From: Greg Kroah-Hartman Date: Wed, 17 Aug 2016 12:54:01 +0000 (+0200) Subject: 4.7-stable patches X-Git-Tag: v3.14.77~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4c8f41ab2a6bf166f6cac88b3ce63bf28a45338;p=thirdparty%2Fkernel%2Fstable-queue.git 4.7-stable patches added patches: arm64-debug-unmask-pstate.d-earlier.patch arm64-fix-incorrect-per-cpu-usage-for-boot-cpu.patch arm64-honor-nosmp-kernel-command-line-option.patch arm64-kvm-vhe-context-switch-mdscr_el1.patch arm64-only-select-arm64_module_plts-if-modules-y.patch usb-dwc3-fix-for-the-isoc-transfer-ep_busy-flag.patch usb-dwc3-gadget-only-resume-usb2-phy-in-highspeed.patch usb-gadget-pch_udc-reorder-spin_lock-to-avoid-deadlock.patch usb-gadget-udc-atmel-also-get-regmap-for-at91sam9x5-pmc.patch usb-quirks-add-no-lpm-quirk-for-elan.patch usb-renesas_usbhs-fix-null-pointer-dereference-in-xfer_work.patch usb-renesas_usbhs-protect-the-cfifosel-setting-in-usbhsg_ep_enable.patch usb-serial-option-add-support-for-telit-le910-pid-0x1206.patch --- diff --git a/queue-4.7/arm64-debug-unmask-pstate.d-earlier.patch b/queue-4.7/arm64-debug-unmask-pstate.d-earlier.patch new file mode 100644 index 00000000000..f9b1e5fe4a3 --- /dev/null +++ b/queue-4.7/arm64-debug-unmask-pstate.d-earlier.patch @@ -0,0 +1,89 @@ +From 2ce39ad15182604beb6c8fa8bed5e46b59fd1082 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 19 Jul 2016 15:07:37 +0100 +Subject: arm64: debug: unmask PSTATE.D earlier + +From: Will Deacon + +commit 2ce39ad15182604beb6c8fa8bed5e46b59fd1082 upstream. + +Clearing PSTATE.D is one of the requirements for generating a debug +exception. The arm64 booting protocol requires that PSTATE.D is set, +since many of the debug registers (for example, the hw_breakpoint +registers) are UNKNOWN out of reset and could potentially generate +spurious, fatal debug exceptions in early boot code if PSTATE.D was +clear. Once the debug registers have been safely initialised, PSTATE.D +is cleared, however this is currently broken for two reasons: + +(1) The boot CPU clears PSTATE.D in a postcore_initcall and secondary + CPUs clear PSTATE.D in secondary_start_kernel. Since the initcall + runs after SMP (and the scheduler) have been initialised, there is + no guarantee that it is actually running on the boot CPU. In this + case, the boot CPU is left with PSTATE.D set and is not capable of + generating debug exceptions. + +(2) In a preemptible kernel, we may explicitly schedule on the IRQ + return path to EL1. If an IRQ occurs with PSTATE.D set in the idle + thread, then we may schedule the kthread_init thread, run the + postcore_initcall to clear PSTATE.D and then context switch back + to the idle thread before returning from the IRQ. The exception + return path will then restore PSTATE.D from the stack, and set it + again. + +This patch fixes the problem by moving the clearing of PSTATE.D earlier +to proc.S. This has the desirable effect of clearing it in one place for +all CPUs, long before we have to worry about the scheduler or any +exception handling. We ensure that the previous reset of MDSCR_EL1 has +completed before unmasking the exception, so that any spurious +exceptions resulting from UNKNOWN debug registers are not generated. + +Without this patch applied, the kprobes selftests have been seen to fail +under KVM, where we end up attempting to step the OOL instruction buffer +with PSTATE.D set and therefore fail to complete the step. + +Acked-by: Mark Rutland +Reported-by: Catalin Marinas +Tested-by: Marc Zyngier +Signed-off-by: Will Deacon +Reviewed-by: Catalin Marinas +Tested-by: Catalin Marinas +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/debug-monitors.c | 1 - + arch/arm64/kernel/smp.c | 1 - + arch/arm64/mm/proc.S | 2 ++ + 3 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -151,7 +151,6 @@ static int debug_monitors_init(void) + /* Clear the OS lock. */ + on_each_cpu(clear_os_lock, NULL, 1); + isb(); +- local_dbg_enable(); + + /* Register hotplug handler. */ + __register_cpu_notifier(&os_lock_nb); +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -267,7 +267,6 @@ asmlinkage void secondary_start_kernel(v + set_cpu_online(cpu, true); + complete(&cpu_running); + +- local_dbg_enable(); + local_irq_enable(); + local_async_enable(); + +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -180,6 +180,8 @@ ENTRY(__cpu_setup) + msr cpacr_el1, x0 // Enable FP/ASIMD + mov x0, #1 << 12 // Reset mdscr_el1 and disable + msr mdscr_el1, x0 // access to the DCC from EL0 ++ isb // Unmask debug exceptions now, ++ enable_dbg // since this is per-cpu + reset_pmuserenr_el0 x0 // Disable PMU access from EL0 + /* + * Memory region attributes for LPAE: diff --git a/queue-4.7/arm64-fix-incorrect-per-cpu-usage-for-boot-cpu.patch b/queue-4.7/arm64-fix-incorrect-per-cpu-usage-for-boot-cpu.patch new file mode 100644 index 00000000000..1f747cc2f12 --- /dev/null +++ b/queue-4.7/arm64-fix-incorrect-per-cpu-usage-for-boot-cpu.patch @@ -0,0 +1,43 @@ +From 9113c2aa05e9848cd4f1154abee17d4f265f012d Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Thu, 21 Jul 2016 11:12:55 +0100 +Subject: arm64: Fix incorrect per-cpu usage for boot CPU + +From: Suzuki K Poulose + +commit 9113c2aa05e9848cd4f1154abee17d4f265f012d upstream. + +In smp_prepare_boot_cpu(), we invoke cpuinfo_store_boot_cpu to store +the cpuinfo in a per-cpu ptr, before initialising the per-cpu offset for +the boot CPU. This patch reorders the sequence to make sure we initialise +the per-cpu offset before accessing the per-cpu area. + +Commit 4b998ff1885eec ("arm64: Delay cpuinfo_store_boot_cpu") fixed the +issue where we modified the per-cpu area even before the kernel initialises +the per-cpu areas, but failed to wait until the boot cpu updated it's +offset. + +Fixes: 4b998ff1885e ("arm64: Delay cpuinfo_store_boot_cpu") +Cc: Will Deacon +Signed-off-by: Suzuki K Poulose +Acked-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -436,9 +436,9 @@ void __init smp_cpus_done(unsigned int m + + void __init smp_prepare_boot_cpu(void) + { ++ set_my_cpu_offset(per_cpu_offset(smp_processor_id())); + cpuinfo_store_boot_cpu(); + save_boot_cpu_run_el(); +- set_my_cpu_offset(per_cpu_offset(smp_processor_id())); + } + + static u64 __init of_get_cpu_mpidr(struct device_node *dn) diff --git a/queue-4.7/arm64-honor-nosmp-kernel-command-line-option.patch b/queue-4.7/arm64-honor-nosmp-kernel-command-line-option.patch new file mode 100644 index 00000000000..4255a69917c --- /dev/null +++ b/queue-4.7/arm64-honor-nosmp-kernel-command-line-option.patch @@ -0,0 +1,47 @@ +From e75118a7b581b19b08282c7819c1ec6f68b91b79 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Thu, 21 Jul 2016 11:15:27 +0100 +Subject: arm64: Honor nosmp kernel command line option + +From: Suzuki K Poulose + +commit e75118a7b581b19b08282c7819c1ec6f68b91b79 upstream. + +Passing "nosmp" should boot the kernel with a single processor, without +provision to enable secondary CPUs even if they are present. "nosmp" is +implemented by setting maxcpus=0. At the moment we still mark the secondary +CPUs present even with nosmp, which allows the userspace to bring them +up. This patch corrects the smp_prepare_cpus() to honor the maxcpus == 0. + +Commit 44dbcc93ab67145 ("arm64: Fix behavior of maxcpus=N") fixed the +behavior for maxcpus >= 1, but broke maxcpus = 0. + +Fixes: 44dbcc93ab67 ("arm64: Fix behavior of maxcpus=N") +Cc: Will Deacon +Cc: James Morse +Signed-off-by: Suzuki K Poulose +Acked-by: Mark Rutland +[catalin.marinas@arm.com: updated code comment] +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/smp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -693,6 +693,13 @@ void __init smp_prepare_cpus(unsigned in + smp_store_cpu_info(smp_processor_id()); + + /* ++ * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set ++ * secondary CPUs present. ++ */ ++ if (max_cpus == 0) ++ return; ++ ++ /* + * Initialise the present map (which describes the set of CPUs + * actually populated at the present time) and release the + * secondaries from the bootloader. diff --git a/queue-4.7/arm64-kvm-vhe-context-switch-mdscr_el1.patch b/queue-4.7/arm64-kvm-vhe-context-switch-mdscr_el1.patch new file mode 100644 index 00000000000..63a69683575 --- /dev/null +++ b/queue-4.7/arm64-kvm-vhe-context-switch-mdscr_el1.patch @@ -0,0 +1,75 @@ +From 4c47eb1c18c38b755eb4894a6ca38f834de3ec23 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Tue, 19 Jul 2016 13:56:54 +0100 +Subject: arm64: KVM: VHE: Context switch MDSCR_EL1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marc Zyngier + +commit 4c47eb1c18c38b755eb4894a6ca38f834de3ec23 upstream. + +The kprobe enablement work has uncovered that changes made by +a guest to MDSCR_EL1 were propagated to the host when VHE was +enabled, leading to unexpected exception being delivered. + +Moving this register to the list of registers that are always +context-switched fixes the issue. + +Fixes: 9c6c35683286 ("arm64: KVM: VHE: Split save/restore of registers shared between guest and host") +Reported-by: Tirumalesh Chalamarla +Tested-by: Tirumalesh Chalamarla +Signed-off-by: Marc Zyngier +Signed-off-by: Radim Krčmář +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kvm/hyp/sysreg-sr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm64/kvm/hyp/sysreg-sr.c ++++ b/arch/arm64/kvm/hyp/sysreg-sr.c +@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothi + /* + * Non-VHE: Both host and guest must save everything. + * +- * VHE: Host must save tpidr*_el[01], actlr_el1, sp0, pc, pstate, and +- * guest must save everything. ++ * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc, ++ * pstate, and guest must save everything. + */ + + static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt) +@@ -37,6 +37,7 @@ static void __hyp_text __sysreg_save_com + ctxt->sys_regs[TPIDR_EL0] = read_sysreg(tpidr_el0); + ctxt->sys_regs[TPIDRRO_EL0] = read_sysreg(tpidrro_el0); + ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1); ++ ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1); + ctxt->gp_regs.regs.sp = read_sysreg(sp_el0); + ctxt->gp_regs.regs.pc = read_sysreg_el2(elr); + ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr); +@@ -61,7 +62,6 @@ static void __hyp_text __sysreg_save_sta + ctxt->sys_regs[AMAIR_EL1] = read_sysreg_el1(amair); + ctxt->sys_regs[CNTKCTL_EL1] = read_sysreg_el1(cntkctl); + ctxt->sys_regs[PAR_EL1] = read_sysreg(par_el1); +- ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1); + + ctxt->gp_regs.sp_el1 = read_sysreg(sp_el1); + ctxt->gp_regs.elr_el1 = read_sysreg_el1(elr); +@@ -90,6 +90,7 @@ static void __hyp_text __sysreg_restore_ + write_sysreg(ctxt->sys_regs[TPIDR_EL0], tpidr_el0); + write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0); + write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1); ++ write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1); + write_sysreg(ctxt->gp_regs.regs.sp, sp_el0); + write_sysreg_el2(ctxt->gp_regs.regs.pc, elr); + write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr); +@@ -114,7 +115,6 @@ static void __hyp_text __sysreg_restore_ + write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1], amair); + write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], cntkctl); + write_sysreg(ctxt->sys_regs[PAR_EL1], par_el1); +- write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1); + + write_sysreg(ctxt->gp_regs.sp_el1, sp_el1); + write_sysreg_el1(ctxt->gp_regs.elr_el1, elr); diff --git a/queue-4.7/arm64-only-select-arm64_module_plts-if-modules-y.patch b/queue-4.7/arm64-only-select-arm64_module_plts-if-modules-y.patch new file mode 100644 index 00000000000..18cb11926f2 --- /dev/null +++ b/queue-4.7/arm64-only-select-arm64_module_plts-if-modules-y.patch @@ -0,0 +1,44 @@ +From b9c220b589daaf140f5b8ebe502c98745b94e65c Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Tue, 26 Jul 2016 10:16:55 -0700 +Subject: arm64: Only select ARM64_MODULE_PLTS if MODULES=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Catalin Marinas + +commit b9c220b589daaf140f5b8ebe502c98745b94e65c upstream. + +Selecting CONFIG_RANDOMIZE_BASE=y and CONFIG_MODULES=n fails to build +the module PLTs support: + + CC arch/arm64/kernel/module-plts.o +/work/Linux/linux-2.6-aarch64/arch/arm64/kernel/module-plts.c: In function ‘module_emit_plt_entry’: +/work/Linux/linux-2.6-aarch64/arch/arm64/kernel/module-plts.c:32:49: error: dereferencing pointer to incomplete type ‘struct module’ + +This patch selects ARM64_MODULE_PLTS conditionally only if MODULES is +enabled. + +Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR") +Reported-by: Jeff Vander Stoep +Acked-by: Ard Biesheuvel +Acked-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -872,7 +872,7 @@ config RELOCATABLE + + config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" +- select ARM64_MODULE_PLTS ++ select ARM64_MODULE_PLTS if MODULES + select RELOCATABLE + help + Randomizes the virtual address at which the kernel image is diff --git a/queue-4.7/usb-dwc3-fix-for-the-isoc-transfer-ep_busy-flag.patch b/queue-4.7/usb-dwc3-fix-for-the-isoc-transfer-ep_busy-flag.patch new file mode 100644 index 00000000000..41d7e35194e --- /dev/null +++ b/queue-4.7/usb-dwc3-fix-for-the-isoc-transfer-ep_busy-flag.patch @@ -0,0 +1,42 @@ +From 9cad39fe4e4a4fe95d8ea5a7b0692b0a6e89e38b Mon Sep 17 00:00:00 2001 +From: Konrad Leszczynski +Date: Mon, 8 Feb 2016 16:13:12 +0100 +Subject: usb: dwc3: fix for the isoc transfer EP_BUSY flag + +From: Konrad Leszczynski + +commit 9cad39fe4e4a4fe95d8ea5a7b0692b0a6e89e38b upstream. + +commit f3af36511e60 ("usb: dwc3: gadget: always +enable IOC on bulk/interrupt transfers") ended up +regressing Isochronous endpoints by clearing +DWC3_EP_BUSY flag too early, which resulted in +choppy audio playback over USB. + +Fix that by partially reverting original commit and +making sure that we check for isochronous endpoints. + +Fixes: f3af36511e60 ("usb: dwc3: gadget: always enable IOC + on bulk/interrupt transfers") +Signed-off-by: Konrad Leszczynski +Signed-off-by: Rafal Redzimski +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2025,6 +2025,10 @@ static int dwc3_cleanup_done_reqs(struct + return 1; + } + ++ if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) ++ if ((event->status & DEPEVT_STATUS_IOC) && ++ (trb->ctrl & DWC3_TRB_CTRL_IOC)) ++ return 0; + return 1; + } + diff --git a/queue-4.7/usb-dwc3-gadget-only-resume-usb2-phy-in-highspeed.patch b/queue-4.7/usb-dwc3-gadget-only-resume-usb2-phy-in-highspeed.patch new file mode 100644 index 00000000000..141c8aa6da4 --- /dev/null +++ b/queue-4.7/usb-dwc3-gadget-only-resume-usb2-phy-in-highspeed.patch @@ -0,0 +1,43 @@ +From ab2a92e7a608c09f13baf1730b9ba24c73c35d52 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Tue, 17 May 2016 14:55:58 +0300 +Subject: usb: dwc3: gadget: only resume USB2 PHY in <=HIGHSPEED + +From: Felipe Balbi + +commit ab2a92e7a608c09f13baf1730b9ba24c73c35d52 upstream. + +As a micro-power optimization, let's only resume the +USB2 PHY if we're working on <=HIGHSPEED. If we're +gonna work on SUPERSPEED or SUPERSPEED+, there's no +point in resuming the USB2 PHY. + +Fixes: 2b0f11df84bb ("usb: dwc3: gadget: clear SUSPHY bit before ep cmds") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -258,11 +258,13 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 + * We will also set SUSPHY bit to what it was before returning as stated + * by the same section on Synopsys databook. + */ +- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); +- if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) { +- susphy = true; +- reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; +- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); ++ if (dwc->gadget.speed <= USB_SPEED_HIGH) { ++ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); ++ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) { ++ susphy = true; ++ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; ++ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); ++ } + } + + if (cmd == DWC3_DEPCMD_STARTTRANSFER) { diff --git a/queue-4.7/usb-gadget-pch_udc-reorder-spin_lock-to-avoid-deadlock.patch b/queue-4.7/usb-gadget-pch_udc-reorder-spin_lock-to-avoid-deadlock.patch new file mode 100644 index 00000000000..997fb0f61bf --- /dev/null +++ b/queue-4.7/usb-gadget-pch_udc-reorder-spin_lock-to-avoid-deadlock.patch @@ -0,0 +1,95 @@ +From 1d23d16a88e6c8143b07339435ba061b131ebb8c Mon Sep 17 00:00:00 2001 +From: Iago Abal +Date: Tue, 21 Jun 2016 12:01:11 +0200 +Subject: usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock + +From: Iago Abal + +commit 1d23d16a88e6c8143b07339435ba061b131ebb8c upstream. + +The above commit reordered spin_lock/unlock and now `&dev->lock' is acquired +(rather than released) before calling `dev->driver->disconnect', +`dev->driver->setup', `dev->driver->suspend', `usb_gadget_giveback_request', and +`usb_gadget_udc_reset'. + +But this *may* not be the right way to fix the problem pointed by d3cb25a12138. + +Note that the other usb/gadget/udc drivers do release the lock before calling +these functions. There are also inconsistencies within pch_udc.c, where +`dev->driver->disconnect' is called while holding `&dev->lock' in lines 613 and +1184, but not in line 2739. + +Finally, commit d3cb25a12138 may have introduced several potential deadlocks. + +For instance, EBA (https://github.com/models-team/eba) reports: + + Double lock in drivers/usb/gadget/udc/pch_udc.c + first at 2791: spin_lock(& dev->lock); [pch_udc_isr] + second at 2694: spin_lock(& dev->lock); [pch_udc_svc_cfg_interrupt] + after calling from 2793: pch_udc_dev_isr(dev, dev_intr); + after calling from 2724: pch_udc_svc_cfg_interrupt(dev); + +Similarly, other potential deadlocks are 2791 -> 2793 -> 2721 -> 2657; and +2791 -> 2793 -> 2711 -> 2573 -> 1499 -> 1480. + +Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") +Signed-off-by: Iago Abal +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/pch_udc.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1477,11 +1477,11 @@ static void complete_req(struct pch_udc_ + req->dma_mapped = 0; + } + ep->halted = 1; +- spin_lock(&dev->lock); ++ spin_unlock(&dev->lock); + if (!ep->in) + pch_udc_ep_clear_rrdy(ep); + usb_gadget_giveback_request(&ep->ep, &req->req); +- spin_unlock(&dev->lock); ++ spin_lock(&dev->lock); + ep->halted = halted; + } + +@@ -2573,9 +2573,9 @@ static void pch_udc_svc_ur_interrupt(str + empty_req_queue(ep); + } + if (dev->driver) { +- spin_lock(&dev->lock); +- usb_gadget_udc_reset(&dev->gadget, dev->driver); + spin_unlock(&dev->lock); ++ usb_gadget_udc_reset(&dev->gadget, dev->driver); ++ spin_lock(&dev->lock); + } + } + +@@ -2654,9 +2654,9 @@ static void pch_udc_svc_intf_interrupt(s + dev->ep[i].halted = 0; + } + dev->stall = 0; +- spin_lock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); + spin_unlock(&dev->lock); ++ dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); + } + + /** +@@ -2691,9 +2691,9 @@ static void pch_udc_svc_cfg_interrupt(st + dev->stall = 0; + + /* call gadget zero with setup data received */ +- spin_lock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); + spin_unlock(&dev->lock); ++ dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); + } + + /** diff --git a/queue-4.7/usb-gadget-udc-atmel-also-get-regmap-for-at91sam9x5-pmc.patch b/queue-4.7/usb-gadget-udc-atmel-also-get-regmap-for-at91sam9x5-pmc.patch new file mode 100644 index 00000000000..671f247a056 --- /dev/null +++ b/queue-4.7/usb-gadget-udc-atmel-also-get-regmap-for-at91sam9x5-pmc.patch @@ -0,0 +1,36 @@ +From 882bd9fc46321c9d4721b376039a142cbfe8a17a Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Mon, 13 Jun 2016 10:47:30 +0200 +Subject: usb: gadget: udc: atmel: Also get regmap for at91sam9x5-pmc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +commit 882bd9fc46321c9d4721b376039a142cbfe8a17a upstream. + +The "atmel,at91sam9g45-udc" compatible UDC is also used on at91sam9x5 so it +is also necessary to try to get the syscon for at91sam9x5-pmc. + +Fixes: 4747639f01c9 ("usb: gadget: atmel: access the PMC using regmap") +Reported-by: Uwe Kleine-König +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -1920,6 +1920,8 @@ static struct usba_ep * atmel_udc_of_ini + + udc->errata = match->data; + udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc"); ++ if (IS_ERR(udc->pmc)) ++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc"); + if (udc->errata && IS_ERR(udc->pmc)) + return ERR_CAST(udc->pmc); + diff --git a/queue-4.7/usb-quirks-add-no-lpm-quirk-for-elan.patch b/queue-4.7/usb-quirks-add-no-lpm-quirk-for-elan.patch new file mode 100644 index 00000000000..a0912bd52dd --- /dev/null +++ b/queue-4.7/usb-quirks-add-no-lpm-quirk-for-elan.patch @@ -0,0 +1,35 @@ +From 25b1f9acc452209ae0fcc8c1332be852b5c52f53 Mon Sep 17 00:00:00 2001 +From: Joseph Salisbury +Date: Wed, 6 Jul 2016 21:18:51 -0400 +Subject: usb: quirks: Add no-lpm quirk for Elan + +From: Joseph Salisbury + +commit 25b1f9acc452209ae0fcc8c1332be852b5c52f53 upstream. + +BugLink: http://bugs.launchpad.net/bugs/1498667 + +As reported in BugLink, this device has an issue with Linux Power +Management so adding a quirk. This quirk was reccomended by Alan Stern: + +http://lkml.iu.edu/hypermail/linux/kernel/1606.2/05590.html + +Signed-off-by: Joseph Salisbury +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -128,6 +128,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x04f3, 0x016f), .driver_info = + USB_QUIRK_DEVICE_QUALIFIER }, + ++ { USB_DEVICE(0x04f3, 0x0381), .driver_info = ++ USB_QUIRK_NO_LPM }, ++ + { USB_DEVICE(0x04f3, 0x21b8), .driver_info = + USB_QUIRK_DEVICE_QUALIFIER }, + diff --git a/queue-4.7/usb-renesas_usbhs-fix-null-pointer-dereference-in-xfer_work.patch b/queue-4.7/usb-renesas_usbhs-fix-null-pointer-dereference-in-xfer_work.patch new file mode 100644 index 00000000000..d373cc4e19c --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-fix-null-pointer-dereference-in-xfer_work.patch @@ -0,0 +1,79 @@ +From 4fdef698383db07d829da567e0e405fc41ff3a89 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 8 Jun 2016 16:32:49 +0900 +Subject: usb: renesas_usbhs: fix NULL pointer dereference in xfer_work() + +From: Yoshihiro Shimoda + +commit 4fdef698383db07d829da567e0e405fc41ff3a89 upstream. + +This patch fixes an issue that the xfer_work() is possible to cause +NULL pointer dereference if the usb cable is disconnected while data +transfer is running. + +In such case, a gadget driver may call usb_ep_disable()) before +xfer_work() is actually called. In this case, the usbhs_pkt_pop() +will call usbhsf_fifo_unselect(), and then usbhs_pipe_to_fifo() +in xfer_work() will return NULL. + +Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/fifo.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -810,20 +810,27 @@ static void xfer_work(struct work_struct + { + struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work); + struct usbhs_pipe *pipe = pkt->pipe; +- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe); ++ struct usbhs_fifo *fifo; + struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); + struct dma_async_tx_descriptor *desc; +- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt); ++ struct dma_chan *chan; + struct device *dev = usbhs_priv_to_dev(priv); + enum dma_transfer_direction dir; ++ unsigned long flags; + ++ usbhs_lock(priv, flags); ++ fifo = usbhs_pipe_to_fifo(pipe); ++ if (!fifo) ++ goto xfer_work_end; ++ ++ chan = usbhsf_dma_chan_get(fifo, pkt); + dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV; + + desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual, + pkt->trans, dir, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc) +- return; ++ goto xfer_work_end; + + desc->callback = usbhsf_dma_complete; + desc->callback_param = pipe; +@@ -831,7 +838,7 @@ static void xfer_work(struct work_struct + pkt->cookie = dmaengine_submit(desc); + if (pkt->cookie < 0) { + dev_err(dev, "Failed to submit dma descriptor\n"); +- return; ++ goto xfer_work_end; + } + + dev_dbg(dev, " %s %d (%d/ %d)\n", +@@ -842,6 +849,9 @@ static void xfer_work(struct work_struct + usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans); + dma_async_issue_pending(chan); + usbhs_pipe_enable(pipe); ++ ++xfer_work_end: ++ usbhs_unlock(priv, flags); + } + + /* diff --git a/queue-4.7/usb-renesas_usbhs-protect-the-cfifosel-setting-in-usbhsg_ep_enable.patch b/queue-4.7/usb-renesas_usbhs-protect-the-cfifosel-setting-in-usbhsg_ep_enable.patch new file mode 100644 index 00000000000..c005d0acb89 --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-protect-the-cfifosel-setting-in-usbhsg_ep_enable.patch @@ -0,0 +1,69 @@ +From 15e4292a2d21e9997fdb2b8c014cc461b3f268f0 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 8 Jun 2016 16:32:50 +0900 +Subject: usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable() + +From: Yoshihiro Shimoda + +commit 15e4292a2d21e9997fdb2b8c014cc461b3f268f0 upstream. + +This patch fixes an issue that the CFIFOSEL register value is possible +to be changed by usbhsg_ep_enable() wrongly. And then, a data transfer +using CFIFO may not work correctly. + +For example: + # modprobe g_multi file=usb-storage.bin + # ifconfig usb0 192.168.1.1 up + (During the USB host is sending file to the mass storage) + # ifconfig usb0 down + +In this case, since the u_ether.c may call usb_ep_enable() in +eth_stop(), if the renesas_usbhs driver is also using CFIFO for +mass storage, the mass storage may not work correctly. + +So, this patch adds usbhs_lock() and usbhs_unlock() calling in +usbhsg_ep_enable() to protect CFIFOSEL register. This is because: + - CFIFOSEL.CURPIPE = 0 is also needed for the pipe configuration + - The CFIFOSEL (fifo->sel) is already protected by usbhs_lock() + +Fixes: 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/mod_gadget.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -585,6 +585,9 @@ static int usbhsg_ep_enable(struct usb_e + struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv); + struct usbhs_pipe *pipe; + int ret = -EIO; ++ unsigned long flags; ++ ++ usbhs_lock(priv, flags); + + /* + * if it already have pipe, +@@ -593,7 +596,8 @@ static int usbhsg_ep_enable(struct usb_e + if (uep->pipe) { + usbhs_pipe_clear(uep->pipe); + usbhs_pipe_sequence_data0(uep->pipe); +- return 0; ++ ret = 0; ++ goto usbhsg_ep_enable_end; + } + + pipe = usbhs_pipe_malloc(priv, +@@ -621,6 +625,9 @@ static int usbhsg_ep_enable(struct usb_e + ret = 0; + } + ++usbhsg_ep_enable_end: ++ usbhs_unlock(priv, flags); ++ + return ret; + } + diff --git a/queue-4.7/usb-serial-option-add-support-for-telit-le910-pid-0x1206.patch b/queue-4.7/usb-serial-option-add-support-for-telit-le910-pid-0x1206.patch new file mode 100644 index 00000000000..93b2eba8bc0 --- /dev/null +++ b/queue-4.7/usb-serial-option-add-support-for-telit-le910-pid-0x1206.patch @@ -0,0 +1,41 @@ +From 3c0415fa08548e3bc63ef741762664497ab187ed Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Mon, 6 Jun 2016 12:38:17 +0200 +Subject: USB: serial: option: add support for Telit LE910 PID 0x1206 + +From: Daniele Palmas + +commit 3c0415fa08548e3bc63ef741762664497ab187ed upstream. + +This patch adds support for 0x1206 PID of Telit LE910. + +Since the interfaces positions are the same than the ones for +0x1043 PID of Telit LE922, telit_le922_blacklist_usbcfg3 is used. + +Signed-off-by: Daniele Palmas +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -273,6 +273,7 @@ static void option_instat_callback(struc + #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 ++#define TELIT_PRODUCT_LE910_USBCFG4 0x1206 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -1198,6 +1199,8 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */