From: Greg Kroah-Hartman Date: Tue, 4 Feb 2014 01:06:32 +0000 (+0100) Subject: 3.12-stable patches X-Git-Tag: v3.4.79~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=74aa63fa83bcab59eac619db18456b28224105fa;p=thirdparty%2Fkernel%2Fstable-queue.git 3.12-stable patches added patches: arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch ath9k-disable-cross-band-fcc.patch ath9k-use-correct-channel-for-rx-packets.patch b43-fix-lockdep-splat.patch b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b43-fix-unload-oops-if-firmware-is-not-available.patch b43legacy-fix-unload-oops-if-firmware-is-not-available.patch hwmon-k10temp-add-support-for-kaveri-cpus.patch iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch iwlwifi-pcie-enable-oscillator-for-l1-exit.patch kvm-s390-fix-diagnose-code-extraction.patch kvm-s390-ioeventfd-ignore-leftmost-bits.patch kvm-x86-limit-pit-timer-frequency.patch mei-use-hbm-idle-state-to-prevent-spurious-resets.patch mwifiex-add-missing-endian-conversion-for-fw_tsf.patch mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch rtlwifi-add-missing-code-to-pwdb-statics-routine.patch rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch rtlwifi-redo-register-save-locations.patch rtlwifi-rtl8188ee-fix-typo-in-code.patch rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch rtlwifi-rtl8192cu-add-new-device-id.patch rtlwifi-rtl8192cu-add-new-firmware.patch rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch rtlwifi-rtl8192cu-update-the-power-index-registers.patch rtlwifi-set-the-link-state.patch rtlwifi-update-beacon-statistics-for-usb-driver.patch s390-uapi-fix-struct-statfs64-definition.patch serial-8250-enable-uart_bug_nomsr-for-tegra.patch serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch serial-add-support-for-200-v3-series-titan-card.patch staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch staging-r8712u-set-device-type-to-wlan.patch staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch tty-serial-at91-handle-shutdown-more-safely.patch tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch usb-chipidea-add-freescale-imx28-special-write-register-method.patch usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch usb-ehci-add-freescale-imx28-special-write-register-method.patch usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch usb-nokia-502-is-an-unusual-device.patch usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch usb-pl2303-fix-data-corruption-on-termios-updates.patch usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch x86-add-check-for-number-of-available-vectors-before-cpu-down.patch x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch --- diff --git a/queue-3.12/arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch b/queue-3.12/arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch new file mode 100644 index 00000000000..45fa1aab0a4 --- /dev/null +++ b/queue-3.12/arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch @@ -0,0 +1,38 @@ +From 0645b93f6c223b594c0dca348e2ae0a23bccf6e3 Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Fri, 22 Nov 2013 14:49:52 +0100 +Subject: ARM: at91: at91sam9g45: set default mmc pinctrl-names + +From: Ludovic Desroches + +commit 0645b93f6c223b594c0dca348e2ae0a23bccf6e3 upstream. + +pinctrl-names property was missing from mmc nodes. + +Signed-off-by: Ludovic Desroches +Acked-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9g45.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/at91sam9g45.dtsi ++++ b/arch/arm/boot/dts/at91sam9g45.dtsi +@@ -618,6 +618,7 @@ + compatible = "atmel,hsmci"; + reg = <0xfff80000 0x600>; + interrupts = <11 IRQ_TYPE_LEVEL_HIGH 0>; ++ pinctrl-names = "default"; + dmas = <&dma 1 AT91_DMA_CFG_PER_ID(0)>; + dma-names = "rxtx"; + #address-cells = <1>; +@@ -629,6 +630,7 @@ + compatible = "atmel,hsmci"; + reg = <0xfffd0000 0x600>; + interrupts = <29 IRQ_TYPE_LEVEL_HIGH 0>; ++ pinctrl-names = "default"; + dmas = <&dma 1 AT91_DMA_CFG_PER_ID(13)>; + dma-names = "rxtx"; + #address-cells = <1>; diff --git a/queue-3.12/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch b/queue-3.12/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch new file mode 100644 index 00000000000..aec05426fbe --- /dev/null +++ b/queue-3.12/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch @@ -0,0 +1,32 @@ +From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001 +From: Jean-Jacques Hiblot +Date: Thu, 9 Jan 2014 16:01:54 +0100 +Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read() + +From: Jean-Jacques Hiblot + +commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream. + +There was a copy/paste error when reading the nwe_pulse value. + +Signed-off-by: Jean-Jacques Hiblot +Acked-by: Boris BREZILLON +Signed-off-by: Nicolas Ferre +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-at91/sam9_smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-at91/sam9_smc.c ++++ b/arch/arm/mach-at91/sam9_smc.c +@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome + /* Pulse register */ + val = __raw_readl(base + AT91_SMC_PULSE); + +- config->nwe_setup = val & AT91_SMC_NWEPULSE; ++ config->nwe_pulse = val & AT91_SMC_NWEPULSE; + config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8; + config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16; + config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24; diff --git a/queue-3.12/ath9k-disable-cross-band-fcc.patch b/queue-3.12/ath9k-disable-cross-band-fcc.patch new file mode 100644 index 00000000000..d456ba58991 --- /dev/null +++ b/queue-3.12/ath9k-disable-cross-band-fcc.patch @@ -0,0 +1,40 @@ +From 1e2f9295f4c657500111514f92a3d3894d0e05b4 Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Thu, 9 Jan 2014 08:51:15 +0530 +Subject: ath9k: Disable cross-band FCC + +From: Sujith Manoharan + +commit 1e2f9295f4c657500111514f92a3d3894d0e05b4 upstream. + +Fast Channel Change across bands was enabled for +AR9462 recently, but this is causing baseband issues. +Disable it until this feature is tested well. Also, +remove the feature bit for AR9565 since it is +a single-band card and doesn't support this feature. + +Reported-by: Oleksij Rempel +Signed-off-by: Sujith Manoharan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -2608,13 +2608,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw + ah->eep_ops->get_eeprom(ah, EEP_PAPRD)) + pCap->hw_caps |= ATH9K_HW_CAP_PAPRD; + +- /* +- * Fast channel change across bands is available +- * only for AR9462 and AR9565. +- */ +- if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) +- pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH; +- + return 0; + } + diff --git a/queue-3.12/ath9k-use-correct-channel-for-rx-packets.patch b/queue-3.12/ath9k-use-correct-channel-for-rx-packets.patch new file mode 100644 index 00000000000..3dc92c84e42 --- /dev/null +++ b/queue-3.12/ath9k-use-correct-channel-for-rx-packets.patch @@ -0,0 +1,81 @@ +From ff9a93f2ebb88ac7aab9568de80b64b92078e96d Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Thu, 9 Jan 2014 08:51:14 +0530 +Subject: ath9k: Use correct channel for RX packets + +From: Sujith Manoharan + +commit ff9a93f2ebb88ac7aab9568de80b64b92078e96d upstream. + +Accessing the current channel definition in mac80211 +when processing RX packets is problematic because it +could have been updated when a scan is issued. Since a +channel change involves flushing the existing packets +in the RX queue before a chip-reset is done, they would +be processed using the wrong band/channel information. + +To avoid this, use the current channel information +maintained in the driver. + +Reported-by: Oleksij Rempel +Signed-off-by: Sujith Manoharan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/recv.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -848,20 +848,15 @@ static int ath9k_process_rate(struct ath + enum ieee80211_band band; + unsigned int i = 0; + struct ath_softc __maybe_unused *sc = common->priv; ++ struct ath_hw *ah = sc->sc_ah; + +- band = hw->conf.chandef.chan->band; ++ band = ah->curchan->chan->band; + sband = hw->wiphy->bands[band]; + +- switch (hw->conf.chandef.width) { +- case NL80211_CHAN_WIDTH_5: ++ if (IS_CHAN_QUARTER_RATE(ah->curchan)) + rxs->flag |= RX_FLAG_5MHZ; +- break; +- case NL80211_CHAN_WIDTH_10: ++ else if (IS_CHAN_HALF_RATE(ah->curchan)) + rxs->flag |= RX_FLAG_10MHZ; +- break; +- default: +- break; +- } + + if (rx_stats->rs_rate & 0x80) { + /* HT rate */ +@@ -1175,6 +1170,14 @@ static int ath9k_rx_skb_preprocess(struc + ath_start_rx_poll(sc, 3); + } + ++ /* ++ * This shouldn't happen, but have a safety check anyway. ++ */ ++ if (WARN_ON(!ah->curchan)) { ++ ret = -EINVAL; ++ goto exit; ++ } ++ + if (ath9k_process_rate(common, hw, rx_stats, rx_status)) { + ret =-EINVAL; + goto exit; +@@ -1182,8 +1185,8 @@ static int ath9k_rx_skb_preprocess(struc + + ath9k_process_rssi(common, hw, rx_stats, rx_status); + +- rx_status->band = hw->conf.chandef.chan->band; +- rx_status->freq = hw->conf.chandef.chan->center_freq; ++ rx_status->band = ah->curchan->chan->band; ++ rx_status->freq = ah->curchan->chan->center_freq; + rx_status->antenna = rx_stats->rs_antenna; + rx_status->flag |= RX_FLAG_MACTIME_END; + diff --git a/queue-3.12/b43-fix-lockdep-splat.patch b/queue-3.12/b43-fix-lockdep-splat.patch new file mode 100644 index 00000000000..08eff5f6b00 --- /dev/null +++ b/queue-3.12/b43-fix-lockdep-splat.patch @@ -0,0 +1,103 @@ +From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:37 -0600 +Subject: b43: Fix lockdep splat + +From: Larry Finger + +commit 09164043f63c947a49797750a09ca1cd7c31108e upstream. + +In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported +when b43 is used with hostapd, and rfkill is used to kill the radio output. + +The lockdep splat (in part) is as follows: + +====================================================== +[ INFO: possible circular locking dependency detected ] +3.12.0 #1 Not tainted +------------------------------------------------------- +rfkill/10040 is trying to acquire lock: + (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x12/0x20 + +but task is already holding lock: + (rfkill_global_mutex){+.+.+.}, at: [] rfkill_fop_write+0x6a/0x170 [rfkill] + +--snip-- + +Chain exists of: + rtnl_mutex --> misc_mtx --> rfkill_global_mutex + +The fix is to move the initialization of the hardware random number generator +outside the code range covered by the rtnl_mutex. + +Reported-by: yury +Tested-by: yury +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/main.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2424,6 +2424,7 @@ error: + + static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl); + static void b43_one_core_detach(struct b43_bus_dev *dev); ++static int b43_rng_init(struct b43_wl *wl); + + static void b43_request_firmware(struct work_struct *work) + { +@@ -2475,6 +2476,10 @@ start_ieee80211: + goto err_one_core_detach; + wl->hw_registred = true; + b43_leds_register(wl->current_dev); ++ ++ /* Register HW RNG driver */ ++ b43_rng_init(wl); ++ + goto out; + + err_one_core_detach: +@@ -4636,9 +4641,6 @@ static void b43_wireless_core_exit(struc + if (!dev || b43_status(dev) != B43_STAT_INITIALIZED) + return; + +- /* Unregister HW RNG driver */ +- b43_rng_exit(dev->wl); +- + b43_set_status(dev, B43_STAT_UNINIT); + + /* Stop the microcode PSM. */ +@@ -4795,9 +4797,6 @@ static int b43_wireless_core_init(struct + + b43_set_status(dev, B43_STAT_INITIALIZED); + +- /* Register HW RNG driver */ +- b43_rng_init(dev->wl); +- + out: + return err; + +@@ -5464,6 +5463,9 @@ static void b43_bcma_remove(struct bcma_ + + b43_one_core_detach(wldev->dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + b43_leds_unregister(wl); + + ieee80211_free_hw(wl->hw); +@@ -5541,6 +5543,9 @@ static void b43_ssb_remove(struct ssb_de + + b43_one_core_detach(dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + if (list_empty(&wl->devlist)) { + b43_leds_unregister(wl); + /* Last core on the chip unregistered. diff --git a/queue-3.12/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b/queue-3.12/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch new file mode 100644 index 00000000000..93b50b53c41 --- /dev/null +++ b/queue-3.12/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch @@ -0,0 +1,39 @@ +From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001 +From: ZHAO Gang +Date: Sat, 18 Jan 2014 00:17:38 +0800 +Subject: b43: fix the wrong assignment of status.freq in b43_rx() + +From: ZHAO Gang + +commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream. + +Use the right function to update frequency value. + +If rx skb is probe response or beacon, the wrong frequency value can +cause problem that bss info can't be updated when it should be. + +Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion") +Signed-off-by: ZHAO Gang +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struc + * channel number in b43. */ + if (chanstat & B43_RX_CHAN_5GHZ) { + status.band = IEEE80211_BAND_5GHZ; +- status.freq = b43_freq_to_channel_5ghz(chanid); ++ status.freq = b43_channel_to_freq_5ghz(chanid); + } else { + status.band = IEEE80211_BAND_2GHZ; +- status.freq = b43_freq_to_channel_2ghz(chanid); ++ status.freq = b43_channel_to_freq_2ghz(chanid); + } + break; + default: diff --git a/queue-3.12/b43-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.12/b43-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..c973bb17526 --- /dev/null +++ b/queue-3.12/b43-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,91 @@ +From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:38 -0600 +Subject: b43: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +To be able to access the completion structure at teardown, it had to be moved +into the b43_wldev structure. + +This patch also fixes a typo in a comment. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/b43.h | 4 ++-- + drivers/net/wireless/b43/main.c | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/b43.h ++++ b/drivers/net/wireless/b43/b43.h +@@ -731,8 +731,6 @@ enum b43_firmware_file_type { + struct b43_request_fw_context { + /* The device we are requesting the fw for. */ + struct b43_wldev *dev; +- /* a completion event structure needed if this call is asynchronous */ +- struct completion fw_load_complete; + /* a pointer to the firmware object */ + const struct firmware *blob; + /* The type of firmware to request. */ +@@ -809,6 +807,8 @@ enum { + struct b43_wldev { + struct b43_bus_dev *dev; + struct b43_wl *wl; ++ /* a completion event structure needed if this call is asynchronous */ ++ struct completion fw_load_complete; + + /* The device initialization status. + * Use b43_status() to query. */ +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2070,6 +2070,7 @@ void b43_do_release_fw(struct b43_firmwa + + static void b43_release_firmware(struct b43_wldev *dev) + { ++ complete(&dev->fw_load_complete); + b43_do_release_fw(&dev->fw.ucode); + b43_do_release_fw(&dev->fw.pcm); + b43_do_release_fw(&dev->fw.initvals); +@@ -2095,7 +2096,7 @@ static void b43_fw_cb(const struct firmw + struct b43_request_fw_context *ctx = context; + + ctx->blob = firmware; +- complete(&ctx->fw_load_complete); ++ complete(&ctx->dev->fw_load_complete); + } + + int b43_do_request_fw(struct b43_request_fw_context *ctx, +@@ -2142,7 +2143,7 @@ int b43_do_request_fw(struct b43_request + } + if (async) { + /* do this part asynchronously */ +- init_completion(&ctx->fw_load_complete); ++ init_completion(&ctx->dev->fw_load_complete); + err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname, + ctx->dev->dev->dev, GFP_KERNEL, + ctx, b43_fw_cb); +@@ -2150,12 +2151,11 @@ int b43_do_request_fw(struct b43_request + pr_err("Unable to load firmware\n"); + return err; + } +- /* stall here until fw ready */ +- wait_for_completion(&ctx->fw_load_complete); ++ wait_for_completion(&ctx->dev->fw_load_complete); + if (ctx->blob) + goto fw_ready; + /* On some ARM systems, the async request will fail, but the next sync +- * request works. For this reason, we dall through here ++ * request works. For this reason, we fall through here + */ + } + err = request_firmware(&ctx->blob, ctx->fwname, diff --git a/queue-3.12/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.12/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..7d3d2056604 --- /dev/null +++ b/queue-3.12/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,32 @@ +From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:39 -0600 +Subject: b43legacy: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 452028665312672c6ba9e16a19248ee00ead9400 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43legacy/main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/b43legacy/main.c ++++ b/drivers/net/wireless/b43legacy/main.c +@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_ + * as the ieee80211 unreg will destroy the workqueue. */ + cancel_work_sync(&wldev->restart_work); + cancel_work_sync(&wl->firmware_load); ++ complete(&wldev->fw_load_complete); + + B43legacy_WARN_ON(!wl); + if (!wldev->fw.ucode) diff --git a/queue-3.12/hwmon-k10temp-add-support-for-kaveri-cpus.patch b/queue-3.12/hwmon-k10temp-add-support-for-kaveri-cpus.patch new file mode 100644 index 00000000000..6a5d799f781 --- /dev/null +++ b/queue-3.12/hwmon-k10temp-add-support-for-kaveri-cpus.patch @@ -0,0 +1,29 @@ +From d303b1b5fbb688282bbf72a534b9dfed7af9fe4f Mon Sep 17 00:00:00 2001 +From: Phil Pokorny +Date: Tue, 14 Jan 2014 10:46:46 -0800 +Subject: hwmon: (k10temp) Add support for Kaveri CPUs + +From: Phil Pokorny + +commit d303b1b5fbb688282bbf72a534b9dfed7af9fe4f upstream. + +Add new PCI ID to support new model "Kaveri" family. + +Signed-off-by: Philip Pokorny +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k10temp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -210,6 +210,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_i + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, + {} + }; diff --git a/queue-3.12/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch b/queue-3.12/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch new file mode 100644 index 00000000000..96390536782 --- /dev/null +++ b/queue-3.12/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch @@ -0,0 +1,35 @@ +From 91b0d1198417cf4fd9a7bd4138b6909f0b359099 Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Sun, 5 Jan 2014 12:41:12 +0200 +Subject: iwlwifi: mvm: fix missing cleanup in .start() error path + +From: Eliad Peller + +commit 91b0d1198417cf4fd9a7bd4138b6909f0b359099 upstream. + +Cleanup of iwl_mvm_leds was missing in case of error, +resulting in the following warning: + +WARNING: at lib/kobject.c:196 kobject_add_internal+0x1f4/0x210() +kobject_add_internal failed for phy0-led with -EEXIST, don't try to register things with the same name in the same directory. + +which prevents further reloads of the driver. + +Signed-off-by: Eliad Peller +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/ops.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c +@@ -446,6 +446,7 @@ iwl_op_mode_mvm_start(struct iwl_trans * + + out_unregister: + ieee80211_unregister_hw(mvm->hw); ++ iwl_mvm_leds_exit(mvm); + out_free: + iwl_phy_db_free(mvm->phy_db); + kfree(mvm->scan_cmd); diff --git a/queue-3.12/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch b/queue-3.12/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch new file mode 100644 index 00000000000..0531548a4ea --- /dev/null +++ b/queue-3.12/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch @@ -0,0 +1,81 @@ +From 2d93aee152b1758a94a18fe15d72153ba73b5679 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Tue, 24 Dec 2013 14:15:41 +0200 +Subject: iwlwifi: pcie: enable oscillator for L1 exit + +From: Emmanuel Grumbach + +commit 2d93aee152b1758a94a18fe15d72153ba73b5679 upstream. + +Enabling the oscillator consumes slightly more power (100uA) +but allows to make sure that we exit from L1 on time. + +Not doing so might lead to a PCIe specification violation +since we might wake up from L1 at the wrong time. +This issue has been identified on 3160 and 7260 only. +On older NICs L1 off is not enabled, on newer NICs (7265), +the issue is fixed. + +When the bug occurs the user sees that the NIC has +disappeared from the PCI bridge, any access to the device +returns 0xff. + +This fixes: + https://bugzilla.kernel.org/show_bug.cgi?id=64541 + +and has been extensively discussed here: + http://markmail.org/thread/mfmpzqt3r333n4bo + +Fixes: 99cd47142399 ("iwlwifi: add 7000 series device configuration") +Reported-and-tested-by: wzyboy +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-prph.h | 4 ++++ + drivers/net/wireless/iwlwifi/pcie/trans.c | 22 ++++++++++++++++++++++ + 2 files changed, 26 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-prph.h ++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h +@@ -272,4 +272,8 @@ static inline unsigned int SCD_QUEUE_STA + + /*********************** END TX SCHEDULER *************************************/ + ++/* Oscillator clock */ ++#define OSC_CLK (0xa04068) ++#define OSC_CLK_FORCE_CONTROL (0x8) ++ + #endif /* __iwl_prph_h__ */ +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -206,6 +206,28 @@ static int iwl_pcie_apm_init(struct iwl_ + goto out; + } + ++ if (trans->cfg->host_interrupt_operation_mode) { ++ /* ++ * This is a bit of an abuse - This is needed for 7260 / 3160 ++ * only check host_interrupt_operation_mode even if this is ++ * not related to host_interrupt_operation_mode. ++ * ++ * Enable the oscillator to count wake up time for L1 exit. This ++ * consumes slightly more power (100uA) - but allows to be sure ++ * that we wake up from L1 on time. ++ * ++ * This looks weird: read twice the same register, discard the ++ * value, set a bit, and yet again, read that same register ++ * just to discard the value. But that's the way the hardware ++ * seems to like it. ++ */ ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL); ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_read_prph(trans, OSC_CLK); ++ } ++ + /* + * Enable DMA clock and wait for it to stabilize. + * diff --git a/queue-3.12/kvm-s390-fix-diagnose-code-extraction.patch b/queue-3.12/kvm-s390-fix-diagnose-code-extraction.patch new file mode 100644 index 00000000000..f56438fbe1f --- /dev/null +++ b/queue-3.12/kvm-s390-fix-diagnose-code-extraction.patch @@ -0,0 +1,34 @@ +From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 11 Nov 2013 13:56:47 +0100 +Subject: KVM: s390: fix diagnose code extraction + +From: Heiko Carstens + +commit 743db27c526e0f31cc507959d662e97e2048a86f upstream. + +The diagnose code to be used is the contents of the base register (if not +zero), plus the displacement. The current code ignores the base register +contents. So let's fix that... + +Reviewed-by: Cornelia Huck +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Cornelia Huck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kvm/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -139,7 +139,7 @@ static int __diag_virtio_hypercall(struc + + int kvm_s390_handle_diag(struct kvm_vcpu *vcpu) + { +- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16; ++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff; + + if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) + return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); diff --git a/queue-3.12/kvm-s390-ioeventfd-ignore-leftmost-bits.patch b/queue-3.12/kvm-s390-ioeventfd-ignore-leftmost-bits.patch new file mode 100644 index 00000000000..f7af4daf448 --- /dev/null +++ b/queue-3.12/kvm-s390-ioeventfd-ignore-leftmost-bits.patch @@ -0,0 +1,36 @@ +From ff1f3cb4b3ac5d039f02679f34cb1498d110d241 Mon Sep 17 00:00:00 2001 +From: Dominik Dingel +Date: Mon, 9 Dec 2013 18:30:01 +0100 +Subject: KVM: s390: ioeventfd: ignore leftmost bits + +From: Dominik Dingel + +commit ff1f3cb4b3ac5d039f02679f34cb1498d110d241 upstream. + +The diagnose 500 subcode 3 contains the 32 bit subchannel id in bits 32-63 +(counting from the left). As for other I/O instructions, bits 0-31 should be +ignored and thus not be passed to kvm_io_bus_write_cookie(). + +This fixes a bug where the guest passed non-zero bits 0-31 which the +host tried to interpret, leading to ioeventfd notification failures. + +Signed-off-by: Dominik Dingel +Reviewed-by: Cornelia Huck +Signed-off-by: Cornelia Huck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kvm/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -122,7 +122,7 @@ static int __diag_virtio_hypercall(struc + * - gpr 4 contains the index on the bus (optionally) + */ + ret = kvm_io_bus_write_cookie(vcpu->kvm, KVM_VIRTIO_CCW_NOTIFY_BUS, +- vcpu->run->s.regs.gprs[2], ++ vcpu->run->s.regs.gprs[2] & 0xffffffff, + 8, &vcpu->run->s.regs.gprs[3], + vcpu->run->s.regs.gprs[4]); + srcu_read_unlock(&vcpu->kvm->srcu, idx); diff --git a/queue-3.12/kvm-x86-limit-pit-timer-frequency.patch b/queue-3.12/kvm-x86-limit-pit-timer-frequency.patch new file mode 100644 index 00000000000..cf5d643c876 --- /dev/null +++ b/queue-3.12/kvm-x86-limit-pit-timer-frequency.patch @@ -0,0 +1,92 @@ +From 9ed96e87c5748de4c2807ef17e81287c7304186c Mon Sep 17 00:00:00 2001 +From: Marcelo Tosatti +Date: Mon, 6 Jan 2014 12:00:02 -0200 +Subject: KVM: x86: limit PIT timer frequency + +From: Marcelo Tosatti + +commit 9ed96e87c5748de4c2807ef17e81287c7304186c upstream. + +Limit PIT timer frequency similarly to the limit applied by +LAPIC timer. + +Reviewed-by: Jan Kiszka +Signed-off-by: Marcelo Tosatti +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/i8254.c | 18 ++++++++++++++++++ + arch/x86/kvm/lapic.c | 3 --- + arch/x86/kvm/x86.c | 3 +++ + arch/x86/kvm/x86.h | 2 ++ + 4 files changed, 23 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -37,6 +37,7 @@ + + #include "irq.h" + #include "i8254.h" ++#include "x86.h" + + #ifndef CONFIG_X86_64 + #define mod_64(x, y) ((x) - (y) * div64_u64(x, y)) +@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm + atomic_set(&ps->pending, 0); + ps->irq_ack = 1; + ++ /* ++ * Do not allow the guest to program periodic timers with small ++ * interval, since the hrtimers are not throttled by the host ++ * scheduler. ++ */ ++ if (ps->is_periodic) { ++ s64 min_period = min_timer_period_us * 1000LL; ++ ++ if (ps->period < min_period) { ++ pr_info_ratelimited( ++ "kvm: requested %lld ns " ++ "i8254 timer period limited to %lld ns\n", ++ ps->period, min_period); ++ ps->period = min_period; ++ } ++ } ++ + hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval), + HRTIMER_MODE_ABS); + } +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -71,9 +71,6 @@ + #define VEC_POS(v) ((v) & (32 - 1)) + #define REG_POS(v) (((v) >> 5) << 4) + +-static unsigned int min_timer_period_us = 500; +-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); +- + static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val) + { + *((u32 *) (apic->regs + reg_off)) = val; +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops); + static bool ignore_msrs = 0; + module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR); + ++unsigned int min_timer_period_us = 500; ++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); ++ + bool kvm_has_tsc_control; + EXPORT_SYMBOL_GPL(kvm_has_tsc_control); + u32 kvm_max_guest_tsc_khz; +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x + + extern u64 host_xcr0; + ++extern unsigned int min_timer_period_us; ++ + extern struct static_key kvm_no_apic_vcpu; + #endif diff --git a/queue-3.12/mei-use-hbm-idle-state-to-prevent-spurious-resets.patch b/queue-3.12/mei-use-hbm-idle-state-to-prevent-spurious-resets.patch new file mode 100644 index 00000000000..2723741e791 --- /dev/null +++ b/queue-3.12/mei-use-hbm-idle-state-to-prevent-spurious-resets.patch @@ -0,0 +1,154 @@ +From 66ae460b13c31a176b41550259683c841a62af3e Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Wed, 8 Jan 2014 20:19:22 +0200 +Subject: mei: use hbm idle state to prevent spurious resets + +From: Tomas Winkler + +commit 66ae460b13c31a176b41550259683c841a62af3e upstream. + +When reset is caused by hbm protocol mismatch or timeout +we might end up in an endless reset loop and hbm protocol +will never sync + +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hbm.c | 19 +++++++++++++++++++ + drivers/misc/mei/hbm.h | 1 + + drivers/misc/mei/init.c | 12 ++++++++---- + drivers/misc/mei/interrupt.c | 25 +++++++++++++++---------- + 4 files changed, 43 insertions(+), 14 deletions(-) + +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -128,6 +128,17 @@ static bool is_treat_specially_client(st + return false; + } + ++/** ++ * mei_hbm_idle - set hbm to idle state ++ * ++ * @dev: the device structure ++ */ ++void mei_hbm_idle(struct mei_device *dev) ++{ ++ dev->init_clients_timer = 0; ++ dev->hbm_state = MEI_HBM_IDLE; ++} ++ + int mei_hbm_start_wait(struct mei_device *dev) + { + int ret; +@@ -577,6 +588,14 @@ void mei_hbm_dispatch(struct mei_device + mei_read_slots(dev, dev->rd_msg_buf, hdr->length); + mei_msg = (struct mei_bus_message *)dev->rd_msg_buf; + ++ /* ignore spurious message and prevent reset nesting ++ * hbm is put to idle during system reset ++ */ ++ if (dev->hbm_state == MEI_HBM_IDLE) { ++ dev_dbg(&dev->pdev->dev, "hbm: state is idle ignore spurious messages\n"); ++ return 0; ++ } ++ + switch (mei_msg->hbm_cmd) { + case HOST_START_RES_CMD: + version_res = (struct hbm_host_version_response *)mei_msg; +--- a/drivers/misc/mei/hbm.h ++++ b/drivers/misc/mei/hbm.h +@@ -49,6 +49,7 @@ static inline void mei_hbm_hdr(struct me + hdr->reserved = 0; + } + ++void mei_hbm_idle(struct mei_device *dev); + int mei_hbm_start_req(struct mei_device *dev); + int mei_hbm_start_wait(struct mei_device *dev); + int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl); +--- a/drivers/misc/mei/init.c ++++ b/drivers/misc/mei/init.c +@@ -139,14 +139,19 @@ void mei_reset(struct mei_device *dev, i + dev->dev_state != MEI_DEV_POWER_DOWN && + dev->dev_state != MEI_DEV_POWER_UP); + ++ /* we're already in reset, cancel the init timer ++ * if the reset was called due the hbm protocol error ++ * we need to call it before hw start ++ * so the hbm watchdog won't kick in ++ */ ++ mei_hbm_idle(dev); ++ + ret = mei_hw_reset(dev, interrupts_enabled); + if (ret) { + dev_err(&dev->pdev->dev, "hw reset failed disabling the device\n"); + interrupts_enabled = false; +- dev->dev_state = MEI_DEV_DISABLED; + } + +- dev->hbm_state = MEI_HBM_IDLE; + + if (dev->dev_state != MEI_DEV_INITIALIZING && + dev->dev_state != MEI_DEV_POWER_UP) { +@@ -175,8 +180,6 @@ void mei_reset(struct mei_device *dev, i + memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg)); + } + +- /* we're already in reset, cancel the init timer */ +- dev->init_clients_timer = 0; + + dev->me_clients_num = 0; + dev->rd_msg_hdr = 0; +@@ -188,6 +191,7 @@ void mei_reset(struct mei_device *dev, i + + if (!interrupts_enabled) { + dev_dbg(&dev->pdev->dev, "intr not enabled end of reset\n"); ++ dev->dev_state = MEI_DEV_DISABLED; + return; + } + +--- a/drivers/misc/mei/interrupt.c ++++ b/drivers/misc/mei/interrupt.c +@@ -536,7 +536,6 @@ EXPORT_SYMBOL_GPL(mei_irq_write_handler) + * + * @work: pointer to the work_struct structure + * +- * NOTE: This function is called by timer interrupt work + */ + void mei_timer(struct work_struct *work) + { +@@ -551,18 +550,24 @@ void mei_timer(struct work_struct *work) + + + mutex_lock(&dev->device_lock); +- if (dev->dev_state != MEI_DEV_ENABLED) { +- if (dev->dev_state == MEI_DEV_INIT_CLIENTS) { +- if (dev->init_clients_timer) { +- if (--dev->init_clients_timer == 0) { +- dev_err(&dev->pdev->dev, "reset: init clients timeout hbm_state = %d.\n", +- dev->hbm_state); +- mei_reset(dev, 1); +- } ++ ++ /* Catch interrupt stalls during HBM init handshake */ ++ if (dev->dev_state == MEI_DEV_INIT_CLIENTS && ++ dev->hbm_state != MEI_HBM_IDLE) { ++ ++ if (dev->init_clients_timer) { ++ if (--dev->init_clients_timer == 0) { ++ dev_err(&dev->pdev->dev, "timer: init clients timeout hbm_state = %d.\n", ++ dev->hbm_state); ++ mei_reset(dev, 1); ++ goto out; + } + } +- goto out; + } ++ ++ if (dev->dev_state != MEI_DEV_ENABLED) ++ goto out; ++ + /*** connect/disconnect timeouts ***/ + list_for_each_entry_safe(cl_pos, cl_next, &dev->file_list, link) { + if (cl_pos->timer_count) { diff --git a/queue-3.12/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch b/queue-3.12/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch new file mode 100644 index 00000000000..a3bffaedce6 --- /dev/null +++ b/queue-3.12/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch @@ -0,0 +1,41 @@ +From 9795229752c31da0c5f8a7dc4c827665327b52f9 Mon Sep 17 00:00:00 2001 +From: Amitkumar Karwar +Date: Fri, 10 Jan 2014 14:30:41 -0800 +Subject: mwifiex: add missing endian conversion for fw_tsf + +From: Amitkumar Karwar + +commit 9795229752c31da0c5f8a7dc4c827665327b52f9 upstream. + +It is u64 data received from firmware. Little endian to cpu +conversion is required here. + +Signed-off-by: Amitkumar Karwar +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/scan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mwifiex/scan.c ++++ b/drivers/net/wireless/mwifiex/scan.c +@@ -1681,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifi + const u8 *ie_buf; + size_t ie_len; + u16 channel = 0; +- u64 fw_tsf = 0; ++ __le64 fw_tsf = 0; + u16 beacon_size = 0; + u32 curr_bcn_bytes; + u32 freq; +@@ -1815,7 +1815,7 @@ int mwifiex_ret_802_11_scan(struct mwifi + ie_buf, ie_len, rssi, GFP_KERNEL); + bss_priv = (struct mwifiex_bss_priv *)bss->priv; + bss_priv->band = band; +- bss_priv->fw_tsf = fw_tsf; ++ bss_priv->fw_tsf = le64_to_cpu(fw_tsf); + if (priv->media_connected && + !memcmp(bssid, + priv->curr_bss_params.bss_descriptor diff --git a/queue-3.12/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch b/queue-3.12/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch new file mode 100644 index 00000000000..18f1f7fe5ae --- /dev/null +++ b/queue-3.12/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch @@ -0,0 +1,31 @@ +From 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 Mon Sep 17 00:00:00 2001 +From: Bing Zhao +Date: Tue, 14 Jan 2014 19:16:34 -0800 +Subject: mwifiex: fix wrong 11ac bits setting in fw_cap_info + +From: Bing Zhao + +commit 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 upstream. + +bit 14 is actually reserved and bit 12 & 13 should be used for +11ac capability in fw_cap_info. + +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/fw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mwifiex/fw.h ++++ b/drivers/net/wireless/mwifiex/fw.h +@@ -226,7 +226,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER { + + /* HW_SPEC fw_cap_info */ + +-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14))) ++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13))) + + #define GET_VHTCAP_CHWDSET(vht_cap_info) ((vht_cap_info >> 2) & 0x3) + #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3) diff --git a/queue-3.12/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch b/queue-3.12/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch new file mode 100644 index 00000000000..e927a11b6de --- /dev/null +++ b/queue-3.12/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch @@ -0,0 +1,60 @@ +From d82403a9f407217b6aed5260aa92a120e8e98310 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:35 -0600 +Subject: rtlwifi: Add missing code to PWDB statics routine + +From: Larry Finger + +commit d82403a9f407217b6aed5260aa92a120e8e98310 upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/stats.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/stats.c ++++ b/drivers/net/wireless/rtlwifi/stats.c +@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee + struct rtl_sta_info *drv_priv = NULL; + struct ieee80211_sta *sta = NULL; + long undec_sm_pwdb; ++ long undec_sm_cck; + + rcu_read_lock(); + if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION) +@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee + if (sta) { + drv_priv = (struct rtl_sta_info *) sta->drv_priv; + undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb; ++ undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck; + } else { + undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb; ++ undec_sm_cck = rtlpriv->dm.undec_sm_cck; + } + + if (undec_sm_pwdb < 0) + undec_sm_pwdb = pstatus->rx_pwdb_all; ++ if (undec_sm_cck < 0) ++ undec_sm_cck = pstatus->rx_pwdb_all; + if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) { + undec_sm_pwdb = (((undec_sm_pwdb) * + (RX_SMOOTH_FACTOR - 1)) + +@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee + undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) + + (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); + } ++ if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) { ++ undec_sm_cck = (((undec_sm_pwdb) * ++ (RX_SMOOTH_FACTOR - 1)) + ++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); ++ undec_sm_cck = undec_sm_cck + 1; ++ } else { ++ undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) + ++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); ++ } + + if (sta) { + drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb; diff --git a/queue-3.12/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch b/queue-3.12/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch new file mode 100644 index 00000000000..d3c45901d04 --- /dev/null +++ b/queue-3.12/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch @@ -0,0 +1,31 @@ +From dc6405712268fe514d3dd89aa936c4397b0871b9 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:30 -0600 +Subject: rtlwifi: Increase the RX queue length for USB drivers + +From: Larry Finger + +commit dc6405712268fe514d3dd89aa936c4397b0871b9 upstream. + +The current number of RX buffers queued is 32, which is too small under +heavy load. That number is doubled. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -557,7 +557,7 @@ static void _rtl_rx_pre_process(struct i + } + } + +-#define __RX_SKB_MAX_QUEUED 32 ++#define __RX_SKB_MAX_QUEUED 64 + + static void _rtl_rx_work(unsigned long param) + { diff --git a/queue-3.12/rtlwifi-redo-register-save-locations.patch b/queue-3.12/rtlwifi-redo-register-save-locations.patch new file mode 100644 index 00000000000..a6f72401bfc --- /dev/null +++ b/queue-3.12/rtlwifi-redo-register-save-locations.patch @@ -0,0 +1,101 @@ +From b9a758a8c905fc59e783ae91ad645452d877ea88 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:27 -0600 +Subject: rtlwifi: Redo register save locations + +From: Larry Finger + +commit b9a758a8c905fc59e783ae91ad645452d877ea88 upstream. + +The initial USB driver did not use some register save locations in the +private data storage. To save some memory, a union was used to overlay these +variables with USB I/O components. In an update of the gain-control code, +these register save locations are now needed for USB drivers. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/wifi.h | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/wifi.h ++++ b/drivers/net/wireless/rtlwifi/wifi.h +@@ -1035,6 +1035,7 @@ struct rtl_ht_agg { + + struct rssi_sta { + long undec_sm_pwdb; ++ long undec_sm_cck; + }; + + struct rtl_tid_data { +@@ -1325,8 +1326,10 @@ struct fast_ant_training { + struct rtl_dm { + /*PHY status for Dynamic Management */ + long entry_min_undec_sm_pwdb; ++ long undec_sm_cck; + long undec_sm_pwdb; /*out dm */ + long entry_max_undec_sm_pwdb; ++ s32 ofdm_pkt_cnt; + bool dm_initialgain_enable; + bool dynamic_txpower_enable; + bool current_turbo_edca; +@@ -1341,6 +1344,7 @@ struct rtl_dm { + bool inform_fw_driverctrldm; + bool current_mrc_switch; + u8 txpowercount; ++ u8 powerindex_backup[6]; + + u8 thermalvalue_rxgain; + u8 thermalvalue_iqk; +@@ -1352,7 +1356,9 @@ struct rtl_dm { + bool done_txpower; + u8 dynamic_txhighpower_lvl; /*Tx high power level */ + u8 dm_flag; /*Indicate each dynamic mechanism's status. */ ++ u8 dm_flag_tmp; + u8 dm_type; ++ u8 dm_rssi_sel; + u8 txpower_track_control; + bool interrupt_migration; + bool disable_tx_int; +@@ -1951,6 +1957,7 @@ struct dig_t { + u8 pre_ccastate; + u8 cur_ccasate; + u8 large_fa_hit; ++ u8 dig_dynamic_min; + u8 forbidden_igi; + u8 dig_state; + u8 dig_highpwrstate; +@@ -2031,22 +2038,15 @@ struct rtl_priv { + struct dig_t dm_digtable; + struct ps_t dm_pstable; + +- /* section shared by individual drivers */ +- union { +- struct { /* data buffer pointer for USB reads */ +- __le32 *usb_data; +- int usb_data_index; +- bool initialized; +- }; +- struct { /* section for 8723ae */ +- bool reg_init; /* true if regs saved */ +- u32 reg_874; +- u32 reg_c70; +- u32 reg_85c; +- u32 reg_a74; +- bool bt_operation_on; +- }; +- }; ++ u32 reg_874; ++ u32 reg_c70; ++ u32 reg_85c; ++ u32 reg_a74; ++ bool reg_init; /* true if regs saved */ ++ bool bt_operation_on; ++ __le32 *usb_data; ++ int usb_data_index; ++ bool initialized; + bool enter_ps; /* true when entering PS */ + u8 rate_mask[5]; + diff --git a/queue-3.12/rtlwifi-rtl8188ee-fix-typo-in-code.patch b/queue-3.12/rtlwifi-rtl8188ee-fix-typo-in-code.patch new file mode 100644 index 00000000000..a984dd06383 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8188ee-fix-typo-in-code.patch @@ -0,0 +1,33 @@ +From f699273d6a624266ebc9198774f06ee64a3847a1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 25 Nov 2013 10:45:28 -0600 +Subject: rtlwifi: rtl8188ee: Fix typo in code + +From: Larry Finger + +commit f699273d6a624266ebc9198774f06ee64a3847a1 upstream. + +The static analyser "cppcheck" shows the following typo: +drivers/net/wireless/rtlwifi/rtl8188ee/dm.c:1081]: (style) Same expression on both sides of '!='. + +Signed-off-by: Larry Finger +Reported-by: David Binderman +Cc: David Binderman +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8188ee/dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c +@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_c + rtldm->swing_flag_ofdm = true; + } + +- if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) { ++ if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) { + rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck; + rtldm->swing_flag_cck = true; + } diff --git a/queue-3.12/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch b/queue-3.12/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch new file mode 100644 index 00000000000..afe14567b02 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch @@ -0,0 +1,48 @@ +From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:29 -0600 +Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header + +From: Larry Finger + +commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream. + +Changes in the gain-control mechanism will require some changes in the header. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h +@@ -91,6 +91,17 @@ + #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74 + #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67 + ++#define DYNAMIC_FUNC_DISABLE 0x0 ++#define DYNAMIC_FUNC_DIG BIT(0) ++#define DYNAMIC_FUNC_HP BIT(1) ++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/ ++#define DYNAMIC_FUNC_BT BIT(3) ++#define DYNAMIC_FUNC_ANT_DIV BIT(4) ++ ++#define RSSI_CCK 0 ++#define RSSI_OFDM 1 ++#define RSSI_DEFAULT 2 ++ + struct swat_t { + u8 failure_cnt; + u8 try_flag; +@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee + void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery); + void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw); + void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); + + #endif diff --git a/queue-3.12/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch b/queue-3.12/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch new file mode 100644 index 00000000000..2705bc72df2 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch @@ -0,0 +1,62 @@ +From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:32 -0600 +Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers + +From: Larry Finger + +commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c +@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_ + {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00} + }; + ++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a}; ++ ++void dm_restorepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], ++ rtlpriv->dm.powerindex_backup[index]); ++} ++EXPORT_SYMBOL_GPL(dm_restorepowerindex); ++ ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], value); ++} ++EXPORT_SYMBOL_GPL(dm_writepowerindex); ++ ++void dm_savepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ u8 tmp; ++ ++ for (index = 0; index < 6; index++) { ++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]); ++ rtlpriv->dm.powerindex_backup[index] = tmp; ++ } ++} ++EXPORT_SYMBOL_GPL(dm_savepowerindex); ++ + static void rtl92c_dm_diginit(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); diff --git a/queue-3.12/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch b/queue-3.12/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch new file mode 100644 index 00000000000..548bf75f6df --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch @@ -0,0 +1,33 @@ +From 8fd77aec1a9d6f4328fc0244f21932114e066df3 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:25 -0600 +Subject: rtlwifi: rtl8192c: Prevent reconnect attempts if not connected + +From: Larry Finger + +commit 8fd77aec1a9d6f4328fc0244f21932114e066df3 upstream. + +This driver has a watchdog timer that attempts to reconnect when beacon frames +are not seen for 6 seconds. This patch disables that reconnect whenever the +device has never been connected. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/base.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/base.c ++++ b/drivers/net/wireless/rtlwifi/base.c +@@ -1437,7 +1437,8 @@ void rtl_watchdog_wq_callback(void *data + /* if we can't recv beacon for 6s, we should + * reconnect this AP + */ +- if (rtlpriv->link_info.roam_times >= 3) { ++ if ((rtlpriv->link_info.roam_times >= 3) && ++ !is_zero_ether_addr(rtlpriv->mac80211.bssid)) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, + "AP off, try to reconnect now\n"); + rtlpriv->link_info.roam_times = 0; diff --git a/queue-3.12/rtlwifi-rtl8192cu-add-new-device-id.patch b/queue-3.12/rtlwifi-rtl8192cu-add-new-device-id.patch new file mode 100644 index 00000000000..9381a2ffe3d --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192cu-add-new-device-id.patch @@ -0,0 +1,29 @@ +From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Thu, 9 Jan 2014 10:27:27 -0600 +Subject: rtlwifi: rtl8192cu: Add new device ID + +From: Larry Finger + +commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream. + +Reported-by: Jan Prinsloo +Tested-by: Jan Prinsloo +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ + /* HP - Lite-On ,8188CUS Slim Combo */ diff --git a/queue-3.12/rtlwifi-rtl8192cu-add-new-firmware.patch b/queue-3.12/rtlwifi-rtl8192cu-add-new-firmware.patch new file mode 100644 index 00000000000..94396f75199 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192cu-add-new-firmware.patch @@ -0,0 +1,93 @@ +From 62009b7f12793c932aaba0df946b04cb4a77d022 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:26 -0600 +Subject: rtlwifi: rtl8192cu: Add new firmware + +From: Larry Finger + +commit 62009b7f12793c932aaba0df946b04cb4a77d022 upstream. + +Vendor driver rtl8188C_8192C_8192D_usb_linux_v3.4.2_3727.20120404 introduced +new firmware for these chips. The code try for the new file, and fall back to +the original firmware if the new file is not available. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 10 ++++++++++ + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 16 +++++++++++++--- + drivers/net/wireless/rtlwifi/wifi.h | 1 + + 3 files changed, 24 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *fi + "Firmware callback routine entered!\n"); + complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { ++ if (rtlpriv->cfg->alt_fw_name) { ++ err = request_firmware(&firmware, ++ rtlpriv->cfg->alt_fw_name, ++ rtlpriv->io.dev); ++ pr_info("Loading alternative firmware %s\n", ++ rtlpriv->cfg->alt_fw_name); ++ if (!err) ++ goto found_alt; ++ } + pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name); + rtlpriv->max_fw_size = 0; + return; + } ++found_alt: + if (firmware->size > rtlpriv->max_fw_size) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, + "Firmware is too big!\n"); +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger rtlhal.version) && ++ !IS_92C_SERIAL(rtlpriv->rtlhal.version)) { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin"; ++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin"; ++ } else { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin"; ++ } ++ /* provide name of alternative file */ ++ rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin"; + pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name); + rtlpriv->max_fw_size = 0x4000; + err = request_firmware_nowait(THIS_MODULE, 1, + rtlpriv->cfg->fw_name, rtlpriv->io.dev, + GFP_KERNEL, hw, rtl_fw_cb); +- +- + return err; + } + +--- a/drivers/net/wireless/rtlwifi/wifi.h ++++ b/drivers/net/wireless/rtlwifi/wifi.h +@@ -1806,6 +1806,7 @@ struct rtl_hal_cfg { + bool write_readback; + char *name; + char *fw_name; ++ char *alt_fw_name; + struct rtl_hal_ops *ops; + struct rtl_mod_params *mod_params; + struct rtl_hal_usbint_cfg *usb_interface_cfg; diff --git a/queue-3.12/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch b/queue-3.12/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch new file mode 100644 index 00000000000..76053d80899 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch @@ -0,0 +1,69 @@ +From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:34 -0600 +Subject: rtlwifi: rtl8192cu: Fix some code in RF handling + +From: Larry Finger + +commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + if (mac->act_scanning) { + tx_agc[RF90_PATH_A] = 0x3f3f3f3f; + tx_agc[RF90_PATH_B] = 0x3f3f3f3f; +- if (turbo_scanoff) { +- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { +- tx_agc[idx1] = ppowerlevel[idx1] | +- (ppowerlevel[idx1] << 8) | +- (ppowerlevel[idx1] << 16) | +- (ppowerlevel[idx1] << 24); +- if (rtlhal->interface == INTF_USB) { +- if (tx_agc[idx1] > 0x20 && +- rtlefuse->external_pa) +- tx_agc[idx1] = 0x20; +- } ++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { ++ tx_agc[idx1] = ppowerlevel[idx1] | ++ (ppowerlevel[idx1] << 8) | ++ (ppowerlevel[idx1] << 16) | ++ (ppowerlevel[idx1] << 24); ++ if (rtlhal->interface == INTF_USB) { ++ if (tx_agc[idx1] > 0x20 && ++ rtlefuse->external_pa) ++ tx_agc[idx1] = 0x20; + } + } + } else { +@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + TXHIGHPWRLEVEL_LEVEL2) { + tx_agc[RF90_PATH_A] = 0x00000000; + tx_agc[RF90_PATH_B] = 0x00000000; +- } else{ ++ } else { + for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { + tx_agc[idx1] = ppowerlevel[idx1] | + (ppowerlevel[idx1] << 8) | +@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg + regoffset == RTXAGC_B_MCS07_MCS04) + regoffset = 0xc98; + for (i = 0; i < 3; i++) { +- writeVal = (writeVal > 6) ? (writeVal - 6) : 0; ++ if (i != 2) ++ writeVal = (writeVal > 8) ? ++ (writeVal - 8) : 0; ++ else ++ writeVal = (writeVal > 6) ? ++ (writeVal - 6) : 0; + rtl_write_byte(rtlpriv, (u32)(regoffset + i), + (u8)writeVal); + } diff --git a/queue-3.12/rtlwifi-rtl8192cu-update-the-power-index-registers.patch b/queue-3.12/rtlwifi-rtl8192cu-update-the-power-index-registers.patch new file mode 100644 index 00000000000..b8f9cab4e33 --- /dev/null +++ b/queue-3.12/rtlwifi-rtl8192cu-update-the-power-index-registers.patch @@ -0,0 +1,47 @@ +From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:33 -0600 +Subject: rtlwifi: rtl8192cu: Update the power index registers + +From: Larry Finger + +commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream. + +This patch uses the newly introduced power index register routines. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++ + drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++ + 2 files changed, 12 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c +@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct i + "PHY_SetTxPowerLevel8192S() Channel = %d\n", + rtlphy->current_channel); + rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel); ++ if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_NORMAL) ++ dm_restorepowerindex(hw); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL1) ++ dm_writepowerindex(hw, 0x14); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL2) ++ dm_writepowerindex(hw, 0x10); + } + + rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl; +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h +@@ -30,3 +30,6 @@ + #include "../rtl8192ce/dm.h" + + void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); diff --git a/queue-3.12/rtlwifi-set-the-link-state.patch b/queue-3.12/rtlwifi-set-the-link-state.patch new file mode 100644 index 00000000000..45aa2cb53aa --- /dev/null +++ b/queue-3.12/rtlwifi-set-the-link-state.patch @@ -0,0 +1,30 @@ +From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:28 -0600 +Subject: rtlwifi: Set the link state + +From: Larry Finger + +commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream. + +The present code fails to set the linked state when an interface is +added. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -194,6 +194,7 @@ static int rtl_op_add_interface(struct i + rtlpriv->cfg->maps + [RTL_IBSS_INT_MASKS]); + } ++ mac->link_state = MAC80211_LINKED; + break; + case NL80211_IFTYPE_ADHOC: + RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, diff --git a/queue-3.12/rtlwifi-update-beacon-statistics-for-usb-driver.patch b/queue-3.12/rtlwifi-update-beacon-statistics-for-usb-driver.patch new file mode 100644 index 00000000000..c403ac7003f --- /dev/null +++ b/queue-3.12/rtlwifi-update-beacon-statistics-for-usb-driver.patch @@ -0,0 +1,31 @@ +From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:31 -0600 +Subject: rtlwifi: Update beacon statistics for USB driver + +From: Larry Finger + +commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream. + +The USB drivers were not updating the beacon statistics, which led to +false beacon loss indications. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -484,6 +484,8 @@ static void _rtl_usb_rx_process_agg(stru + if (unicast) + rtlpriv->link_info.num_rx_inperiod++; + } ++ /* static bcn for roaming */ ++ rtl_beacon_statistic(hw, skb); + } + } + diff --git a/queue-3.12/s390-uapi-fix-struct-statfs64-definition.patch b/queue-3.12/s390-uapi-fix-struct-statfs64-definition.patch new file mode 100644 index 00000000000..ffec82e91fb --- /dev/null +++ b/queue-3.12/s390-uapi-fix-struct-statfs64-definition.patch @@ -0,0 +1,44 @@ +From 4e078146dff728f4865270a47710d57797e81eb6 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 21 Jan 2014 17:31:10 +0100 +Subject: s390/uapi: fix struct statfs64 definition + +From: Heiko Carstens + +commit 4e078146dff728f4865270a47710d57797e81eb6 upstream. + +With b8668fd0a7e1b59f "s390/uapi: change struct statfs[64] member types +to unsigned values" the size of a couple of struct statfs64 member got +incorrectly changed from 64 to 32 bit for 32 bit builds. + +Fix this by changing the type of couple of struct statfs64 members from +unsigned long to unsigned long long. +The definition of struct compat_statfs64 was correct however. + +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/uapi/asm/statfs.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/s390/include/uapi/asm/statfs.h ++++ b/arch/s390/include/uapi/asm/statfs.h +@@ -35,11 +35,11 @@ struct statfs { + struct statfs64 { + unsigned int f_type; + unsigned int f_bsize; +- unsigned long f_blocks; +- unsigned long f_bfree; +- unsigned long f_bavail; +- unsigned long f_files; +- unsigned long f_ffree; ++ unsigned long long f_blocks; ++ unsigned long long f_bfree; ++ unsigned long long f_bavail; ++ unsigned long long f_files; ++ unsigned long long f_ffree; + __kernel_fsid_t f_fsid; + unsigned int f_namelen; + unsigned int f_frsize; diff --git a/queue-3.12/serial-8250-enable-uart_bug_nomsr-for-tegra.patch b/queue-3.12/serial-8250-enable-uart_bug_nomsr-for-tegra.patch new file mode 100644 index 00000000000..30710e63ca2 --- /dev/null +++ b/queue-3.12/serial-8250-enable-uart_bug_nomsr-for-tegra.patch @@ -0,0 +1,65 @@ +From 3685f19e07802ec4207b52465c408f185b66490e Mon Sep 17 00:00:00 2001 +From: Stephen Warren +Date: Tue, 7 Jan 2014 15:00:12 -0700 +Subject: serial: 8250: enable UART_BUG_NOMSR for Tegra + +From: Stephen Warren + +commit 3685f19e07802ec4207b52465c408f185b66490e upstream. + +Tegra chips have 4 or 5 identical UART modules embedded. UARTs C..E have +their MODEM-control signals tied off to a static state. However UARTs A +and B can optionally route those signals to/from package pins, depending +on the exact pinmux configuration. + +When these signals are not routed to package pins, false interrupts may +trigger either temporarily, or permanently, all while not showing up in +the IIR; it will read as NO_INT. This will eventually lead to the UART +IRQ being disabled due to unhandled interrupts. When this happens, the +kernel may print e.g.: + + irq 68: nobody cared (try booting with the "irqpoll" option) + +In order to prevent this, enable UART_BUG_NOMSR. This prevents +UART_IER_MSI from being enabled, which prevents the false interrupts +from triggering. + +In practice, this is not needed under any of the following conditions: + +* On Tegra chips after Tegra30, since the HW bug has apparently been + fixed. + +* On UARTs C..E since their MODEM control signals are tied to the correct + static state which doesn't trigger the issue. + +* On UARTs A..B if the MODEM control signals are routed out to package + pins, since they will then carry valid signals. + +However, we ignore these exceptions for now, since they are only relevant +if a board actually hooks up more than a 4-wire UART, and no currently +supported board does this. If we ever support a board that does, we can +refine the algorithm that enables UART_BUG_NOMSR to take those exceptions +into account, and/or read a flag from DT/... that indicates that the +board has hooked up and pinmux'd more than a 4-wire UART. + +Reported-by: Olof Johansson # autotester +Signed-off-by: Stephen Warren +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struc + if (port->type == PORT_16550A && port->iotype == UPIO_AU) + up->bugs |= UART_BUG_NOMSR; + ++ /* HW bugs may trigger IRQ while IIR == NO_INT */ ++ if (port->type == PORT_TEGRA) ++ up->bugs |= UART_BUG_NOMSR; ++ + if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ) + autoconfig_irq(up); + diff --git a/queue-3.12/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch b/queue-3.12/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch new file mode 100644 index 00000000000..ffadef9f21a --- /dev/null +++ b/queue-3.12/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch @@ -0,0 +1,34 @@ +From 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 Mon Sep 17 00:00:00 2001 +From: Jonathan Woithe +Date: Mon, 9 Dec 2013 16:33:08 +1030 +Subject: serial: 8250: Fix initialisation of Quatech cards with the AMCC PCI chip + +From: Jonathan Woithe + +commit 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 upstream. + +Fix the initialisation of older Quatech serial cards which are fitted with +the AMCC PCI Matchmaker interface chip. + +Signed-off-by: Jonathan Woithe (jwoithe@just42.net) +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_d + unsigned long base = pci_resource_start(dev, 0); + if (base) { + u32 tmp; +- outl(inl(base + 0x38), base + 0x38); ++ outl(inl(base + 0x38) | 0x00002000, base + 0x38); + tmp = inl(base + 0x3c); + outl(tmp | 0x01000000, base + 0x3c); +- outl(tmp, base + 0x3c); ++ outl(tmp &= ~0x01000000, base + 0x3c); + } + } + return 0; diff --git a/queue-3.12/serial-add-support-for-200-v3-series-titan-card.patch b/queue-3.12/serial-add-support-for-200-v3-series-titan-card.patch new file mode 100644 index 00000000000..ab7ee16c7e5 --- /dev/null +++ b/queue-3.12/serial-add-support-for-200-v3-series-titan-card.patch @@ -0,0 +1,36 @@ +From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001 +From: Yegor Yefremov +Date: Mon, 9 Dec 2013 12:11:15 +0100 +Subject: serial: add support for 200 v3 series Titan card + +From: Yegor Yefremov + +commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream. + +Signed-off-by: Yegor Yefremov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_privat + #define PCI_DEVICE_ID_TITAN_800E 0xA014 + #define PCI_DEVICE_ID_TITAN_200EI 0xA016 + #define PCI_DEVICE_ID_TITAN_200EISI 0xA017 ++#define PCI_DEVICE_ID_TITAN_200V3 0xA306 + #define PCI_DEVICE_ID_TITAN_400V3 0xA310 + #define PCI_DEVICE_ID_TITAN_410V3 0xA312 + #define PCI_DEVICE_ID_TITAN_800V3 0xA314 +@@ -4140,6 +4141,9 @@ static struct pci_device_id serial_pci_t + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_bt_2_921600 }, + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_b0_4_921600 }, diff --git a/queue-3.12/series b/queue-3.12/series index 56b369ffc13..32e16017738 100644 --- a/queue-3.12/series +++ b/queue-3.12/series @@ -5,3 +5,66 @@ mm-hugetlbfs-fix-hugetlbfs-optimization.patch e752x_edac-fix-pci_dev-usage-count.patch e1000e-fix-compiler-warnings.patch mm-mempolicy.c-fix-mempolicy-printing-in-numa_maps.patch +x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch +x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch +x86-add-check-for-number-of-available-vectors-before-cpu-down.patch +kvm-x86-limit-pit-timer-frequency.patch +x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch +x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch +usb-chipidea-add-freescale-imx28-special-write-register-method.patch +usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch +usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch +usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch +usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch +usb-pl2303-fix-data-corruption-on-termios-updates.patch +usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch +usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch +usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch +usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch +usb-nokia-502-is-an-unusual-device.patch +usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch +usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch +usb-ehci-add-freescale-imx28-special-write-register-method.patch +rtlwifi-rtl8192cu-add-new-device-id.patch +rtlwifi-update-beacon-statistics-for-usb-driver.patch +rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch +rtlwifi-rtl8192cu-add-new-firmware.patch +rtlwifi-redo-register-save-locations.patch +rtlwifi-set-the-link-state.patch +rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch +rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch +rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch +rtlwifi-rtl8192cu-update-the-power-index-registers.patch +rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch +rtlwifi-add-missing-code-to-pwdb-statics-routine.patch +rtlwifi-rtl8188ee-fix-typo-in-code.patch +mwifiex-add-missing-endian-conversion-for-fw_tsf.patch +mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch +iwlwifi-pcie-enable-oscillator-for-l1-exit.patch +iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch +b43-fix-lockdep-splat.patch +b43-fix-unload-oops-if-firmware-is-not-available.patch +b43legacy-fix-unload-oops-if-firmware-is-not-available.patch +b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch +ath9k-use-correct-channel-for-rx-packets.patch +ath9k-disable-cross-band-fcc.patch +staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch +staging-r8712u-set-device-type-to-wlan.patch +staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch +staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch +mei-use-hbm-idle-state-to-prevent-spurious-resets.patch +tty-serial-at91-handle-shutdown-more-safely.patch +tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch +tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch +tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch +arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch +arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch +hwmon-k10temp-add-support-for-kaveri-cpus.patch +xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch +xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch +serial-add-support-for-200-v3-series-titan-card.patch +serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch +serial-8250-enable-uart_bug_nomsr-for-tegra.patch +kvm-s390-fix-diagnose-code-extraction.patch +kvm-s390-ioeventfd-ignore-leftmost-bits.patch +s390-uapi-fix-struct-statfs64-definition.patch diff --git a/queue-3.12/staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch b/queue-3.12/staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch new file mode 100644 index 00000000000..acdb3164de7 --- /dev/null +++ b/queue-3.12/staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch @@ -0,0 +1,69 @@ +From 3c92a0bf4d72737035a16c4fe357ccd439c9b7d2 Mon Sep 17 00:00:00 2001 +From: Amir Shehata +Date: Tue, 3 Dec 2013 21:58:47 +0800 +Subject: staging/lustre/ptlrpc: Fix a crash when dereferencing NULL + pointer + +From: Amir Shehata + +commit 3c92a0bf4d72737035a16c4fe357ccd439c9b7d2 upstream. + +When a system runs out of memory and the function +ptlrpc_register_bulk() is called from ptl_send_rpc() the call to +LNetMEAttach() fails due to failure to allocate memory. This forces +the code into an error path, which most probably previously went +untested. The error path: +if (rc != 0) { + CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %dn", + desc->bd_export->exp_obd->obd_name, xid, + posted_md, rc); + break; +} +This print assumes that desc->bd_export is not NULL. However, it is. +In fact it is expected to be NULL. desc->bd_import is the correct +structure to access in this case. + +Lustre-change: http://review.whamcloud.com/7121 +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3585 +Signed-off-by: Amir Shehata +Reviewed-by: Liang Zhen +Reviewed-by: Doug Oucharek +Reviewed-by: Oleg Drokin +Signed-off-by: Peng Tao +Signed-off-by: Andreas Dilger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/lustre/lustre/ptlrpc/niobuf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c ++++ b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c +@@ -179,7 +179,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r + LNET_UNLINK, LNET_INS_AFTER, &me_h); + if (rc != 0) { + CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %d\n", +- desc->bd_export->exp_obd->obd_name, xid, ++ desc->bd_import->imp_obd->obd_name, xid, + posted_md, rc); + break; + } +@@ -189,7 +189,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r + &desc->bd_mds[posted_md]); + if (rc != 0) { + CERROR("%s: LNetMDAttach failed x"LPU64"/%d: rc = %d\n", +- desc->bd_export->exp_obd->obd_name, xid, ++ desc->bd_import->imp_obd->obd_name, xid, + posted_md, rc); + rc2 = LNetMEUnlink(me_h); + LASSERT(rc2 == 0); +@@ -219,7 +219,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r + /* Holler if peer manages to touch buffers before he knows the xid */ + if (desc->bd_md_count != total_md) + CWARN("%s: Peer %s touched %d buffers while I registered\n", +- desc->bd_export->exp_obd->obd_name, libcfs_id2str(peer), ++ desc->bd_import->imp_obd->obd_name, libcfs_id2str(peer), + total_md - desc->bd_md_count); + spin_unlock(&desc->bd_lock); + diff --git a/queue-3.12/staging-r8712u-set-device-type-to-wlan.patch b/queue-3.12/staging-r8712u-set-device-type-to-wlan.patch new file mode 100644 index 00000000000..01ccdb59eaf --- /dev/null +++ b/queue-3.12/staging-r8712u-set-device-type-to-wlan.patch @@ -0,0 +1,40 @@ +From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 24 Dec 2013 11:22:54 -0600 +Subject: staging: r8712u: Set device type to wlan + +From: Larry Finger + +commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream. + +The latest version of NetworkManager does not recognize the device as wireless +without this change. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/usb_intf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch) + return (hex_to_bin(hch) << 4) | hex_to_bin(lch); + } + ++static const struct device_type wlan_type = { ++ .name = "wlan", ++}; ++ + /* + * drv_init() - a device potentially for us + * +@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_in + padapter->pusb_intf = pusb_intf; + usb_set_intfdata(pusb_intf, pnetdev); + SET_NETDEV_DEV(pnetdev, &pusb_intf->dev); ++ pnetdev->dev.type = &wlan_type; + /* step 2. */ + padapter->dvobj_init = &r8712_usb_dvobj_init; + padapter->dvobj_deinit = &r8712_usb_dvobj_deinit; diff --git a/queue-3.12/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch b/queue-3.12/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch new file mode 100644 index 00000000000..2b46ad2d38a --- /dev/null +++ b/queue-3.12/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch @@ -0,0 +1,48 @@ +From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 8 Dec 2013 09:11:30 +0000 +Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning + +From: Malcolm Priestley + +commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream. + +byBBPreEDIndex value is initially 0, this means that from +cold BBvUpdatePreEDThreshold is never set. + +This means that sensitivity may be in an ambiguous state, +failing to scan any wireless points or at least distant ones. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/baseband.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -1464,7 +1464,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70,.... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE) +@@ -1607,7 +1606,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE) +@@ -1759,7 +1757,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + case RF_VT3342A0: //RobertYu:20060627, testing table + if( bScanning ) + { // need Max sensitivity //RSSI -67, -68, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE) diff --git a/queue-3.12/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch b/queue-3.12/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch new file mode 100644 index 00000000000..9a0f8ed2d41 --- /dev/null +++ b/queue-3.12/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch @@ -0,0 +1,31 @@ +From 9acec059c0cef0bf086c738f4c0b1f4447782a48 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 1 Jan 2014 19:19:28 +0000 +Subject: staging: vt6656: CARDqGetNextTBTT correct uLowNextTBTT + +From: Malcolm Priestley + +commit 9acec059c0cef0bf086c738f4c0b1f4447782a48 upstream. + +value uLowNextTBTT yields wrong value. + +ULL is needed with qwTSF + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/card.c ++++ b/drivers/staging/vt6656/card.c +@@ -731,7 +731,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBea + + uBeaconInterval = wBeaconInterval * 1024; + // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval +- uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10; ++ uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10; + uLowRemain = (uLowNextTBTT) % uBeaconInterval; + uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32)) + % uBeaconInterval; diff --git a/queue-3.12/tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch b/queue-3.12/tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch new file mode 100644 index 00000000000..70cf0aecb05 --- /dev/null +++ b/queue-3.12/tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch @@ -0,0 +1,93 @@ +From 8bc661bfc0c2d221e209f4205bdaaf574d50100c Mon Sep 17 00:00:00 2001 +From: Marek Roszko +Date: Fri, 10 Jan 2014 10:33:11 +0100 +Subject: tty/serial: at91: disable uart timer at start of shutdown + +From: Marek Roszko + +commit 8bc661bfc0c2d221e209f4205bdaaf574d50100c upstream. + +The uart timer will schedule a tasklet when it fires. It is possible that it +can fire inside _shutdown before it is killed in the dma and pdc cleanup +routines. This causes a tasklet that exists after the port is shutdown, so when +the kernel finally executes it, it panics as the tty port is NULL. + +This is a somewhat rare condition but its possible if a program keeps on +opening/closing the port. It has been observed in particular with systemd +boot messages that were causing a kernel panic because of this behavior. + +Moving the timer deletion to the beginning of the function stops a tasklet from +being scheduled unexpectedly. + +Signed-off-by: Marek Roszko +[nicolas.ferre@atmel.com: modify commit message, call setup_timer() in any case] +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -824,9 +824,6 @@ static void atmel_release_rx_dma(struct + atmel_port->desc_rx = NULL; + atmel_port->chan_rx = NULL; + atmel_port->cookie_rx = -EINVAL; +- +- if (!atmel_port->is_usart) +- del_timer_sync(&atmel_port->uart_timer); + } + + static void atmel_rx_from_dma(struct uart_port *port) +@@ -1228,9 +1225,6 @@ static void atmel_release_rx_pdc(struct + DMA_FROM_DEVICE); + kfree(pdc->buf); + } +- +- if (!atmel_port->is_usart) +- del_timer_sync(&atmel_port->uart_timer); + } + + static void atmel_rx_from_pdc(struct uart_port *port) +@@ -1587,12 +1581,13 @@ static int atmel_startup(struct uart_por + /* enable xmit & rcvr */ + UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN); + ++ setup_timer(&atmel_port->uart_timer, ++ atmel_uart_timer_callback, ++ (unsigned long)port); ++ + if (atmel_use_pdc_rx(port)) { + /* set UART timeout */ + if (!atmel_port->is_usart) { +- setup_timer(&atmel_port->uart_timer, +- atmel_uart_timer_callback, +- (unsigned long)port); + mod_timer(&atmel_port->uart_timer, + jiffies + uart_poll_timeout(port)); + /* set USART timeout */ +@@ -1607,9 +1602,6 @@ static int atmel_startup(struct uart_por + } else if (atmel_use_dma_rx(port)) { + /* set UART timeout */ + if (!atmel_port->is_usart) { +- setup_timer(&atmel_port->uart_timer, +- atmel_uart_timer_callback, +- (unsigned long)port); + mod_timer(&atmel_port->uart_timer, + jiffies + uart_poll_timeout(port)); + /* set USART timeout */ +@@ -1635,6 +1627,12 @@ static void atmel_shutdown(struct uart_p + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + /* ++ * Prevent any tasklets being scheduled during ++ * cleanup ++ */ ++ del_timer_sync(&atmel_port->uart_timer); ++ ++ /* + * Clear out any scheduled tasklets before + * we destroy the buffers + */ diff --git a/queue-3.12/tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch b/queue-3.12/tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch new file mode 100644 index 00000000000..63847953e44 --- /dev/null +++ b/queue-3.12/tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch @@ -0,0 +1,41 @@ +From f50c995f9ebf064cea1368bf361c4e29679415b4 Mon Sep 17 00:00:00 2001 +From: Marek Roszko +Date: Tue, 7 Jan 2014 11:45:07 +0100 +Subject: tty/serial: at91: fix race condition in atmel_serial_remove + +From: Marek Roszko + +commit f50c995f9ebf064cea1368bf361c4e29679415b4 upstream. + +The _remove callback could be called when a tasklet is scheduled. tasklet_kill +was called inside the function in order to free up any scheduled tasklets. +However it was called after uart_remove_one_port which destroys tty references +needed in the port for atmel_tasklet_func. +Simply putting the tasklet_kill at the start of the function will prevent this +conflict. + +Signed-off-by: Marek Roszko +Acked-by: Leilei Zhao +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2430,11 +2430,12 @@ static int atmel_serial_remove(struct pl + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + int ret = 0; + ++ tasklet_kill(&atmel_port->tasklet); ++ + device_init_wakeup(&pdev->dev, 0); + + ret = uart_remove_one_port(&atmel_uart, port); + +- tasklet_kill(&atmel_port->tasklet); + kfree(atmel_port->rx_ring.buf); + + /* "port" is allocated statically, so we shouldn't free it */ diff --git a/queue-3.12/tty-serial-at91-handle-shutdown-more-safely.patch b/queue-3.12/tty-serial-at91-handle-shutdown-more-safely.patch new file mode 100644 index 00000000000..09e3a9fe79f --- /dev/null +++ b/queue-3.12/tty-serial-at91-handle-shutdown-more-safely.patch @@ -0,0 +1,73 @@ +From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001 +From: Marek Roszko +Date: Tue, 7 Jan 2014 11:45:06 +0100 +Subject: tty/serial: at91: Handle shutdown more safely + +From: Marek Roszko + +commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream. + +Interrupts were being cleaned up late in the shutdown handler, it is possible +that an interrupt can occur and schedule a tasklet that runs after the port is +cleaned up. There is a null dereference due to this race condition with the +following stacktrace: + +[] (atmel_tasklet_func+0x514/0x814) from [] (tasklet_action+0x70/0xa8) +[] (tasklet_action+0x70/0xa8) from [] (__do_softirq+0x90/0x144) +[] (__do_softirq+0x90/0x144) from [] (irq_exit+0x40/0x4c) +[] (irq_exit+0x40/0x4c) from [] (handle_IRQ+0x64/0x84) +[] (handle_IRQ+0x64/0x84) from [] (__irq_svc+0x40/0x50) +[] (__irq_svc+0x40/0x50) from [] (atmel_rx_dma_release+0x88/0xb8) +[] (atmel_rx_dma_release+0x88/0xb8) from [] (atmel_shutdown+0x104/0x160) +[] (atmel_shutdown+0x104/0x160) from [] (uart_port_shutdown+0x2c/0x38) + +Signed-off-by: Marek Roszko +Acked-by: Leilei Zhao +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1633,12 +1633,24 @@ static int atmel_startup(struct uart_por + static void atmel_shutdown(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); ++ ++ /* ++ * Clear out any scheduled tasklets before ++ * we destroy the buffers ++ */ ++ tasklet_kill(&atmel_port->tasklet); ++ + /* +- * Ensure everything is stopped. ++ * Ensure everything is stopped and ++ * disable all interrupts, port and break condition. + */ + atmel_stop_rx(port); + atmel_stop_tx(port); + ++ UART_PUT_CR(port, ATMEL_US_RSTSTA); ++ UART_PUT_IDR(port, -1); ++ ++ + /* + * Shut-down the DMA. + */ +@@ -1648,12 +1660,6 @@ static void atmel_shutdown(struct uart_p + atmel_port->release_tx(port); + + /* +- * Disable all interrupts, port and break condition. +- */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); +- UART_PUT_IDR(port, -1); +- +- /* + * Free the interrupt + */ + free_irq(port->irq, port); diff --git a/queue-3.12/tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch b/queue-3.12/tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch new file mode 100644 index 00000000000..c971536a812 --- /dev/null +++ b/queue-3.12/tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch @@ -0,0 +1,45 @@ +From bb7e73c598fb226c75f7625088a8f6a45a0fc892 Mon Sep 17 00:00:00 2001 +From: Mark Deneen +Date: Tue, 7 Jan 2014 11:45:09 +0100 +Subject: tty/serial: at91: reset rx_ring when port is shutdown + +From: Mark Deneen + +commit bb7e73c598fb226c75f7625088a8f6a45a0fc892 upstream. + +When using RX DMA, the driver won't pass any data to the uart layer +until the buffer is flipped. When the port is shutdown, the dma buffers +are unmapped, but the head and tail of the ring buffer are not reseted. +Since the serial console will keep the port open, this will only +present itself when the uart is not shared. + +To reproduce the issue, with an unpatched driver, run a getty on /dev/ttyS0 +with no serial console and exit. Getty will exit, and when the new one returns +you will be unable to log in. If you hold down a key long enough to fill the +DMA buffer and flip it, you can then log in. + +Signed-off-by: Mark Deneen +Acked-by: Leilei Zhao +[nicolas.ferre@atmel.com: adapt to mainline kernel, handle !DMA case] +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1660,6 +1660,12 @@ static void atmel_shutdown(struct uart_p + atmel_port->release_tx(port); + + /* ++ * Reset ring buffer pointers ++ */ ++ atmel_port->rx_ring.head = 0; ++ atmel_port->rx_ring.tail = 0; ++ ++ /* + * Free the interrupt + */ + free_irq(port->irq, port); diff --git a/queue-3.12/usb-chipidea-add-freescale-imx28-special-write-register-method.patch b/queue-3.12/usb-chipidea-add-freescale-imx28-special-write-register-method.patch new file mode 100644 index 00000000000..fe584319371 --- /dev/null +++ b/queue-3.12/usb-chipidea-add-freescale-imx28-special-write-register-method.patch @@ -0,0 +1,126 @@ +From ed8f8318d2ef3e5f9e4ddf79349508c116b68d7f Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:27 +0800 +Subject: usb: chipidea: add freescale imx28 special write register method + +From: Peter Chen + +commit ed8f8318d2ef3e5f9e4ddf79349508c116b68d7f upstream. + +According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB +register error issue", All USB register write operations must +use the ARM SWP instruction. So, we implement special hw_write +and hw_test_and_clear for imx28. + +Discussion for it at below: +http://marc.info/?l=linux-usb&m=137996395529294&w=2 + +This patch is needed for stable tree 3.11+. + +Cc: robert.hodaszi@digi.com +Signed-off-by: Peter Chen +Signed-off-by: Marc Kleine-Budde +Tested-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/ci.h | 26 ++++++++++++++++++++++++-- + drivers/usb/chipidea/core.c | 2 ++ + drivers/usb/chipidea/host.c | 1 + + include/linux/usb/chipidea.h | 1 + + 4 files changed, 28 insertions(+), 2 deletions(-) + +--- a/drivers/usb/chipidea/ci.h ++++ b/drivers/usb/chipidea/ci.h +@@ -135,6 +135,7 @@ struct hw_bank { + * @id_event: indicates there is an id event, and handled at ci_otg_work + * @b_sess_valid_event: indicates there is a vbus event, and handled + * at ci_otg_work ++ * @imx28_write_fix: Freescale imx28 needs swp instruction for writing + */ + struct ci_hdrc { + struct device *dev; +@@ -173,6 +174,7 @@ struct ci_hdrc { + struct dentry *debugfs; + bool id_event; + bool b_sess_valid_event; ++ bool imx28_write_fix; + }; + + static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci) +@@ -253,6 +255,26 @@ static inline u32 hw_read(struct ci_hdrc + return ioread32(ci->hw_bank.regmap[reg]) & mask; + } + ++#ifdef CONFIG_SOC_IMX28 ++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr) ++{ ++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr)); ++} ++#else ++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr) ++{ ++} ++#endif ++ ++static inline void __hw_write(struct ci_hdrc *ci, u32 val, ++ void __iomem *addr) ++{ ++ if (ci->imx28_write_fix) ++ imx28_ci_writel(val, addr); ++ else ++ iowrite32(val, addr); ++} ++ + /** + * hw_write: writes to a hw register + * @reg: register index +@@ -266,7 +288,7 @@ static inline void hw_write(struct ci_hd + data = (ioread32(ci->hw_bank.regmap[reg]) & ~mask) + | (data & mask); + +- iowrite32(data, ci->hw_bank.regmap[reg]); ++ __hw_write(ci, data, ci->hw_bank.regmap[reg]); + } + + /** +@@ -281,7 +303,7 @@ static inline u32 hw_test_and_clear(stru + { + u32 val = ioread32(ci->hw_bank.regmap[reg]) & mask; + +- iowrite32(val, ci->hw_bank.regmap[reg]); ++ __hw_write(ci, val, ci->hw_bank.regmap[reg]); + return val; + } + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -497,6 +497,8 @@ static int ci_hdrc_probe(struct platform + ci->transceiver = ci->platdata->phy; + else + ci->global_phy = true; ++ ci->imx28_write_fix = !!(ci->platdata->flags & ++ CI_HDRC_IMX28_WRITE_FIX); + + ret = hw_device_init(ci, base); + if (ret < 0) { +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -65,6 +65,7 @@ static int host_start(struct ci_hdrc *ci + ehci->caps = ci->hw_bank.cap; + ehci->has_hostpc = ci->hw_bank.lpm; + ehci->has_tdi_phy_lpm = ci->hw_bank.lpm; ++ ehci->imx28_write_fix = ci->imx28_write_fix; + + if (ci->platdata->reg_vbus) { + ret = regulator_enable(ci->platdata->reg_vbus); +--- a/include/linux/usb/chipidea.h ++++ b/include/linux/usb/chipidea.h +@@ -24,6 +24,7 @@ struct ci_hdrc_platform_data { + * but otg is not supported (no register otgsc). + */ + #define CI_HDRC_DUAL_ROLE_NOT_OTG BIT(4) ++#define CI_HDRC_IMX28_WRITE_FIX BIT(5) + enum usb_dr_mode dr_mode; + #define CI_HDRC_CONTROLLER_RESET_EVENT 0 + #define CI_HDRC_CONTROLLER_STOPPED_EVENT 1 diff --git a/queue-3.12/usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch b/queue-3.12/usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch new file mode 100644 index 00000000000..0d25708c743 --- /dev/null +++ b/queue-3.12/usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch @@ -0,0 +1,86 @@ +From 1071055e2a118a81c0b300d7f4af7eba3f7a7c82 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:28 +0800 +Subject: usb: chipidea: imx: set CI_HDRC_IMX28_WRITE_FIX for imx28 + +From: Peter Chen + +commit 1071055e2a118a81c0b300d7f4af7eba3f7a7c82 upstream. + +Due to imx28 needs ARM swp instruction for writing, we set +CI_HDRC_IMX28_WRITE_FIX for imx28. + +This patch is needed for stable tree 3.11+ + +Cc: robert.hodaszi@digi.com +Signed-off-by: Peter Chen +Signed-off-by: Marc Kleine-Budde +Tested-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 32 ++++++++++++++++++++++++++------ + 1 file changed, 26 insertions(+), 6 deletions(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -23,6 +23,26 @@ + #include "ci.h" + #include "ci_hdrc_imx.h" + ++#define CI_HDRC_IMX_IMX28_WRITE_FIX BIT(0) ++ ++struct ci_hdrc_imx_platform_flag { ++ unsigned int flags; ++}; ++ ++static const struct ci_hdrc_imx_platform_flag imx27_usb_data = { ++}; ++ ++static const struct ci_hdrc_imx_platform_flag imx28_usb_data = { ++ .flags = CI_HDRC_IMX_IMX28_WRITE_FIX, ++}; ++ ++static const struct of_device_id ci_hdrc_imx_dt_ids[] = { ++ { .compatible = "fsl,imx28-usb", .data = &imx28_usb_data}, ++ { .compatible = "fsl,imx27-usb", .data = &imx27_usb_data}, ++ { /* sentinel */ } ++}; ++MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids); ++ + struct ci_hdrc_imx_data { + struct usb_phy *phy; + struct platform_device *ci_pdev; +@@ -82,6 +102,9 @@ static int ci_hdrc_imx_probe(struct plat + CI_HDRC_DISABLE_STREAMING, + }; + int ret; ++ const struct of_device_id *of_id = ++ of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev); ++ const struct ci_hdrc_imx_platform_flag *imx_platform_flag = of_id->data; + + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { +@@ -121,6 +144,9 @@ static int ci_hdrc_imx_probe(struct plat + + pdata.phy = data->phy; + ++ if (imx_platform_flag->flags & CI_HDRC_IMX_IMX28_WRITE_FIX) ++ pdata.flags |= CI_HDRC_IMX28_WRITE_FIX; ++ + if (!pdev->dev.dma_mask) + pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask; + if (!pdev->dev.coherent_dma_mask) +@@ -187,12 +213,6 @@ static int ci_hdrc_imx_remove(struct pla + return 0; + } + +-static const struct of_device_id ci_hdrc_imx_dt_ids[] = { +- { .compatible = "fsl,imx27-usb", }, +- { /* sentinel */ } +-}; +-MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids); +- + static struct platform_driver ci_hdrc_imx_driver = { + .probe = ci_hdrc_imx_probe, + .remove = ci_hdrc_imx_remove, diff --git a/queue-3.12/usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch b/queue-3.12/usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch new file mode 100644 index 00000000000..22e801eb1af --- /dev/null +++ b/queue-3.12/usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch @@ -0,0 +1,48 @@ +From 5332ff1fb63c46588656e4208201bc131627c878 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:31 +0800 +Subject: usb: chipidea: need to mask INT_STATUS when write otgsc + +From: Peter Chen + +commit 5332ff1fb63c46588656e4208201bc131627c878 upstream. + +For otgsc, both enable bits and status bits are in it. So we need +to make sure the status bits are not be cleared when write enable +bits. It can fix one bug that we plug in/out Micro AB cable fast, +and sometimes, the IDIS will be cleared wrongly when handle last +ID interrupt (ID 0->1), so the current interrupt will not occur. + +For stable tree: 3.12+ + +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/otg.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/chipidea/otg.h ++++ b/drivers/usb/chipidea/otg.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (C) 2013 Freescale Semiconductor, Inc. ++ * Copyright (C) 2013-2014 Freescale Semiconductor, Inc. + * + * Author: Peter Chen + * +@@ -19,12 +19,12 @@ static inline void ci_clear_otg_interrup + + static inline void ci_enable_otg_interrupt(struct ci_hdrc *ci, u32 bits) + { +- hw_write(ci, OP_OTGSC, bits, bits); ++ hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, bits); + } + + static inline void ci_disable_otg_interrupt(struct ci_hdrc *ci, u32 bits) + { +- hw_write(ci, OP_OTGSC, bits, 0); ++ hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, 0); + } + + int ci_hdrc_otg_init(struct ci_hdrc *ci); diff --git a/queue-3.12/usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch b/queue-3.12/usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch new file mode 100644 index 00000000000..65ec0eae47e --- /dev/null +++ b/queue-3.12/usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch @@ -0,0 +1,85 @@ +From 2fc5a7dace3c43e62402ab4e8800a8f1834ffe2a Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:32 +0800 +Subject: usb: chipidea: udc: using MultO at TD as real mult value for ISO-TX + +From: Peter Chen + +commit 2fc5a7dace3c43e62402ab4e8800a8f1834ffe2a upstream. + +We have met a bug that the high bandwidth ISO-TX transfer has failed +at the last packet if it is less than 1024, the TD status shows it +is "Transaction Error". + +The root cause of this problem is: the mult value at qh is not correct +for current TD's transfer length. We use TD list to queue un-transfer +TDs, and change mult for new adding TDs. If new adding TDs transfer length +less than 1024, but the queued un-transfer TDs transfer length is larger +than 1024, the transfer error will occur, and vice versa. +Usually, this problem occurs at the last packet, and the first packet for +new frame. + +We fixed this problem by setting Mult at QH as the largest value (3), and +set MultO (Multiplier Override) at TD according to every transfer length. +It can cover both hardware version less than 2.3 (the real mult is MultO +if it is not 0) and 2.3+ (the real mult is min(qh.mult, td.multo)). + +Since the MultO bits are only existed at TX TD, we keep the ISO-RX behavior +unchanged. + +For stable tree: 3.11+. + +Cc: Michael Grzeschik +Reported-by: Matthieu Vanin +Tested-by: Matthieu Vanin +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -394,6 +394,14 @@ static int add_td_to_list(struct ci_hw_e + node->ptr->token = cpu_to_le32(length << __ffs(TD_TOTAL_BYTES)); + node->ptr->token &= cpu_to_le32(TD_TOTAL_BYTES); + node->ptr->token |= cpu_to_le32(TD_STATUS_ACTIVE); ++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX) { ++ u32 mul = hwreq->req.length / hwep->ep.maxpacket; ++ ++ if (hwreq->req.length == 0 ++ || hwreq->req.length % hwep->ep.maxpacket) ++ mul++; ++ node->ptr->token |= mul << __ffs(TD_MULTO); ++ } + + temp = (u32) (hwreq->req.dma + hwreq->req.actual); + if (length) { +@@ -516,10 +524,11 @@ static int _hardware_enqueue(struct ci_h + hwep->qh.ptr->td.token &= + cpu_to_le32(~(TD_STATUS_HALTED|TD_STATUS_ACTIVE)); + +- if (hwep->type == USB_ENDPOINT_XFER_ISOC) { ++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == RX) { + u32 mul = hwreq->req.length / hwep->ep.maxpacket; + +- if (hwreq->req.length % hwep->ep.maxpacket) ++ if (hwreq->req.length == 0 ++ || hwreq->req.length % hwep->ep.maxpacket) + mul++; + hwep->qh.ptr->cap |= mul << __ffs(QH_MULT); + } +@@ -1172,6 +1181,12 @@ static int ep_enable(struct usb_ep *ep, + if (hwep->num) + cap |= QH_ZLT; + cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT; ++ /* ++ * For ISO-TX, we set mult at QH as the largest value, and use ++ * MultO at TD as real mult value. ++ */ ++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX) ++ cap |= 3 << __ffs(QH_MULT); + + hwep->qh.ptr->cap = cpu_to_le32(cap); + diff --git a/queue-3.12/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch b/queue-3.12/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch new file mode 100644 index 00000000000..80401a757b1 --- /dev/null +++ b/queue-3.12/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch @@ -0,0 +1,33 @@ +From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 2 Jan 2014 22:49:24 +0100 +Subject: USB: cypress_m8: fix ring-indicator detection and reporting + +From: Johan Hovold + +commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream. + +Fix ring-indicator (RI) status-bit definition, which was defined as CTS, +effectively preventing RI-changes from being detected while reporting +false RI status. + +This bug predates git. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -63,7 +63,7 @@ + #define UART_DSR 0x20 /* data set ready - flow control - device to host */ + #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */ + #define UART_CTS 0x10 /* clear to send - flow control - device to host */ +-#define UART_RI 0x10 /* ring indicator - modem - device to host */ ++#define UART_RI 0x80 /* ring indicator - modem - device to host */ + #define UART_CD 0x40 /* carrier detect - modem - device to host */ + #define CYP_ERROR 0x08 /* received from input report - device to host */ + /* Note - the below has nothing to do with the "feature report" reset */ diff --git a/queue-3.12/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch b/queue-3.12/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch new file mode 100644 index 00000000000..6172641dc17 --- /dev/null +++ b/queue-3.12/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch @@ -0,0 +1,45 @@ +From 13518673f1419f2667985a6fca4543e44143408b Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 18 Dec 2013 16:41:25 +0200 +Subject: usb: dwc3: fix the glue drivers using the nop phy + +From: Heikki Krogerus + +commit 13518673f1419f2667985a6fca4543e44143408b upstream. + +The reset_gpio member of the usb_phy_gen_xceiv_platform_data +structure needs the have negative value or phy-generic's +probe will fail unless DT is used. 0 is a valid gpio number. + +This fixes an issue where phy-generic fails to probe with +message: "usb_phy_gen_xceiv.0: Error requesting RESET GPIO 0". + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-exynos.c | 1 + + drivers/usb/dwc3/dwc3-pci.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-exynos.c ++++ b/drivers/usb/dwc3/dwc3-exynos.c +@@ -50,6 +50,7 @@ static int dwc3_exynos_register_phys(str + + exynos->usb2_phy = pdev; + pdata.type = USB_PHY_TYPE_USB2; ++ pdata.gpio_reset = -1; + + ret = platform_device_add_data(exynos->usb2_phy, &pdata, sizeof(pdata)); + if (ret) +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -52,6 +52,7 @@ static int dwc3_pci_register_phys(struct + + glue->usb2_phy = pdev; + pdata.type = USB_PHY_TYPE_USB2; ++ pdata.gpio_reset = -1; + + ret = platform_device_add_data(glue->usb2_phy, &pdata, sizeof(pdata)); + if (ret) diff --git a/queue-3.12/usb-ehci-add-freescale-imx28-special-write-register-method.patch b/queue-3.12/usb-ehci-add-freescale-imx28-special-write-register-method.patch new file mode 100644 index 00000000000..8280b820ddd --- /dev/null +++ b/queue-3.12/usb-ehci-add-freescale-imx28-special-write-register-method.patch @@ -0,0 +1,75 @@ +From feffe09f510c475df082546815f9e4a573f6a233 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:26 +0800 +Subject: usb: ehci: add freescale imx28 special write register method + +From: Peter Chen + +commit feffe09f510c475df082546815f9e4a573f6a233 upstream. + +According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB +register error issue", All USB register write operations must +use the ARM SWP instruction. So, we implement a special ehci_write +for imx28. + +Discussion for it at below: +http://marc.info/?l=linux-usb&m=137996395529294&w=2 + +Without this patcheset, imx28 works unstable at high AHB bus loading. +If the bus loading is not high, the imx28 usb can work well at the most +of time. There is a IC errata for this problem, usually, we consider +IC errata is a problem not a new feature, and this workaround is needed +for that, so we need to add them to stable tree 3.11+. + +Cc: robert.hodaszi@digi.com +Signed-off-by: Peter Chen +Acked-by: Alan Stern +Signed-off-by: Marc Kleine-Budde +Tested-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci.h | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -203,6 +203,7 @@ struct ehci_hcd { /* one per controlle + unsigned has_synopsys_hc_bug:1; /* Synopsys HC */ + unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ + unsigned need_oc_pp_cycle:1; /* MPC834X port power */ ++ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ + + /* required for usb32 quirk */ + #define OHCI_CTRL_HCFS (3 << 6) +@@ -679,6 +680,18 @@ static inline unsigned int ehci_readl(co + #endif + } + ++#ifdef CONFIG_SOC_IMX28 ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr)); ++} ++#else ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++} ++#endif + static inline void ehci_writel(const struct ehci_hcd *ehci, + const unsigned int val, __u32 __iomem *regs) + { +@@ -687,7 +700,10 @@ static inline void ehci_writel(const str + writel_be(val, regs) : + writel(val, regs); + #else +- writel(val, regs); ++ if (ehci->imx28_write_fix) ++ imx28_ehci_writel(val, regs); ++ else ++ writel(val, regs); + #endif + } + diff --git a/queue-3.12/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch b/queue-3.12/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch new file mode 100644 index 00000000000..3ae4d5cfdc5 --- /dev/null +++ b/queue-3.12/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch @@ -0,0 +1,92 @@ +From 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 7 Jan 2014 10:43:02 -0500 +Subject: USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED + +From: Alan Stern + +commit 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 upstream. + +There is a race in the hub driver between hub_disconnect() and +recursively_mark_NOTATTACHED(). This race can be triggered if the +driver is unbound from a device at the same time as the bus's root hub +is removed. When the race occurs, it can cause an oops: + +BUG: unable to handle kernel NULL pointer dereference at 0000015c +IP: [] recursively_mark_NOTATTACHED+0x20/0x60 +Call Trace: + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] usb_set_device_state+0x92/0x120 + [] usb_disconnect+0x2b/0x1a0 + [] usb_remove_hcd+0xb0/0x160 + [] ? _raw_spin_unlock_irqrestore+0x26/0x50 + [] ehci_mid_remove+0x1c/0x30 + [] ehci_mid_stop_host+0x16/0x30 + [] penwell_otg_work+0xd28/0x3520 + [] ? __schedule+0x39b/0x7f0 + [] ? sub_preempt_count+0x3d/0x50 + [] process_one_work+0x11d/0x3d0 + [] ? mutex_unlock+0xd/0x10 + [] ? manage_workers.isra.24+0x1b5/0x270 + [] worker_thread+0xf9/0x320 + [] ? _raw_spin_unlock_irqrestore+0x26/0x50 + [] ? rescuer_thread+0x2b0/0x2b0 + [] kthread+0x94/0xa0 + [] ret_from_kernel_thread+0x1b/0x28 + [] ? kthread_create_on_node+0xc0/0xc0 + +One problem is that recursively_mark_NOTATTACHED() uses the intfdata +value and hub->hdev->maxchild while hub_disconnect() is clearing them. +Another problem is that it uses hub->ports[i] while the port device is +being released. + +To fix this race, we need to hold the device_state_lock while +hub_disconnect() changes the values. (Note that usb_disconnect() +and hub_port_connect_change() already acquire this lock at similar +critical times during a USB device's life cycle.) We also need to +remove the port devices after maxchild has been set to 0, instead of +before. + +Signed-off-by: Alan Stern +Reported-by: "Du, Changbin" +Tested-by: "Du, Changbin" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1610,7 +1610,7 @@ static void hub_disconnect(struct usb_in + { + struct usb_hub *hub = usb_get_intfdata(intf); + struct usb_device *hdev = interface_to_usbdev(intf); +- int i; ++ int port1; + + /* Take the hub off the event list and don't let it be added again */ + spin_lock_irq(&hub_event_lock); +@@ -1625,11 +1625,15 @@ static void hub_disconnect(struct usb_in + hub->error = 0; + hub_quiesce(hub, HUB_DISCONNECT); + +- usb_set_intfdata (intf, NULL); ++ /* Avoid races with recursively_mark_NOTATTACHED() */ ++ spin_lock_irq(&device_state_lock); ++ port1 = hdev->maxchild; ++ hdev->maxchild = 0; ++ usb_set_intfdata(intf, NULL); ++ spin_unlock_irq(&device_state_lock); + +- for (i = 0; i < hdev->maxchild; i++) +- usb_hub_remove_port_device(hub, i + 1); +- hub->hdev->maxchild = 0; ++ for (; port1 > 0; --port1) ++ usb_hub_remove_port_device(hub, port1); + + if (hub->hdev->speed == USB_SPEED_HIGH) + highspeed_hubs--; diff --git a/queue-3.12/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch b/queue-3.12/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch new file mode 100644 index 00000000000..f1a0d997ccb --- /dev/null +++ b/queue-3.12/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch @@ -0,0 +1,67 @@ +From c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 Mon Sep 17 00:00:00 2001 +From: Colin Leitner +Date: Mon, 6 Jan 2014 21:33:54 +0100 +Subject: USB: ftdi_sio: added CS5 quirk for broken smartcard readers + +From: Colin Leitner + +commit c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 upstream. + +Genuine FTDI chips support only CS7/8. A previous fix in commit +8704211f65a2 ("USB: ftdi_sio: fixed handling of unsupported CSIZE +setting") enforced this limitation and reported it back to userspace. + +However, certain types of smartcard readers depend on specific +driver behaviour that requests 0 data bits (not 5) to change into a +different operating mode if CS5 has been set. + +This patch reenables this behaviour for all FTDI devices. + +Tagged to be added to stable, because it affects a lot of users of +embedded systems which rely on these readers to work properly. + +Reported-by: Heinrich Siebmanns +Tested-by: Heinrich Siebmanns +Signed-off-by: Colin Leitner +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2116,10 +2116,20 @@ static void ftdi_set_termios(struct tty_ + } + + /* +- * All FTDI UART chips are limited to CS7/8. We won't pretend to ++ * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to + * support CS5/6 and revert the CSIZE setting instead. ++ * ++ * CS5 however is used to control some smartcard readers which abuse ++ * this limitation to switch modes. Original FTDI chips fall back to ++ * eight data bits. ++ * ++ * TODO: Implement a quirk to only allow this with mentioned ++ * readers. One I know of (Argolis Smartreader V1) ++ * returns "USB smartcard server" as iInterface string. ++ * The vendor didn't bother with a custom VID/PID of ++ * course. + */ +- if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) { ++ if (C_CSIZE(tty) == CS6) { + dev_warn(ddev, "requested CSIZE setting not supported\n"); + + termios->c_cflag &= ~CSIZE; +@@ -2166,6 +2176,9 @@ no_skip: + urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE; + } + switch (cflag & CSIZE) { ++ case CS5: ++ dev_dbg(ddev, "Setting CS5 quirk\n"); ++ break; + case CS7: + urb_value |= 7; + dev_dbg(ddev, "Setting CS7\n"); diff --git a/queue-3.12/usb-nokia-502-is-an-unusual-device.patch b/queue-3.12/usb-nokia-502-is-an-unusual-device.patch new file mode 100644 index 00000000000..89228ea5bd5 --- /dev/null +++ b/queue-3.12/usb-nokia-502-is-an-unusual-device.patch @@ -0,0 +1,42 @@ +From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001 +From: Mikhail Zolotaryov +Date: Sat, 28 Dec 2013 01:56:35 +0200 +Subject: USB: Nokia 502 is an unusual device + +From: Mikhail Zolotaryov + +commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream. + +The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha +Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered +files are corrupted). A similar issue is described here: +http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170 + +The workaround is (MAX_SECTORS_64): + rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m + +The patch adds the tested device to the unusual list permanently. + +Signed-off-by: Mikhail Zolotaryov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -234,6 +234,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Patch submitted by Mikhail Zolotaryov */ ++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, ++ "Nokia", ++ "502", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + #ifdef NO_SDDR09 + UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, + "Microtech", diff --git a/queue-3.12/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch b/queue-3.12/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch new file mode 100644 index 00000000000..07a1f274dfe --- /dev/null +++ b/queue-3.12/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch @@ -0,0 +1,36 @@ +From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= +Date: Wed, 18 Dec 2013 15:37:17 +0800 +Subject: usb: option: add new zte 3g modem pids to option driver + +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= + +commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream. + +Signed-off-by: Jun zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1447,6 +1447,17 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + + /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), diff --git a/queue-3.12/usb-pl2303-fix-data-corruption-on-termios-updates.patch b/queue-3.12/usb-pl2303-fix-data-corruption-on-termios-updates.patch new file mode 100644 index 00000000000..e2fed437982 --- /dev/null +++ b/queue-3.12/usb-pl2303-fix-data-corruption-on-termios-updates.patch @@ -0,0 +1,88 @@ +From 623c8263376c0b8a4b0c220232e7313d762cd0cc Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 29 Dec 2013 19:22:53 +0100 +Subject: USB: pl2303: fix data corruption on termios updates +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 623c8263376c0b8a4b0c220232e7313d762cd0cc upstream. + +Some PL2303 devices are known to lose bytes if you change serial +settings even to the same values as before. Avoid this by comparing the +encoded settings with the previsouly used ones before configuring the +device. + +The common case was fixed by commit bf5e5834bffc6 ("pl2303: Fix mode +switching regression"), but this problem was still possible to trigger, +for instance, by using the TCSETS2-interface to repeatedly request +115201 baud, which gets mapped to 115200 and thus always triggers a +settings update. + +Cc: Frank Schäfer +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 34 +++++++++++++++++++++++++--------- + 1 file changed, 25 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -142,6 +142,8 @@ struct pl2303_private { + spinlock_t lock; + u8 line_control; + u8 line_status; ++ ++ u8 line_settings[7]; + }; + + static int pl2303_vendor_read(__u16 value, __u16 index, +@@ -339,11 +341,6 @@ static void pl2303_set_termios(struct tt + int i; + u8 control; + +- /* +- * The PL2303 is reported to lose bytes if you change serial settings +- * even to the same values as before. Thus we actually need to filter +- * in this specific case. +- */ + if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios)) + return; + +@@ -428,10 +425,29 @@ static void pl2303_set_termios(struct tt + dev_dbg(&port->dev, "parity = none\n"); + } + +- i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, +- 0, 0, buf, 7, 100); +- dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i); ++ /* ++ * Some PL2303 are known to lose bytes if you change serial settings ++ * even to the same values as before. Thus we actually need to filter ++ * in this specific case. ++ * ++ * Note that the tty_termios_hw_change check above is not sufficient ++ * as a previously requested baud rate may differ from the one ++ * actually used (and stored in old_termios). ++ * ++ * NOTE: No additional locking needed for line_settings as it is ++ * only used in set_termios, which is serialised against itself. ++ */ ++ if (!old_termios || memcmp(buf, priv->line_settings, 7)) { ++ i = usb_control_msg(serial->dev, ++ usb_sndctrlpipe(serial->dev, 0), ++ SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, ++ 0, 0, buf, 7, 100); ++ ++ dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i); ++ ++ if (i == 7) ++ memcpy(priv->line_settings, buf, 7); ++ } + + /* change control lines if we are switching to or from B0 */ + spin_lock_irqsave(&priv->lock, flags); diff --git a/queue-3.12/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch b/queue-3.12/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch new file mode 100644 index 00000000000..faf73a53066 --- /dev/null +++ b/queue-3.12/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch @@ -0,0 +1,59 @@ +From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001 +From: Rahul Bedarkar +Date: Thu, 2 Jan 2014 20:57:56 +0530 +Subject: USB: serial: add support for iBall 3.5G connect usb modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rahul Bedarkar + +commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream. + +Add support for iBall 3.5G connect usb modem. + +$lsusb +Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY + +$usb-devices +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=9605 Rev=00.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +S: SerialNumber=1234567890ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage + +Signed-off-by: Rahul Bedarkar +Suggested-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -320,6 +320,9 @@ static void option_instat_callback(struc + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* iBall 3.5G connect wireless modem */ ++#define IBALL_3_5G_CONNECT 0x9605 ++ + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + +@@ -1500,6 +1503,7 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, diff --git a/queue-3.12/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch b/queue-3.12/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch new file mode 100644 index 00000000000..7945444e03e --- /dev/null +++ b/queue-3.12/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch @@ -0,0 +1,37 @@ +From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Fri, 15 Nov 2013 14:53:14 -0800 +Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix() + +From: Jack Pham + +commit 9005355af23856c55a5538c9024355785424821b upstream. + +If CONFIG_PCI is enabled, make sure xhci_cleanup_msix() +doesn't try to free a bogus PCI IRQ or dereference an invalid +pci_dev when the xHCI device is actually a platform_device. + +This patch should be backported to kernels as old as 3.9, that +contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25 +"xhci-plat: Don't enable legacy PCI interrupts." + +Signed-off-by: Jack Pham +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -321,6 +321,9 @@ static void xhci_cleanup_msix(struct xhc + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); + ++ if (xhci->quirks & XHCI_PLAT) ++ return; ++ + xhci_free_irq(xhci); + + if (xhci->msix_entries) { diff --git a/queue-3.12/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch b/queue-3.12/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch new file mode 100644 index 00000000000..352fdb34333 --- /dev/null +++ b/queue-3.12/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch @@ -0,0 +1,211 @@ +From da6139e49c7cb0f4251265cb5243b8d220adb48d Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Mon, 13 Jan 2014 06:51:01 -0500 +Subject: x86: Add check for number of available vectors before CPU down + +From: Prarit Bhargava + +commit da6139e49c7cb0f4251265cb5243b8d220adb48d upstream. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64791 + +When a cpu is downed on a system, the irqs on the cpu are assigned to +other cpus. It is possible, however, that when a cpu is downed there +aren't enough free vectors on the remaining cpus to account for the +vectors from the cpu that is being downed. + +This results in an interesting "overflow" condition where irqs are +"assigned" to a CPU but are not handled. + +For example, when downing cpus on a 1-64 logical processor system: + + +[ 232.021745] smpboot: CPU 61 is now offline +[ 238.480275] smpboot: CPU 62 is now offline +[ 245.991080] ------------[ cut here ]------------ +[ 245.996270] WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:264 dev_watchdog+0x246/0x250() +[ 246.005688] NETDEV WATCHDOG: p786p1 (ixgbe): transmit queue 0 timed out +[ 246.013070] Modules linked in: lockd sunrpc iTCO_wdt iTCO_vendor_support sb_edac ixgbe microcode e1000e pcspkr joydev edac_core lpc_ich ioatdma ptp mdio mfd_core i2c_i801 dca pps_core i2c_core wmi acpi_cpufreq isci libsas scsi_transport_sas +[ 246.037633] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0+ #14 +[ 246.044451] Hardware name: Intel Corporation S4600LH ........../SVRBD-ROW_T, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013 +[ 246.057371] 0000000000000009 ffff88081fa03d40 ffffffff8164fbf6 ffff88081fa0ee48 +[ 246.065728] ffff88081fa03d90 ffff88081fa03d80 ffffffff81054ecc ffff88081fa13040 +[ 246.074073] 0000000000000000 ffff88200cce0000 0000000000000040 0000000000000000 +[ 246.082430] Call Trace: +[ 246.085174] [] dump_stack+0x46/0x58 +[ 246.091633] [] warn_slowpath_common+0x8c/0xc0 +[ 246.098352] [] warn_slowpath_fmt+0x46/0x50 +[ 246.104786] [] dev_watchdog+0x246/0x250 +[ 246.110923] [] ? dev_deactivate_queue.constprop.31+0x80/0x80 +[ 246.119097] [] call_timer_fn+0x3a/0x110 +[ 246.125224] [] ? update_process_times+0x6f/0x80 +[ 246.132137] [] ? dev_deactivate_queue.constprop.31+0x80/0x80 +[ 246.140308] [] run_timer_softirq+0x1f0/0x2a0 +[ 246.146933] [] __do_softirq+0xe0/0x220 +[ 246.152976] [] call_softirq+0x1c/0x30 +[ 246.158920] [] do_softirq+0x55/0x90 +[ 246.164670] [] irq_exit+0xa5/0xb0 +[ 246.170227] [] smp_apic_timer_interrupt+0x4a/0x60 +[ 246.177324] [] apic_timer_interrupt+0x6a/0x70 +[ 246.184041] [] ? cpuidle_enter_state+0x5b/0xe0 +[ 246.191559] [] ? cpuidle_enter_state+0x57/0xe0 +[ 246.198374] [] cpuidle_idle_call+0xbd/0x200 +[ 246.204900] [] arch_cpu_idle+0xe/0x30 +[ 246.210846] [] cpu_startup_entry+0xd0/0x250 +[ 246.217371] [] rest_init+0x77/0x80 +[ 246.223028] [] start_kernel+0x3ee/0x3fb +[ 246.229165] [] ? repair_env_string+0x5e/0x5e +[ 246.235787] [] x86_64_start_reservations+0x2a/0x2c +[ 246.242990] [] x86_64_start_kernel+0xf8/0xfc +[ 246.249610] ---[ end trace fb74fdef54d79039 ]--- +[ 246.254807] ixgbe 0000:c2:00.0 p786p1: initiating reset due to tx timeout +[ 246.262489] ixgbe 0000:c2:00.0 p786p1: Reset adapter +Last login: Mon Nov 11 08:35:14 from 10.18.17.119 +[root@(none) ~]# [ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5 +[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX +[ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5 +[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX + +(last lines keep repeating. ixgbe driver is dead until module reload.) + +If the downed cpu has more vectors than are free on the remaining cpus on the +system, it is possible that some vectors are "orphaned" even though they are +assigned to a cpu. In this case, since the ixgbe driver had a watchdog, the +watchdog fired and notified that something was wrong. + +This patch adds a function, check_vectors(), to compare the number of vectors +on the CPU going down and compares it to the number of vectors available on +the system. If there aren't enough vectors for the CPU to go down, an +error is returned and propogated back to userspace. + +v2: Do not need to look at percpu irqs +v3: Need to check affinity to prevent counting of MSIs in IOAPIC Lowest + Priority Mode +v4: Additional changes suggested by Gong Chen. +v5/v6/v7/v8: Updated comment text + +Signed-off-by: Prarit Bhargava +Link: http://lkml.kernel.org/r/1389613861-3853-1-git-send-email-prarit@redhat.com +Reviewed-by: Gong Chen +Cc: Andi Kleen +Cc: Michel Lespinasse +Cc: Seiji Aguchi +Cc: Yang Zhang +Cc: Paul Gortmaker +Cc: Janet Morgan +Cc: Tony Luck +Cc: Ruiv Wang +Cc: Gong Chen +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/irq.h | 1 + arch/x86/kernel/irq.c | 70 +++++++++++++++++++++++++++++++++++++++++++++ + arch/x86/kernel/smpboot.c | 6 +++ + 3 files changed, 77 insertions(+) + +--- a/arch/x86/include/asm/irq.h ++++ b/arch/x86/include/asm/irq.h +@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu); + + #ifdef CONFIG_HOTPLUG_CPU + #include ++extern int check_irq_vectors_for_cpu_disable(void); + extern void fixup_irqs(void); + extern void irq_force_complete_move(int); + #endif +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -262,6 +262,76 @@ __visible void smp_trace_x86_platform_ip + EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq); + + #ifdef CONFIG_HOTPLUG_CPU ++/* ++ * This cpu is going to be removed and its vectors migrated to the remaining ++ * online cpus. Check to see if there are enough vectors in the remaining cpus. ++ * This function is protected by stop_machine(). ++ */ ++int check_irq_vectors_for_cpu_disable(void) ++{ ++ int irq, cpu; ++ unsigned int this_cpu, vector, this_count, count; ++ struct irq_desc *desc; ++ struct irq_data *data; ++ struct cpumask affinity_new, online_new; ++ ++ this_cpu = smp_processor_id(); ++ cpumask_copy(&online_new, cpu_online_mask); ++ cpu_clear(this_cpu, online_new); ++ ++ this_count = 0; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) { ++ irq = __this_cpu_read(vector_irq[vector]); ++ if (irq >= 0) { ++ desc = irq_to_desc(irq); ++ data = irq_desc_get_irq_data(desc); ++ cpumask_copy(&affinity_new, data->affinity); ++ cpu_clear(this_cpu, affinity_new); ++ ++ /* Do not count inactive or per-cpu irqs. */ ++ if (!irq_has_action(irq) || irqd_is_per_cpu(data)) ++ continue; ++ ++ /* ++ * A single irq may be mapped to multiple ++ * cpu's vector_irq[] (for example IOAPIC cluster ++ * mode). In this case we have two ++ * possibilities: ++ * ++ * 1) the resulting affinity mask is empty; that is ++ * this the down'd cpu is the last cpu in the irq's ++ * affinity mask, or ++ * ++ * 2) the resulting affinity mask is no longer ++ * a subset of the online cpus but the affinity ++ * mask is not zero; that is the down'd cpu is the ++ * last online cpu in a user set affinity mask. ++ */ ++ if (cpumask_empty(&affinity_new) || ++ !cpumask_subset(&affinity_new, &online_new)) ++ this_count++; ++ } ++ } ++ ++ count = 0; ++ for_each_online_cpu(cpu) { ++ if (cpu == this_cpu) ++ continue; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; ++ vector++) { ++ if (per_cpu(vector_irq, cpu)[vector] < 0) ++ count++; ++ } ++ } ++ ++ if (count < this_count) { ++ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n", ++ this_cpu, this_count, count); ++ return -ERANGE; ++ } ++ return 0; ++} ++ + /* A cpu has been removed from cpu_online_mask. Reset irq affinities. */ + void fixup_irqs(void) + { +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1310,6 +1310,12 @@ void cpu_disable_common(void) + + int native_cpu_disable(void) + { ++ int ret; ++ ++ ret = check_irq_vectors_for_cpu_disable(); ++ if (ret) ++ return ret; ++ + clear_local_APIC(); + + cpu_disable_common(); diff --git a/queue-3.12/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch b/queue-3.12/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch new file mode 100644 index 00000000000..6ee8861860e --- /dev/null +++ b/queue-3.12/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch @@ -0,0 +1,38 @@ +From a7f84f03f660d93574ac88835d056c0d6468aebe Mon Sep 17 00:00:00 2001 +From: Dave Young +Date: Fri, 20 Dec 2013 18:02:15 +0800 +Subject: x86/efi: Fix off-by-one bug in EFI Boot Services reservation + +From: Dave Young + +commit a7f84f03f660d93574ac88835d056c0d6468aebe upstream. + +Current code check boot service region with kernel text region by: +start+size >= __pa_symbol(_text) +The end of the above region should be start + size - 1 instead. + +I see this problem in ovmf + Fedora 19 grub boot: +text start: 1000000 md start: 800000 md size: 800000 + +Signed-off-by: Dave Young +Acked-by: Borislav Petkov +Acked-by: Toshi Kani +Tested-by: Toshi Kani +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/platform/efi/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -440,7 +440,7 @@ void __init efi_reserve_boot_services(vo + * - Not within any part of the kernel + * - Not the bios reserved area + */ +- if ((start+size >= __pa_symbol(_text) ++ if ((start + size > __pa_symbol(_text) + && start <= __pa_symbol(_end)) || + !e820_all_mapped(start, start+size, E820_RAM) || + memblock_is_region_reserved(start, size)) { diff --git a/queue-3.12/x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch b/queue-3.12/x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch new file mode 100644 index 00000000000..6a7632979dd --- /dev/null +++ b/queue-3.12/x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch @@ -0,0 +1,103 @@ +From 1c300a40772dae829b91dad634999a6a522c0829 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Mon, 27 Jan 2014 14:49:40 +0100 +Subject: x86, kvm: cache the base of the KVM cpuid leaves + +From: Paolo Bonzini + +commit 1c300a40772dae829b91dad634999a6a522c0829 upstream. + +It is unnecessary to go through hypervisor_cpuid_base every time +a leaf is found (which will be every time a feature is requested +after the next patch). + +Fixes: 1085ba7f552d84aa8ac0ae903fa8d0cc2ff9f79d +Cc: mtosatti@redhat.com +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/kvm_para.h | 22 ++++++---------------- + arch/x86/kernel/kvm.c | 27 +++++++++++++++++++++++++++ + 2 files changed, 33 insertions(+), 16 deletions(-) + +--- a/arch/x86/include/asm/kvm_para.h ++++ b/arch/x86/include/asm/kvm_para.h +@@ -85,28 +85,13 @@ static inline long kvm_hypercall4(unsign + return ret; + } + +-static inline uint32_t kvm_cpuid_base(void) +-{ +- if (boot_cpu_data.cpuid_level < 0) +- return 0; /* So we don't blow up on old processors */ +- +- if (cpu_has_hypervisor) +- return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0); +- +- return 0; +-} +- +-static inline bool kvm_para_available(void) +-{ +- return kvm_cpuid_base() != 0; +-} +- + static inline unsigned int kvm_arch_para_features(void) + { + return cpuid_eax(KVM_CPUID_FEATURES); + } + + #ifdef CONFIG_KVM_GUEST ++bool kvm_para_available(void); + void __init kvm_guest_init(void); + void kvm_async_pf_task_wait(u32 token); + void kvm_async_pf_task_wake(u32 token); +@@ -126,6 +111,11 @@ static inline void kvm_spinlock_init(voi + #define kvm_async_pf_task_wait(T) do {} while(0) + #define kvm_async_pf_task_wake(T) do {} while(0) + ++static inline bool kvm_para_available(void) ++{ ++ return 0; ++} ++ + static inline u32 kvm_read_and_reset_pf_reason(void) + { + return 0; +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -500,6 +500,33 @@ void __init kvm_guest_init(void) + #endif + } + ++static noinline uint32_t __kvm_cpuid_base(void) ++{ ++ if (boot_cpu_data.cpuid_level < 0) ++ return 0; /* So we don't blow up on old processors */ ++ ++ if (cpu_has_hypervisor) ++ return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0); ++ ++ return 0; ++} ++ ++static inline uint32_t kvm_cpuid_base(void) ++{ ++ static int kvm_cpuid_base = -1; ++ ++ if (kvm_cpuid_base == -1) ++ kvm_cpuid_base = __kvm_cpuid_base(); ++ ++ return kvm_cpuid_base; ++} ++ ++bool kvm_para_available(void) ++{ ++ return kvm_cpuid_base() != 0; ++} ++EXPORT_SYMBOL_GPL(kvm_para_available); ++ + static uint32_t __init kvm_detect(void) + { + return kvm_cpuid_base(); diff --git a/queue-3.12/x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch b/queue-3.12/x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch new file mode 100644 index 00000000000..cc9ecf7248d --- /dev/null +++ b/queue-3.12/x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch @@ -0,0 +1,71 @@ +From 77f01bdfa5e55dc19d3eb747181d2730a9bb3ca8 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Mon, 27 Jan 2014 14:51:44 +0100 +Subject: x86, kvm: correctly access the KVM_CPUID_FEATURES leaf at 0x40000101 + +From: Paolo Bonzini + +commit 77f01bdfa5e55dc19d3eb747181d2730a9bb3ca8 upstream. + +When Hyper-V hypervisor leaves are present, KVM must relocate +its own leaves at 0x40000100, because Windows does not look for +Hyper-V leaves at indices other than 0x40000000. In this case, +the KVM features are at 0x40000101, but the old code would always +look at 0x40000001. + +Fix by using kvm_cpuid_base(). This also requires making the +function non-inline, since kvm_cpuid_base() is static. + +Fixes: 1085ba7f552d84aa8ac0ae903fa8d0cc2ff9f79d +Cc: mtosatti@redhat.com +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/kvm_para.h | 11 ++++++----- + arch/x86/kernel/kvm.c | 5 +++++ + 2 files changed, 11 insertions(+), 5 deletions(-) + +--- a/arch/x86/include/asm/kvm_para.h ++++ b/arch/x86/include/asm/kvm_para.h +@@ -85,13 +85,9 @@ static inline long kvm_hypercall4(unsign + return ret; + } + +-static inline unsigned int kvm_arch_para_features(void) +-{ +- return cpuid_eax(KVM_CPUID_FEATURES); +-} +- + #ifdef CONFIG_KVM_GUEST + bool kvm_para_available(void); ++unsigned int kvm_arch_para_features(void); + void __init kvm_guest_init(void); + void kvm_async_pf_task_wait(u32 token); + void kvm_async_pf_task_wake(u32 token); +@@ -115,6 +111,11 @@ static inline bool kvm_para_available(vo + { + return 0; + } ++ ++static inline unsigned int kvm_arch_para_features(void) ++{ ++ return 0; ++} + + static inline u32 kvm_read_and_reset_pf_reason(void) + { +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -527,6 +527,11 @@ bool kvm_para_available(void) + } + EXPORT_SYMBOL_GPL(kvm_para_available); + ++unsigned int kvm_arch_para_features(void) ++{ ++ return cpuid_eax(kvm_cpuid_base() | KVM_CPUID_FEATURES); ++} ++ + static uint32_t __init kvm_detect(void) + { + return kvm_cpuid_base(); diff --git a/queue-3.12/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch b/queue-3.12/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch new file mode 100644 index 00000000000..0ec89719fb7 --- /dev/null +++ b/queue-3.12/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch @@ -0,0 +1,80 @@ +From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001 +From: PaX Team +Date: Thu, 30 Jan 2014 16:59:25 -0800 +Subject: x86, x32: Correct invalid use of user timespec in the kernel + +From: PaX Team + +commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream. + +The x32 case for the recvmsg() timout handling is broken: + + asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg, + unsigned int vlen, unsigned int flags, + struct compat_timespec __user *timeout) + { + int datagrams; + struct timespec ktspec; + + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + + if (COMPAT_USE_64BIT_TIME) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, + (struct timespec *) timeout); + ... + +The timeout pointer parameter is provided by userland (hence the __user +annotation) but for x32 syscalls it's simply cast to a kernel pointer +and is passed to __sys_recvmmsg which will eventually directly +dereference it for both reading and writing. Other callers to +__sys_recvmmsg properly copy from userland to the kernel first. + +The bug was introduced by commit ee4fa23c4bfc ("compat: Use +COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels +since 3.4 (and perhaps vendor kernels if they backported x32 support +along with this code). + +Note that CONFIG_X86_X32_ABI gets enabled at build time and only if +CONFIG_X86_X32 is enabled and ld can build x32 executables. + +Other uses of COMPAT_USE_64BIT_TIME seem fine. + +This addresses CVE-2014-0038. + +Signed-off-by: PaX Team +Signed-off-by: H. Peter Anvin +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/compat.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/net/compat.c ++++ b/net/compat.c +@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + +- if (COMPAT_USE_64BIT_TIME) +- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, +- flags | MSG_CMSG_COMPAT, +- (struct timespec *) timeout); +- + if (timeout == NULL) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, NULL); + +- if (get_compat_timespec(&ktspec, timeout)) ++ if (compat_get_timespec(&ktspec, timeout)) + return -EFAULT; + + datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, &ktspec); +- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout)) ++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout)) + datagrams = -EFAULT; + + return datagrams; diff --git a/queue-3.12/xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch b/queue-3.12/xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch new file mode 100644 index 00000000000..4a457db4c9c --- /dev/null +++ b/queue-3.12/xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch @@ -0,0 +1,39 @@ +From d6c9ea9069af684358efedcaf2f2f687f51c58ee Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 6 Jan 2014 03:16:32 +0000 +Subject: xhci: Avoid infinite loop when sg urb requires too many trbs + +From: Ben Hutchings + +commit d6c9ea9069af684358efedcaf2f2f687f51c58ee upstream. + +Currently prepare_ring() returns -ENOMEM if the urb won't fit into a +single ring segment. usb_sg_wait() treats this error as a temporary +condition and will keep retrying until something else goes wrong. + +The number of retries should be limited in usb_sg_wait(), but also +prepare_ring() should not return an error code that suggests it might +be worth retrying. Change it to -EINVAL. + +Reported-by: jidanni@jidanni.org +References: http://bugs.debian.org/733907 +Fixes: 35773dac5f86 ('usb: xhci: Link TRB must not occur within a USB payload burst') +Signed-off-by: Ben Hutchings +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2964,7 +2964,7 @@ static int prepare_ring(struct xhci_hcd + if (num_trbs >= TRBS_PER_SEGMENT) { + xhci_err(xhci, "Too many fragments %d, max %d\n", + num_trbs, TRBS_PER_SEGMENT - 1); +- return -ENOMEM; ++ return -EINVAL; + } + + nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) | diff --git a/queue-3.12/xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch b/queue-3.12/xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch new file mode 100644 index 00000000000..00fb506517a --- /dev/null +++ b/queue-3.12/xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch @@ -0,0 +1,69 @@ +From f2d9b991c549f159dc9ae81f77d8206c790cbfee Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Mon, 6 Jan 2014 13:07:03 -0800 +Subject: xhci: Set scatter-gather limit to avoid failed block writes. + +From: Sarah Sharp + +commit f2d9b991c549f159dc9ae81f77d8206c790cbfee upstream. + +Commit 35773dac5f862cb1c82ea151eba3e2f6de51ec3e "usb: xhci: Link TRB +must not occur within a USB payload burst" attempted to fix an issue +found with USB ethernet adapters, and inadvertently broke USB storage +devices. The patch attempts to ensure that transfers never span a +segment, and rejects transfers that have more than 63 entries (or +possibly less, if some entries cross 64KB boundaries). + +usb-storage limits the maximum transfer size to 120K, and we had assumed +the block layer would pass a scatter-gather list of 4K entries, +resulting in no more than 31 sglist entries: + +http://marc.info/?l=linux-usb&m=138498190419312&w=2 + +That assumption was wrong, since we've seen the driver reject a write +that was 218 sectors long (of probably 512 bytes each): + +Jan 1 07:04:49 jidanni5 kernel: [ 559.624704] xhci_hcd 0000:00:14.0: Too many fragments 79, max 63 +... +Jan 1 07:04:58 jidanni5 kernel: [ 568.622583] Write(10): 2a 00 00 06 85 0e 00 00 da 00 + +Limit the number of scatter-gather entries to half a ring segment. That +should be margin enough in case some entries cross 64KB boundaries. +Increase the number of TRBs per segment from 64 to 256, which should +result in ring segments fitting on a 4K page. + +Signed-off-by: Sarah Sharp +Reported-by: jidanni@jidanni.org +References: http://bugs.debian.org/733907 +Fixes: 35773dac5f86 ('usb: xhci: Link TRB must not occur within a USB payload burst') +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 4 ++-- + drivers/usb/host/xhci.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4727,8 +4727,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, + struct device *dev = hcd->self.controller; + int retval; + +- /* Accept arbitrarily long scatter-gather lists */ +- hcd->self.sg_tablesize = ~0; ++ /* Limit the block layer scatter-gather lists to half a segment. */ ++ hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2; + + /* support to build packet from discontinuous buffers */ + hcd->self.no_sg_constraint = 1; +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1262,7 +1262,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16)