--- /dev/null
+From 90cfde46586d2286488d8ed636929e936c0c9ab2 Mon Sep 17 00:00:00 2001
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Date: Tue, 22 Dec 2015 17:29:16 +0100
+Subject: can: ems_usb: Fix possible tx overflow
+
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+
+commit 90cfde46586d2286488d8ed636929e936c0c9ab2 upstream.
+
+This patch fixes the problem that more CAN messages could be sent to the
+interface as could be send on the CAN bus. This was more likely for slow baud
+rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
+heavy TX load this produced another bulk transfer without checking the
+free_slots variable and hence caused the overflow in the interface.
+
+Signed-off-by: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/ems_usb.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -118,6 +118,9 @@ MODULE_LICENSE("GPL v2");
+ */
+ #define EMS_USB_ARM7_CLOCK 8000000
+
++#define CPC_TX_QUEUE_TRIGGER_LOW 25
++#define CPC_TX_QUEUE_TRIGGER_HIGH 35
++
+ /*
+ * CAN-Message representation in a CPC_MSG. Message object type is
+ * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or
+@@ -279,6 +282,11 @@ static void ems_usb_read_interrupt_callb
+ switch (urb->status) {
+ case 0:
+ dev->free_slots = dev->intr_in_buffer[1];
++ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){
++ if (netif_queue_stopped(netdev)){
++ netif_wake_queue(netdev);
++ }
++ }
+ break;
+
+ case -ECONNRESET: /* unlink */
+@@ -530,8 +538,6 @@ static void ems_usb_write_bulk_callback(
+ /* Release context */
+ context->echo_index = MAX_TX_URBS;
+
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ /*
+@@ -591,7 +597,7 @@ static int ems_usb_start(struct ems_usb
+ int err, i;
+
+ dev->intr_in_buffer[0] = 0;
+- dev->free_slots = 15; /* initial size */
++ dev->free_slots = 50; /* initial size */
+
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+@@ -841,7 +847,7 @@ static netdev_tx_t ems_usb_start_xmit(st
+
+ /* Slow down tx path */
+ if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS ||
+- dev->free_slots < 5) {
++ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) {
+ netif_stop_queue(netdev);
+ }
+ }
--- /dev/null
+From 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <kernel@kyup.com>
+Date: Thu, 17 Dec 2015 18:03:35 +0200
+Subject: dm thin: fix race condition when destroying thin pool workqueue
+
+From: Nikolay Borisov <kernel@kyup.com>
+
+commit 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 upstream.
+
+When a thin pool is being destroyed delayed work items are
+cancelled using cancel_delayed_work(), which doesn't guarantee that on
+return the delayed item isn't running. This can cause the work item to
+requeue itself on an already destroyed workqueue. Fix this by using
+cancel_delayed_work_sync() which guarantees that on return the work item
+is not running anymore.
+
+Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second")
+Fixes: 85ad643b7e7e5 ("dm thin: add timeout to stop out-of-data-space mode holding IO forever")
+Signed-off-by: Nikolay Borisov <kernel@kyup.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2281,7 +2281,7 @@ static void pool_postsuspend(struct dm_t
+ struct pool_c *pt = ti->private;
+ struct pool *pool = pt->pool;
+
+- cancel_delayed_work(&pool->waker);
++ cancel_delayed_work_sync(&pool->waker);
+ flush_workqueue(pool->wq);
+ (void) commit_or_fallback(pool);
+ }
--- /dev/null
+From 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 9 Dec 2015 16:23:24 +0000
+Subject: dm thin metadata: fix bug when taking a metadata snapshot
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 upstream.
+
+When you take a metadata snapshot the btree roots for the mapping and
+details tree need to have their reference counts incremented so they
+persist for the lifetime of the metadata snap.
+
+The roots being incremented were those currently written in the
+superblock, which could possibly be out of date if concurrent IO is
+triggering new mappings, breaking of sharing, etc.
+
+Fix this by performing a commit with the metadata lock held while taking
+a metadata snapshot.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1191,6 +1191,12 @@ static int __reserve_metadata_snap(struc
+ dm_block_t held_root;
+
+ /*
++ * We commit to ensure the btree roots which we increment in a
++ * moment are up to date.
++ */
++ __commit_transaction(pmd);
++
++ /*
+ * Copy the superblock.
+ */
+ dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
--- /dev/null
+From 7f98ca454ad373fc1b76be804fa7138ff68c1d27 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 20 Aug 2015 10:13:55 +1000
+Subject: drm/radeon: fix hotplug race at startup
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 7f98ca454ad373fc1b76be804fa7138ff68c1d27 upstream.
+
+We apparantly get a hotplug irq before we've initialised
+modesetting,
+
+[drm] Loading R100 Microcode
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<c125f56f>] __mutex_lock_slowpath+0x23/0x91
+*pde = 00000000
+Oops: 0002 [#1]
+Modules linked in: radeon(+) drm_kms_helper ttm drm i2c_algo_bit backlight pcspkr psmouse evdev sr_mod input_leds led_class cdrom sg parport_pc parport floppy intel_agp intel_gtt lpc_ich acpi_cpufreq processor button mfd_core agpgart uhci_hcd ehci_hcd rng_core snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm usbcore usb_common i2c_i801 i2c_core snd_timer snd soundcore thermal_sys
+CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted 4.2.0-rc7-00015-gbf67402 #111
+Hardware name: MicroLink /D850MV , BIOS MV85010A.86A.0067.P24.0304081124 04/08/2003
+Workqueue: events radeon_hotplug_work_func [radeon]
+task: f6ca5900 ti: f6d3e000 task.ti: f6d3e000
+EIP: 0060:[<c125f56f>] EFLAGS: 00010282 CPU: 0
+EIP is at __mutex_lock_slowpath+0x23/0x91
+EAX: 00000000 EBX: f5e900fc ECX: 00000000 EDX: fffffffe
+ESI: f6ca5900 EDI: f5e90100 EBP: f5e90000 ESP: f6d3ff0c
+ DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
+CR0: 8005003b CR2: 00000000 CR3: 36f61000 CR4: 000006d0
+Stack:
+ f5e90100 00000000 c103c4c1 f6d2a5a0 f5e900fc f6df394c c125f162 f8b0faca
+ f6d2a5a0 c138ca00 f6df394c f7395600 c1034741 00d40000 00000000 f6d2a5a0
+ c138ca00 f6d2a5b8 c138ca10 c1034b58 00000001 f6d40000 f6ca5900 f6d0c940
+Call Trace:
+ [<c103c4c1>] ? dequeue_task_fair+0xa4/0xb7
+ [<c125f162>] ? mutex_lock+0x9/0xa
+ [<f8b0faca>] ? radeon_hotplug_work_func+0x17/0x57 [radeon]
+ [<c1034741>] ? process_one_work+0xfc/0x194
+ [<c1034b58>] ? worker_thread+0x18d/0x218
+ [<c10349cb>] ? rescuer_thread+0x1d5/0x1d5
+ [<c103742a>] ? kthread+0x7b/0x80
+ [<c12601c0>] ? ret_from_kernel_thread+0x20/0x30
+ [<c10373af>] ? init_completion+0x18/0x18
+Code: 42 08 e8 8e a6 dd ff c3 57 56 53 83 ec 0c 8b 35 48 f7 37 c1 8b 10 4a 74 1a 89 c3 8d 78 04 8b 40 08 89 63
+
+Reported-and-Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_irq_kms.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -73,6 +73,11 @@ static void radeon_hotplug_work_func(str
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ /* we can race here at startup, some boards seem to trigger
++ * hotplug irqs when they shouldn't. */
++ if (!rdev->mode_info.mode_config_initialized)
++ return;
++
+ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
--- /dev/null
+From 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 Mon Sep 17 00:00:00 2001
+From: Ingo Molnar <mingo@kernel.org>
+Date: Tue, 3 Mar 2015 07:34:33 +0100
+Subject: efi: Disable interrupts around EFI calls, not in the epilog/prolog calls
+
+From: Ingo Molnar <mingo@kernel.org>
+
+commit 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 upstream.
+
+Tapasweni Pathak reported that we do a kmalloc() in efi_call_phys_prolog()
+on x86-64 while having interrupts disabled, which is a big no-no, as
+kmalloc() can sleep.
+
+Solve this by removing the irq disabling from the prolog/epilog calls
+around EFI calls: it's unnecessary, as in this stage we are single
+threaded in the boot thread, and we don't ever execute this from
+interrupt contexts.
+
+Reported-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+[ luis: backported to 3.10: adjusted context ]
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/efi/efi.c | 7 +++++++
+ arch/x86/platform/efi/efi_32.c | 11 +++--------
+ arch/x86/platform/efi/efi_64.c | 3 ---
+ 3 files changed, 10 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -250,12 +250,19 @@ static efi_status_t __init phys_efi_set_
+ efi_memory_desc_t *virtual_map)
+ {
+ efi_status_t status;
++ unsigned long flags;
+
+ efi_call_phys_prelog();
++
++ /* Disable interrupts around EFI calls: */
++ local_irq_save(flags);
+ status = efi_call_phys4(efi_phys.set_virtual_address_map,
+ memory_map_size, descriptor_size,
+ descriptor_version, virtual_map);
++ local_irq_restore(flags);
++
+ efi_call_phys_epilog();
++
+ return status;
+ }
+
+--- a/arch/x86/platform/efi/efi_32.c
++++ b/arch/x86/platform/efi/efi_32.c
+@@ -33,19 +33,16 @@
+
+ /*
+ * To make EFI call EFI runtime service in physical addressing mode we need
+- * prelog/epilog before/after the invocation to disable interrupt, to
+- * claim EFI runtime service handler exclusively and to duplicate a memory in
+- * low memory space say 0 - 3G.
++ * prolog/epilog before/after the invocation to claim the EFI runtime service
++ * handler exclusively and to duplicate a memory mapping in low memory space,
++ * say 0 - 3G.
+ */
+
+-static unsigned long efi_rt_eflags;
+
+ void efi_call_phys_prelog(void)
+ {
+ struct desc_ptr gdt_descr;
+
+- local_irq_save(efi_rt_eflags);
+-
+ load_cr3(initial_page_table);
+ __flush_tlb_all();
+
+@@ -64,6 +61,4 @@ void efi_call_phys_epilog(void)
+
+ load_cr3(swapper_pg_dir);
+ __flush_tlb_all();
+-
+- local_irq_restore(efi_rt_eflags);
+ }
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -40,7 +40,6 @@
+ #include <asm/fixmap.h>
+
+ static pgd_t *save_pgd __initdata;
+-static unsigned long efi_flags __initdata;
+
+ static void __init early_code_mapping_set_exec(int executable)
+ {
+@@ -66,7 +65,6 @@ void __init efi_call_phys_prelog(void)
+ int n_pgds;
+
+ early_code_mapping_set_exec(1);
+- local_irq_save(efi_flags);
+
+ n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
+ save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
+@@ -90,7 +88,6 @@ void __init efi_call_phys_epilog(void)
+ set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
+ kfree(save_pgd);
+ __flush_tlb_all();
+- local_irq_restore(efi_flags);
+ early_code_mapping_set_exec(0);
+ }
+
--- /dev/null
+From a41cbe86df3afbc82311a1640e20858c0cd7e065 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <aglo@umich.edu>
+Date: Mon, 14 Sep 2015 19:54:36 -0400
+Subject: Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Olga Kornievskaia <aglo@umich.edu>
+
+commit a41cbe86df3afbc82311a1640e20858c0cd7e065 upstream.
+
+A test case is as the description says:
+open(foobar, O_WRONLY);
+sleep() --> reboot the server
+close(foobar)
+
+The bug is because in nfs4state.c in nfs4_reclaim_open_state() a few
+line before going to restart, there is
+clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &state->flags).
+
+NFS4CLNT_RECLAIM_NOGRACE is a flag for the client states not open
+owner states. Value of NFS4CLNT_RECLAIM_NOGRACE is 4 which is the
+value of NFS_O_WRONLY_STATE in nfs4_state->flags. So clearing it wipes
+out state and when we go to close it, “call_close” doesn’t get set as
+state flag is not set and CLOSE doesn’t go on the wire.
+
+Signed-off-by: Olga Kornievskaia <aglo@umich.edu>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1452,7 +1452,7 @@ restart:
+ }
+ spin_unlock(&state->state_lock);
+ nfs4_put_open_state(state);
+- clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
++ clear_bit(NFS_STATE_RECLAIM_NOGRACE,
+ &state->flags);
+ spin_lock(&sp->so_lock);
+ goto restart;
--- /dev/null
+From 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 Mon Sep 17 00:00:00 2001
+From: Hariprasad S <hariprasad@chelsio.com>
+Date: Fri, 11 Dec 2015 13:59:17 +0530
+Subject: iw_cxgb3: Fix incorrectly returning error on success
+
+From: Hariprasad S <hariprasad@chelsio.com>
+
+commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 upstream.
+
+The cxgb3_*_send() functions return NET_XMIT_ values, which are
+positive integers values. So don't treat positive return values
+as an error.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+[a pox on developers and maintainers who do not cc: stable for bug fixes like this - gregkh]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *
+ error = l2t_send(tdev, skb, l2e);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
+@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *
+ error = cxgb3_ofld_send(tdev, skb);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
--- /dev/null
+From 002374f371bd02df864cce1fe85d90dc5b292837 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:18 +0000
+Subject: MIPS: KVM: Fix ASID restoration logic
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 002374f371bd02df864cce1fe85d90dc5b292837 upstream.
+
+ASID restoration on guest resume should determine the guest execution
+mode based on the guest Status register rather than bit 30 of the guest
+PC.
+
+Fix the two places in locore.S that do this, loading the guest status
+from the cop0 area. Note, this assembly is specific to the trap &
+emulate implementation of KVM, so it doesn't need to check the
+supervisor bit as that mode is not implemented in the guest.
+
+Fixes: b680f70fc111 ("KVM/MIPS32: Entry point for trampolining to...")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_locore.S | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/mips/kvm/kvm_locore.S
++++ b/arch/mips/kvm/kvm_locore.S
+@@ -156,9 +156,11 @@ FEXPORT(__kvm_mips_vcpu_run)
+
+ FEXPORT(__kvm_mips_load_asid)
+ /* Set the ASID for the Guest Kernel */
+- sll t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */
+- /* addresses shift to 0x80000000 */
+- bltz t0, 1f /* If kernel */
++ PTR_L t0, VCPU_COP0(k1)
++ LONG_L t0, COP0_STATUS(t0)
++ andi t0, KSU_USER | ST0_ERL | ST0_EXL
++ xori t0, KSU_USER
++ bnez t0, 1f /* If kernel */
+ addiu t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */
+ addiu t1, k1, VCPU_GUEST_USER_ASID /* else user */
+ 1:
+@@ -442,9 +444,11 @@ __kvm_mips_return_to_guest:
+ mtc0 t0, CP0_EPC
+
+ /* Set the ASID for the Guest Kernel */
+- sll t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */
+- /* addresses shift to 0x80000000 */
+- bltz t0, 1f /* If kernel */
++ PTR_L t0, VCPU_COP0(k1)
++ LONG_L t0, COP0_STATUS(t0)
++ andi t0, KSU_USER | ST0_ERL | ST0_EXL
++ xori t0, KSU_USER
++ bnez t0, 1f /* If kernel */
+ addiu t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */
+ addiu t1, k1, VCPU_GUEST_USER_ASID /* else user */
+ 1:
--- /dev/null
+From c5c2a3b998f1ff5a586f9d37e154070b8d550d17 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:19 +0000
+Subject: MIPS: KVM: Fix CACHE immediate offset sign extension
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit c5c2a3b998f1ff5a586f9d37e154070b8d550d17 upstream.
+
+The immediate field of the CACHE instruction is signed, so ensure that
+it gets sign extended by casting it to an int16_t rather than just
+masking the low 16 bits.
+
+Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_mips_emul.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/kvm/kvm_mips_emul.c
++++ b/arch/mips/kvm/kvm_mips_emul.c
+@@ -935,7 +935,7 @@ kvm_mips_emulate_cache(uint32_t inst, ui
+
+ base = (inst >> 21) & 0x1f;
+ op_inst = (inst >> 16) & 0x1f;
+- offset = inst & 0xffff;
++ offset = (int16_t)inst;
+ cache = (inst >> 16) & 0x3;
+ op = (inst >> 18) & 0x7;
+
--- /dev/null
+From 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:20 +0000
+Subject: MIPS: KVM: Uninit VCPU in vcpu_create error path
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 upstream.
+
+If either of the memory allocations in kvm_arch_vcpu_create() fail, the
+vcpu which has been allocated and kvm_vcpu_init'd doesn't get uninit'd
+in the error handling path. Add a call to kvm_vcpu_uninit() to fix this.
+
+Fixes: 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_mips.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/kvm/kvm_mips.c
++++ b/arch/mips/kvm/kvm_mips.c
+@@ -308,7 +308,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
+
+ if (!gebase) {
+ err = -ENOMEM;
+- goto out_free_cpu;
++ goto out_uninit_cpu;
+ }
+ kvm_info("Allocated %d bytes for KVM Exception Handlers @ %p\n",
+ ALIGN(size, PAGE_SIZE), gebase);
+@@ -368,6 +368,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
+ out_free_gebase:
+ kfree(gebase);
+
++out_uninit_cpu:
++ kvm_vcpu_uninit(vcpu);
++
+ out_free_cpu:
+ kfree(vcpu);
+
--- /dev/null
+From undefined@pobox.com Mon Feb 29 22:02:13 2016
+From: Corey Wright <undefined@pobox.com>
+Date: Sun, 28 Feb 2016 02:42:39 -0600
+Subject: proc: Fix ptrace-based permission checks for accessing task maps
+To: stable@vger.kernel.org
+Cc: Jann Horn <jann@thejh.net>
+Message-ID: <20160228024239.c82b6c2db17c670611ee6b16@pobox.com>
+
+From: Corey Wright <undefined@pobox.com>
+
+Modify mm_access() calls in fs/proc/task_mmu.c and fs/proc/task_nommu.c to
+have the mode include PTRACE_MODE_FSCREDS so accessing /proc/pid/maps and
+/proc/pid/pagemap is not denied to all users.
+
+In backporting upstream commit caaee623 to pre-3.18 kernel versions it was
+overlooked that mm_access() is used in fs/proc/task_*mmu.c as those calls
+were removed in 3.18 (by upstream commit 29a40ace) and did not exist at the
+time of the original commit.
+
+Signed-off-by: Corey Wright <undefined@pobox.com>
+Acked-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/task_mmu.c | 4 ++--
+ fs/proc/task_nommu.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -170,7 +170,7 @@ static void *m_start(struct seq_file *m,
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_access(priv->task, PTRACE_MODE_READ);
++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
+ if (!mm || IS_ERR(mm))
+ return mm;
+ down_read(&mm->mmap_sem);
+@@ -1044,7 +1044,7 @@ static ssize_t pagemap_read(struct file
+ if (!pm.buffer)
+ goto out_task;
+
+- mm = mm_access(task, PTRACE_MODE_READ);
++ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
+ ret = PTR_ERR(mm);
+ if (!mm || IS_ERR(mm))
+ goto out_free;
+--- a/fs/proc/task_nommu.c
++++ b/fs/proc/task_nommu.c
+@@ -223,7 +223,7 @@ static void *m_start(struct seq_file *m,
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_access(priv->task, PTRACE_MODE_READ);
++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
+ if (!mm || IS_ERR(mm)) {
+ put_task_struct(priv->task);
+ priv->task = NULL;
drm-ast-initialized-data-needed-to-map-fbdev-memory.patch
netfilter-nf_conntrack-fix-rcu-race-in-nf_conntrack_find_get.patch
bcache-unregister-reboot-notifier-if-bcache-fails-to-unregister-device.patch
+tools-add-a-make-all-rule.patch
+drm-radeon-fix-hotplug-race-at-startup.patch
+efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch
+dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch
+dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch
+can-ems_usb-fix-possible-tx-overflow.patch
+usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch
+usb-option-add-support-for-sim7100e.patch
+usb-option-add-4g-lte-usb-modem-u901.patch
+proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch
+iw_cxgb3-fix-incorrectly-returning-error-on-success.patch
+mips-kvm-fix-asid-restoration-logic.patch
+mips-kvm-fix-cache-immediate-offset-sign-extension.patch
+mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch
+splice-sendfile-at-once-fails-for-big-files.patch
+failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch
+unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch
--- /dev/null
+From 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Wed, 6 May 2015 17:26:47 +0200
+Subject: splice: sendfile() at once fails for big files
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream.
+
+Using sendfile with below small program to get MD5 sums of some files,
+it appear that big files (over 64kbytes with 4k pages system) get a
+wrong MD5 sum while small files get the correct sum.
+This program uses sendfile() to send a file to an AF_ALG socket
+for hashing.
+
+/* md5sum2.c */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <linux/if_alg.h>
+
+int main(int argc, char **argv)
+{
+ int sk = socket(AF_ALG, SOCK_SEQPACKET, 0);
+ struct stat st;
+ struct sockaddr_alg sa = {
+ .salg_family = AF_ALG,
+ .salg_type = "hash",
+ .salg_name = "md5",
+ };
+ int n;
+
+ bind(sk, (struct sockaddr*)&sa, sizeof(sa));
+
+ for (n = 1; n < argc; n++) {
+ int size;
+ int offset = 0;
+ char buf[4096];
+ int fd;
+ int sko;
+ int i;
+
+ fd = open(argv[n], O_RDONLY);
+ sko = accept(sk, NULL, 0);
+ fstat(fd, &st);
+ size = st.st_size;
+ sendfile(sko, fd, &offset, size);
+ size = read(sko, buf, sizeof(buf));
+ for (i = 0; i < size; i++)
+ printf("%2.2x", buf[i]);
+ printf(" %s\n", argv[n]);
+ close(fd);
+ close(sko);
+ }
+ exit(0);
+}
+
+Test below is done using official linux patch files. First result is
+with a software based md5sum. Second result is with the program above.
+
+root@vgoip:~# ls -l patch-3.6.*
+-rw-r--r-- 1 root root 64011 Aug 24 12:01 patch-3.6.2.gz
+-rw-r--r-- 1 root root 94131 Aug 24 12:01 patch-3.6.3.gz
+
+root@vgoip:~# md5sum patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+root@vgoip:~# ./md5sum2 patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+5fd77b24e68bb24dcc72d6e57c64790e patch-3.6.3.gz
+
+After investivation, it appears that sendfile() sends the files by blocks
+of 64kbytes (16 times PAGE_SIZE). The problem is that at the end of each
+block, the SPLICE_F_MORE flag is missing, therefore the hashing operation
+is reset as if it was the end of the file.
+
+This patch adds SPLICE_F_MORE to the flags when more data is pending.
+
+With the patch applied, we get the correct sums:
+
+root@vgoip:~# md5sum patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+root@vgoip:~# ./md5sum2 patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/splice.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1189,7 +1189,7 @@ ssize_t splice_direct_to_actor(struct fi
+ long ret, bytes;
+ umode_t i_mode;
+ size_t len;
+- int i, flags;
++ int i, flags, more;
+
+ /*
+ * We require the input being a regular file, as we don't want to
+@@ -1232,6 +1232,7 @@ ssize_t splice_direct_to_actor(struct fi
+ * Don't block on output, we have to drain the direct pipe.
+ */
+ sd->flags &= ~SPLICE_F_NONBLOCK;
++ more = sd->flags & SPLICE_F_MORE;
+
+ while (len) {
+ size_t read_len;
+@@ -1245,6 +1246,15 @@ ssize_t splice_direct_to_actor(struct fi
+ sd->total_len = read_len;
+
+ /*
++ * If more data is pending, set SPLICE_F_MORE
++ * If this is the last data and SPLICE_F_MORE was not set
++ * initially, clears it.
++ */
++ if (read_len < len)
++ sd->flags |= SPLICE_F_MORE;
++ else if (!more)
++ sd->flags &= ~SPLICE_F_MORE;
++ /*
+ * NOTE: nonblocking mode only applies to the input. We
+ * must not do the output in nonblocking mode as then we
+ * could get stuck data in the internal pipe:
--- /dev/null
+From f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Wed, 11 Nov 2015 14:25:34 -0800
+Subject: tools: Add a "make all" rule
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream.
+
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonathan Cameron <jic23@kernel.org>
+Cc: Pali Rohar <pali.rohar@gmail.com>
+Cc: Roberta Dobrescu <roberta.dobrescu@gmail.com>
+Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+[ kamal: backport to 3.10-stable: build all tools for this version ]
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/Makefile | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -22,6 +22,10 @@ help:
+ @echo ' from the kernel command line to build and install one of'
+ @echo ' the tools above'
+ @echo ''
++ @echo ' $$ make tools/all'
++ @echo ''
++ @echo ' builds all tools.'
++ @echo ''
+ @echo ' $$ make tools/install'
+ @echo ''
+ @echo ' installs all tools.'
+@@ -50,6 +54,10 @@ selftests: FORCE
+ turbostat x86_energy_perf_policy: FORCE
+ $(call descend,power/x86/$@)
+
++all: cgroup cpupower firewire lguest \
++ perf selftests turbostat usb \
++ virtio vm net x86_energy_perf_policy
++
+ cpupower_install:
+ $(call descend,power/$(@:_install=),install)
+
--- /dev/null
+From 415e3d3e90ce9e18727e8843ae343eda5a58fad6 Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Wed, 3 Feb 2016 02:11:03 +0100
+Subject: unix: correctly track in-flight fds in sending process user_struct
+
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+
+commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 upstream.
+
+The commit referenced in the Fixes tag incorrectly accounted the number
+of in-flight fds over a unix domain socket to the original opener
+of the file-descriptor. This allows another process to arbitrary
+deplete the original file-openers resource limit for the maximum of
+open files. Instead the sending processes and its struct cred should
+be credited.
+
+To do so, we add a reference counted struct user_struct pointer to the
+scm_fp_list and use it to account for the number of inflight unix fds.
+
+Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets")
+Reported-by: David Herrmann <dh.herrmann@gmail.com>
+Cc: David Herrmann <dh.herrmann@gmail.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/af_unix.h | 4 ++--
+ include/net/scm.h | 1 +
+ net/core/scm.c | 7 +++++++
+ net/unix/af_unix.c | 4 ++--
+ net/unix/garbage.c | 8 ++++----
+ 5 files changed, 16 insertions(+), 8 deletions(-)
+
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -6,8 +6,8 @@
+ #include <linux/mutex.h>
+ #include <net/sock.h>
+
+-extern void unix_inflight(struct file *fp);
+-extern void unix_notinflight(struct file *fp);
++extern void unix_inflight(struct user_struct *user, struct file *fp);
++extern void unix_notinflight(struct user_struct *user, struct file *fp);
+ extern void unix_gc(void);
+ extern void wait_for_unix_gc(void);
+ extern struct sock *unix_get_socket(struct file *filp);
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -21,6 +21,7 @@ struct scm_creds {
+ struct scm_fp_list {
+ short count;
+ short max;
++ struct user_struct *user;
+ struct file *fp[SCM_MAX_FD];
+ };
+
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *c
+ *fplp = fpl;
+ fpl->count = 0;
+ fpl->max = SCM_MAX_FD;
++ fpl->user = NULL;
+ }
+ fpp = &fpl->fp[fpl->count];
+
+@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *c
+ *fpp++ = file;
+ fpl->count++;
+ }
++
++ if (!fpl->user)
++ fpl->user = get_uid(current_user());
++
+ return num;
+ }
+
+@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *sc
+ scm->fp = NULL;
+ for (i=fpl->count-1; i>=0; i--)
+ fput(fpl->fp[i]);
++ free_uid(fpl->user);
+ kfree(fpl);
+ }
+ }
+@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct sc
+ for (i = 0; i < fpl->count; i++)
+ get_file(fpl->fp[i]);
+ new_fpl->max = new_fpl->count;
++ new_fpl->user = get_uid(fpl->user);
+ }
+ return new_fpl;
+ }
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1466,7 +1466,7 @@ static void unix_detach_fds(struct scm_c
+ UNIXCB(skb).fp = NULL;
+
+ for (i = scm->fp->count-1; i >= 0; i--)
+- unix_notinflight(scm->fp->fp[i]);
++ unix_notinflight(scm->fp->user, scm->fp->fp[i]);
+ }
+
+ static void unix_destruct_scm(struct sk_buff *skb)
+@@ -1531,7 +1531,7 @@ static int unix_attach_fds(struct scm_co
+ return -ENOMEM;
+
+ for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
++ unix_inflight(scm->fp->user, scm->fp->fp[i]);
+ return max_level;
+ }
+
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file
+ * descriptor if it is for an AF_UNIX socket.
+ */
+
+-void unix_inflight(struct file *fp)
++void unix_inflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp)
+ }
+ unix_tot_inflight++;
+ }
+- fp->f_cred->user->unix_inflight++;
++ user->unix_inflight++;
+ spin_unlock(&unix_gc_lock);
+ }
+
+-void unix_notinflight(struct file *fp)
++void unix_notinflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -157,7 +157,7 @@ void unix_notinflight(struct file *fp)
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+ }
+- fp->f_cred->user->unix_inflight--;
++ user->unix_inflight--;
+ spin_unlock(&unix_gc_lock);
+ }
+
--- /dev/null
+From 6627ae19385283b89356a199d7f03c75ba35fb29 Mon Sep 17 00:00:00 2001
+From: Ken Lin <ken.lin@advantech.com.tw>
+Date: Mon, 1 Feb 2016 14:57:25 -0500
+Subject: USB: cp210x: add IDs for GE B650V3 and B850V3 boards
+
+From: Ken Lin <ken.lin@advantech.com.tw>
+
+commit 6627ae19385283b89356a199d7f03c75ba35fb29 upstream.
+
+Add USB ID for cp2104/5 devices on GE B650v3 and B850v3 boards.
+
+Signed-off-by: Ken Lin <ken.lin@advantech.com.tw>
+Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -162,6 +162,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
++ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
++ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
--- /dev/null
+From d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Fri, 12 Feb 2016 16:40:00 +0100
+Subject: USB: option: add "4G LTE usb-modem U901"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 upstream.
+
+Thomas reports:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=05c6 ProdID=6001 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Reported-by: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1135,6 +1135,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
++ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
--- /dev/null
+From 3158a8d416f4e1b79dcc867d67cb50013140772c Mon Sep 17 00:00:00 2001
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Date: Fri, 29 Jan 2016 00:07:30 +0300
+Subject: USB: option: add support for SIM7100E
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+commit 3158a8d416f4e1b79dcc867d67cb50013140772c upstream.
+
+$ lsusb:
+Bus 001 Device 101: ID 1e0e:9001 Qualcomm / Option
+
+$ usb-devices:
+T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=101 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 2
+P: Vendor=1e0e ProdID=9001 Rev= 2.32
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+The last interface (6) is used for Android Composite ADB interface.
+
+Serial port layout:
+0: QCDM/DIAG
+1: NMEA
+2: AT
+3: AT/PPP
+4: audio
+
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -315,6 +315,7 @@ static void option_instat_callback(struc
+ #define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
++#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */
+ #define ALINK_PRODUCT_PH300 0x9100
+ #define ALINK_PRODUCT_3GU 0x9200
+
+@@ -615,6 +616,10 @@ static const struct option_blacklist_inf
+ .reserved = BIT(3) | BIT(4),
+ };
+
++static const struct option_blacklist_info simcom_sim7100e_blacklist = {
++ .reserved = BIT(5) | BIT(6),
++};
++
+ static const struct option_blacklist_info telit_le910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(2),
+@@ -1645,6 +1650,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
++ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
projects / thirdparty / kernel / stable-queue.git / commitdiff
