From 966cb48993e0732808a45d7ffa0af074dcdda3f7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 27 Jun 2014 12:19:35 -0700 Subject: [PATCH] 3.15-stable patches added patches: applicom-dereferencing-null-on-error-path.patch arm-omap-replace-checks-for-config_usb_gadget_omap.patch block-virtio_blk-don-t-hold-spin-lock-during-world-switch.patch extcon-max14577-fix-probe-failure-on-successful-work-queue.patch extcon-max14577-properly-handle-regmap_irq_get_virq-error.patch extcon-max77693-fix-two-null-pointer-exceptions-on-missing-pdata.patch extcon-max8997-fix-null-pointer-exception-on-missing-pdata.patch imx-drm-fix-hdmi-hotplug-detection-initial-state.patch phy-exynos-mipi-video-fix-check-on-array-index.patch printk-of_serial-fix-serial-console-cessation-part-way-through-boot.patch staging-mt29f_spinand-terminate-of-match-table.patch staging-rtl8188eu-overflow-in-update_sta_support_rate.patch staging-tidspbridge-check-for-config_snd_omap_soc_mcbsp.patch usb-dwc3-gadget-clear-stall-when-disabling-endpoint.patch usb-ehci-avoid-bios-handover-on-the-hasee-e200.patch usb-gadget-rename-config_usb_gadget_pxa25x.patch usb-usbtest-add-a-timeout-for-scatter-gather-tests.patch usb-usbtest-fix-unlink-write-error-with-pattern-1.patch w1-do-not-unlock-unheld-list_mutex-in-__w1_remove_master_device.patch --- ...com-dereferencing-null-on-error-path.patch | 30 +++++++ ...ce-checks-for-config_usb_gadget_omap.patch | 86 ++++++++++++++++++ ...t-hold-spin-lock-during-world-switch.patch | 74 ++++++++++++++++ ...obe-failure-on-successful-work-queue.patch | 42 +++++++++ ...rly-handle-regmap_irq_get_virq-error.patch | 31 +++++++ ...-pointer-exceptions-on-missing-pdata.patch | 87 +++++++++++++++++++ ...l-pointer-exception-on-missing-pdata.patch | 32 +++++++ ...hdmi-hotplug-detection-initial-state.patch | 68 +++++++++++++++ ...-mipi-video-fix-check-on-array-index.patch | 36 ++++++++ ...sole-cessation-part-way-through-boot.patch | 85 ++++++++++++++++++ ...29f_spinand-terminate-of-match-table.patch | 32 +++++++ ...-overflow-in-update_sta_support_rate.patch | 43 +++++++++ ...-check-for-config_snd_omap_soc_mcbsp.patch | 46 ++++++++++ ...-clear-stall-when-disabling-endpoint.patch | 35 ++++++++ ...void-bios-handover-on-the-hasee-e200.patch | 61 +++++++++++++ ...dget-rename-config_usb_gadget_pxa25x.patch | 34 ++++++++ ...d-a-timeout-for-scatter-gather-tests.patch | 72 +++++++++++++++ ...ix-unlink-write-error-with-pattern-1.patch | 68 +++++++++++++++ ...t_mutex-in-__w1_remove_master_device.patch | 55 ++++++++++++ 19 files changed, 1017 insertions(+) create mode 100644 queue-3.15/applicom-dereferencing-null-on-error-path.patch create mode 100644 queue-3.15/arm-omap-replace-checks-for-config_usb_gadget_omap.patch create mode 100644 queue-3.15/block-virtio_blk-don-t-hold-spin-lock-during-world-switch.patch create mode 100644 queue-3.15/extcon-max14577-fix-probe-failure-on-successful-work-queue.patch create mode 100644 queue-3.15/extcon-max14577-properly-handle-regmap_irq_get_virq-error.patch create mode 100644 queue-3.15/extcon-max77693-fix-two-null-pointer-exceptions-on-missing-pdata.patch create mode 100644 queue-3.15/extcon-max8997-fix-null-pointer-exception-on-missing-pdata.patch create mode 100644 queue-3.15/imx-drm-fix-hdmi-hotplug-detection-initial-state.patch create mode 100644 queue-3.15/phy-exynos-mipi-video-fix-check-on-array-index.patch create mode 100644 queue-3.15/printk-of_serial-fix-serial-console-cessation-part-way-through-boot.patch create mode 100644 queue-3.15/staging-mt29f_spinand-terminate-of-match-table.patch create mode 100644 queue-3.15/staging-rtl8188eu-overflow-in-update_sta_support_rate.patch create mode 100644 queue-3.15/staging-tidspbridge-check-for-config_snd_omap_soc_mcbsp.patch create mode 100644 queue-3.15/usb-dwc3-gadget-clear-stall-when-disabling-endpoint.patch create mode 100644 queue-3.15/usb-ehci-avoid-bios-handover-on-the-hasee-e200.patch create mode 100644 queue-3.15/usb-gadget-rename-config_usb_gadget_pxa25x.patch create mode 100644 queue-3.15/usb-usbtest-add-a-timeout-for-scatter-gather-tests.patch create mode 100644 queue-3.15/usb-usbtest-fix-unlink-write-error-with-pattern-1.patch create mode 100644 queue-3.15/w1-do-not-unlock-unheld-list_mutex-in-__w1_remove_master_device.patch diff --git a/queue-3.15/applicom-dereferencing-null-on-error-path.patch b/queue-3.15/applicom-dereferencing-null-on-error-path.patch new file mode 100644 index 00000000000..3030249d83b --- /dev/null +++ b/queue-3.15/applicom-dereferencing-null-on-error-path.patch @@ -0,0 +1,30 @@ +From 8bab797c6e5724a43b7666ad70860712365cdb71 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 9 May 2014 14:59:16 +0300 +Subject: applicom: dereferencing NULL on error path + +From: Dan Carpenter + +commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream. + +This is a static checker fix. The "dev" variable is always NULL after +the while statement so we would be dereferencing a NULL pointer here. + +Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling') +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/applicom.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -345,7 +345,6 @@ out: + free_irq(apbs[i].irq, &dummy); + iounmap(apbs[i].RamIO); + } +- pci_disable_device(dev); + return ret; + } + diff --git a/queue-3.15/arm-omap-replace-checks-for-config_usb_gadget_omap.patch b/queue-3.15/arm-omap-replace-checks-for-config_usb_gadget_omap.patch new file mode 100644 index 00000000000..e15020fb63a --- /dev/null +++ b/queue-3.15/arm-omap-replace-checks-for-config_usb_gadget_omap.patch @@ -0,0 +1,86 @@ +From 77c2f02edbeda9409a7cf3fd66233015820c213a Mon Sep 17 00:00:00 2001 +From: Paul Bolle +Date: Fri, 16 May 2014 12:00:57 +0200 +Subject: ARM: OMAP: replace checks for CONFIG_USB_GADGET_OMAP + +From: Paul Bolle + +commit 77c2f02edbeda9409a7cf3fd66233015820c213a upstream. + +Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built") +apparently required that checks for CONFIG_USB_GADGET_OMAP would be +replaced with checks for CONFIG_USB_OMAP. Do so now for the remaining +checks for CONFIG_USB_GADGET_OMAP, even though these checks have +basically been broken since v3.1. + +And, since we're touching this code, use the IS_ENABLED() macro, so +things will now (hopefully) also work if USB_OMAP is modular. + +Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built") +Signed-off-by: Paul Bolle +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap1/board-h2.c | 2 +- + arch/arm/mach-omap1/board-h3.c | 2 +- + arch/arm/mach-omap1/board-innovator.c | 2 +- + arch/arm/mach-omap1/board-osk.c | 2 +- + drivers/usb/phy/phy-isp1301-omap.c | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/mach-omap1/board-h2.c ++++ b/arch/arm/mach-omap1/board-h2.c +@@ -346,7 +346,7 @@ static struct omap_usb_config h2_usb_con + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) +--- a/arch/arm/mach-omap1/board-h3.c ++++ b/arch/arm/mach-omap1/board-h3.c +@@ -366,7 +366,7 @@ static struct omap_usb_config h3_usb_con + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) + /* NONSTANDARD CABLE NEEDED (B-to-Mini-B) */ +--- a/arch/arm/mach-omap1/board-innovator.c ++++ b/arch/arm/mach-omap1/board-innovator.c +@@ -312,7 +312,7 @@ static struct omap_usb_config h2_usb_con + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) +--- a/arch/arm/mach-omap1/board-osk.c ++++ b/arch/arm/mach-omap1/board-osk.c +@@ -283,7 +283,7 @@ static struct omap_usb_config osk_usb_co + * be used, with a NONSTANDARD gender-bending cable/dongle, as + * a peripheral. + */ +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .register_dev = 1, + .hmc_mode = 0, + #else +--- a/drivers/usb/phy/phy-isp1301-omap.c ++++ b/drivers/usb/phy/phy-isp1301-omap.c +@@ -1295,7 +1295,7 @@ isp1301_set_host(struct usb_otg *otg, st + return isp1301_otg_enable(isp); + return 0; + +-#elif !defined(CONFIG_USB_GADGET_OMAP) ++#elif !IS_ENABLED(CONFIG_USB_OMAP) + // FIXME update its refcount + otg->host = host; + diff --git a/queue-3.15/block-virtio_blk-don-t-hold-spin-lock-during-world-switch.patch b/queue-3.15/block-virtio_blk-don-t-hold-spin-lock-during-world-switch.patch new file mode 100644 index 00000000000..3d021827275 --- /dev/null +++ b/queue-3.15/block-virtio_blk-don-t-hold-spin-lock-during-world-switch.patch @@ -0,0 +1,74 @@ +From e8edca6f7f92234202d6dd163c118ef495244d7c Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Fri, 30 May 2014 10:49:29 +0800 +Subject: block: virtio_blk: don't hold spin lock during world switch + +From: Ming Lei + +commit e8edca6f7f92234202d6dd163c118ef495244d7c upstream. + +Firstly, it isn't necessary to hold lock of vblk->vq_lock +when notifying hypervisor about queued I/O. + +Secondly, virtqueue_notify() will cause world switch and +it may take long time on some hypervisors(such as, qemu-arm), +so it isn't good to hold the lock and block other vCPUs. + +On arm64 quad core VM(qemu-kvm), the patch can increase I/O +performance a lot with VIRTIO_RING_F_EVENT_IDX enabled: + - without the patch: 14K IOPS + - with the patch: 34K IOPS + +fio script: + [global] + direct=1 + bsrange=4k-4k + timeout=10 + numjobs=4 + ioengine=libaio + iodepth=64 + + filename=/dev/vdc + group_reporting=1 + + [f1] + rw=randread + +Cc: Rusty Russell +Cc: "Michael S. Tsirkin" +Cc: virtualization@lists.linux-foundation.org +Signed-off-by: Ming Lei +Acked-by: Rusty Russell +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/virtio_blk.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -159,6 +159,7 @@ static int virtio_queue_rq(struct blk_mq + unsigned int num; + const bool last = (req->cmd_flags & REQ_END) != 0; + int err; ++ bool notify = false; + + BUG_ON(req->nr_phys_segments + 2 > vblk->sg_elems); + +@@ -211,10 +212,12 @@ static int virtio_queue_rq(struct blk_mq + return BLK_MQ_RQ_QUEUE_ERROR; + } + +- if (last) +- virtqueue_kick(vblk->vq); +- ++ if (last && virtqueue_kick_prepare(vblk->vq)) ++ notify = true; + spin_unlock_irqrestore(&vblk->vq_lock, flags); ++ ++ if (notify) ++ virtqueue_notify(vblk->vq); + return BLK_MQ_RQ_QUEUE_OK; + } + diff --git a/queue-3.15/extcon-max14577-fix-probe-failure-on-successful-work-queue.patch b/queue-3.15/extcon-max14577-fix-probe-failure-on-successful-work-queue.patch new file mode 100644 index 00000000000..e3f6460cada --- /dev/null +++ b/queue-3.15/extcon-max14577-fix-probe-failure-on-successful-work-queue.patch @@ -0,0 +1,42 @@ +From 12adef5b49e98eb181b4163c36e2998169e1379b Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 9 Apr 2014 11:56:09 +0200 +Subject: extcon: max14577: Fix probe failure on successful work queue + +From: Krzysztof Kozlowski + +commit 12adef5b49e98eb181b4163c36e2998169e1379b upstream. + +In probe the driver queued delayed work for cable detection and +returned the result of queue_delayed_work() call. However the return +value of queue_delayed_work() does not indicate an error and in normal +condition it returns true which means successful work queue. +This effectively resulted in probe failure: +[ 2.088204] max14577-muic: probe of max77836-muic failed with error 1 + +Signed-off-by: Krzysztof Kozlowski +Fixes: 962e56bfcf0b ("extcon: max14577: Add extcon-max14577 driver...") +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon-max14577.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/extcon/extcon-max14577.c ++++ b/drivers/extcon/extcon-max14577.c +@@ -710,13 +710,8 @@ static int max14577_muic_probe(struct pl + * driver should notify cable state to upper layer. + */ + INIT_DELAYED_WORK(&info->wq_detcable, max14577_muic_detect_cable_wq); +- ret = queue_delayed_work(system_power_efficient_wq, &info->wq_detcable, ++ queue_delayed_work(system_power_efficient_wq, &info->wq_detcable, + delay_jiffies); +- if (ret < 0) { +- dev_err(&pdev->dev, +- "failed to schedule delayed work for cable detect\n"); +- goto err_extcon; +- } + + return ret; + diff --git a/queue-3.15/extcon-max14577-properly-handle-regmap_irq_get_virq-error.patch b/queue-3.15/extcon-max14577-properly-handle-regmap_irq_get_virq-error.patch new file mode 100644 index 00000000000..8a145097074 --- /dev/null +++ b/queue-3.15/extcon-max14577-properly-handle-regmap_irq_get_virq-error.patch @@ -0,0 +1,31 @@ +From 369afd4ba22f5b8de0c9229b6e62b3f9e2207034 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 18 Apr 2014 16:47:30 +0200 +Subject: extcon: max14577: Properly handle regmap_irq_get_virq error + +From: Krzysztof Kozlowski + +commit 369afd4ba22f5b8de0c9229b6e62b3f9e2207034 upstream. + +The regmap_irq_get_virq may return 0 or -EINVAL on error. Fail the probe +in both situations. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon-max14577.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/extcon/extcon-max14577.c ++++ b/drivers/extcon/extcon-max14577.c +@@ -650,7 +650,7 @@ static int max14577_muic_probe(struct pl + unsigned int virq = 0; + + virq = regmap_irq_get_virq(max14577->irq_data, muic_irq->irq); +- if (!virq) ++ if (virq <= 0) + return -EINVAL; + muic_irq->virq = virq; + diff --git a/queue-3.15/extcon-max77693-fix-two-null-pointer-exceptions-on-missing-pdata.patch b/queue-3.15/extcon-max77693-fix-two-null-pointer-exceptions-on-missing-pdata.patch new file mode 100644 index 00000000000..3a4e9bd2b75 --- /dev/null +++ b/queue-3.15/extcon-max77693-fix-two-null-pointer-exceptions-on-missing-pdata.patch @@ -0,0 +1,87 @@ +From d5653f2b7304f05eeb45d84f123cf02f840b8537 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 9 Apr 2014 15:20:12 +0200 +Subject: extcon: max77693: Fix two NULL pointer exceptions on missing pdata + +From: Krzysztof Kozlowski + +commit d5653f2b7304f05eeb45d84f123cf02f840b8537 upstream. + +Fix NULL pointer exceptions when platform data is not supplied. + +Trace of one exception: +Unable to handle kernel NULL pointer dereference at virtual address 00000008 +pgd = c0004000 +[00000008] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT SMP ARM +Modules linked in: +CPU: 2 PID: 1 Comm: swapper/0 Not tainted 3.14.0-12045-gead5dd4687a6-dirty #1628 +task: eea80000 ti: eea88000 task.ti: eea88000 +PC is at max77693_muic_probe+0x27c/0x528 +LR is at regmap_write+0x50/0x60 +pc : [] lr : [] psr: 20000113 +sp : eea89e38 ip : 00000000 fp : c098a834 +r10: ee1a5a10 r9 : 00000005 r8 : c098a83c +r7 : 0000000a r6 : c098a774 r5 : 00000005 r4 : eeb006d0 +r3 : c0697bd8 r2 : 00000000 r1 : 00000001 r0 : 00000000 +Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5387d Table: 4000404a DAC: 00000015 +Process swapper/0 (pid: 1, stack limit = 0xeea88240) +Stack: (0xeea89e38 to 0xeea8a000) +9e20: c08499fc eeb006d0 +9e40: 00000000 00000000 c0915f98 00000001 00000000 ee1a5a10 c098a730 c09a88b8 +9e60: 00000000 c098a730 c0915f98 00000000 00000000 c02d6aa0 c02d6a88 ee1a5a10 +9e80: c0a712c8 c02d54e4 00001204 c0628b00 ee1a5a10 c098a730 ee1a5a44 00000000 +9ea0: eea88000 c02d57b4 00000000 c098a730 c02d5728 c02d3a24 ee813e5c eeb9d534 +9ec0: c098a730 ee22f700 c097c720 c02d4b14 c08174ec c098a730 00000006 c098a730 +9ee0: 00000006 c092fd30 c09b8500 c02d5df8 00000000 c093cbb8 00000006 c0008928 +9f00: 000000c3 ef7fc785 00000000 ef7fc794 00000000 c08af968 00000072 eea89f30 +9f20: ef7fc85e c065f198 000000c3 c003e87c 00000003 00000000 c092fd3c 00000000 +9f40: c08af618 c0826d58 00000006 00000006 c0956f58 c093cbb8 00000006 c092fd30 +9f60: c09b8500 000000c3 c092fd3c c08e8510 00000000 c08e8bb0 00000006 00000006 +9f80: c08e8510 c0c0c0c0 00000000 c0628fac 00000000 00000000 00000000 00000000 +9fa0: 00000000 c0628fb4 00000000 c000f038 00000000 00000000 00000000 00000000 +9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 c0c0c0c0 c0c0c0c0 +[] (max77693_muic_probe) from [] (platform_drv_probe+0x18/0x48) +[] (platform_drv_probe) from [] (driver_probe_device+0x140/0x384) +[] (driver_probe_device) from [] (__driver_attach+0x8c/0x90) +[] (__driver_attach) from [] (bus_for_each_dev+0x54/0x88) +[] (bus_for_each_dev) from [] (bus_add_driver+0xe8/0x204) +[] (bus_add_driver) from [] (driver_register+0x78/0xf4) +[] (driver_register) from [] (do_one_initcall+0xc4/0x174) +[] (do_one_initcall) from [] (kernel_init_freeable+0xfc/0x1c8) +[] (kernel_init_freeable) from [] (kernel_init+0x8/0xec) +[] (kernel_init) from [] (ret_from_fork+0x14/0x3c) +Code: caffffe7 e59d200c e3550001 b3a05001 (e5923008) +---[ end trace 85db969ce011bde7 ]--- + +Signed-off-by: Krzysztof Kozlowski +Fixes: 190d7cfc8632 +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon-max77693.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/extcon/extcon-max77693.c ++++ b/drivers/extcon/extcon-max77693.c +@@ -1193,7 +1193,7 @@ static int max77693_muic_probe(struct pl + + + /* Initialize MUIC register by using platform data or default data */ +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + init_data = pdata->muic_data->init_data; + num_init_data = pdata->muic_data->num_init_data; + } else { +@@ -1226,7 +1226,7 @@ static int max77693_muic_probe(struct pl + = init_data[i].data; + } + +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + struct max77693_muic_platform_data *muic_pdata + = pdata->muic_data; + diff --git a/queue-3.15/extcon-max8997-fix-null-pointer-exception-on-missing-pdata.patch b/queue-3.15/extcon-max8997-fix-null-pointer-exception-on-missing-pdata.patch new file mode 100644 index 00000000000..6f4bead2b98 --- /dev/null +++ b/queue-3.15/extcon-max8997-fix-null-pointer-exception-on-missing-pdata.patch @@ -0,0 +1,32 @@ +From dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 9 Apr 2014 15:20:14 +0200 +Subject: extcon: max8997: Fix NULL pointer exception on missing pdata + +From: Krzysztof Kozlowski + +commit dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d upstream. + +Fix NULL pointer exception when platform data is not supplied. The +driver dereferenced pdata pointer where it could be NULL. + +Signed-off-by: Krzysztof Kozlowski +Fixes: 810d601f07c +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon-max8997.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -715,7 +715,7 @@ static int max8997_muic_probe(struct pla + goto err_irq; + } + +- if (pdata->muic_pdata) { ++ if (pdata && pdata->muic_pdata) { + struct max8997_muic_platform_data *muic_pdata + = pdata->muic_pdata; + diff --git a/queue-3.15/imx-drm-fix-hdmi-hotplug-detection-initial-state.patch b/queue-3.15/imx-drm-fix-hdmi-hotplug-detection-initial-state.patch new file mode 100644 index 00000000000..18d59151768 --- /dev/null +++ b/queue-3.15/imx-drm-fix-hdmi-hotplug-detection-initial-state.patch @@ -0,0 +1,68 @@ +From 98dbeadaf050335df8655d8d9be7a324b6cd896e Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 18 Apr 2014 10:46:45 +0100 +Subject: imx-drm: fix hdmi hotplug detection initial state + +From: Russell King + +commit 98dbeadaf050335df8655d8d9be7a324b6cd896e upstream. + +The initial state at boot is assumed to be disconnected, and we hope +to receive an interrupt to update the status. Let's be more explicit +about the current state - reading the PHY status register tells us +the current level of the hotplug signal, which we can report back in +the _detect() method. + +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/imx-drm/imx-hdmi.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/staging/imx-drm/imx-hdmi.c ++++ b/drivers/staging/imx-drm/imx-hdmi.c +@@ -120,8 +120,6 @@ struct imx_hdmi { + struct clk *isfr_clk; + struct clk *iahb_clk; + +- enum drm_connector_status connector_status; +- + struct hdmi_data_info hdmi_data; + int vic; + +@@ -1382,7 +1380,9 @@ static enum drm_connector_status imx_hdm + { + struct imx_hdmi *hdmi = container_of(connector, struct imx_hdmi, + connector); +- return hdmi->connector_status; ++ ++ return hdmi_readb(hdmi, HDMI_PHY_STAT0) & HDMI_PHY_HPD ? ++ connector_status_connected : connector_status_disconnected; + } + + static int imx_hdmi_connector_get_modes(struct drm_connector *connector) +@@ -1524,7 +1524,6 @@ static irqreturn_t imx_hdmi_irq(int irq, + + hdmi_modb(hdmi, 0, HDMI_PHY_HPD, HDMI_PHY_POL0); + +- hdmi->connector_status = connector_status_connected; + imx_hdmi_poweron(hdmi); + } else { + dev_dbg(hdmi->dev, "EVENT=plugout\n"); +@@ -1532,7 +1531,6 @@ static irqreturn_t imx_hdmi_irq(int irq, + hdmi_modb(hdmi, HDMI_PHY_HPD, HDMI_PHY_HPD, + HDMI_PHY_POL0); + +- hdmi->connector_status = connector_status_disconnected; + imx_hdmi_poweroff(hdmi); + } + drm_helper_hpd_irq_event(hdmi->connector.dev); +@@ -1606,7 +1604,6 @@ static int imx_hdmi_bind(struct device * + return -ENOMEM; + + hdmi->dev = dev; +- hdmi->connector_status = connector_status_disconnected; + hdmi->sample_rate = 48000; + hdmi->ratio = 100; + diff --git a/queue-3.15/phy-exynos-mipi-video-fix-check-on-array-index.patch b/queue-3.15/phy-exynos-mipi-video-fix-check-on-array-index.patch new file mode 100644 index 00000000000..70b60181475 --- /dev/null +++ b/queue-3.15/phy-exynos-mipi-video-fix-check-on-array-index.patch @@ -0,0 +1,36 @@ +From 98c3b32229f2685c13436b652b8959c99dfc5a31 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Antoine=20T=C3=A9nart?= +Date: Mon, 12 May 2014 14:56:28 +0200 +Subject: phy: exynos-mipi-video: fix check on array index +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Antoine=20T=C3=A9nart?= + +commit 98c3b32229f2685c13436b652b8959c99dfc5a31 upstream. + +The phys array is of size EXYNOS_MIPI_PHYS_NUM. Trying to access the +index EXYNOS_MIPI_PHYS_NUM should return an error. + +Fixes: 069d2e26e9d6 "phy: Add driver for Exynos MIPI CSIS/DSIM DPHYs" + +Signed-off-by: Antoine Ténart +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/phy-exynos-mipi-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/phy-exynos-mipi-video.c ++++ b/drivers/phy/phy-exynos-mipi-video.c +@@ -101,7 +101,7 @@ static struct phy *exynos_mipi_video_phy + { + struct exynos_mipi_video_phy *state = dev_get_drvdata(dev); + +- if (WARN_ON(args->args[0] > EXYNOS_MIPI_PHYS_NUM)) ++ if (WARN_ON(args->args[0] >= EXYNOS_MIPI_PHYS_NUM)) + return ERR_PTR(-ENODEV); + + return state->phys[args->args[0]].phy; diff --git a/queue-3.15/printk-of_serial-fix-serial-console-cessation-part-way-through-boot.patch b/queue-3.15/printk-of_serial-fix-serial-console-cessation-part-way-through-boot.patch new file mode 100644 index 00000000000..ba98f5beb9f --- /dev/null +++ b/queue-3.15/printk-of_serial-fix-serial-console-cessation-part-way-through-boot.patch @@ -0,0 +1,85 @@ +From 7fa21dd8bd191564a195291161d6b43db5d9c350 Mon Sep 17 00:00:00 2001 +From: Stephen Chivers +Date: Wed, 14 May 2014 08:04:39 +1000 +Subject: printk/of_serial: fix serial console cessation part way through boot. + +From: Stephen Chivers + +commit 7fa21dd8bd191564a195291161d6b43db5d9c350 upstream. + +Commit 5f5c9ae56c38942623f69c3e6dc6ec78e4da2076 +"serial_core: Unregister console in uart_remove_one_port()" +fixed a crash where a serial port was removed but +not deregistered as a console. + +There is a side effect of that commit for platforms having serial consoles +and of_serial configured (CONFIG_SERIAL_OF_PLATFORM). The serial console +is disabled midway through the boot process. + +This cessation of the serial console affects PowerPC computers +such as the MVME5100 and SAM440EP. + +The sequence is: + + bootconsole [udbg0] enabled + .... + serial8250/16550 driver initialises and registers its UARTS, + one of these is the serial console. + console [ttyS0] enabled + .... + of_serial probes "platform" devices, registering them as it goes. + One of these is the serial console. + console [ttyS0] disabled. + +The disabling of the serial console is due to: + + a. unregister_console in printk not clearing the + CONS_ENABLED bit in the console flags, + even though it has announced that the console is disabled; and + + b. of_platform_serial_probe in of_serial not setting the port type + before it registers with serial8250_register_8250_port. + +This patch ensures that the serial console is re-enabled when of_serial +registers a serial port that corresponds to the designated console. + +=== +The above failure was identified in Linux-3.15-rc2. + +Tested using MVME5100 and SAM440EP PowerPC computers with +kernels built from Linux-3.15-rc5 and tty-next. + +The continued operation of the serial console is vital for computers +such as the MVME5100 as that Single Board Computer does not +have any grapical/display hardware. + +Signed-off-by: Stephen Chivers +Tested-by: Stephen Chivers +Acked-by: Geert Uytterhoeven [unregister_console] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/of_serial.c | 1 + + kernel/printk/printk.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/tty/serial/of_serial.c ++++ b/drivers/tty/serial/of_serial.c +@@ -173,6 +173,7 @@ static int of_platform_serial_probe(stru + { + struct uart_8250_port port8250; + memset(&port8250, 0, sizeof(port8250)); ++ port.type = port_type; + port8250.port = port; + + if (port.fifosize) +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2413,6 +2413,7 @@ int unregister_console(struct console *c + if (console_drivers != NULL && console->flags & CON_CONSDEV) + console_drivers->flags |= CON_CONSDEV; + ++ console->flags &= ~CON_ENABLED; + console_unlock(); + console_sysfs_notify(); + return res; diff --git a/queue-3.15/staging-mt29f_spinand-terminate-of-match-table.patch b/queue-3.15/staging-mt29f_spinand-terminate-of-match-table.patch new file mode 100644 index 00000000000..43b75a817bd --- /dev/null +++ b/queue-3.15/staging-mt29f_spinand-terminate-of-match-table.patch @@ -0,0 +1,32 @@ +From ffd07de65ef5315053ea16356cd533b7f47c17e9 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Fri, 23 May 2014 17:16:53 -0700 +Subject: staging/mt29f_spinand: Terminate of match table + +From: Stephen Boyd + +commit ffd07de65ef5315053ea16356cd533b7f47c17e9 upstream. + +Failure to terminate this match table can lead to boot failures +depending on where the compiler places the match table. + +Cc: Kamlakant Patel +Cc: Mona Anonuevo +Cc: linux-mtd@lists.infradead.org +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/mt29f_spinand/mt29f_spinand.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c ++++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c +@@ -924,6 +924,7 @@ static int spinand_remove(struct spi_dev + + static const struct of_device_id spinand_dt[] = { + { .compatible = "spinand,mt29f", }, ++ {} + }; + + /* diff --git a/queue-3.15/staging-rtl8188eu-overflow-in-update_sta_support_rate.patch b/queue-3.15/staging-rtl8188eu-overflow-in-update_sta_support_rate.patch new file mode 100644 index 00000000000..a03dfbc7f1c --- /dev/null +++ b/queue-3.15/staging-rtl8188eu-overflow-in-update_sta_support_rate.patch @@ -0,0 +1,43 @@ +From 9dbd79aeb9842144d9a114a979a12c0949ee11eb Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 7 Apr 2014 09:31:21 +0300 +Subject: Staging: rtl8188eu: overflow in update_sta_support_rate() + +From: Dan Carpenter + +commit 9dbd79aeb9842144d9a114a979a12c0949ee11eb upstream. + +The ->SupportedRates[] array has NDIS_802_11_LENGTH_RATES_EX (16) +elements. Since "ie_len" comes from then network and can go up to 255 +then it means we should add a range check to prevent memory corruption. + +Fixes: d6846af679e0 ('staging: r8188eu: Add files for new driver - part 7') +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/core/rtw_wlan_util.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c ++++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c +@@ -1599,13 +1599,18 @@ int update_sta_support_rate(struct adapt + pIE = (struct ndis_802_11_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len); + if (pIE == NULL) + return _FAIL; ++ if (ie_len > NDIS_802_11_LENGTH_RATES_EX) ++ return _FAIL; + + memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len); + supportRateNum = ie_len; + + pIE = (struct ndis_802_11_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len); +- if (pIE) ++ if (pIE) { ++ if (supportRateNum + ie_len > NDIS_802_11_LENGTH_RATES_EX) ++ return _FAIL; + memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len); ++ } + + return _SUCCESS; + } diff --git a/queue-3.15/staging-tidspbridge-check-for-config_snd_omap_soc_mcbsp.patch b/queue-3.15/staging-tidspbridge-check-for-config_snd_omap_soc_mcbsp.patch new file mode 100644 index 00000000000..5a9b665b425 --- /dev/null +++ b/queue-3.15/staging-tidspbridge-check-for-config_snd_omap_soc_mcbsp.patch @@ -0,0 +1,46 @@ +From d3921a03a89acb1b9ca599590c0131c89f8737d8 Mon Sep 17 00:00:00 2001 +From: Paul Bolle +Date: Mon, 26 May 2014 21:47:11 +0200 +Subject: staging: tidspbridge: check for CONFIG_SND_OMAP_SOC_MCBSP + +From: Paul Bolle + +commit d3921a03a89acb1b9ca599590c0131c89f8737d8 upstream. + +Commit d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP") +removed the Kconfig symbol OMAP_MCBSP. It left two checks for +CONFIG_OMAP_MCBSP untouched. + +Convert these to checks for CONFIG_SND_OMAP_SOC_MCBSP. That must be +correct, since that re-enables calls to functions that are all found in +sound/soc/omap/mcbsp.c. And that file is built only if +CONFIG_SND_OMAP_SOC_MCBSP is defined. + +Fixes: d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP") +Signed-off-by: Paul Bolle +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/tidspbridge/core/dsp-clock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/tidspbridge/core/dsp-clock.c ++++ b/drivers/staging/tidspbridge/core/dsp-clock.c +@@ -226,7 +226,7 @@ int dsp_clk_enable(enum dsp_clk_id clk_i + case GPT_CLK: + status = omap_dm_timer_start(timer[clk_id - 1]); + break; +-#ifdef CONFIG_OMAP_MCBSP ++#ifdef CONFIG_SND_OMAP_SOC_MCBSP + case MCBSP_CLK: + omap_mcbsp_request(MCBSP_ID(clk_id)); + omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC); +@@ -302,7 +302,7 @@ int dsp_clk_disable(enum dsp_clk_id clk_ + case GPT_CLK: + status = omap_dm_timer_stop(timer[clk_id - 1]); + break; +-#ifdef CONFIG_OMAP_MCBSP ++#ifdef CONFIG_SND_OMAP_SOC_MCBSP + case MCBSP_CLK: + omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PRCM_SRC); + omap_mcbsp_free(MCBSP_ID(clk_id)); diff --git a/queue-3.15/usb-dwc3-gadget-clear-stall-when-disabling-endpoint.patch b/queue-3.15/usb-dwc3-gadget-clear-stall-when-disabling-endpoint.patch new file mode 100644 index 00000000000..1cf0ff286e6 --- /dev/null +++ b/queue-3.15/usb-dwc3-gadget-clear-stall-when-disabling-endpoint.patch @@ -0,0 +1,35 @@ +From 687ef9817df7ed960d14575b9033dde3d04631fe Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Wed, 16 Apr 2014 10:30:33 -0500 +Subject: usb: dwc3: gadget: clear stall when disabling endpoint + +From: Felipe Balbi + +commit 687ef9817df7ed960d14575b9033dde3d04631fe upstream. + +so it seems like DWC3 IP doesn't clear stalls +automatically when we disable an endpoint, because +of that, we _must_ make sure stalls are cleared +before clearing the proper bit in DALEPENA register. + +Reported-by: Johannes Stezenbach +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -604,6 +604,10 @@ static int __dwc3_gadget_ep_disable(stru + + dwc3_remove_requests(dwc, dep); + ++ /* make sure HW endpoint isn't stalled */ ++ if (dep->flags & DWC3_EP_STALL) ++ __dwc3_gadget_ep_set_halt(dep, 0); ++ + reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); + reg &= ~DWC3_DALEPENA_EP(dep->number); + dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); diff --git a/queue-3.15/usb-ehci-avoid-bios-handover-on-the-hasee-e200.patch b/queue-3.15/usb-ehci-avoid-bios-handover-on-the-hasee-e200.patch new file mode 100644 index 00000000000..67fcecf7dbb --- /dev/null +++ b/queue-3.15/usb-ehci-avoid-bios-handover-on-the-hasee-e200.patch @@ -0,0 +1,61 @@ +From b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 3 Jun 2014 11:00:27 -0400 +Subject: USB: EHCI: avoid BIOS handover on the HASEE E200 + +From: Alan Stern + +commit b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b upstream. + +Leandro Liptak reports that his HASEE E200 computer hangs when we ask +the BIOS to hand over control of the EHCI host controller. This +definitely sounds like a bug in the BIOS, but at the moment there is +no way to fix it. + +This patch works around the problem by avoiding the handoff whenever +the motherboard and BIOS version match those of Leandro's computer. + +Signed-off-by: Alan Stern +Reported-by: Leandro Liptak +Tested-by: Leandro Liptak +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -656,6 +656,14 @@ static const struct dmi_system_id ehci_d + DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, ++ { ++ /* HASEE E200 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"), ++ DMI_MATCH(DMI_BOARD_NAME, "E210"), ++ DMI_MATCH(DMI_BIOS_VERSION, "6.00"), ++ }, ++ }, + { } + }; + +@@ -665,9 +673,14 @@ static void ehci_bios_handoff(struct pci + { + int try_handoff = 1, tried_handoff = 0; + +- /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying +- * the handoff on its unused controller. Skip it. */ +- if (pdev->vendor == 0x8086 && pdev->device == 0x283a) { ++ /* ++ * The Pegatron Lucid tablet sporadically waits for 98 seconds trying ++ * the handoff on its unused controller. Skip it. ++ * ++ * The HASEE E200 hangs when the semaphore is set (bugzilla #77021). ++ */ ++ if (pdev->vendor == 0x8086 && (pdev->device == 0x283a || ++ pdev->device == 0x27cc)) { + if (dmi_check_system(ehci_dmi_nohandoff_table)) + try_handoff = 0; + } diff --git a/queue-3.15/usb-gadget-rename-config_usb_gadget_pxa25x.patch b/queue-3.15/usb-gadget-rename-config_usb_gadget_pxa25x.patch new file mode 100644 index 00000000000..98295e0347c --- /dev/null +++ b/queue-3.15/usb-gadget-rename-config_usb_gadget_pxa25x.patch @@ -0,0 +1,34 @@ +From d30f2065d6da377cc76771aca5a9850cfca8723b Mon Sep 17 00:00:00 2001 +From: Paul Bolle +Date: Mon, 26 May 2014 23:37:09 +0200 +Subject: usb: gadget: rename CONFIG_USB_GADGET_PXA25X + +From: Paul Bolle + +commit d30f2065d6da377cc76771aca5a9850cfca8723b upstream. + +Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built") +basically renamed the Kconfig symbol USB_GADGET_PXA25X to USB_PXA25X. It +did not rename the related macros in use at that time. Commit +c0a39151a405 ("ARM: pxa: fix inconsistent CONFIG_USB_PXA27X") did so for +all but one macro. Rename that last macro too now. + +Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built") +Signed-off-by: Paul Bolle +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/inode.c ++++ b/drivers/usb/gadget/inode.c +@@ -1501,7 +1501,7 @@ gadgetfs_setup (struct usb_gadget *gadge + } + break; + +-#ifndef CONFIG_USB_GADGET_PXA25X ++#ifndef CONFIG_USB_PXA25X + /* PXA automagically handles this request too */ + case USB_REQ_GET_CONFIGURATION: + if (ctrl->bRequestType != 0x80) diff --git a/queue-3.15/usb-usbtest-add-a-timeout-for-scatter-gather-tests.patch b/queue-3.15/usb-usbtest-add-a-timeout-for-scatter-gather-tests.patch new file mode 100644 index 00000000000..c7372badcef --- /dev/null +++ b/queue-3.15/usb-usbtest-add-a-timeout-for-scatter-gather-tests.patch @@ -0,0 +1,72 @@ +From 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 3 Jun 2014 11:11:34 -0400 +Subject: USB: usbtest: add a timeout for scatter-gather tests + +From: Alan Stern + +commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream. + +In usbtest, tests 5 - 8 use the scatter-gather library in usbcore +without any sort of timeout. If there's a problem in the gadget or +host controller being tested, the test can hang. + +This patch adds a 10-second timeout to the tests, so that they will +fail gracefully with an ETIMEDOUT error instead of hanging. + +Signed-off-by: Alan Stern +Reported-by: Huang Rui +Tested-by: Huang Rui +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbtest.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -7,7 +7,7 @@ + #include + #include + #include +- ++#include + #include + + #define SIMPLE_IO_TIMEOUT 10000 /* in milliseconds */ +@@ -484,6 +484,14 @@ alloc_sglist(int nents, int max, int var + return sg; + } + ++static void sg_timeout(unsigned long _req) ++{ ++ struct usb_sg_request *req = (struct usb_sg_request *) _req; ++ ++ req->status = -ETIMEDOUT; ++ usb_sg_cancel(req); ++} ++ + static int perform_sglist( + struct usbtest_dev *tdev, + unsigned iterations, +@@ -495,6 +503,9 @@ static int perform_sglist( + { + struct usb_device *udev = testdev_to_usbdev(tdev); + int retval = 0; ++ struct timer_list sg_timer; ++ ++ setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req); + + while (retval == 0 && iterations-- > 0) { + retval = usb_sg_init(req, udev, pipe, +@@ -505,7 +516,10 @@ static int perform_sglist( + + if (retval) + break; ++ mod_timer(&sg_timer, jiffies + ++ msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); + usb_sg_wait(req); ++ del_timer_sync(&sg_timer); + retval = req->status; + + /* FIXME check resulting data pattern */ diff --git a/queue-3.15/usb-usbtest-fix-unlink-write-error-with-pattern-1.patch b/queue-3.15/usb-usbtest-fix-unlink-write-error-with-pattern-1.patch new file mode 100644 index 00000000000..48ac7cc7d2d --- /dev/null +++ b/queue-3.15/usb-usbtest-fix-unlink-write-error-with-pattern-1.patch @@ -0,0 +1,68 @@ +From e4d58f5dcb7d7be45df8def31881ebfae99c75da Mon Sep 17 00:00:00 2001 +From: Huang Rui +Date: Mon, 26 May 2014 10:55:36 +0800 +Subject: usb: usbtest: fix unlink write error with pattern 1 + +From: Huang Rui + +commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream. + +TEST 12 and TEST 24 unlinks the URB write request for N times. When +host and gadget both initialize pattern 1 (mod 63) data series to +transfer, the gadget side will complain the wrong data which is not +expected. Because in host side, usbtest doesn't fill the data buffer +as mod 63 and this patch fixed it. + +[20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready +[20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active +[20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last +[20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000 +[20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0 +[20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready +[20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active +[20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy +[20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete +[20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0 +[20285.491431] zero gadget: bad OUT byte, buf[1] = 0 +[20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000 +[20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0 +[20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512 +[20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready +[20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active +[20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last +[20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000 +[20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0 + +Signed-off-by: Huang Rui +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbtest.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -1320,6 +1320,11 @@ static int unlink1(struct usbtest_dev *d + urb->context = &completion; + urb->complete = unlink1_callback; + ++ if (usb_pipeout(urb->pipe)) { ++ simple_fill_buf(urb); ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ } ++ + /* keep the endpoint busy. there are lots of hc/hcd-internal + * states, and testing should get to all of them over time. + * +@@ -1450,6 +1455,11 @@ static int unlink_queued(struct usbtest_ + unlink_queued_callback, &ctx); + ctx.urbs[i]->transfer_dma = buf_dma; + ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP; ++ ++ if (usb_pipeout(ctx.urbs[i]->pipe)) { ++ simple_fill_buf(ctx.urbs[i]); ++ ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET; ++ } + } + + /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */ diff --git a/queue-3.15/w1-do-not-unlock-unheld-list_mutex-in-__w1_remove_master_device.patch b/queue-3.15/w1-do-not-unlock-unheld-list_mutex-in-__w1_remove_master_device.patch new file mode 100644 index 00000000000..cd75704be52 --- /dev/null +++ b/queue-3.15/w1-do-not-unlock-unheld-list_mutex-in-__w1_remove_master_device.patch @@ -0,0 +1,55 @@ +From a0f104644ec27ce5bbb36e950eb426dba9a3ad44 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Wed, 7 May 2014 01:26:04 +0400 +Subject: w1: do not unlock unheld list_mutex in __w1_remove_master_device() + +From: Alexey Khoroshilov + +commit a0f104644ec27ce5bbb36e950eb426dba9a3ad44 upstream. + +w1_process_callbacks() expects to be called with dev->list_mutex held, +but it is the fact only in w1_process(). __w1_remove_master_device() +calls w1_process_callbacks() after it releases list_mutex. + +The patch fixes __w1_remove_master_device() to acquire list_mutex +for w1_process_callbacks(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Acked-by: David Fries +Acked-by: Evgeniy Polyakov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/w1.c | 2 ++ + drivers/w1/w1_int.c | 4 ++++ + 2 files changed, 6 insertions(+) + +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1078,6 +1078,8 @@ static void w1_search_process(struct w1_ + * w1_process_callbacks() - execute each dev->async_list callback entry + * @dev: w1_master device + * ++ * The w1 master list_mutex must be held. ++ * + * Return: 1 if there were commands to executed 0 otherwise + */ + int w1_process_callbacks(struct w1_master *dev) +--- a/drivers/w1/w1_int.c ++++ b/drivers/w1/w1_int.c +@@ -219,9 +219,13 @@ void __w1_remove_master_device(struct w1 + + if (msleep_interruptible(1000)) + flush_signals(current); ++ mutex_lock(&dev->list_mutex); + w1_process_callbacks(dev); ++ mutex_unlock(&dev->list_mutex); + } ++ mutex_lock(&dev->list_mutex); + w1_process_callbacks(dev); ++ mutex_unlock(&dev->list_mutex); + + memset(&msg, 0, sizeof(msg)); + msg.id.mst.id = dev->id; -- 2.47.3