From: Greg Kroah-Hartman Date: Sat, 17 Oct 2015 23:42:50 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v3.10.91~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f74019a16cc0d79c0bf1dc2e07f4b0bac862d07b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch batman-adv-fix-potentially-broken-skb-network-header-access.patch batman-adv-make-mcast-capability-changes-atomic.patch batman-adv-make-nc-capability-changes-atomic.patch batman-adv-make-tt-capability-changes-atomic.patch cpu-cacheinfo-fix-teardown-path.patch cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch rsi-fix-possible-leak-when-loading-firmware.patch tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch usb-add-device-quirk-for-logitech-ptz-cameras.patch usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch usb-chaoskey-read-offset-bug.patch usb-chipidea-udc-using-the-correct-stall-implementation.patch usb-musb-cppi41-allow-it-to-work-again.patch usb-musb-dsps-fix-polling-in-device-only-mode.patch usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch --- diff --git a/queue-4.1/batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch b/queue-4.1/batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch new file mode 100644 index 00000000000..6ced91f5fdc --- /dev/null +++ b/queue-4.1/batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch @@ -0,0 +1,257 @@ +From 8a4023c5b5e30b11f1f383186f4a7222b3b823cf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 16 Jun 2015 17:10:26 +0200 +Subject: batman-adv: Fix potential synchronization issues in mcast tvlv handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Linus=20L=C3=BCssing?= + +commit 8a4023c5b5e30b11f1f383186f4a7222b3b823cf upstream. + +So far the mcast tvlv handler did not anticipate the processing of +multiple incoming OGMs from the same originator at the same time. This +can lead to various issues: + +* Broken refcounting: For instance two mcast handlers might both assume + that an originator just got multicast capabilities and will together + wrongly decrease mcast.num_disabled by two, potentially leading to + an integer underflow. + +* Potential kernel panic on hlist_del_rcu(): Two mcast handlers might + one after another try to do an + hlist_del_rcu(&orig->mcast_want_all_*_node). The second one will + cause memory corruption / crashes. + (Reported by: Sven Eckelmann ) + +Right in the beginning the code path makes assumptions about the current +multicast related state of an originator and bases all updates on that. The +easiest and least error prune way to fix the issues in this case is to +serialize multiple mcast handler invocations with a spinlock. + +Fixes: 60432d756cf0 ("batman-adv: Announce new capability via multicast TVLV") +Signed-off-by: Linus Lüssing +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/multicast.c | 63 ++++++++++++++++++++++++++++++++++---------- + net/batman-adv/originator.c | 5 +++ + net/batman-adv/types.h | 3 ++ + 3 files changed, 58 insertions(+), 13 deletions(-) + +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -16,6 +16,7 @@ + */ + + #include ++#include + #include "main.h" + #include "multicast.h" + #include "originator.h" +@@ -566,19 +567,26 @@ batadv_mcast_forw_mode(struct batadv_pri + * + * If the BATADV_MCAST_WANT_ALL_UNSNOOPABLES flag of this originator, + * orig, has toggled then this method updates counter and list accordingly. ++ * ++ * Caller needs to hold orig->mcast_handler_lock. + */ + static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv, + struct batadv_orig_node *orig, + uint8_t mcast_flags) + { ++ struct hlist_node *node = &orig->mcast_want_all_unsnoopables_node; ++ struct hlist_head *head = &bat_priv->mcast.want_all_unsnoopables_list; ++ + /* switched from flag unset to set */ + if (mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES && + !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES)) { + atomic_inc(&bat_priv->mcast.num_want_all_unsnoopables); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_add_head_rcu(&orig->mcast_want_all_unsnoopables_node, +- &bat_priv->mcast.want_all_unsnoopables_list); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(!hlist_unhashed(node)); ++ ++ hlist_add_head_rcu(node, head); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + /* switched from flag set to unset */ + } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES) && +@@ -586,7 +594,10 @@ static void batadv_mcast_want_unsnoop_up + atomic_dec(&bat_priv->mcast.num_want_all_unsnoopables); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_del_rcu(&orig->mcast_want_all_unsnoopables_node); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(hlist_unhashed(node)); ++ ++ hlist_del_init_rcu(node); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + } + } +@@ -599,19 +610,26 @@ static void batadv_mcast_want_unsnoop_up + * + * If the BATADV_MCAST_WANT_ALL_IPV4 flag of this originator, orig, has + * toggled then this method updates counter and list accordingly. ++ * ++ * Caller needs to hold orig->mcast_handler_lock. + */ + static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv, + struct batadv_orig_node *orig, + uint8_t mcast_flags) + { ++ struct hlist_node *node = &orig->mcast_want_all_ipv4_node; ++ struct hlist_head *head = &bat_priv->mcast.want_all_ipv4_list; ++ + /* switched from flag unset to set */ + if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV4 && + !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV4)) { + atomic_inc(&bat_priv->mcast.num_want_all_ipv4); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_add_head_rcu(&orig->mcast_want_all_ipv4_node, +- &bat_priv->mcast.want_all_ipv4_list); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(!hlist_unhashed(node)); ++ ++ hlist_add_head_rcu(node, head); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + /* switched from flag set to unset */ + } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV4) && +@@ -619,7 +637,10 @@ static void batadv_mcast_want_ipv4_updat + atomic_dec(&bat_priv->mcast.num_want_all_ipv4); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_del_rcu(&orig->mcast_want_all_ipv4_node); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(hlist_unhashed(node)); ++ ++ hlist_del_init_rcu(node); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + } + } +@@ -632,19 +653,26 @@ static void batadv_mcast_want_ipv4_updat + * + * If the BATADV_MCAST_WANT_ALL_IPV6 flag of this originator, orig, has + * toggled then this method updates counter and list accordingly. ++ * ++ * Caller needs to hold orig->mcast_handler_lock. + */ + static void batadv_mcast_want_ipv6_update(struct batadv_priv *bat_priv, + struct batadv_orig_node *orig, + uint8_t mcast_flags) + { ++ struct hlist_node *node = &orig->mcast_want_all_ipv6_node; ++ struct hlist_head *head = &bat_priv->mcast.want_all_ipv6_list; ++ + /* switched from flag unset to set */ + if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV6 && + !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV6)) { + atomic_inc(&bat_priv->mcast.num_want_all_ipv6); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_add_head_rcu(&orig->mcast_want_all_ipv6_node, +- &bat_priv->mcast.want_all_ipv6_list); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(!hlist_unhashed(node)); ++ ++ hlist_add_head_rcu(node, head); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + /* switched from flag set to unset */ + } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) && +@@ -652,7 +680,10 @@ static void batadv_mcast_want_ipv6_updat + atomic_dec(&bat_priv->mcast.num_want_all_ipv6); + + spin_lock_bh(&bat_priv->mcast.want_lists_lock); +- hlist_del_rcu(&orig->mcast_want_all_ipv6_node); ++ /* flag checks above + mcast_handler_lock prevents this */ ++ WARN_ON(hlist_unhashed(node)); ++ ++ hlist_del_init_rcu(node); + spin_unlock_bh(&bat_priv->mcast.want_lists_lock); + } + } +@@ -675,6 +706,11 @@ static void batadv_mcast_tvlv_ogm_handle + uint8_t mcast_flags = BATADV_NO_FLAGS; + bool orig_initialized; + ++ if (orig_mcast_enabled && tvlv_value && ++ (tvlv_value_len >= sizeof(mcast_flags))) ++ mcast_flags = *(uint8_t *)tvlv_value; ++ ++ spin_lock_bh(&orig->mcast_handler_lock); + orig_initialized = test_bit(BATADV_ORIG_CAPA_HAS_MCAST, + &orig->capa_initialized); + +@@ -700,15 +736,12 @@ static void batadv_mcast_tvlv_ogm_handle + + set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized); + +- if (orig_mcast_enabled && tvlv_value && +- (tvlv_value_len >= sizeof(mcast_flags))) +- mcast_flags = *(uint8_t *)tvlv_value; +- + batadv_mcast_want_unsnoop_update(bat_priv, orig, mcast_flags); + batadv_mcast_want_ipv4_update(bat_priv, orig, mcast_flags); + batadv_mcast_want_ipv6_update(bat_priv, orig, mcast_flags); + + orig->mcast_flags = mcast_flags; ++ spin_unlock_bh(&orig->mcast_handler_lock); + } + + /** +@@ -742,6 +775,8 @@ void batadv_mcast_purge_orig(struct bata + { + struct batadv_priv *bat_priv = orig->bat_priv; + ++ spin_lock_bh(&orig->mcast_handler_lock); ++ + if (!test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) && + test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized)) + atomic_dec(&bat_priv->mcast.num_disabled); +@@ -749,4 +784,6 @@ void batadv_mcast_purge_orig(struct bata + batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS); + batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS); + batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS); ++ ++ spin_unlock_bh(&orig->mcast_handler_lock); + } +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -678,8 +678,13 @@ struct batadv_orig_node *batadv_orig_nod + orig_node->last_seen = jiffies; + reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS); + orig_node->bcast_seqno_reset = reset_time; ++ + #ifdef CONFIG_BATMAN_ADV_MCAST + orig_node->mcast_flags = BATADV_NO_FLAGS; ++ INIT_HLIST_NODE(&orig_node->mcast_want_all_unsnoopables_node); ++ INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv4_node); ++ INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv6_node); ++ spin_lock_init(&orig_node->mcast_handler_lock); + #endif + + /* create a vlan object for the "untagged" LAN */ +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -204,6 +204,7 @@ struct batadv_orig_bat_iv { + * @batadv_dat_addr_t: address of the orig node in the distributed hash + * @last_seen: time when last packet from this node was received + * @bcast_seqno_reset: time when the broadcast seqno window was reset ++ * @mcast_handler_lock: synchronizes mcast-capability and -flag changes + * @mcast_flags: multicast flags announced by the orig node + * @mcast_want_all_unsnoop_node: a list node for the + * mcast.want_all_unsnoopables list +@@ -251,6 +252,8 @@ struct batadv_orig_node { + unsigned long last_seen; + unsigned long bcast_seqno_reset; + #ifdef CONFIG_BATMAN_ADV_MCAST ++ /* synchronizes mcast tvlv specific orig changes */ ++ spinlock_t mcast_handler_lock; + uint8_t mcast_flags; + struct hlist_node mcast_want_all_unsnoopables_node; + struct hlist_node mcast_want_all_ipv4_node; diff --git a/queue-4.1/batman-adv-fix-potentially-broken-skb-network-header-access.patch b/queue-4.1/batman-adv-fix-potentially-broken-skb-network-header-access.patch new file mode 100644 index 00000000000..551cf989fc4 --- /dev/null +++ b/queue-4.1/batman-adv-fix-potentially-broken-skb-network-header-access.patch @@ -0,0 +1,60 @@ +From 53cf037bf846417fd92dc92ddf97267f69b110f4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 30 Jun 2015 23:45:26 +0200 +Subject: batman-adv: Fix potentially broken skb network header access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Linus=20L=C3=BCssing?= + +commit 53cf037bf846417fd92dc92ddf97267f69b110f4 upstream. + +The two commits noted below added calls to ip_hdr() and ipv6_hdr(). They +need a correctly set skb network header. + +Unfortunately we cannot rely on the device drivers to set it for us. +Therefore setting it in the beginning of the according ndo_start_xmit +handler. + +Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets") +Fixes: ab49886e3da7 ("batman-adv: Add IPv4 link-local/IPv6-ll-all-nodes multicast support") +Signed-off-by: Linus Lüssing +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/soft-interface.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -172,6 +172,7 @@ static int batadv_interface_tx(struct sk + int gw_mode; + enum batadv_forw_mode forw_mode; + struct batadv_orig_node *mcast_single_orig = NULL; ++ int network_offset = ETH_HLEN; + + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; +@@ -184,14 +185,18 @@ static int batadv_interface_tx(struct sk + case ETH_P_8021Q: + vhdr = vlan_eth_hdr(skb); + +- if (vhdr->h_vlan_encapsulated_proto != ethertype) ++ if (vhdr->h_vlan_encapsulated_proto != ethertype) { ++ network_offset += VLAN_HLEN; + break; ++ } + + /* fall through */ + case ETH_P_BATMAN: + goto dropped; + } + ++ skb_set_network_header(skb, network_offset); ++ + if (batadv_bla_tx(bat_priv, skb, vid)) + goto dropped; + diff --git a/queue-4.1/batman-adv-make-mcast-capability-changes-atomic.patch b/queue-4.1/batman-adv-make-mcast-capability-changes-atomic.patch new file mode 100644 index 00000000000..7b55aa893e9 --- /dev/null +++ b/queue-4.1/batman-adv-make-mcast-capability-changes-atomic.patch @@ -0,0 +1,98 @@ +From 9c936e3f4c4fad07abb6c082a89508b8f724c88f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 16 Jun 2015 17:10:25 +0200 +Subject: batman-adv: Make MCAST capability changes atomic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Linus=20L=C3=BCssing?= + +commit 9c936e3f4c4fad07abb6c082a89508b8f724c88f upstream. + +Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One +OGM handler might undo the set/clear of a specific bit from another +handler run in between. + +Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions. + +Fixes: 60432d756cf0 ("batman-adv: Announce new capability via multicast TVLV") +Signed-off-by: Linus Lüssing +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/multicast.c | 18 ++++++++++-------- + net/batman-adv/types.h | 2 +- + 2 files changed, 11 insertions(+), 9 deletions(-) + +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -15,6 +15,7 @@ + * along with this program; if not, see . + */ + ++#include + #include "main.h" + #include "multicast.h" + #include "originator.h" +@@ -674,29 +675,30 @@ static void batadv_mcast_tvlv_ogm_handle + uint8_t mcast_flags = BATADV_NO_FLAGS; + bool orig_initialized; + +- orig_initialized = orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST; ++ orig_initialized = test_bit(BATADV_ORIG_CAPA_HAS_MCAST, ++ &orig->capa_initialized); + + /* If mcast support is turned on decrease the disabled mcast node + * counter only if we had increased it for this node before. If this + * is a completely new orig_node no need to decrease the counter. + */ + if (orig_mcast_enabled && +- !(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST)) { ++ !test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities)) { + if (orig_initialized) + atomic_dec(&bat_priv->mcast.num_disabled); +- orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST; ++ set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities); + /* If mcast support is being switched off or if this is an initial + * OGM without mcast support then increase the disabled mcast + * node counter. + */ + } else if (!orig_mcast_enabled && +- (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST || ++ (test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) || + !orig_initialized)) { + atomic_inc(&bat_priv->mcast.num_disabled); +- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST; ++ clear_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities); + } + +- orig->capa_initialized |= BATADV_ORIG_CAPA_HAS_MCAST; ++ set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized); + + if (orig_mcast_enabled && tvlv_value && + (tvlv_value_len >= sizeof(mcast_flags))) +@@ -740,8 +742,8 @@ void batadv_mcast_purge_orig(struct bata + { + struct batadv_priv *bat_priv = orig->bat_priv; + +- if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) && +- orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST) ++ if (!test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities) && ++ test_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized)) + atomic_dec(&bat_priv->mcast.num_disabled); + + batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS); +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -299,7 +299,7 @@ enum batadv_orig_capabilities { + BATADV_ORIG_CAPA_HAS_DAT, + BATADV_ORIG_CAPA_HAS_NC, + BATADV_ORIG_CAPA_HAS_TT, +- BATADV_ORIG_CAPA_HAS_MCAST = BIT(3), ++ BATADV_ORIG_CAPA_HAS_MCAST, + }; + + /** diff --git a/queue-4.1/batman-adv-make-nc-capability-changes-atomic.patch b/queue-4.1/batman-adv-make-nc-capability-changes-atomic.patch new file mode 100644 index 00000000000..520973433af --- /dev/null +++ b/queue-4.1/batman-adv-make-nc-capability-changes-atomic.patch @@ -0,0 +1,71 @@ +From 4635469f5c617282f18c69643af36cd8c0acf707 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 16 Jun 2015 17:10:23 +0200 +Subject: batman-adv: Make NC capability changes atomic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Linus=20L=C3=BCssing?= + +commit 4635469f5c617282f18c69643af36cd8c0acf707 upstream. + +Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One +OGM handler might undo the set/clear of a specific bit from another +handler run in between. + +Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions. + +Fixes: 3f4841ffb336 ("batman-adv: tvlv - add network coding container") +Signed-off-by: Linus Lüssing +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/network-coding.c | 7 ++++--- + net/batman-adv/types.h | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/net/batman-adv/network-coding.c ++++ b/net/batman-adv/network-coding.c +@@ -15,6 +15,7 @@ + * along with this program; if not, see . + */ + ++#include + #include + + #include "main.h" +@@ -105,9 +106,9 @@ static void batadv_nc_tvlv_ogm_handler_v + uint16_t tvlv_value_len) + { + if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND) +- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_NC; ++ clear_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities); + else +- orig->capabilities |= BATADV_ORIG_CAPA_HAS_NC; ++ set_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities); + } + + /** +@@ -871,7 +872,7 @@ void batadv_nc_update_nc_node(struct bat + goto out; + + /* check if orig node is network coding enabled */ +- if (!(orig_node->capabilities & BATADV_ORIG_CAPA_HAS_NC)) ++ if (!test_bit(BATADV_ORIG_CAPA_HAS_NC, &orig_node->capabilities)) + goto out; + + /* accept ogms from 'good' neighbors and single hop neighbors */ +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -297,7 +297,7 @@ struct batadv_orig_node { + */ + enum batadv_orig_capabilities { + BATADV_ORIG_CAPA_HAS_DAT, +- BATADV_ORIG_CAPA_HAS_NC = BIT(1), ++ BATADV_ORIG_CAPA_HAS_NC, + BATADV_ORIG_CAPA_HAS_TT = BIT(2), + BATADV_ORIG_CAPA_HAS_MCAST = BIT(3), + }; diff --git a/queue-4.1/batman-adv-make-tt-capability-changes-atomic.patch b/queue-4.1/batman-adv-make-tt-capability-changes-atomic.patch new file mode 100644 index 00000000000..fe564a4bcfe --- /dev/null +++ b/queue-4.1/batman-adv-make-tt-capability-changes-atomic.patch @@ -0,0 +1,87 @@ +From ac4eebd48461ec993e7cb614d5afe7df8c72e6b7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 16 Jun 2015 17:10:24 +0200 +Subject: batman-adv: Make TT capability changes atomic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Linus=20L=C3=BCssing?= + +commit ac4eebd48461ec993e7cb614d5afe7df8c72e6b7 upstream. + +Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One +OGM handler might undo the set/clear of a specific bit from another +handler run in between. + +Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions. + +Fixes: e17931d1a61d ("batman-adv: introduce capability initialization bitfield") +Signed-off-by: Linus Lüssing +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/translation-table.c | 8 +++++--- + net/batman-adv/types.h | 4 ++-- + 2 files changed, 7 insertions(+), 5 deletions(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -15,6 +15,7 @@ + * along with this program; if not, see . + */ + ++#include + #include "main.h" + #include "translation-table.h" + #include "soft-interface.h" +@@ -1860,7 +1861,7 @@ void batadv_tt_global_del_orig(struct ba + } + spin_unlock_bh(list_lock); + } +- orig_node->capa_initialized &= ~BATADV_ORIG_CAPA_HAS_TT; ++ clear_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized); + } + + static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global, +@@ -2819,7 +2820,7 @@ static void _batadv_tt_update_changes(st + return; + } + } +- orig_node->capa_initialized |= BATADV_ORIG_CAPA_HAS_TT; ++ set_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized); + } + + static void batadv_tt_fill_gtable(struct batadv_priv *bat_priv, +@@ -3321,7 +3322,8 @@ static void batadv_tt_update_orig(struct + bool has_tt_init; + + tt_vlan = (struct batadv_tvlv_tt_vlan_data *)tt_buff; +- has_tt_init = orig_node->capa_initialized & BATADV_ORIG_CAPA_HAS_TT; ++ has_tt_init = test_bit(BATADV_ORIG_CAPA_HAS_TT, ++ &orig_node->capa_initialized); + + /* orig table not initialised AND first diff is in the OGM OR the ttvn + * increased by one -> we can apply the attached changes +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -257,7 +257,7 @@ struct batadv_orig_node { + struct hlist_node mcast_want_all_ipv6_node; + #endif + unsigned long capabilities; +- uint8_t capa_initialized; ++ unsigned long capa_initialized; + atomic_t last_ttvn; + unsigned char *tt_buff; + int16_t tt_buff_len; +@@ -298,7 +298,7 @@ struct batadv_orig_node { + enum batadv_orig_capabilities { + BATADV_ORIG_CAPA_HAS_DAT, + BATADV_ORIG_CAPA_HAS_NC, +- BATADV_ORIG_CAPA_HAS_TT = BIT(2), ++ BATADV_ORIG_CAPA_HAS_TT, + BATADV_ORIG_CAPA_HAS_MCAST = BIT(3), + }; + diff --git a/queue-4.1/cpu-cacheinfo-fix-teardown-path.patch b/queue-4.1/cpu-cacheinfo-fix-teardown-path.patch new file mode 100644 index 00000000000..24e5926cb85 --- /dev/null +++ b/queue-4.1/cpu-cacheinfo-fix-teardown-path.patch @@ -0,0 +1,84 @@ +From 2110d70c5e58326a10e93cfefdc0b3686e2ada12 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Sat, 8 Aug 2015 10:46:02 +0200 +Subject: cpu/cacheinfo: Fix teardown path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Borislav Petkov + +commit 2110d70c5e58326a10e93cfefdc0b3686e2ada12 upstream. + +Philip Müller reported a hang when booting 32-bit 4.1 kernel on an AMD +box. A fragment of the splat was enough to pinpoint the issue: + + task: f58e0000 ti: f58e8000 task.ti: f58e800 + EIP: 0060:[] EFLAGS: 00010206 CPU: 0 + EIP is at free_cache_attributes+0x83/0xd0 + EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000 + ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0 + DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 + CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0 + +cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo descriptor +while the respective teardown path cache_shared_cpu_map_remove() didn't. +Fix that. + +>From tglx's version: to be on the safe side, move the cacheinfo +descriptor check to free_cache_attributes(), thus cleaning up the +hotplug path a little and making this even more robust. + +Reported-and-tested-by: Philip Müller +Reviewed-by: Thomas Gleixner +Acked-by: Sudeep Holla +Cc: Andre Przywara +Cc: Guenter Roeck +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: linux-kernel@vger.kernel.org +Cc: manjaro-dev@manjaro.org +Cc: Philip Müller +Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/cacheinfo.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/base/cacheinfo.c ++++ b/drivers/base/cacheinfo.c +@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove( + + if (sibling == cpu) /* skip itself */ + continue; ++ + sib_cpu_ci = get_cpu_cacheinfo(sibling); ++ if (!sib_cpu_ci->info_list) ++ continue; ++ + sib_leaf = sib_cpu_ci->info_list + index; + cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map); + cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map); +@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove( + + static void free_cache_attributes(unsigned int cpu) + { ++ if (!per_cpu_cacheinfo(cpu)) ++ return; ++ + cache_shared_cpu_map_remove(cpu); + + kfree(per_cpu_cacheinfo(cpu)); +@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct + break; + case CPU_DEAD: + cache_remove_dev(cpu); +- if (per_cpu_cacheinfo(cpu)) +- free_cache_attributes(cpu); ++ free_cache_attributes(cpu); + break; + } + return notifier_from_errno(rc); diff --git a/queue-4.1/cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch b/queue-4.1/cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch new file mode 100644 index 00000000000..f657ed15f6e --- /dev/null +++ b/queue-4.1/cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch @@ -0,0 +1,36 @@ +From a2022001cebd0825b96aa0f3345ea3ad44ae79d4 Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Wed, 2 Sep 2015 14:36:50 +0530 +Subject: cpufreq: dt: Tolerance applies on both sides of target voltage + +From: Viresh Kumar + +commit a2022001cebd0825b96aa0f3345ea3ad44ae79d4 upstream. + +Tolerance applies on both sides of the target voltage, i.e. both min and +max sides. But while checking if a voltage is supported by the regulator +or not, we haven't taken care of tolerance on the lower side. Fix that. + +Cc: Lucas Stach +Fixes: 045ee45c4ff2 ("cpufreq: cpufreq-dt: disable unsupported OPPs") +Signed-off-by: Viresh Kumar +Reviewed-by: Lucas Stach +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq-dt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/cpufreq-dt.c ++++ b/drivers/cpufreq/cpufreq-dt.c +@@ -255,7 +255,8 @@ static int cpufreq_init(struct cpufreq_p + rcu_read_unlock(); + + tol_uV = opp_uV * priv->voltage_tolerance / 100; +- if (regulator_is_supported_voltage(cpu_reg, opp_uV, ++ if (regulator_is_supported_voltage(cpu_reg, ++ opp_uV - tol_uV, + opp_uV + tol_uV)) { + if (opp_uV < min_uV) + min_uV = opp_uV; diff --git a/queue-4.1/dts-imx6-fix-sd-card-gpio-polarity-specified-in-device-tree.patch b/queue-4.1/dts-imx6-fix-sd-card-gpio-polarity-specified-in-device-tree.patch deleted file mode 100644 index adb2cd25622..00000000000 --- a/queue-4.1/dts-imx6-fix-sd-card-gpio-polarity-specified-in-device-tree.patch +++ /dev/null @@ -1,500 +0,0 @@ -From 89c1a8cf63f8c69dfddb6e377c04df8b25ab1c88 Mon Sep 17 00:00:00 2001 -From: Dong Aisheng -Date: Wed, 22 Jul 2015 20:53:02 +0800 -Subject: dts: imx6: fix sd card gpio polarity specified in device tree - -From: Dong Aisheng - -commit 89c1a8cf63f8c69dfddb6e377c04df8b25ab1c88 upstream. - -cd-gpios polarity should be changed to GPIO_ACTIVE_LOW and wp-gpios -should be changed to GPIO_ACTIVE_HIGH. -Otherwise, the SD may not work properly due to wrong polarity inversion -specified in DT after switch to common parsing function mmc_of_parse(). - -Signed-off-by: Dong Aisheng -Acked-by: Shawn Guo -Signed-off-by: Ulf Hansson -Signed-off-by: Fabio Estevam -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts -index 43cb3fd76be7..5111f5170d53 100644 ---- a/arch/arm/boot/dts/imx6dl-riotboard.dts -+++ b/arch/arm/boot/dts/imx6dl-riotboard.dts -@@ -305,8 +305,8 @@ - &usdhc2 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; -- cd-gpios = <&gpio1 4 0>; -- wp-gpios = <&gpio1 2 0>; -+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -@@ -314,8 +314,8 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 0>; -- wp-gpios = <&gpio7 1 0>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6q-arm2.dts b/arch/arm/boot/dts/imx6q-arm2.dts -index 78df05e9d1ce..d6515f7a56c4 100644 ---- a/arch/arm/boot/dts/imx6q-arm2.dts -+++ b/arch/arm/boot/dts/imx6q-arm2.dts -@@ -11,6 +11,7 @@ - */ - - /dts-v1/; -+#include - #include "imx6q.dtsi" - - / { -@@ -196,8 +197,8 @@ - }; - - &usdhc3 { -- cd-gpios = <&gpio6 11 0>; -- wp-gpios = <&gpio6 14 0>; -+ cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>; - vmmc-supply = <®_3p3v>; - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3 -diff --git a/arch/arm/boot/dts/imx6q-gk802.dts b/arch/arm/boot/dts/imx6q-gk802.dts -index 703539cf36d3..00bd63e63d0c 100644 ---- a/arch/arm/boot/dts/imx6q-gk802.dts -+++ b/arch/arm/boot/dts/imx6q-gk802.dts -@@ -7,6 +7,7 @@ - */ - - /dts-v1/; -+#include - #include "imx6q.dtsi" - - / { -@@ -161,7 +162,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; - bus-width = <4>; -- cd-gpios = <&gpio6 11 0>; -+ cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts -index a43abfa21e33..5645d52850a7 100644 ---- a/arch/arm/boot/dts/imx6q-tbs2910.dts -+++ b/arch/arm/boot/dts/imx6q-tbs2910.dts -@@ -251,7 +251,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; - bus-width = <4>; -- cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -@@ -260,7 +260,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; - bus-width = <4>; -- cd-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>; - wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; - vmmc-supply = <®_3p3v>; - status = "okay"; -diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi -index e6d9195a1da7..f4d6ae564ead 100644 ---- a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi -@@ -173,7 +173,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc1>; - vmmc-supply = <®_3p3v>; -- cd-gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - -@@ -181,7 +181,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; - vmmc-supply = <®_3p3v>; -- cd-gpios = <&gpio4 8 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio4 8 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi -index 1d85de2befb3..a47a0399a172 100644 ---- a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi -@@ -392,7 +392,7 @@ - &usdhc1 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc1>; -- cd-gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; - no-1-8-v; - status = "okay"; - }; -@@ -400,7 +400,7 @@ - &usdhc2 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; -- cd-gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio4 5 GPIO_ACTIVE_LOW>; - wp-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>; - no-1-8-v; - status = "okay"; -diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi -index 59e5d15e3ec4..ff41f83551de 100644 ---- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi -@@ -258,6 +258,6 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_cubox_i_usdhc2_aux &pinctrl_cubox_i_usdhc2>; - vmmc-supply = <®_3p3v>; -- cd-gpios = <&gpio1 4 0>; -+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi -index 2c253d6d20bd..45e7c39e80d5 100644 ---- a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi -@@ -1,3 +1,5 @@ -+#include -+ - / { - regulators { - compatible = "simple-bus"; -@@ -181,7 +183,7 @@ - &usdhc2 { /* module slot */ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; -- cd-gpios = <&gpio2 2 0>; -+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi -index b5756c21ea1d..4493f6e99330 100644 ---- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi -@@ -318,7 +318,7 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi -index 86f03c1b147c..a857d1294609 100644 ---- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi -@@ -324,7 +324,7 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi -index 4a8d97f47759..1afe3385e2d2 100644 ---- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi -@@ -417,7 +417,7 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi -index 62a82f3eba88..6dd0b764e036 100644 ---- a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi -@@ -299,6 +299,6 @@ - &pinctrl_hummingboard_usdhc2 - >; - vmmc-supply = <®_3p3v>; -- cd-gpios = <&gpio1 4 0>; -+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi -index 3af16dfe417b..d7fe6672d00c 100644 ---- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi -@@ -453,7 +453,7 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 0>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -@@ -461,7 +461,7 @@ - &usdhc4 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc4>; -- cd-gpios = <&gpio2 6 0>; -+ cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -index 1ce6133b67f5..9e6ecd99b472 100644 ---- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -@@ -409,8 +409,8 @@ - &usdhc2 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; -- cd-gpios = <&gpio1 4 0>; -- wp-gpios = <&gpio1 2 0>; -+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; - status = "disabled"; - }; - -@@ -418,7 +418,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3 - &pinctrl_usdhc3_cdwp>; -- cd-gpios = <&gpio1 27 0>; -- wp-gpios = <&gpio1 29 0>; -+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>; - status = "disabled"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi -index 488a640796ac..3373fd958e95 100644 ---- a/arch/arm/boot/dts/imx6qdl-rex.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi -@@ -342,7 +342,7 @@ - pinctrl-0 = <&pinctrl_usdhc2>; - bus-width = <4>; - cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>; -- wp-gpios = <&gpio2 3 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -@@ -351,6 +351,6 @@ - pinctrl-0 = <&pinctrl_usdhc3>; - bus-width = <4>; - cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>; -- wp-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi -index 3b24b12651b2..e329ca5c3322 100644 ---- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi -@@ -467,8 +467,8 @@ - pinctrl-0 = <&pinctrl_usdhc3>; - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; -- cd-gpios = <&gpio6 15 0>; -- wp-gpios = <&gpio1 13 0>; -+ cd-gpios = <&gpio6 15 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio1 13 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi -index e00c44f6a0df..782379320517 100644 ---- a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi -@@ -448,8 +448,8 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio7 0 0>; -- wp-gpios = <&gpio7 1 0>; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -@@ -457,7 +457,7 @@ - &usdhc4 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc4>; -- cd-gpios = <&gpio2 6 0>; -+ cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_3p3v>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi -index a626e6dd8022..944eb81cb2b8 100644 ---- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi -@@ -562,8 +562,8 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc2>; - bus-width = <8>; -- cd-gpios = <&gpio2 2 0>; -- wp-gpios = <&gpio2 3 0>; -+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -@@ -571,8 +571,8 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; - bus-width = <8>; -- cd-gpios = <&gpio2 0 0>; -- wp-gpios = <&gpio2 1 0>; -+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi -index f02b80b41d4f..da08de324e9e 100644 ---- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi -@@ -680,7 +680,7 @@ - pinctrl-0 = <&pinctrl_usdhc1>; - bus-width = <4>; - no-1-8-v; -- cd-gpios = <&gpio7 2 0>; -+ cd-gpios = <&gpio7 2 GPIO_ACTIVE_LOW>; - fsl,wp-controller; - status = "okay"; - }; -@@ -690,7 +690,7 @@ - pinctrl-0 = <&pinctrl_usdhc2>; - bus-width = <4>; - no-1-8-v; -- cd-gpios = <&gpio7 3 0>; -+ cd-gpios = <&gpio7 3 GPIO_ACTIVE_LOW>; - fsl,wp-controller; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi -index 5fb091675582..9e096d811bed 100644 ---- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi -@@ -9,6 +9,8 @@ - * - */ - -+#include -+ - / { - regulators { - compatible = "simple-bus"; -@@ -250,13 +252,13 @@ - &usdhc1 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc1>; -- cd-gpios = <&gpio1 2 0>; -+ cd-gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- cd-gpios = <&gpio3 9 0>; -+ cd-gpios = <&gpio3 9 GPIO_ACTIVE_LOW>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts -index 945887d3fdb3..b84dff2e94ea 100644 ---- a/arch/arm/boot/dts/imx6sl-evk.dts -+++ b/arch/arm/boot/dts/imx6sl-evk.dts -@@ -617,8 +617,8 @@ - pinctrl-1 = <&pinctrl_usdhc1_100mhz>; - pinctrl-2 = <&pinctrl_usdhc1_200mhz>; - bus-width = <8>; -- cd-gpios = <&gpio4 7 0>; -- wp-gpios = <&gpio4 6 0>; -+ cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -@@ -627,8 +627,8 @@ - pinctrl-0 = <&pinctrl_usdhc2>; - pinctrl-1 = <&pinctrl_usdhc2_100mhz>; - pinctrl-2 = <&pinctrl_usdhc2_200mhz>; -- cd-gpios = <&gpio5 0 0>; -- wp-gpios = <&gpio4 29 0>; -+ cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>; -+ wp-gpios = <&gpio4 29 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -@@ -637,6 +637,6 @@ - pinctrl-0 = <&pinctrl_usdhc3>; - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; -- cd-gpios = <&gpio3 22 0>; -+ cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts -index e3c0b63c2205..115f3fd78971 100644 ---- a/arch/arm/boot/dts/imx6sx-sabreauto.dts -+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts -@@ -49,7 +49,7 @@ - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; - bus-width = <8>; -- cd-gpios = <&gpio7 10 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio7 10 GPIO_ACTIVE_LOW>; - wp-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>; - keep-power-in-suspend; - enable-sdio-wakeup; -@@ -61,7 +61,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc4>; - bus-width = <8>; -- cd-gpios = <&gpio7 11 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>; - no-1-8-v; - keep-power-in-suspend; - enable-sdio-wakup; -diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi -index cef04cef3a80..ac88c3467078 100644 ---- a/arch/arm/boot/dts/imx6sx-sdb.dtsi -+++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi -@@ -293,7 +293,7 @@ - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; - bus-width = <8>; -- cd-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>; - wp-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>; - keep-power-in-suspend; - enable-sdio-wakeup; -@@ -304,7 +304,7 @@ - &usdhc4 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc4>; -- cd-gpios = <&gpio6 21 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&gpio6 21 GPIO_ACTIVE_LOW>; - wp-gpios = <&gpio6 20 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; diff --git a/queue-4.1/inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch b/queue-4.1/inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch new file mode 100644 index 00000000000..0a920eb1619 --- /dev/null +++ b/queue-4.1/inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch @@ -0,0 +1,44 @@ +From 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 13 Aug 2015 15:44:51 -0700 +Subject: inet: fix potential deadlock in reqsk_queue_unlink() + +From: Eric Dumazet + +commit 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af upstream. + +When replacing del_timer() with del_timer_sync(), I introduced +a deadlock condition : + +reqsk_queue_unlink() is called from inet_csk_reqsk_queue_drop() + +inet_csk_reqsk_queue_drop() can be called from many contexts, +one being the timer handler itself (reqsk_timer_handler()). + +In this case, del_timer_sync() loops forever. + +Simple fix is to test if timer is pending. + +Fixes: 2235f2ac75fd ("inet: fix races with reqsk timers") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Cc: Holger Hoffstätte +Cc: Andre Tomt +Cc: Chris Caputo +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/inet_connection_sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -584,7 +584,7 @@ static bool reqsk_queue_unlink(struct re + } + + spin_unlock(&queue->syn_wait_lock); +- if (del_timer_sync(&req->rsk_timer)) ++ if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + return found; + } diff --git a/queue-4.1/mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch b/queue-4.1/mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch new file mode 100644 index 00000000000..d422f97288e --- /dev/null +++ b/queue-4.1/mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch @@ -0,0 +1,41 @@ +From 53960059d56ecef67d4ddd546731623641a3d2d1 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Fri, 27 Mar 2015 08:33:43 +0000 +Subject: MIPS: dma-default: Fix 32-bit fall back to GFP_DMA + +From: James Hogan + +commit 53960059d56ecef67d4ddd546731623641a3d2d1 upstream. + +If there is a DMA zone (usually 24bit = 16MB I believe), but no DMA32 +zone, as is the case for some 32-bit kernels, then massage_gfp_flags() +will cause DMA memory allocated for devices with a 32..63-bit +coherent_dma_mask to fall back to using __GFP_DMA, even though there may +only be 32-bits of physical address available anyway. + +Correct that case to compare against a mask the size of phys_addr_t +instead of always using a 64-bit mask. + +Signed-off-by: James Hogan +Fixes: a2e715a86c6d ("MIPS: DMA: Fix computation of DMA flags from device's coherent_dma_mask.") +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9610/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/dma-default.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/mm/dma-default.c ++++ b/arch/mips/mm/dma-default.c +@@ -100,7 +100,7 @@ static gfp_t massage_gfp_flags(const str + else + #endif + #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32) +- if (dev->coherent_dma_mask < DMA_BIT_MASK(64)) ++ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8)) + dma_flag = __GFP_DMA; + else + #endif diff --git a/queue-4.1/powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch b/queue-4.1/powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch new file mode 100644 index 00000000000..890a0e3fa34 --- /dev/null +++ b/queue-4.1/powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch @@ -0,0 +1,169 @@ +From e297c939b745e420ef0b9dc989cb87bda617b399 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Thu, 10 Sep 2015 14:36:21 +1000 +Subject: powerpc/MSI: Fix race condition in tearing down MSI interrupts + +From: Paul Mackerras + +commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream. + +This fixes a race which can result in the same virtual IRQ number +being assigned to two different MSI interrupts. The most visible +consequence of that is usually a warning and stack trace from the +sysfs code about an attempt to create a duplicate entry in sysfs. + +The race happens when one CPU (say CPU 0) is disposing of an MSI +while another CPU (say CPU 1) is setting up an MSI. CPU 0 calls +(for example) pnv_teardown_msi_irqs(), which calls +msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its +hardware IRQ number) is no longer in use. Then, before CPU 0 gets +to calling irq_dispose_mapping() to free up the virtal IRQ number, +CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an +MSI, and gets the same hardware IRQ number that CPU 0 just freed. +CPU 1 then calls irq_create_mapping() to get a virtual IRQ number, +which sees that there is currently a mapping for that hardware IRQ +number and returns the corresponding virtual IRQ number (which is +the same virtual IRQ number that CPU 0 was using). CPU 0 then +calls irq_dispose_mapping() and frees that virtual IRQ number. +Now, if another CPU comes along and calls irq_create_mapping(), it +is likely to get the virtual IRQ number that was just freed, +resulting in the same virtual IRQ number apparently being used for +two different hardware interrupts. + +To fix this race, we just move the call to msi_bitmap_free_hwirqs() +to after the call to irq_dispose_mapping(). Since virq_to_hw() +doesn't work for the virtual IRQ number after irq_dispose_mapping() +has been called, we need to call it before irq_dispose_mapping() and +remember the result for the msi_bitmap_free_hwirqs() call. + +The pattern of calling msi_bitmap_free_hwirqs() before +irq_dispose_mapping() appears in 5 places under arch/powerpc, and +appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC +U3/U4 MSI backend") from 2007. + +Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend") +Reported-by: Alexey Kardashevskiy +Signed-off-by: Paul Mackerras +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/powerpc/platforms/powernv/pci.c | 5 +++-- + arch/powerpc/sysdev/fsl_msi.c | 5 +++-- + arch/powerpc/sysdev/mpic_pasemi_msi.c | 6 ++++-- + arch/powerpc/sysdev/mpic_u3msi.c | 5 +++-- + arch/powerpc/sysdev/ppc4xx_msi.c | 5 +++-- + 5 files changed, 16 insertions(+), 10 deletions(-) + +--- a/arch/powerpc/platforms/powernv/pci.c ++++ b/arch/powerpc/platforms/powernv/pci.c +@@ -99,6 +99,7 @@ static void pnv_teardown_msi_irqs(struct + struct pci_controller *hose = pci_bus_to_host(pdev->bus); + struct pnv_phb *phb = hose->private_data; + struct msi_desc *entry; ++ irq_hw_number_t hwirq; + + if (WARN_ON(!phb)) + return; +@@ -106,10 +107,10 @@ static void pnv_teardown_msi_irqs(struct + list_for_each_entry(entry, &pdev->msi_list, list) { + if (entry->irq == NO_IRQ) + continue; ++ hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); +- msi_bitmap_free_hwirqs(&phb->msi_bmp, +- virq_to_hw(entry->irq) - phb->msi_base, 1); + irq_dispose_mapping(entry->irq); ++ msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1); + } + } + #endif /* CONFIG_PCI_MSI */ +--- a/arch/powerpc/sysdev/fsl_msi.c ++++ b/arch/powerpc/sysdev/fsl_msi.c +@@ -128,15 +128,16 @@ static void fsl_teardown_msi_irqs(struct + { + struct msi_desc *entry; + struct fsl_msi *msi_data; ++ irq_hw_number_t hwirq; + + list_for_each_entry(entry, &pdev->msi_list, list) { + if (entry->irq == NO_IRQ) + continue; ++ hwirq = virq_to_hw(entry->irq); + msi_data = irq_get_chip_data(entry->irq); + irq_set_msi_desc(entry->irq, NULL); +- msi_bitmap_free_hwirqs(&msi_data->bitmap, +- virq_to_hw(entry->irq), 1); + irq_dispose_mapping(entry->irq); ++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1); + } + + return; +--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c ++++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c +@@ -65,6 +65,7 @@ static struct irq_chip mpic_pasemi_msi_c + static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev) + { + struct msi_desc *entry; ++ irq_hw_number_t hwirq; + + pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev); + +@@ -72,10 +73,11 @@ static void pasemi_msi_teardown_msi_irqs + if (entry->irq == NO_IRQ) + continue; + ++ hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); +- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, +- virq_to_hw(entry->irq), ALLOC_CHUNK); + irq_dispose_mapping(entry->irq); ++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, ++ hwirq, ALLOC_CHUNK); + } + + return; +--- a/arch/powerpc/sysdev/mpic_u3msi.c ++++ b/arch/powerpc/sysdev/mpic_u3msi.c +@@ -107,15 +107,16 @@ static u64 find_u4_magic_addr(struct pci + static void u3msi_teardown_msi_irqs(struct pci_dev *pdev) + { + struct msi_desc *entry; ++ irq_hw_number_t hwirq; + + list_for_each_entry(entry, &pdev->msi_list, list) { + if (entry->irq == NO_IRQ) + continue; + ++ hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); +- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, +- virq_to_hw(entry->irq), 1); + irq_dispose_mapping(entry->irq); ++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1); + } + + return; +--- a/arch/powerpc/sysdev/ppc4xx_msi.c ++++ b/arch/powerpc/sysdev/ppc4xx_msi.c +@@ -124,16 +124,17 @@ void ppc4xx_teardown_msi_irqs(struct pci + { + struct msi_desc *entry; + struct ppc4xx_msi *msi_data = &ppc4xx_msi; ++ irq_hw_number_t hwirq; + + dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n"); + + list_for_each_entry(entry, &dev->msi_list, list) { + if (entry->irq == NO_IRQ) + continue; ++ hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); +- msi_bitmap_free_hwirqs(&msi_data->bitmap, +- virq_to_hw(entry->irq), 1); + irq_dispose_mapping(entry->irq); ++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1); + } + } + diff --git a/queue-4.1/rsi-fix-possible-leak-when-loading-firmware.patch b/queue-4.1/rsi-fix-possible-leak-when-loading-firmware.patch new file mode 100644 index 00000000000..6b7f239ac83 --- /dev/null +++ b/queue-4.1/rsi-fix-possible-leak-when-loading-firmware.patch @@ -0,0 +1,73 @@ +From a8b9774571d46506a0774b1ced3493b1245cf893 Mon Sep 17 00:00:00 2001 +From: Christian Engelmayer +Date: Fri, 21 Aug 2015 23:14:26 +0200 +Subject: rsi: Fix possible leak when loading firmware + +From: Christian Engelmayer + +commit a8b9774571d46506a0774b1ced3493b1245cf893 upstream. + +Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory +leak fix and fix the leak") also added a check on the allocation of +DMA-accessible memory that may directly return. In that case the +already allocated firmware data is leaked. Make sure the data is +always freed correctly. Detected by Coverity CID 1316519. + +Fixes: 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak") +Signed-off-by: Christian Engelmayer +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 ++++++-- + drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 8 ++++++-- + 2 files changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c +@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(stru + + /* Copy firmware into DMA-accessible memory */ + fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); +- if (!fw) +- return -ENOMEM; ++ if (!fw) { ++ status = -ENOMEM; ++ goto out; ++ } + len = fw_entry->size; + + if (len % 4) +@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(stru + + status = rsi_copy_to_card(common, fw, len, num_blocks); + kfree(fw); ++ ++out: + release_firmware(fw_entry); + return status; + } +--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c +@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(stru + + /* Copy firmware into DMA-accessible memory */ + fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); +- if (!fw) +- return -ENOMEM; ++ if (!fw) { ++ status = -ENOMEM; ++ goto out; ++ } + len = fw_entry->size; + + if (len % 4) +@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(stru + + status = rsi_copy_to_card(common, fw, len, num_blocks); + kfree(fw); ++ ++out: + release_firmware(fw_entry); + return status; + } diff --git a/queue-4.1/series b/queue-4.1/series index 65ce3667560..a6f59bef06a 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -148,4 +148,23 @@ ipr-enable-sis-pipe-commands-for-sis-32-devices.patch regmap-debugfs-ensure-we-don-t-underflow-when-printing-access-masks.patch regmap-debugfs-don-t-bother-actually-printing-when-calculating-max-length.patch security-fix-typo-in-security_task_prctl.patch -dts-imx6-fix-sd-card-gpio-polarity-specified-in-device-tree.patch +usb-musb-dsps-fix-polling-in-device-only-mode.patch +usb-chipidea-udc-using-the-correct-stall-implementation.patch +usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch +usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch +usb-musb-cppi41-allow-it-to-work-again.patch +usb-chaoskey-read-offset-bug.patch +usb-add-device-quirk-for-logitech-ptz-cameras.patch +usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch +cpu-cacheinfo-fix-teardown-path.patch +cpufreq-dt-tolerance-applies-on-both-sides-of-target-voltage.patch +mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch +batman-adv-make-nc-capability-changes-atomic.patch +batman-adv-make-tt-capability-changes-atomic.patch +batman-adv-make-mcast-capability-changes-atomic.patch +batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch +batman-adv-fix-potentially-broken-skb-network-header-access.patch +tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch +powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch +rsi-fix-possible-leak-when-loading-firmware.patch +inet-fix-potential-deadlock-in-reqsk_queue_unlink.patch diff --git a/queue-4.1/tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch b/queue-4.1/tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch new file mode 100644 index 00000000000..dae14d67be8 --- /dev/null +++ b/queue-4.1/tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch @@ -0,0 +1,90 @@ +From c2e4b24ff848bb180f9b9cd873a38327cd219ad2 Mon Sep 17 00:00:00 2001 +From: Kapileshwar Singh +Date: Tue, 22 Sep 2015 14:22:03 +0100 +Subject: tools lib traceevent: Fix string handling in heterogeneous arch environments + +From: Kapileshwar Singh + +commit c2e4b24ff848bb180f9b9cd873a38327cd219ad2 upstream. + +When a trace recorded on a 32-bit device is processed with a 64-bit +binary, the higher 32-bits of the address need to ignored. + +The lack of this results in the output of the 64-bit pointer +value to the trace as the 32-bit address lookup fails in find_printk(). + +Before: + + burn-1778 [003] 548.600305: bputs: 0xc0046db2s: 2cec5c058d98c + +After: + + burn-1778 [003] 548.600305: bputs: 0xc0046db2s: RT throttling activated + +The problem occurs in PRINT_FIELD when the field is recognized as a +pointer to a string (of the type const char *) + +Heterogeneous architectures cases below can arise and should be handled: + +* Traces recorded using 32-bit addresses processed on a 64-bit machine +* Traces recorded using 64-bit addresses processed on a 32-bit machine + +Reported-by: Juri Lelli +Signed-off-by: Kapileshwar Singh +Reviewed-by: Steven Rostedt +Cc: David Ahern +Cc: Javi Merino +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lkml.kernel.org/r/1442928123-13824-1-git-send-email-kapileshwar.singh@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/lib/traceevent/event-parse.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -3721,7 +3721,7 @@ static void print_str_arg(struct trace_s + struct format_field *field; + struct printk_map *printk; + long long val, fval; +- unsigned long addr; ++ unsigned long long addr; + char *str; + unsigned char *hex; + int print; +@@ -3754,13 +3754,30 @@ static void print_str_arg(struct trace_s + */ + if (!(field->flags & FIELD_IS_ARRAY) && + field->size == pevent->long_size) { +- addr = *(unsigned long *)(data + field->offset); ++ ++ /* Handle heterogeneous recording and processing ++ * architectures ++ * ++ * CASE I: ++ * Traces recorded on 32-bit devices (32-bit ++ * addressing) and processed on 64-bit devices: ++ * In this case, only 32 bits should be read. ++ * ++ * CASE II: ++ * Traces recorded on 64 bit devices and processed ++ * on 32-bit devices: ++ * In this case, 64 bits must be read. ++ */ ++ addr = (pevent->long_size == 8) ? ++ *(unsigned long long *)(data + field->offset) : ++ (unsigned long long)*(unsigned int *)(data + field->offset); ++ + /* Check if it matches a print format */ + printk = find_printk(pevent, addr); + if (printk) + trace_seq_puts(s, printk->printk); + else +- trace_seq_printf(s, "%lx", addr); ++ trace_seq_printf(s, "%llx", addr); + break; + } + str = malloc(len + 1); diff --git a/queue-4.1/usb-add-device-quirk-for-logitech-ptz-cameras.patch b/queue-4.1/usb-add-device-quirk-for-logitech-ptz-cameras.patch new file mode 100644 index 00000000000..b87034956de --- /dev/null +++ b/queue-4.1/usb-add-device-quirk-for-logitech-ptz-cameras.patch @@ -0,0 +1,45 @@ +From 72194739f54607bbf8cfded159627a2015381557 Mon Sep 17 00:00:00 2001 +From: Vincent Palatin +Date: Thu, 1 Oct 2015 14:10:22 -0700 +Subject: usb: Add device quirk for Logitech PTZ cameras + +From: Vincent Palatin + +commit 72194739f54607bbf8cfded159627a2015381557 upstream. + +Add a device quirk for the Logitech PTZ Pro Camera and its sibling the +ConferenceCam CC3000e Camera. +This fixes the failed camera enumeration on some boot, particularly on +machines with fast CPU. + +Tested by connecting a Logitech PTZ Pro Camera to a machine with a +Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles +while recording the kernel logs and taking camera picture after each boot. +Before the patch, more than 7% of the boots show some enumeration transfer +failures and in a few of them, the kernel is giving up before actually +enumerating the webcam. After the patch, the enumeration has been correct +on every reboot. + +Signed-off-by: Vincent Palatin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* Logitech ConferenceCam CC3000e */ ++ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT }, ++ ++ /* Logitech PTZ Pro Camera */ ++ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Logitech Quickcam Fusion */ + { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.1/usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch b/queue-4.1/usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch new file mode 100644 index 00000000000..9fd9349857b --- /dev/null +++ b/queue-4.1/usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch @@ -0,0 +1,34 @@ +From 8484bf2981b3d006426ac052a3642c9ce1d8d980 Mon Sep 17 00:00:00 2001 +From: Yao-Wen Mao +Date: Mon, 31 Aug 2015 14:24:09 +0800 +Subject: USB: Add reset-resume quirk for two Plantronics usb headphones. + +From: Yao-Wen Mao + +commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream. + +These two headphones need a reset-resume quirk to properly resume to +original volume level. + +Signed-off-by: Yao-Wen Mao +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -85,6 +85,12 @@ static const struct usb_device_id usb_qu + /* Philips PSC805 audio device */ + { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Plantronic Audio 655 DSP */ ++ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME }, ++ ++ /* Plantronic Audio 648 USB */ ++ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Artisman Watchdog Dongle */ + { USB_DEVICE(0x04b4, 0x0526), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-4.1/usb-chaoskey-read-offset-bug.patch b/queue-4.1/usb-chaoskey-read-offset-bug.patch new file mode 100644 index 00000000000..db3024ec27f --- /dev/null +++ b/queue-4.1/usb-chaoskey-read-offset-bug.patch @@ -0,0 +1,30 @@ +From 1d5c47f555c5ae050fad22e4a99f88856cae5d05 Mon Sep 17 00:00:00 2001 +From: Alexander Inyukhin +Date: Sat, 26 Sep 2015 15:24:21 +0300 +Subject: USB: chaoskey read offset bug + +From: Alexander Inyukhin + +commit 1d5c47f555c5ae050fad22e4a99f88856cae5d05 upstream. + +Rng reads in chaoskey driver could return the same data under +the certain conditions. + +Signed-off-by: Alexander Inyukhin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/chaoskey.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/chaoskey.c ++++ b/drivers/usb/misc/chaoskey.c +@@ -472,7 +472,7 @@ static int chaoskey_rng_read(struct hwrn + if (this_time > max) + this_time = max; + +- memcpy(data, dev->buf, this_time); ++ memcpy(data, dev->buf + dev->used, this_time); + + dev->used += this_time; + diff --git a/queue-4.1/usb-chipidea-udc-using-the-correct-stall-implementation.patch b/queue-4.1/usb-chipidea-udc-using-the-correct-stall-implementation.patch new file mode 100644 index 00000000000..fd4516a324b --- /dev/null +++ b/queue-4.1/usb-chipidea-udc-using-the-correct-stall-implementation.patch @@ -0,0 +1,160 @@ +From 56ffa1d154c7e12af16273f0cdc42690dd05caf5 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Mon, 24 Aug 2015 14:10:07 +0800 +Subject: usb: chipidea: udc: using the correct stall implementation + +From: Peter Chen + +commit 56ffa1d154c7e12af16273f0cdc42690dd05caf5 upstream. + +According to spec, there are functional and protocol stalls. + +For functional stall, it is for bulk and interrupt endpoints, +below are cases for it: +- Host sends SET_FEATURE request for Set-Halt, the udc driver +needs to set stall, and return true unconditionally. +- The gadget driver may call usb_ep_set_halt to stall certain +endpoints, if there is a transfer in pending, the udc driver +should not set stall, and return -EAGAIN accordingly. +These two kinds of stall need to be cleared by host using CLEAR_FEATURE +request (Clear-Halt). + +For protocol stall, it is for control endpoint, this stall will +be set if the control request has failed. This stall will be +cleared by next setup request (hardware will do it). + +It fixed usbtest (drivers/usb/misc/usbtest.c) Test 13 "set/clear halt" +test failure, meanwhile, this change has been verified by +USB2 CV Compliance Test and MSC Tests. + +Cc: Alan Stern +Cc: Felipe Balbi +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 84 +++++++++++++++++++++++---------------------- + 1 file changed, 44 insertions(+), 40 deletions(-) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -656,6 +656,44 @@ __acquires(hwep->lock) + return 0; + } + ++static int _ep_set_halt(struct usb_ep *ep, int value, bool check_transfer) ++{ ++ struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); ++ int direction, retval = 0; ++ unsigned long flags; ++ ++ if (ep == NULL || hwep->ep.desc == NULL) ++ return -EINVAL; ++ ++ if (usb_endpoint_xfer_isoc(hwep->ep.desc)) ++ return -EOPNOTSUPP; ++ ++ spin_lock_irqsave(hwep->lock, flags); ++ ++ if (value && hwep->dir == TX && check_transfer && ++ !list_empty(&hwep->qh.queue) && ++ !usb_endpoint_xfer_control(hwep->ep.desc)) { ++ spin_unlock_irqrestore(hwep->lock, flags); ++ return -EAGAIN; ++ } ++ ++ direction = hwep->dir; ++ do { ++ retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value); ++ ++ if (!value) ++ hwep->wedge = 0; ++ ++ if (hwep->type == USB_ENDPOINT_XFER_CONTROL) ++ hwep->dir = (hwep->dir == TX) ? RX : TX; ++ ++ } while (hwep->dir != direction); ++ ++ spin_unlock_irqrestore(hwep->lock, flags); ++ return retval; ++} ++ ++ + /** + * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts + * @gadget: gadget +@@ -1051,7 +1089,7 @@ __acquires(ci->lock) + num += ci->hw_ep_max / 2; + + spin_unlock(&ci->lock); +- err = usb_ep_set_halt(&ci->ci_hw_ep[num].ep); ++ err = _ep_set_halt(&ci->ci_hw_ep[num].ep, 1, false); + spin_lock(&ci->lock); + if (!err) + isr_setup_status_phase(ci); +@@ -1110,8 +1148,8 @@ delegate: + + if (err < 0) { + spin_unlock(&ci->lock); +- if (usb_ep_set_halt(&hwep->ep)) +- dev_err(ci->dev, "error: ep_set_halt\n"); ++ if (_ep_set_halt(&hwep->ep, 1, false)) ++ dev_err(ci->dev, "error: _ep_set_halt\n"); + spin_lock(&ci->lock); + } + } +@@ -1142,9 +1180,9 @@ __acquires(ci->lock) + err = isr_setup_status_phase(ci); + if (err < 0) { + spin_unlock(&ci->lock); +- if (usb_ep_set_halt(&hwep->ep)) ++ if (_ep_set_halt(&hwep->ep, 1, false)) + dev_err(ci->dev, +- "error: ep_set_halt\n"); ++ "error: _ep_set_halt\n"); + spin_lock(&ci->lock); + } + } +@@ -1390,41 +1428,7 @@ static int ep_dequeue(struct usb_ep *ep, + */ + static int ep_set_halt(struct usb_ep *ep, int value) + { +- struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); +- int direction, retval = 0; +- unsigned long flags; +- +- if (ep == NULL || hwep->ep.desc == NULL) +- return -EINVAL; +- +- if (usb_endpoint_xfer_isoc(hwep->ep.desc)) +- return -EOPNOTSUPP; +- +- spin_lock_irqsave(hwep->lock, flags); +- +-#ifndef STALL_IN +- /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */ +- if (value && hwep->type == USB_ENDPOINT_XFER_BULK && hwep->dir == TX && +- !list_empty(&hwep->qh.queue)) { +- spin_unlock_irqrestore(hwep->lock, flags); +- return -EAGAIN; +- } +-#endif +- +- direction = hwep->dir; +- do { +- retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value); +- +- if (!value) +- hwep->wedge = 0; +- +- if (hwep->type == USB_ENDPOINT_XFER_CONTROL) +- hwep->dir = (hwep->dir == TX) ? RX : TX; +- +- } while (hwep->dir != direction); +- +- spin_unlock_irqrestore(hwep->lock, flags); +- return retval; ++ return _ep_set_halt(ep, value, true); + } + + /** diff --git a/queue-4.1/usb-musb-cppi41-allow-it-to-work-again.patch b/queue-4.1/usb-musb-cppi41-allow-it-to-work-again.patch new file mode 100644 index 00000000000..253ab0c3be7 --- /dev/null +++ b/queue-4.1/usb-musb-cppi41-allow-it-to-work-again.patch @@ -0,0 +1,54 @@ +From b0a688ddcc5015eb26000c63841db7c46cfb380a Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Thu, 6 Aug 2015 10:51:29 -0500 +Subject: usb: musb: cppi41: allow it to work again + +From: Felipe Balbi + +commit b0a688ddcc5015eb26000c63841db7c46cfb380a upstream. + +since commit 33c300cb90a6 ("usb: musb: dsps: +don't fake of_node to musb core") we have been +preventing CPPI 4.1 from probing due to NULL +of_node. We can't revert said commit otherwise +a different regression would show up, so the fix +is to look for the parent device's (glue layer's) +of_node instead, since that's the thing which +is actually described in DTS. + +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_cppi41.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -614,7 +614,7 @@ static int cppi41_dma_controller_start(s + { + struct musb *musb = controller->musb; + struct device *dev = musb->controller; +- struct device_node *np = dev->of_node; ++ struct device_node *np = dev->parent->of_node; + struct cppi41_dma_channel *cppi41_channel; + int count; + int i; +@@ -664,7 +664,7 @@ static int cppi41_dma_controller_start(s + musb_dma->status = MUSB_DMA_STATUS_FREE; + musb_dma->max_len = SZ_4M; + +- dc = dma_request_slave_channel(dev, str); ++ dc = dma_request_slave_channel(dev->parent, str); + if (!dc) { + dev_err(dev, "Failed to request %s.\n", str); + ret = -EPROBE_DEFER; +@@ -694,7 +694,7 @@ struct dma_controller *dma_controller_cr + struct cppi41_dma_controller *controller; + int ret = 0; + +- if (!musb->controller->of_node) { ++ if (!musb->controller->parent->of_node) { + dev_err(musb->controller, "Need DT for the DMA engine.\n"); + return NULL; + } diff --git a/queue-4.1/usb-musb-dsps-fix-polling-in-device-only-mode.patch b/queue-4.1/usb-musb-dsps-fix-polling-in-device-only-mode.patch new file mode 100644 index 00000000000..db2a1573c00 --- /dev/null +++ b/queue-4.1/usb-musb-dsps-fix-polling-in-device-only-mode.patch @@ -0,0 +1,38 @@ +From b8239dcc03afbd0886c1d9b91ba8fee7c6c9a6cb Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Wed, 16 Sep 2015 14:49:28 -0500 +Subject: usb: musb: dsps: fix polling in device-only mode + +From: Bin Liu + +commit b8239dcc03afbd0886c1d9b91ba8fee7c6c9a6cb upstream. + +Fix the regression caused by commit ad78c918602 ("usb: musb: dsps: just +start polling already") which causes polling the ID pin status even in +device-only mode. + +Fixes: ad78c918602c ("usb: musb: dsps: just start polling already") +Signed-off-by: Bin Liu +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_dsps.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/musb/musb_dsps.c ++++ b/drivers/usb/musb/musb_dsps.c +@@ -225,8 +225,11 @@ static void dsps_musb_enable(struct musb + + dsps_writel(reg_base, wrp->epintr_set, epmask); + dsps_writel(reg_base, wrp->coreintr_set, coremask); +- /* start polling for ID change. */ +- mod_timer(&glue->timer, jiffies + msecs_to_jiffies(wrp->poll_timeout)); ++ /* start polling for ID change in dual-role idle mode */ ++ if (musb->xceiv->otg->state == OTG_STATE_B_IDLE && ++ musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE) ++ mod_timer(&glue->timer, jiffies + ++ msecs_to_jiffies(wrp->poll_timeout)); + dsps_musb_try_idle(musb, 0); + } + diff --git a/queue-4.1/usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch b/queue-4.1/usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch new file mode 100644 index 00000000000..74104231d7e --- /dev/null +++ b/queue-4.1/usb-phy-phy-generic-fix-reset-behaviour-on-legacy-boot.patch @@ -0,0 +1,38 @@ +From 762982db33b23029e98c844611e2e8beeb75bc0d Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Thu, 13 Aug 2015 13:28:42 +0300 +Subject: usb: phy: phy-generic: Fix reset behaviour on legacy boot + +From: Roger Quadros + +commit 762982db33b23029e98c844611e2e8beeb75bc0d upstream. + +The gpio-desc migration done in v4.0 caused a regression +with legacy boots due to reversed reset logic. +e.g. omap3-beagle USB host breaks on legacy boot. + +Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that +it matches the driver logic and pin behaviour. + +Fixes: e9f2cefb0cdc ("usb: phy: generic: migrate to gpio_desc") +Tested-by: Fabio Estevam +Signed-off-by: Roger Quadros +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/phy/phy-generic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/phy/phy-generic.c ++++ b/drivers/usb/phy/phy-generic.c +@@ -230,7 +230,8 @@ int usb_phy_gen_create_phy(struct device + clk_rate = pdata->clk_rate; + needs_vcc = pdata->needs_vcc; + if (gpio_is_valid(pdata->gpio_reset)) { +- err = devm_gpio_request_one(dev, pdata->gpio_reset, 0, ++ err = devm_gpio_request_one(dev, pdata->gpio_reset, ++ GPIOF_ACTIVE_LOW, + dev_name(dev)); + if (!err) + nop->gpiod_reset = diff --git a/queue-4.1/usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch b/queue-4.1/usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch new file mode 100644 index 00000000000..8091f90e524 --- /dev/null +++ b/queue-4.1/usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch @@ -0,0 +1,47 @@ +From ff30cbc8da425754e8ab96904db1d295bd034f27 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 21 Sep 2015 17:46:09 +0300 +Subject: usb: Use the USB_SS_MULT() macro to get the burst multiplier. + +From: Mathias Nyman + +commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream. + +Bits 1:0 of the bmAttributes are used for the burst multiplier. +The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7 +into use. + +Use the existing USB_SS_MULT() macro instead to make sure the mult value +and hence max packet calculations are correct for USB3.1 devices. + +Note that burst multiplier in bmAttributes is zero based and that +the USB_SS_MULT() macro adds one. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -112,7 +112,7 @@ static void usb_parse_ss_endpoint_compan + cfgno, inum, asnum, ep->desc.bEndpointAddress); + ep->ss_ep_comp.bmAttributes = 16; + } else if (usb_endpoint_xfer_isoc(&ep->desc) && +- desc->bmAttributes > 2) { ++ USB_SS_MULT(desc->bmAttributes) > 3) { + dev_warn(ddev, "Isoc endpoint has Mult of %d in " + "config %d interface %d altsetting %d ep %d: " + "setting to 3\n", desc->bmAttributes + 1, +@@ -121,7 +121,8 @@ static void usb_parse_ss_endpoint_compan + } + + if (usb_endpoint_xfer_isoc(&ep->desc)) +- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) * ++ max_tx = (desc->bMaxBurst + 1) * ++ (USB_SS_MULT(desc->bmAttributes)) * + usb_endpoint_maxp(&ep->desc); + else if (usb_endpoint_xfer_int(&ep->desc)) + max_tx = usb_endpoint_maxp(&ep->desc) *