more entries. Since this +array is followed by further struct members, gcc (at least in version +4.8.3) thinks that the array has the fixed size of 1 element and thus +may optimize away all accesses beyond the end of array resulting in +non-working code. This problem was only observed with userspace code in +xfsprogs, however it's better to be safe in kernel as well and have +matching kernel and xfsprogs definitions. + +Signed-off-by: Jan Kara +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_da_format.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/fs/xfs/libxfs/xfs_da_format.h ++++ b/fs/xfs/libxfs/xfs_da_format.h +@@ -680,8 +680,15 @@ typedef struct xfs_attr_leaf_name_remote + typedef struct xfs_attr_leafblock { + xfs_attr_leaf_hdr_t hdr; /* constant-structure header block */ + xfs_attr_leaf_entry_t entries[1]; /* sorted on key, not name */ +- xfs_attr_leaf_name_local_t namelist; /* grows from bottom of buf */ +- xfs_attr_leaf_name_remote_t valuelist; /* grows from bottom of buf */ ++ /* ++ * The rest of the block contains the following structures after the ++ * leaf entries, growing from the bottom up. The variables are never ++ * referenced and definining them can actually make gcc optimize away ++ * accesses to the 'entries' array above index 0 so don't do that. ++ * ++ * xfs_attr_leaf_name_local_t namelist; ++ * xfs_attr_leaf_name_remote_t valuelist; ++ */ + } xfs_attr_leafblock_t; + + /*