From: Greg Kroah-Hartman Date: Tue, 26 Feb 2013 23:23:01 +0000 (-0800) Subject: 3.8-stable patches X-Git-Tag: v3.7.10~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=663323cb594150dabead8958f0cc4a94e9e5774b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.8-stable patches added patches: dca-check-against-empty-dca_domains-list-before-unregister-provider.patch dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch ipv4-fix-a-bug-in-ping_err.patch ipv4-fix-error-handling-in-icmp_protocol.patch ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch ipv6-use-a-stronger-hash-for-tcp.patch mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch mlx4_en-fix-allocation-of-device-tx_cq.patch net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch tcp-fix-syn-data-space-mis-accounting.patch usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch usb-ehci-omap-fix-autoloading-of-module.patch usb-musb-core-fix-failure-path.patch usb-musb-fix-dependency-on-transceiver-driver.patch usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch usb-option-add-and-update-alcatel-modems.patch usb-option-add-huawei-acm-devices-using-protocol-vendor.patch usb-option-add-yota-megafon-m100-1-4g-modem.patch usb-storage-properly-handle-the-endian-issues-of-idproduct.patch usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch vlan-adjust-vlan_set_encap_proto-for-its-callers.patch xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch xen-netback-correctly-return-errors-from-netbk_count_requests.patch xfrm-release-neighbor-upon-dst-destruction.patch --- diff --git a/queue-3.8/dca-check-against-empty-dca_domains-list-before-unregister-provider.patch b/queue-3.8/dca-check-against-empty-dca_domains-list-before-unregister-provider.patch new file mode 100644 index 00000000000..3caaa50098f --- /dev/null +++ b/queue-3.8/dca-check-against-empty-dca_domains-list-before-unregister-provider.patch @@ -0,0 +1,37 @@ +From c419fcfd071cf34ba00f9f65282583772d2655e7 Mon Sep 17 00:00:00 2001 +From: Maciej Sosnowski +Date: Wed, 23 May 2012 17:27:07 +0200 +Subject: dca: check against empty dca_domains list before unregister provider + +From: Maciej Sosnowski + +commit c419fcfd071cf34ba00f9f65282583772d2655e7 upstream. + +When providers get blocked unregister_dca_providers() is called ending up +with dca_providers and dca_domain lists emptied. Dca should be prevented from +trying to unregister any provider if dca_domain list is found empty. + +Reported-by: Jiang Liu +Tested-by: Gaohuai Han +Signed-off-by: Maciej Sosnowski +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dca/dca-core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/dca/dca-core.c ++++ b/drivers/dca/dca-core.c +@@ -420,6 +420,11 @@ void unregister_dca_provider(struct dca_ + + raw_spin_lock_irqsave(&dca_lock, flags); + ++ if (list_empty(&dca_domains)) { ++ raw_spin_unlock_irqrestore(&dca_lock, flags); ++ return; ++ } ++ + list_del(&dca->node); + + pci_rc = dca_pci_rc_from_dev(dev); diff --git a/queue-3.8/dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch b/queue-3.8/dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch new file mode 100644 index 00000000000..6587f60ac21 --- /dev/null +++ b/queue-3.8/dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch @@ -0,0 +1,34 @@ +From 7c1119bdd650fa58dad8157bc75c5fcf6ed97843 Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski +Date: Wed, 28 Nov 2012 06:49:47 +0000 +Subject: dma: sh: Don't use ENODEV for failing slave lookup + +From: Guennadi Liakhovetski + +commit 7c1119bdd650fa58dad8157bc75c5fcf6ed97843 upstream. + +If dmaengine driver's .device_alloc_chan_resources() method returns -ENODEV, +dma_request_channel() will decide, that the driver has been removed and will +remove the device from its list. To prevent this use ENXIO if a slave lookup +fails. + +Reported-by: Kuninori Morimoto +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/sh/shdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/sh/shdma.c ++++ b/drivers/dma/sh/shdma.c +@@ -326,7 +326,7 @@ static int sh_dmae_set_slave(struct shdm + shdma_chan); + const struct sh_dmae_slave_config *cfg = dmae_find_slave(sh_chan, slave_id); + if (!cfg) +- return -ENODEV; ++ return -ENXIO; + + if (!try) + sh_chan->config = cfg; diff --git a/queue-3.8/gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch b/queue-3.8/gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch new file mode 100644 index 00000000000..3f6446f0de8 --- /dev/null +++ b/queue-3.8/gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch @@ -0,0 +1,42 @@ +From c7886b18273b07042e25e8d3ba5c983837b84123 Mon Sep 17 00:00:00 2001 +From: Magnus Damm +Date: Wed, 13 Feb 2013 00:56:13 +0900 +Subject: gpio: em: Use irq_domain_add_simple() to fix runtime error + +From: Magnus Damm + +commit c7886b18273b07042e25e8d3ba5c983837b84123 upstream. + +Adjust the gpio-em.c driver to reconsider the pdata->irq_base +variable. Non-DT board code like for instance board-kzm9d.c +needs to operate of a static IRQ range for platform devices. + +So this patch is updating the code to make use of the function +irq_domain_add_simple() instead of irq_domain_add_linear(). + +Fixes a EMEV2 / KZM9D runtime error caused by the following commit: +7385500 gpio/em: convert to linear IRQ domain + +Signed-off-by: Magnus Damm +Tested-by: Simon Horman +Reported-by: Simon Horman +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-em.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-em.c ++++ b/drivers/gpio/gpio-em.c +@@ -299,8 +299,9 @@ static int em_gio_probe(struct platform_ + irq_chip->irq_set_type = em_gio_irq_set_type; + irq_chip->flags = IRQCHIP_SKIP_SET_WAKE; + +- p->irq_domain = irq_domain_add_linear(pdev->dev.of_node, ++ p->irq_domain = irq_domain_add_simple(pdev->dev.of_node, + pdata->number_of_pins, ++ pdata->irq_base, + &em_gio_irq_domain_ops, p); + if (!p->irq_domain) { + ret = -ENXIO; diff --git a/queue-3.8/ipv4-fix-a-bug-in-ping_err.patch b/queue-3.8/ipv4-fix-a-bug-in-ping_err.patch new file mode 100644 index 00000000000..7f381aa9c66 --- /dev/null +++ b/queue-3.8/ipv4-fix-a-bug-in-ping_err.patch @@ -0,0 +1,32 @@ +From 5f3d4d5fb050c029fc41273c1a181b9a3d8dfc6a Mon Sep 17 00:00:00 2001 +From: Li Wei +Date: Thu, 21 Feb 2013 00:09:54 +0000 +Subject: ipv4: fix a bug in ping_err(). + + +From: Li Wei + +[ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ] + +We should get 'type' and 'code' from the outer ICMP header. + +Signed-off-by: Li Wei +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ping.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -322,8 +322,8 @@ void ping_err(struct sk_buff *skb, u32 i + struct iphdr *iph = (struct iphdr *)skb->data; + struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2)); + struct inet_sock *inet_sock; +- int type = icmph->type; +- int code = icmph->code; ++ int type = icmp_hdr(skb)->type; ++ int code = icmp_hdr(skb)->code; + struct net *net = dev_net(skb->dev); + struct sock *sk; + int harderr; diff --git a/queue-3.8/ipv4-fix-error-handling-in-icmp_protocol.patch b/queue-3.8/ipv4-fix-error-handling-in-icmp_protocol.patch new file mode 100644 index 00000000000..196da5fea29 --- /dev/null +++ b/queue-3.8/ipv4-fix-error-handling-in-icmp_protocol.patch @@ -0,0 +1,79 @@ +From 7f1b6cb60443762018a68781bab6d7599e94bed7 Mon Sep 17 00:00:00 2001 +From: Li Wei +Date: Thu, 21 Feb 2013 22:18:44 +0000 +Subject: ipv4: fix error handling in icmp_protocol. + + +From: Li Wei + +[ Upstream commit 5b0520425e5ea81ba95ec486dd6bbb59a09fff0e ] + +Now we handle icmp errors in each transport protocol's err_handler, +for icmp protocols, that is ping_err. Since this handler only care +of those icmp errors triggered by echo request, errors triggered +by echo reply(which sent by kernel) are sliently ignored. + +So wrap ping_err() with icmp_err() to deal with those icmp errors. + +Signed-off-by: Li Wei +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/icmp.h | 1 + + net/ipv4/af_inet.c | 2 +- + net/ipv4/icmp.c | 23 +++++++++++++++++++++++ + 3 files changed, 25 insertions(+), 1 deletion(-) + +--- a/include/net/icmp.h ++++ b/include/net/icmp.h +@@ -41,6 +41,7 @@ struct net; + + extern void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info); + extern int icmp_rcv(struct sk_buff *skb); ++extern void icmp_err(struct sk_buff *, u32 info); + extern int icmp_init(void); + extern void icmp_out_count(struct net *net, unsigned char type); + +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1595,7 +1595,7 @@ static const struct net_offload udp_offl + + static const struct net_protocol icmp_protocol = { + .handler = icmp_rcv, +- .err_handler = ping_err, ++ .err_handler = icmp_err, + .no_policy = 1, + .netns_ok = 1, + }; +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -934,6 +934,29 @@ error: + goto drop; + } + ++void icmp_err(struct sk_buff *skb, u32 info) ++{ ++ struct iphdr *iph = (struct iphdr *)skb->data; ++ struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2)); ++ int type = icmp_hdr(skb)->type; ++ int code = icmp_hdr(skb)->code; ++ struct net *net = dev_net(skb->dev); ++ ++ /* ++ * Use ping_err to handle all icmp errors except those ++ * triggered by ICMP_ECHOREPLY which sent from kernel. ++ */ ++ if (icmph->type != ICMP_ECHOREPLY) { ++ ping_err(skb, info); ++ return; ++ } ++ ++ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) ++ ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ICMP, 0); ++ else if (type == ICMP_REDIRECT) ++ ipv4_redirect(skb, net, 0, 0, IPPROTO_ICMP, 0); ++} ++ + /* + * This table is the definition of how we handle ICMP. + */ diff --git a/queue-3.8/ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch b/queue-3.8/ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch new file mode 100644 index 00000000000..517544fcb83 --- /dev/null +++ b/queue-3.8/ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch @@ -0,0 +1,186 @@ +From d4b29b02bf506ee6ae2041b9297b34e1cd8fa2f9 Mon Sep 17 00:00:00 2001 +From: YOSHIFUJI Hideaki +Date: Wed, 20 Feb 2013 00:29:08 +0000 +Subject: ipv6: fix race condition regarding dst->expires and dst->from. + + +From: YOSHIFUJI Hideaki + +[ Upstream commit ecd9883724b78cc72ed92c98bcb1a46c764fff21 ] + +Eric Dumazet wrote: +| Some strange crashes happen in rt6_check_expired(), with access +| to random addresses. +| +| At first glance, it looks like the RTF_EXPIRES and +| stuff added in commit 1716a96101c49186b +| (ipv6: fix problem with expired dst cache) +| are racy : same dst could be manipulated at the same time +| on different cpus. +| +| At some point, our stack believes rt->dst.from contains a dst pointer, +| while its really a jiffie value (as rt->dst.expires shares the same area +| of memory) +| +| rt6_update_expires() should be fixed, or am I missing something ? +| +| CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060 + +Because we do not have any locks for dst_entry, we cannot change +essential structure in the entry; e.g., we cannot change reference +to other entity. + +To fix this issue, split 'from' and 'expires' field in dst_entry +out of union. Once it is 'from' is assigned in the constructor, +keep the reference until the very last stage of the life time of +the object. + +Of course, it is unsafe to change 'from', so make rt6_set_from simple +just for fresh entries. + +Reported-by: Eric Dumazet +Reported-by: Neil Horman +CC: Gao Feng +Signed-off-by: YOSHIFUJI Hideaki +Reviewed-by: Eric Dumazet +Reported-by: Steinar H. Gunderson +Reviewed-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/dst.h | 8 ++------ + include/net/ip6_fib.h | 37 +++++++++++-------------------------- + net/core/dst.c | 1 + + net/ipv6/route.c | 8 +++----- + 4 files changed, 17 insertions(+), 37 deletions(-) + +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -36,13 +36,9 @@ struct dst_entry { + struct net_device *dev; + struct dst_ops *ops; + unsigned long _metrics; +- union { +- unsigned long expires; +- /* point to where the dst_entry copied from */ +- struct dst_entry *from; +- }; ++ unsigned long expires; + struct dst_entry *path; +- void *__pad0; ++ struct dst_entry *from; + #ifdef CONFIG_XFRM + struct xfrm_state *xfrm; + #else +--- a/include/net/ip6_fib.h ++++ b/include/net/ip6_fib.h +@@ -166,50 +166,35 @@ static inline struct inet6_dev *ip6_dst_ + + static inline void rt6_clean_expires(struct rt6_info *rt) + { +- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) +- dst_release(rt->dst.from); +- + rt->rt6i_flags &= ~RTF_EXPIRES; +- rt->dst.from = NULL; + } + + static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires) + { +- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) +- dst_release(rt->dst.from); +- +- rt->rt6i_flags |= RTF_EXPIRES; + rt->dst.expires = expires; ++ rt->rt6i_flags |= RTF_EXPIRES; + } + +-static inline void rt6_update_expires(struct rt6_info *rt, int timeout) ++static inline void rt6_update_expires(struct rt6_info *rt0, int timeout) + { +- if (!(rt->rt6i_flags & RTF_EXPIRES)) { +- if (rt->dst.from) +- dst_release(rt->dst.from); +- /* dst_set_expires relies on expires == 0 +- * if it has not been set previously. +- */ +- rt->dst.expires = 0; +- } ++ struct rt6_info *rt; + +- dst_set_expires(&rt->dst, timeout); +- rt->rt6i_flags |= RTF_EXPIRES; ++ for (rt = rt0; rt && !(rt->rt6i_flags & RTF_EXPIRES); ++ rt = (struct rt6_info *)rt->dst.from); ++ if (rt && rt != rt0) ++ rt0->dst.expires = rt->dst.expires; ++ ++ dst_set_expires(&rt0->dst, timeout); ++ rt0->rt6i_flags |= RTF_EXPIRES; + } + + static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from) + { + struct dst_entry *new = (struct dst_entry *) from; + +- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) { +- if (new == rt->dst.from) +- return; +- dst_release(rt->dst.from); +- } +- + rt->rt6i_flags &= ~RTF_EXPIRES; +- rt->dst.from = new; + dst_hold(new); ++ rt->dst.from = new; + } + + static inline void ip6_rt_put(struct rt6_info *rt) +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -179,6 +179,7 @@ void *dst_alloc(struct dst_ops *ops, str + dst_init_metrics(dst, dst_default_metrics, true); + dst->expires = 0UL; + dst->path = dst; ++ dst->from = NULL; + #ifdef CONFIG_XFRM + dst->xfrm = NULL; + #endif +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -300,6 +300,7 @@ static void ip6_dst_destroy(struct dst_e + { + struct rt6_info *rt = (struct rt6_info *)dst; + struct inet6_dev *idev = rt->rt6i_idev; ++ struct dst_entry *from = dst->from; + + if (rt->n) + neigh_release(rt->n); +@@ -312,8 +313,8 @@ static void ip6_dst_destroy(struct dst_e + in6_dev_put(idev); + } + +- if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from) +- dst_release(dst->from); ++ dst->from = NULL; ++ dst_release(from); + + if (rt6_has_peer(rt)) { + struct inet_peer *peer = rt6_peer_ptr(rt); +@@ -1054,7 +1055,6 @@ struct dst_entry *ip6_blackhole_route(st + + rt->rt6i_gateway = ort->rt6i_gateway; + rt->rt6i_flags = ort->rt6i_flags; +- rt6_clean_expires(rt); + rt->rt6i_metric = 0; + + memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key)); +@@ -1859,8 +1859,6 @@ static struct rt6_info *ip6_rt_copy(stru + if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) == + (RTF_DEFAULT | RTF_ADDRCONF)) + rt6_set_from(rt, ort); +- else +- rt6_clean_expires(rt); + rt->rt6i_metric = 0; + + #ifdef CONFIG_IPV6_SUBTREES diff --git a/queue-3.8/ipv6-use-a-stronger-hash-for-tcp.patch b/queue-3.8/ipv6-use-a-stronger-hash-for-tcp.patch new file mode 100644 index 00000000000..1300e098f32 --- /dev/null +++ b/queue-3.8/ipv6-use-a-stronger-hash-for-tcp.patch @@ -0,0 +1,120 @@ +From b2dc9692e8f6b75e1a30a061bd7583bea7862395 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 21 Feb 2013 12:18:52 +0000 +Subject: ipv6: use a stronger hash for tcp + + +From: Eric Dumazet + +[ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ] + +It looks like its possible to open thousands of TCP IPv6 +sessions on a server, all landing in a single slot of TCP hash +table. Incoming packets have to lookup sockets in a very +long list. + +We should hash all bits from foreign IPv6 addresses, using +a salt and hash mix, not a simple XOR. + +inet6_ehashfn() can also separately use the ports, instead +of xoring them. + +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/inet6_hashtables.h | 8 ++++---- + include/net/inet_sock.h | 1 + + include/net/ipv6.h | 12 ++++++++++++ + net/ipv4/af_inet.c | 9 +++++++-- + 4 files changed, 24 insertions(+), 6 deletions(-) + +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -28,16 +28,16 @@ + + struct inet_hashinfo; + +-/* I have no idea if this is a good hash for v6 or not. -DaveM */ + static inline unsigned int inet6_ehashfn(struct net *net, + const struct in6_addr *laddr, const u16 lport, + const struct in6_addr *faddr, const __be16 fport) + { +- u32 ports = (lport ^ (__force u16)fport); ++ u32 ports = (((u32)lport) << 16) | (__force u32)fport; + + return jhash_3words((__force u32)laddr->s6_addr32[3], +- (__force u32)faddr->s6_addr32[3], +- ports, inet_ehash_secret + net_hash_mix(net)); ++ ipv6_addr_jhash(faddr), ++ ports, ++ inet_ehash_secret + net_hash_mix(net)); + } + + static inline int inet6_sk_ehashfn(const struct sock *sk) +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -203,6 +203,7 @@ static inline void inet_sk_copy_descenda + extern int inet_sk_rebuild_header(struct sock *sk); + + extern u32 inet_ehash_secret; ++extern u32 ipv6_hash_secret; + extern void build_ehash_secret(void); + + static inline unsigned int inet_ehashfn(struct net *net, +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -15,6 +15,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -473,6 +474,17 @@ static inline u32 ipv6_addr_hash(const s + #endif + } + ++/* more secured version of ipv6_addr_hash() */ ++static inline u32 ipv6_addr_jhash(const struct in6_addr *a) ++{ ++ u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1]; ++ ++ return jhash_3words(v, ++ (__force u32)a->s6_addr32[2], ++ (__force u32)a->s6_addr32[3], ++ ipv6_hash_secret); ++} ++ + static inline bool ipv6_addr_loopback(const struct in6_addr *a) + { + return (a->s6_addr32[0] | a->s6_addr32[1] | +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -248,8 +248,12 @@ EXPORT_SYMBOL(inet_listen); + u32 inet_ehash_secret __read_mostly; + EXPORT_SYMBOL(inet_ehash_secret); + ++u32 ipv6_hash_secret __read_mostly; ++EXPORT_SYMBOL(ipv6_hash_secret); ++ + /* +- * inet_ehash_secret must be set exactly once ++ * inet_ehash_secret must be set exactly once, and to a non nul value ++ * ipv6_hash_secret must be set exactly once. + */ + void build_ehash_secret(void) + { +@@ -259,7 +263,8 @@ void build_ehash_secret(void) + get_random_bytes(&rnd, sizeof(rnd)); + } while (rnd == 0); + +- cmpxchg(&inet_ehash_secret, 0, rnd); ++ if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) ++ get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret)); + } + EXPORT_SYMBOL(build_ehash_secret); + diff --git a/queue-3.8/mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch b/queue-3.8/mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch new file mode 100644 index 00000000000..81e696ecfcd --- /dev/null +++ b/queue-3.8/mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch @@ -0,0 +1,49 @@ +From johannes@sipsolutions.net Tue Feb 26 15:00:24 2013 +From: Johannes Berg +Date: Tue, 26 Feb 2013 22:37:57 +0100 +Subject: mac80211: always unblock CSA queue stop when disconnecting +To: gregkh@linuxfoundation.org +Cc: stable@vger.kernel.org, jan.brummer@tabos.org, Johannes Berg +Message-ID: <1361914677-19032-1-git-send-email-johannes@sipsolutions.net> + + +From: Johannes Berg + +Commit 5b36ebd8249f403c7edf7cf68d68e9a0d0f55243 upstream. + +In some cases when disconnecting after (or during?) CSA +the queues might not recover, and then the only way to +recover is reloading the module. + +Fix this by always unblocking the queue CSA reason when + +disconnecting. + +Reported-by: Jan-Michael Brummer +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1812,6 +1812,8 @@ static void __ieee80211_disconnect(struc + WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, + transmit_frame, frame_buf); + ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED; ++ ieee80211_wake_queues_by_reason(&sdata->local->hw, ++ IEEE80211_QUEUE_STOP_REASON_CSA); + mutex_unlock(&ifmgd->mtx); + + /* +@@ -1856,8 +1858,6 @@ static void ieee80211_csa_connection_dro + container_of(work, struct ieee80211_sub_if_data, + u.mgd.csa_connection_drop_work); + +- ieee80211_wake_queues_by_reason(&sdata->local->hw, +- IEEE80211_QUEUE_STOP_REASON_CSA); + __ieee80211_disconnect(sdata, true); + } + diff --git a/queue-3.8/mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch b/queue-3.8/mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch new file mode 100644 index 00000000000..d40de273af0 --- /dev/null +++ b/queue-3.8/mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch @@ -0,0 +1,39 @@ +From 6bbae7e2f6bb5d68f6440e58bb3e3fe541c7099f Mon Sep 17 00:00:00 2001 +From: Kleber Sacilotto de Souza +Date: Fri, 22 Feb 2013 19:14:52 +0000 +Subject: mlx4_en: fix allocation of CPU affinity reverse-map + + +From: Kleber Sacilotto de Souza + +[ Upstream commit 3770699675dd1b8fc1e86ff369eb3cce44e10082 ] + +The mlx4_en driver allocates the number of objects for the CPU affinity +reverse-map based on the number of rx rings of the device. However, +mlx4_assign_eq() calls irq_cpu_rmap_add() as many times as IRQ's are +assigned to EQ's, which can be as large as mlx4_dev->caps.comp_pool. If +caps.comp_pool is larger than rx_ring_num we will eventually hit the +BUG_ON() in cpu_rmap_add(). + +Fix this problem by allocating space for the maximum number of CPU +affinity reverse-map objects we might want to add. + +Signed-off-by: Kleber Sacilotto de Souza +Acked-by: Amir Vadai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1434,7 +1434,7 @@ int mlx4_en_alloc_resources(struct mlx4_ + } + + #ifdef CONFIG_RFS_ACCEL +- priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->rx_ring_num); ++ priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->mdev->dev->caps.comp_pool); + if (!priv->dev->rx_cpu_rmap) + goto err; + diff --git a/queue-3.8/mlx4_en-fix-allocation-of-device-tx_cq.patch b/queue-3.8/mlx4_en-fix-allocation-of-device-tx_cq.patch new file mode 100644 index 00000000000..18aeeedbd08 --- /dev/null +++ b/queue-3.8/mlx4_en-fix-allocation-of-device-tx_cq.patch @@ -0,0 +1,34 @@ +From 1d750442e470efe1f245b2777c71e9072cff03c0 Mon Sep 17 00:00:00 2001 +From: Kleber Sacilotto de Souza +Date: Fri, 22 Feb 2013 14:58:02 +0000 +Subject: mlx4_en: fix allocation of device tx_cq + + +From: Kleber Sacilotto de Souza + +[ Upstream commit 427a96252d8eee7b9bbafce15bd37fa3387ede55 ] + +The memory to hold the network device tx_cq is not being allocated with +the correct size in mlx4_en_init_netdev(). It should use MAX_TX_RINGS +instead of MAX_RX_RINGS. This can cause problems if the number of tx +rings being used is greater than MAX_RX_RINGS. + +Signed-off-by: Kleber Sacilotto de Souza +Acked-by: Amir Vadai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1597,7 +1597,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d + err = -ENOMEM; + goto out; + } +- priv->tx_cq = kzalloc(sizeof(struct mlx4_en_cq) * MAX_RX_RINGS, ++ priv->tx_cq = kzalloc(sizeof(struct mlx4_en_cq) * MAX_TX_RINGS, + GFP_KERNEL); + if (!priv->tx_cq) { + err = -ENOMEM; diff --git a/queue-3.8/net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch b/queue-3.8/net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch new file mode 100644 index 00000000000..b0b140b5e17 --- /dev/null +++ b/queue-3.8/net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch @@ -0,0 +1,56 @@ +From c4a3284a9f2e1e305cbdf7336a02d44f32372e0c Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 13 Feb 2013 12:09:52 +0000 +Subject: net: cdc_ncm: fix probing of devices with multiple control interface altsettings + + +From: Bjørn Mork + +[ Upstream commit f350ca03703133c94fe742f6fa6ff0fd8f5a9a09 ] + +commit bd329e1 ("net: cdc_ncm: do not bind to NCM compatible MBIM devices") +added a test for a CDC MBIM altsetting, implementing the cdc_ncm part of +MBIM backward compatibility support. This intentionally made the driver +behave differently for CDC NCM devices with 2 alternate settings for the +Communication interface, depending on whether or not CONFIG_USB_NET_CDC_MBIM +was enabled. This is correct iff alternate setting #1 really *is* a MBIM +setting. If not, then NCM probing will use a different altsetting than before, +possibly causing probing failures depending on CONFIG_USB_NET_CDC_MBIM. + +Fix by setting the altsetting back to default after the test, restoring the +previous behaviour for non MBIM devices. + +This bug causes probing of Huawei E3276 devices to fail when the MBIM driver +is enabled, because these devices have a second alternate setting with no CDC +functional descriptors. + +Cc: Greg Suarez +Cc: Alexey Orishko +Reported-and-tested-by: Jonathan A. +Signed-off-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -576,9 +576,14 @@ static int cdc_ncm_bind(struct usbnet *d + if ((intf->num_altsetting == 2) && + !usb_set_interface(dev->udev, + intf->cur_altsetting->desc.bInterfaceNumber, +- CDC_NCM_COMM_ALTSETTING_MBIM) && +- cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting)) +- return -ENODEV; ++ CDC_NCM_COMM_ALTSETTING_MBIM)) { ++ if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting)) ++ return -ENODEV; ++ else ++ usb_set_interface(dev->udev, ++ intf->cur_altsetting->desc.bInterfaceNumber, ++ CDC_NCM_COMM_ALTSETTING_NCM); ++ } + #endif + + /* NCM data altsetting is always 1 */ diff --git a/queue-3.8/net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch b/queue-3.8/net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch new file mode 100644 index 00000000000..d5f7564222a --- /dev/null +++ b/queue-3.8/net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch @@ -0,0 +1,42 @@ +From 231bd964f9d6e8c9854bb2e76bff09c83a85203e Mon Sep 17 00:00:00 2001 +From: Ying Xue +Date: Fri, 15 Feb 2013 22:28:25 +0000 +Subject: net: fix a compile error when SOCK_REFCNT_DEBUG is enabled + + +From: Ying Xue + +[ Upstream commit dec34fb0f5b7873de45132a84a3af29e61084a6b ] + +When SOCK_REFCNT_DEBUG is enabled, below build error is met: + +kernel/sysctl_binary.o: In function `sk_refcnt_debug_release': +include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release' +kernel/sysctl.o:include/net/sock.h:1025: first defined here +kernel/audit.o: In function `sk_refcnt_debug_release': +include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release' +kernel/sysctl.o:include/net/sock.h:1025: first defined here +make[1]: *** [kernel/built-in.o] Error 1 +make: *** [kernel] Error 2 + +So we decide to make sk_refcnt_debug_release static to eliminate +the error. + +Signed-off-by: Ying Xue +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1037,7 +1037,7 @@ static inline void sk_refcnt_debug_dec(s + sk->sk_prot->name, sk, atomic_read(&sk->sk_prot->socks)); + } + +-inline void sk_refcnt_debug_release(const struct sock *sk) ++static inline void sk_refcnt_debug_release(const struct sock *sk) + { + if (atomic_read(&sk->sk_refcnt) != 1) + printk(KERN_DEBUG "Destruction of the %s socket %p delayed, refcnt=%d\n", diff --git a/queue-3.8/ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch b/queue-3.8/ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch new file mode 100644 index 00000000000..8c02c2c67d9 --- /dev/null +++ b/queue-3.8/ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch @@ -0,0 +1,45 @@ +From 4ead5e2075773c4d8b789044f55c0dd293448713 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 19 Feb 2013 10:42:03 -0800 +Subject: ppp: set qdisc_tx_busylock to avoid LOCKDEP splat + + +From: Eric Dumazet + +[ Upstream commit 303c07db487be59ae9fda10600ea65ca11c21497 ] + +If a qdisc is installed on a ppp device, its possible to get +a lockdep splat under stress, because nested dev_queue_xmit() can +lock busylock a second time (on a different device, so its a false +positive) + +Avoid this problem using a distinct lock_class_key for ppp +devices. + +Reported-by: Yanko Kaneti +Tested-by: Yanko Kaneti +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/ppp_generic.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -1058,7 +1058,15 @@ ppp_get_stats64(struct net_device *dev, + return stats64; + } + ++static struct lock_class_key ppp_tx_busylock; ++static int ppp_dev_init(struct net_device *dev) ++{ ++ dev->qdisc_tx_busylock = &ppp_tx_busylock; ++ return 0; ++} ++ + static const struct net_device_ops ppp_netdev_ops = { ++ .ndo_init = ppp_dev_init, + .ndo_start_xmit = ppp_start_xmit, + .ndo_do_ioctl = ppp_net_ioctl, + .ndo_get_stats64 = ppp_get_stats64, diff --git a/queue-3.8/series b/queue-3.8/series index 92a7bc6cd70..38bf83b8124 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -119,3 +119,32 @@ fb-yet-another-band-aid-for-fixing-lockdep-mess.patch mmc-sdhci-esdhc-imx-fix-host-version-read.patch mmc-core-expose-rpmb-partition-only-for-cmd23-capable-hosts.patch hid-wiimote-fix-nunchuck-button-parser.patch +net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch +xen-netback-correctly-return-errors-from-netbk_count_requests.patch +xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch +net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch +xfrm-release-neighbor-upon-dst-destruction.patch +ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch +ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch +ipv4-fix-a-bug-in-ping_err.patch +ipv6-use-a-stronger-hash-for-tcp.patch +ipv4-fix-error-handling-in-icmp_protocol.patch +tcp-fix-syn-data-space-mis-accounting.patch +mlx4_en-fix-allocation-of-device-tx_cq.patch +mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch +sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch +vlan-adjust-vlan_set_encap_proto-for-its-callers.patch +mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch +usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch +gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch +dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch +dca-check-against-empty-dca_domains-list-before-unregister-provider.patch +usb-option-add-and-update-alcatel-modems.patch +usb-option-add-yota-megafon-m100-1-4g-modem.patch +usb-option-add-huawei-acm-devices-using-protocol-vendor.patch +usb-ehci-omap-fix-autoloading-of-module.patch +usb-storage-properly-handle-the-endian-issues-of-idproduct.patch +usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch +usb-musb-core-fix-failure-path.patch +usb-musb-fix-dependency-on-transceiver-driver.patch +usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch diff --git a/queue-3.8/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch b/queue-3.8/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch new file mode 100644 index 00000000000..2449222909b --- /dev/null +++ b/queue-3.8/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch @@ -0,0 +1,36 @@ +From 83245c8498fc24b28a76c3f0de8d80f7a8986d7e Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Sat, 23 Feb 2013 01:13:47 +0000 +Subject: sock_diag: Fix out-of-bounds access to sock_diag_handlers[] + + +From: Mathias Krause + +[ Upstream commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 ] + +Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY +with a family greater or equal then AF_MAX -- the array size of +sock_diag_handlers[]. The current code does not test for this +condition therefore is vulnerable to an out-of-bound access opening +doors for a privilege escalation. + +Signed-off-by: Mathias Krause +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/sock_diag.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk + if (nlmsg_len(nlh) < sizeof(*req)) + return -EINVAL; + ++ if (req->sdiag_family >= AF_MAX) ++ return -EINVAL; ++ + hndl = sock_diag_lock_handler(req->sdiag_family); + if (hndl == NULL) + err = -ENOENT; diff --git a/queue-3.8/tcp-fix-syn-data-space-mis-accounting.patch b/queue-3.8/tcp-fix-syn-data-space-mis-accounting.patch new file mode 100644 index 00000000000..bfeed0a5c44 --- /dev/null +++ b/queue-3.8/tcp-fix-syn-data-space-mis-accounting.patch @@ -0,0 +1,68 @@ +From 9b521570f87082f7678e3f8c58e8ab13d3219eed Mon Sep 17 00:00:00 2001 +From: Yuchung Cheng +Date: Fri, 22 Feb 2013 08:59:06 +0000 +Subject: tcp: fix SYN-data space mis-accounting + + +From: Yuchung Cheng + +[ Upstream commit 1b63edd6ecc55c3a61b40297b49e2323783bddfd ] + +In fast open the sender unncessarily reduces the space available +for data in SYN by 12 bytes. This is because in the sender +incorrectly reserves space for TS option twice in tcp_send_syn_data(): +tcp_mtu_to_mss() already accounts for TS option space. But it further +reserves MAX_TCP_OPTION_SPACE when computing the payload space. + +Signed-off-by: Yuchung Cheng +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1351,8 +1351,8 @@ int tcp_trim_head(struct sock *sk, struc + return 0; + } + +-/* Calculate MSS. Not accounting for SACKs here. */ +-int tcp_mtu_to_mss(struct sock *sk, int pmtu) ++/* Calculate MSS not accounting any TCP options. */ ++static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu) + { + const struct tcp_sock *tp = tcp_sk(sk); + const struct inet_connection_sock *icsk = inet_csk(sk); +@@ -1381,13 +1381,17 @@ int tcp_mtu_to_mss(struct sock *sk, int + /* Then reserve room for full set of TCP options and 8 bytes of data */ + if (mss_now < 48) + mss_now = 48; +- +- /* Now subtract TCP options size, not including SACKs */ +- mss_now -= tp->tcp_header_len - sizeof(struct tcphdr); +- + return mss_now; + } + ++/* Calculate MSS. Not accounting for SACKs here. */ ++int tcp_mtu_to_mss(struct sock *sk, int pmtu) ++{ ++ /* Subtract TCP options size, not including SACKs */ ++ return __tcp_mtu_to_mss(sk, pmtu) - ++ (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr)); ++} ++ + /* Inverse of above */ + int tcp_mss_to_mtu(struct sock *sk, int mss) + { +@@ -2930,7 +2934,7 @@ static int tcp_send_syn_data(struct sock + */ + if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->rx_opt.mss_clamp) + tp->rx_opt.mss_clamp = tp->rx_opt.user_mss; +- space = tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - ++ space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - + MAX_TCP_OPTION_SPACE; + + syn_data = skb_copy_expand(syn, skb_headroom(syn), space, diff --git a/queue-3.8/usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch b/queue-3.8/usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch new file mode 100644 index 00000000000..2fb0ab1c048 --- /dev/null +++ b/queue-3.8/usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch @@ -0,0 +1,69 @@ +From 428525f97153505e83983460a8d08a3210aa6b8a Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Thu, 14 Feb 2013 17:08:08 +0200 +Subject: USB: ehci-omap: Don't free gpios that we didn't request + +From: Roger Quadros + +commit 428525f97153505e83983460a8d08a3210aa6b8a upstream. + +This driver does not request any gpios so don't free them. +Fixes L3 bus error on multiple modprobe/rmmod of ehci_hcd +with ehci-omap in use. + +Without this patch, EHCI will break on repeated insmod/rmmod +of ehci_hcd for all OMAP2+ platforms that use EHCI and +set 'phy_reset = true' in usbhs_omap_board_data. +i.e. + +board-3430sdp.c: .phy_reset = true, +board-3630sdp.c: .phy_reset = true, +board-am3517crane.c: .phy_reset = true, +board-am3517evm.c: .phy_reset = true, +board-cm-t3517.c: .phy_reset = true, +board-cm-t35.c: .phy_reset = true, +board-devkit8000.c: .phy_reset = true, +board-igep0020.c: .phy_reset = true, +board-igep0020.c: .phy_reset = true, +board-omap3beagle.c: .phy_reset = true, +board-omap3evm.c: .phy_reset = true, +board-omap3pandora.c: .phy_reset = true, +board-omap3stalker.c: .phy_reset = true, +board-omap3touchbook.c: .phy_reset = true, +board-omap4panda.c: .phy_reset = false, +board-overo.c: .phy_reset = true, +board-zoom.c: .phy_reset = true, + +Signed-off-by: Roger Quadros +Reviewed-by: Felipe Balbi +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-omap.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -288,7 +288,6 @@ static int ehci_hcd_omap_remove(struct p + { + struct device *dev = &pdev->dev; + struct usb_hcd *hcd = dev_get_drvdata(dev); +- struct ehci_hcd_omap_platform_data *pdata = dev->platform_data; + + usb_remove_hcd(hcd); + disable_put_regulator(dev->platform_data); +@@ -298,13 +297,6 @@ static int ehci_hcd_omap_remove(struct p + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); + +- if (pdata->phy_reset) { +- if (gpio_is_valid(pdata->reset_gpio_port[0])) +- gpio_free(pdata->reset_gpio_port[0]); +- +- if (gpio_is_valid(pdata->reset_gpio_port[1])) +- gpio_free(pdata->reset_gpio_port[1]); +- } + return 0; + } + diff --git a/queue-3.8/usb-ehci-omap-fix-autoloading-of-module.patch b/queue-3.8/usb-ehci-omap-fix-autoloading-of-module.patch new file mode 100644 index 00000000000..c989c957522 --- /dev/null +++ b/queue-3.8/usb-ehci-omap-fix-autoloading-of-module.patch @@ -0,0 +1,32 @@ +From 04753523266629b1cd0518091da1658755787198 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Thu, 14 Feb 2013 17:08:09 +0200 +Subject: USB: ehci-omap: Fix autoloading of module + +From: Roger Quadros + +commit 04753523266629b1cd0518091da1658755787198 upstream. + +The module alias should be "ehci-omap" and not +"omap-ehci" to match the platform device name. +The omap-ehci module should now autoload correctly. + +Signed-off-by: Roger Quadros +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -364,7 +364,7 @@ static const struct hc_driver ehci_omap_ + .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + +-MODULE_ALIAS("platform:omap-ehci"); ++MODULE_ALIAS("platform:ehci-omap"); + MODULE_AUTHOR("Texas Instruments, Inc."); + MODULE_AUTHOR("Felipe Balbi "); + diff --git a/queue-3.8/usb-musb-core-fix-failure-path.patch b/queue-3.8/usb-musb-core-fix-failure-path.patch new file mode 100644 index 00000000000..9f79f17b483 --- /dev/null +++ b/queue-3.8/usb-musb-core-fix-failure-path.patch @@ -0,0 +1,33 @@ +From 681d1e8761ca773967bce9bd1bb2896f07279551 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Fri, 4 Jan 2013 23:13:06 +0800 +Subject: usb: musb: core: fix failure path + +From: Ming Lei + +commit 681d1e8761ca773967bce9bd1bb2896f07279551 upstream. + +In the fail1~fail5 failure path, pm_runtime_disable() should +be called to avoid 'Unbalanced pm_runtime_enable' error in +next probe() which may be triggered by defer probe or next +'modprobe musb_hdrc'. + +Cc: Sebastian Andrzej Siewior +Signed-off-by: Ming Lei +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1993,6 +1993,7 @@ fail2: + musb_platform_exit(musb); + + fail1: ++ pm_runtime_disable(musb->controller); + dev_err(musb->controller, + "musb_init_controller failed with status %d\n", status); + diff --git a/queue-3.8/usb-musb-fix-dependency-on-transceiver-driver.patch b/queue-3.8/usb-musb-fix-dependency-on-transceiver-driver.patch new file mode 100644 index 00000000000..288825a4703 --- /dev/null +++ b/queue-3.8/usb-musb-fix-dependency-on-transceiver-driver.patch @@ -0,0 +1,168 @@ +From 25736e0c8269e9613aa6036fbc591818daa30d14 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Fri, 4 Jan 2013 23:13:58 +0800 +Subject: usb: musb: fix dependency on transceiver driver + +From: Ming Lei + +commit 25736e0c8269e9613aa6036fbc591818daa30d14 upstream. + +This patch let glue driver return -EPROBE_DEFER if the transceiver +is not readly, so we can support defer probe on musb to fix the +below error on 3.7-rc5 if transceiver drivers are built as module: + +[ 19.052490] unable to find transceiver of type USB2 PHY +[ 19.072052] HS USB OTG: no transceiver configured +[ 19.076995] musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -19 +[ 19.089355] musb-hdrc: probe of musb-hdrc.0.auto rejects match -19 +[ 19.096771] driver: 'musb-omap2430': driver_bound: bound to device 'musb-omap2430' +[ 19.105194] bus: 'platform': really_probe: bound device musb-omap2430 to driver musb-omap2430 +[ 19.174407] bus: 'platform': add driver twl4030_usb +[ 19.179656] bus: 'platform': driver_probe_device: matched device twl4030_usb with driver twl4030_usb +[ 19.202270] bus: 'platform': really_probe: probing driver twl4030_usb with device twl4030_usb +[ 19.214172] twl4030_usb twl4030_usb: HW_CONDITIONS 0xc0/192; link 3 +[ 19.239624] musb-omap2430 musb-omap2430: musb core is not yet ready +[ 19.246765] twl4030_usb twl4030_usb: Initialized TWL4030 USB module +[ 19.254516] driver: 'twl4030_usb': driver_bound: bound to device 'twl4030_usb' +[ 19.263580] bus: 'platform': really_probe: bound device twl4030_usb to driver twl4030_usb + +Cc: Sebastian Andrzej Siewior +Signed-off-by: Ming Lei +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/am35x.c | 2 +- + drivers/usb/musb/blackfin.c | 2 +- + drivers/usb/musb/da8xx.c | 7 +++++-- + drivers/usb/musb/davinci.c | 7 +++++-- + drivers/usb/musb/musb_dsps.c | 2 +- + drivers/usb/musb/omap2430.c | 2 +- + drivers/usb/musb/tusb6010.c | 2 +- + drivers/usb/musb/ux500.c | 2 +- + 8 files changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/usb/musb/am35x.c ++++ b/drivers/usb/musb/am35x.c +@@ -365,7 +365,7 @@ static int am35x_musb_init(struct musb * + usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) +- return -ENODEV; ++ return -EPROBE_DEFER; + + setup_timer(&otg_workaround, otg_timer, (unsigned long) musb); + +--- a/drivers/usb/musb/blackfin.c ++++ b/drivers/usb/musb/blackfin.c +@@ -406,7 +406,7 @@ static int bfin_musb_init(struct musb *m + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) { + gpio_free(musb->config->gpio_vrsel); +- return -ENODEV; ++ return -EPROBE_DEFER; + } + + bfin_musb_reg_init(musb); +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -410,6 +410,7 @@ static int da8xx_musb_init(struct musb * + { + void __iomem *reg_base = musb->ctrl_base; + u32 rev; ++ int ret = -ENODEV; + + musb->mregs += DA8XX_MENTOR_CORE_OFFSET; + +@@ -420,8 +421,10 @@ static int da8xx_musb_init(struct musb * + + usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); +- if (IS_ERR_OR_NULL(musb->xceiv)) ++ if (IS_ERR_OR_NULL(musb->xceiv)) { ++ ret = -EPROBE_DEFER; + goto fail; ++ } + + setup_timer(&otg_workaround, otg_timer, (unsigned long)musb); + +@@ -441,7 +444,7 @@ static int da8xx_musb_init(struct musb * + musb->isr = da8xx_musb_interrupt; + return 0; + fail: +- return -ENODEV; ++ return ret; + } + + static int da8xx_musb_exit(struct musb *musb) +--- a/drivers/usb/musb/davinci.c ++++ b/drivers/usb/musb/davinci.c +@@ -380,11 +380,14 @@ static int davinci_musb_init(struct musb + { + void __iomem *tibase = musb->ctrl_base; + u32 revision; ++ int ret = -ENODEV; + + usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); +- if (IS_ERR_OR_NULL(musb->xceiv)) ++ if (IS_ERR_OR_NULL(musb->xceiv)) { ++ ret = -EPROBE_DEFER; + goto unregister; ++ } + + musb->mregs += DAVINCI_BASE_OFFSET; + +@@ -438,7 +441,7 @@ fail: + usb_put_phy(musb->xceiv); + unregister: + usb_nop_xceiv_unregister(); +- return -ENODEV; ++ return ret; + } + + static int davinci_musb_exit(struct musb *musb) +--- a/drivers/usb/musb/musb_dsps.c ++++ b/drivers/usb/musb/musb_dsps.c +@@ -419,7 +419,7 @@ static int dsps_musb_init(struct musb *m + usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) +- return -ENODEV; ++ return -EPROBE_DEFER; + + /* Returns zero if e.g. not clocked */ + rev = dsps_readl(reg_base, wrp->revision); +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -369,7 +369,7 @@ static int omap2430_musb_init(struct mus + musb->xceiv = devm_usb_get_phy(dev, USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) { + pr_err("HS USB OTG: no transceiver configured\n"); +- return -ENODEV; ++ return -EPROBE_DEFER; + } + + musb->isr = omap2430_musb_interrupt; +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -1069,7 +1069,7 @@ static int tusb_musb_init(struct musb *m + usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) +- return -ENODEV; ++ return -EPROBE_DEFER; + + pdev = to_platform_device(musb->controller); + +--- a/drivers/usb/musb/ux500.c ++++ b/drivers/usb/musb/ux500.c +@@ -61,7 +61,7 @@ static int ux500_musb_init(struct musb * + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) { + pr_err("HS USB OTG: no transceiver configured\n"); +- return -ENODEV; ++ return -EPROBE_DEFER; + } + + musb->isr = ux500_musb_interrupt; diff --git a/queue-3.8/usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch b/queue-3.8/usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch new file mode 100644 index 00000000000..4797a1fd72f --- /dev/null +++ b/queue-3.8/usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch @@ -0,0 +1,70 @@ +From 99d17cfa3bbc6f4edb175f819af59c6b9e245e82 Mon Sep 17 00:00:00 2001 +From: Fabio Baltieri +Date: Mon, 7 Jan 2013 17:47:41 +0100 +Subject: usb: musb: ux500: use clk_prepare_enable and clk_disable_unprepare + +From: Fabio Baltieri + +commit 99d17cfa3bbc6f4edb175f819af59c6b9e245e82 upstream. + +This patch converts the module to use clk_prepare_enable and +clk_disable_unprepare variants as required by common clock framework. + +Without this the system crash during probe function. + +Signed-off-by: Fabio Baltieri +Acked-by: Linus Walleij +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/ux500.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/musb/ux500.c ++++ b/drivers/usb/musb/ux500.c +@@ -108,7 +108,7 @@ static int ux500_probe(struct platform_d + goto err3; + } + +- ret = clk_enable(clk); ++ ret = clk_prepare_enable(clk); + if (ret) { + dev_err(&pdev->dev, "failed to enable clock\n"); + goto err4; +@@ -148,7 +148,7 @@ static int ux500_probe(struct platform_d + return 0; + + err5: +- clk_disable(clk); ++ clk_disable_unprepare(clk); + + err4: + clk_put(clk); +@@ -168,7 +168,7 @@ static int ux500_remove(struct platform_ + struct ux500_glue *glue = platform_get_drvdata(pdev); + + platform_device_unregister(glue->musb); +- clk_disable(glue->clk); ++ clk_disable_unprepare(glue->clk); + clk_put(glue->clk); + kfree(glue); + +@@ -182,7 +182,7 @@ static int ux500_suspend(struct device * + struct musb *musb = glue_to_musb(glue); + + usb_phy_set_suspend(musb->xceiv, 1); +- clk_disable(glue->clk); ++ clk_disable_unprepare(glue->clk); + + return 0; + } +@@ -193,7 +193,7 @@ static int ux500_resume(struct device *d + struct musb *musb = glue_to_musb(glue); + int ret; + +- ret = clk_enable(glue->clk); ++ ret = clk_prepare_enable(glue->clk); + if (ret) { + dev_err(dev, "failed to enable clock\n"); + return ret; diff --git a/queue-3.8/usb-option-add-and-update-alcatel-modems.patch b/queue-3.8/usb-option-add-and-update-alcatel-modems.patch new file mode 100644 index 00000000000..74fdc61b316 --- /dev/null +++ b/queue-3.8/usb-option-add-and-update-alcatel-modems.patch @@ -0,0 +1,70 @@ +From f8f0302bbcbd1b14655bef29f6996a2152be559d Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 23 Jan 2013 10:44:36 +0100 +Subject: USB: option: add and update Alcatel modems + +From: Bjørn Mork + +commit f8f0302bbcbd1b14655bef29f6996a2152be559d upstream. + +Adding three currently unsupported modems based on information +from .inf driver files: + + Diag VID_1BBB&PID_0052&MI_00 + AGPS VID_1BBB&PID_0052&MI_01 + VOICE VID_1BBB&PID_0052&MI_02 + AT VID_1BBB&PID_0052&MI_03 + Modem VID_1BBB&PID_0052&MI_05 + wwan VID_1BBB&PID_0052&MI_06 + + Diag VID_1BBB&PID_00B6&MI_00 + AT VID_1BBB&PID_00B6&MI_01 + Modem VID_1BBB&PID_00B6&MI_02 + wwan VID_1BBB&PID_00B6&MI_03 + + Diag VID_1BBB&PID_00B7&MI_00 + AGPS VID_1BBB&PID_00B7&MI_01 + VOICE VID_1BBB&PID_00B7&MI_02 + AT VID_1BBB&PID_00B7&MI_03 + Modem VID_1BBB&PID_00B7&MI_04 + wwan VID_1BBB&PID_00B7&MI_05 + +Updating the blacklist info for the X060S_X200 and X220_X500D, +reserving interfaces for a wwan driver, based on + + wwan VID_1BBB&PID_0000&MI_04 + wwan VID_1BBB&PID_0017&MI_06 + +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -479,6 +479,7 @@ static const struct option_blacklist_inf + + static const struct option_blacklist_info alcatel_x200_blacklist = { + .sendsetup = BIT(0) | BIT(1), ++ .reserved = BIT(4), + }; + + static const struct option_blacklist_info zte_0037_blacklist = { +@@ -1215,7 +1216,14 @@ static const struct usb_device_id option + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), + .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist + }, +- { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x0052), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b6), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b7), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, diff --git a/queue-3.8/usb-option-add-huawei-acm-devices-using-protocol-vendor.patch b/queue-3.8/usb-option-add-huawei-acm-devices-using-protocol-vendor.patch new file mode 100644 index 00000000000..08192fb3388 --- /dev/null +++ b/queue-3.8/usb-option-add-huawei-acm-devices-using-protocol-vendor.patch @@ -0,0 +1,49 @@ +From 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 13 Feb 2013 23:41:34 +0100 +Subject: USB: option: add Huawei "ACM" devices using protocol = vendor + +From: Bjørn Mork + +commit 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 upstream. + +The USB device descriptor of one identity presented by a few +Huawei morphing devices have serial functions with class codes +02/02/ff, indicating CDC ACM with a vendor specific protocol. This +combination is often used for MSFT RNDIS functions, and the CDC +ACM class driver will therefore ignore such functions. + +The CDC ACM class driver cannot support functions with only 2 +endpoints. The underlying serial functions of these modems are +also believed to be the same as for alternate device identities +already supported by the option driver. Letting the same driver +handle these functions independently of the current identity +ensures consistent handling and user experience. + +There is no need to blacklist these devices in the rndis_host +driver. Huawei serial functions will either have only 2 endpoints +or a CDC ACM functional descriptor with bmCapabilities != 0, making +them correctly ignored as "non RNDIS" by that driver. + +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -578,8 +578,12 @@ static const struct usb_device_id option + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) }, + { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff), diff --git a/queue-3.8/usb-option-add-yota-megafon-m100-1-4g-modem.patch b/queue-3.8/usb-option-add-yota-megafon-m100-1-4g-modem.patch new file mode 100644 index 00000000000..812f7d09e36 --- /dev/null +++ b/queue-3.8/usb-option-add-yota-megafon-m100-1-4g-modem.patch @@ -0,0 +1,60 @@ +From cd565279e51bedee1b2988e84f9b3bef485adeb6 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Tue, 12 Feb 2013 13:42:24 +0100 +Subject: USB: option: add Yota / Megafon M100-1 4g modem + +From: Bjørn Mork + +commit cd565279e51bedee1b2988e84f9b3bef485adeb6 upstream. + +Interface layout: + + 00 CD-ROM + 01 debug COM port + 02 AP control port + 03 modem + 04 usb-ethernet + +Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0408 ProdID=ea42 Rev= 0.00 +S: Manufacturer=Qualcomm, Incorporated +S: Product=Qualcomm CDMA Technologies MSM +S: SerialNumber=353568051xxxxxx +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms + +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -576,6 +576,8 @@ static const struct usb_device_id option + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLX) }, + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) }, + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) }, ++ { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), diff --git a/queue-3.8/usb-storage-properly-handle-the-endian-issues-of-idproduct.patch b/queue-3.8/usb-storage-properly-handle-the-endian-issues-of-idproduct.patch new file mode 100644 index 00000000000..bea89b92543 --- /dev/null +++ b/queue-3.8/usb-storage-properly-handle-the-endian-issues-of-idproduct.patch @@ -0,0 +1,39 @@ +From cd060956c5e97931c3909e4a808508469c0bb9f6 Mon Sep 17 00:00:00 2001 +From: fangxiaozhi +Date: Thu, 7 Feb 2013 15:32:07 +0800 +Subject: USB: storage: properly handle the endian issues of idProduct + +From: fangxiaozhi + +commit cd060956c5e97931c3909e4a808508469c0bb9f6 upstream. + +1. The idProduct is little endian, so make sure its value to be +compatible with the current CPU. Make no break on big endian processors. + +Signed-off-by: fangxiaozhi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/initializers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/initializers.c ++++ b/drivers/usb/storage/initializers.c +@@ -147,7 +147,7 @@ static int usb_stor_huawei_dongles_pid(s + int idProduct; + + idesc = &us->pusb_intf->cur_altsetting->desc; +- idProduct = us->pusb_dev->descriptor.idProduct; ++ idProduct = le16_to_cpu(us->pusb_dev->descriptor.idProduct); + /* The first port is CDROM, + * means the dongle in the single port mode, + * and a switch command is required to be sent. */ +@@ -169,7 +169,7 @@ int usb_stor_huawei_init(struct us_data + int result = 0; + + if (usb_stor_huawei_dongles_pid(us)) { +- if (us->pusb_dev->descriptor.idProduct >= 0x1446) ++ if (le16_to_cpu(us->pusb_dev->descriptor.idProduct) >= 0x1446) + result = usb_stor_huawei_scsi_init(us); + else + result = usb_stor_huawei_feature_init(us); diff --git a/queue-3.8/usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch b/queue-3.8/usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch new file mode 100644 index 00000000000..92a0ff44d02 --- /dev/null +++ b/queue-3.8/usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch @@ -0,0 +1,40 @@ +From 18e03310b5caa6d11c1a8c61b982c37047693fba Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Thu, 14 Feb 2013 09:39:09 -0500 +Subject: USB: usb-storage: unusual_devs update for Super TOP SATA bridge + +From: Josh Boyer + +commit 18e03310b5caa6d11c1a8c61b982c37047693fba upstream. + +The current entry in unusual_cypress.h for the Super TOP SATA bridge devices +seems to be causing corruption on newer revisions of this device. This has +been reported in Arch Linux and Fedora. The original patch was tested on +devices with bcdDevice of 1.60, whereas the newer devices report bcdDevice +as 2.20. Limit the UNUSUAL_DEV entry to devices less than 2.20. + +This fixes https://bugzilla.redhat.com/show_bug.cgi?id=909591 + +The Arch Forum post on this is here: + https://bbs.archlinux.org/viewtopic.php?id=152011 + +Reported-by: Carsten S. +Tested-by: Carsten S. +Signed-off-by: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_cypress.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/storage/unusual_cypress.h ++++ b/drivers/usb/storage/unusual_cypress.h +@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x + "Cypress ISD-300LP", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), + +-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999, ++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219, + "Super Top", + "USB 2.0 SATA BRIDGE", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), diff --git a/queue-3.8/vlan-adjust-vlan_set_encap_proto-for-its-callers.patch b/queue-3.8/vlan-adjust-vlan_set_encap_proto-for-its-callers.patch new file mode 100644 index 00000000000..219ec3e7a0b --- /dev/null +++ b/queue-3.8/vlan-adjust-vlan_set_encap_proto-for-its-callers.patch @@ -0,0 +1,69 @@ +From 8977948658ded97d65febe5e45aab15934cfbb59 Mon Sep 17 00:00:00 2001 +From: Cong Wang +Date: Thu, 21 Feb 2013 23:32:27 +0000 +Subject: vlan: adjust vlan_set_encap_proto() for its callers + + +From: Cong Wang + +[ Upstream commit da8c87241c26aac81a64c7e4d21d438a33018f4e ] + +There are two places to call vlan_set_encap_proto(): +vlan_untag() and __pop_vlan_tci(). + +vlan_untag() assumes skb->data points after mac addr, otherwise +the following code + + vhdr = (struct vlan_hdr *) skb->data; + vlan_tci = ntohs(vhdr->h_vlan_TCI); + __vlan_hwaccel_put_tag(skb, vlan_tci); + + skb_pull_rcsum(skb, VLAN_HLEN); + +won't be correct. But __pop_vlan_tci() assumes points _before_ +mac addr. + +In vlan_set_encap_proto(), it looks for some magic L2 value +after mac addr: + + rawp = skb->data; + if (*(unsigned short *) rawp == 0xFFFF) + ... + +Therefore __pop_vlan_tci() is obviously wrong. + +A quick fix is avoiding using skb->data in vlan_set_encap_proto(), +use 'vhdr+1' is always correct in both cases. + +Cc: David S. Miller +Cc: Jesse Gross +Signed-off-by: Cong Wang +Acked-by: Jesse Gross +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/if_vlan.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -331,7 +331,7 @@ static inline void vlan_set_encap_proto( + struct vlan_hdr *vhdr) + { + __be16 proto; +- unsigned char *rawp; ++ unsigned short *rawp; + + /* + * Was a VLAN packet, grab the encapsulated protocol, which the layer +@@ -344,8 +344,8 @@ static inline void vlan_set_encap_proto( + return; + } + +- rawp = skb->data; +- if (*(unsigned short *) rawp == 0xFFFF) ++ rawp = (unsigned short *)(vhdr + 1); ++ if (*rawp == 0xFFFF) + /* + * This is a magic hack to spot IPX packets. Older Novell + * breaks the protocol design and runs IPX over 802.3 without diff --git a/queue-3.8/xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch b/queue-3.8/xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch new file mode 100644 index 00000000000..c32ed6275f7 --- /dev/null +++ b/queue-3.8/xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch @@ -0,0 +1,55 @@ +From 240b9d33e5573f31f2080e4537f2c0431139484a Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Thu, 14 Feb 2013 03:18:58 +0000 +Subject: xen-netback: cancel the credit timer when taking the vif down + + +From: David Vrabel + +[ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ] + +If the credit timer is left armed after calling +xen_netbk_remove_xenvif(), then it may fire and attempt to schedule +the vif which will then oops as vif->netbk == NULL. + +This may happen both in the fatal error path and during normal +disconnection from the front end. + +The sequencing during shutdown is critical to ensure that: a) +vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif +is not freed. + +1. Mark as unschedulable (netif_carrier_off()). +2. Synchronously cancel the timer. +3. Remove the vif from the schedule list. +4. Remove it from it netback thread group. +5. Wait for vif->refcnt to become 0. + +Signed-off-by: David Vrabel +Acked-by: Ian Campbell +Reported-by: Christopher S. Aker +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/interface.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -132,6 +132,7 @@ static void xenvif_up(struct xenvif *vif + static void xenvif_down(struct xenvif *vif) + { + disable_irq(vif->irq); ++ del_timer_sync(&vif->credit_timeout); + xen_netbk_deschedule_xenvif(vif); + xen_netbk_remove_xenvif(vif); + } +@@ -363,8 +364,6 @@ void xenvif_disconnect(struct xenvif *vi + atomic_dec(&vif->refcnt); + wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0); + +- del_timer_sync(&vif->credit_timeout); +- + if (vif->irq) + unbind_from_irqhandler(vif->irq, vif); + diff --git a/queue-3.8/xen-netback-correctly-return-errors-from-netbk_count_requests.patch b/queue-3.8/xen-netback-correctly-return-errors-from-netbk_count_requests.patch new file mode 100644 index 00000000000..e1bea604880 --- /dev/null +++ b/queue-3.8/xen-netback-correctly-return-errors-from-netbk_count_requests.patch @@ -0,0 +1,73 @@ +From 156d41484b7e4786e1f69a6c21b2be3437f52c3e Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Thu, 14 Feb 2013 03:18:57 +0000 +Subject: xen-netback: correctly return errors from netbk_count_requests() + + +From: David Vrabel + +[ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ] + +netbk_count_requests() could detect an error, call +netbk_fatal_tx_error() but return 0. The vif may then be used +afterwards (e.g., in a call to netbk_tx_error(). + +Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may +be freed immediately after the call to netbk_fatal_tx_error() (e.g., +if the vif is also removed). + +Netback thread Xenwatch thread +------------------------------------------- +netbk_fatal_tx_err() netback_remove() + xenvif_disconnect() + ... + free_netdev() +netbk_tx_err() Oops! + +Signed-off-by: Wei Liu +Signed-off-by: Jan Beulich +Signed-off-by: David Vrabel +Reported-by: Christopher S. Aker +Acked-by: Ian Campbell +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/netback.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -911,13 +911,13 @@ static int netbk_count_requests(struct x + if (frags >= work_to_do) { + netdev_err(vif->dev, "Need more frags\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -ENODATA; + } + + if (unlikely(frags >= MAX_SKB_FRAGS)) { + netdev_err(vif->dev, "Too many frags\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -E2BIG; + } + + memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags), +@@ -925,7 +925,7 @@ static int netbk_count_requests(struct x + if (txp->size > first->size) { + netdev_err(vif->dev, "Frag is bigger than frame.\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -EIO; + } + + first->size -= txp->size; +@@ -935,7 +935,7 @@ static int netbk_count_requests(struct x + netdev_err(vif->dev, "txp->offset: %x, size: %u\n", + txp->offset, txp->size); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -EINVAL; + } + } while ((txp++)->flags & XEN_NETTXF_more_data); + return frags; diff --git a/queue-3.8/xfrm-release-neighbor-upon-dst-destruction.patch b/queue-3.8/xfrm-release-neighbor-upon-dst-destruction.patch new file mode 100644 index 00000000000..cb1607e822c --- /dev/null +++ b/queue-3.8/xfrm-release-neighbor-upon-dst-destruction.patch @@ -0,0 +1,36 @@ +From b79c2530c1d19741a701259d417cae0fd1ed2cd9 Mon Sep 17 00:00:00 2001 +From: Romain KUNTZ +Date: Mon, 18 Feb 2013 02:36:24 +0000 +Subject: xfrm: release neighbor upon dst destruction + + +From: Romain KUNTZ + +[ Upstream commit 18cf0d0784b4a634472ed24d0d7ca1c721d93e90 ] + +Neighbor is cloned in xfrm6_fill_dst but seems to never be released. +Neighbor entry should be released when XFRM6 dst entry is destroyed +in xfrm6_dst_destroy, otherwise references may be kept forever on +the device pointed by the neighbor entry. + +I may not have understood all the subtleties of XFRM & dst so I would +be happy to receive comments on this patch. + +Signed-off-by: Romain Kuntz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/xfrm6_policy.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -236,6 +236,8 @@ static void xfrm6_dst_destroy(struct dst + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + ++ if (likely(xdst->u.rt6.n)) ++ neigh_release(xdst->u.rt6.n); + if (likely(xdst->u.rt6.rt6i_idev)) + in6_dev_put(xdst->u.rt6.rt6i_idev); + dst_destroy_metrics_generic(dst);