From 9c8e5b42f3753dd1d83d9e07f7c213decc8634c2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 8 Jan 2013 13:25:48 -0800 Subject: [PATCH] 3.7-stable patches added patches: cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch cgroup_rm_file-don-t-delete-the-uncreated-files.patch freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch genirq-always-force-thread-affinity.patch input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch input-walkera0701-fix-crash-on-startup.patch mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch smb3-mounts-fail-with-access-denied-to-some-servers.patch staging-drm-omap-fix-include-error-during-make.patch usb-fix-endpoint-disabling-for-failed-config-changes.patch usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch usb-musb-cppi_dma-export-cppi_interrupt.patch vfs-d_obtain_alias-needs-to-use-as-default-name.patch xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch xhci-fix-conditional-check-in-bandwidth-calculation.patch xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch xhci-fix-td-size-calculation-on-1.0-hosts.patch --- ...d-after-the-task-is-added-to-css_set.patch | 209 ++++++++++++++++++ ...-dget-dput-pair-in-cgroup_create_dir.patch | 69 ++++++ ...ile-don-t-delete-the-uncreated-files.patch | 53 +++++ ...reezer_count-and-freezer_should_skip.patch | 107 +++++++++ .../genirq-always-force-thread-affinity.patch | 83 +++++++ ...-probing-if-gpio-probing-is-deferred.patch | 53 +++++ ...-probing-if-gpio-probing-is-deferred.patch | 57 +++++ ...on-of-first-finger-as-st-coordinates.patch | 34 +++ ...touch-support-for-bamboo-fun-cth-461.patch | 37 ++++ ...put-walkera0701-fix-crash-on-startup.patch | 58 +++++ ...-hugetlb-cgroup-file-in-hugetlb_init.patch | 131 +++++++++++ ...-remove-explicit-nop-device-creation.patch | 38 ++++ queue-3.7/series | 22 ++ ...l-with-access-denied-to-some-servers.patch | 39 ++++ ...m-omap-fix-include-error-during-make.patch | 29 +++ ...-disabling-for-failed-config-changes.patch | 104 +++++++++ ...tem-models-for-compliance-mode-patch.patch | 36 +++ ...-musb-cppi_dma-export-cppi_interrupt.patch | 30 +++ ...n_alias-needs-to-use-as-default-name.patch | 48 ++++ ...lp-to-list-of-intel-switchable-hosts.patch | 57 +++++ ...ional-check-in-bandwidth-calculation.patch | 52 +++++ ...-destroying-half-built-segment-rings.patch | 64 ++++++ ...fix-td-size-calculation-on-1.0-hosts.patch | 156 +++++++++++++ 23 files changed, 1566 insertions(+) create mode 100644 queue-3.7/cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch create mode 100644 queue-3.7/cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch create mode 100644 queue-3.7/cgroup_rm_file-don-t-delete-the-uncreated-files.patch create mode 100644 queue-3.7/freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch create mode 100644 queue-3.7/genirq-always-force-thread-affinity.patch create mode 100644 queue-3.7/input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch create mode 100644 queue-3.7/input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch create mode 100644 queue-3.7/input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch create mode 100644 queue-3.7/input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch create mode 100644 queue-3.7/input-walkera0701-fix-crash-on-startup.patch create mode 100644 queue-3.7/mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch create mode 100644 queue-3.7/revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch create mode 100644 queue-3.7/smb3-mounts-fail-with-access-denied-to-some-servers.patch create mode 100644 queue-3.7/staging-drm-omap-fix-include-error-during-make.patch create mode 100644 queue-3.7/usb-fix-endpoint-disabling-for-failed-config-changes.patch create mode 100644 queue-3.7/usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch create mode 100644 queue-3.7/usb-musb-cppi_dma-export-cppi_interrupt.patch create mode 100644 queue-3.7/vfs-d_obtain_alias-needs-to-use-as-default-name.patch create mode 100644 queue-3.7/xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch create mode 100644 queue-3.7/xhci-fix-conditional-check-in-bandwidth-calculation.patch create mode 100644 queue-3.7/xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch create mode 100644 queue-3.7/xhci-fix-td-size-calculation-on-1.0-hosts.patch diff --git a/queue-3.7/cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch b/queue-3.7/cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch new file mode 100644 index 00000000000..410969ddcb5 --- /dev/null +++ b/queue-3.7/cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch @@ -0,0 +1,209 @@ +From 5edee61edeaaebafe584f8fb7074c1ef4658596b Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 16 Oct 2012 15:03:14 -0700 +Subject: cgroup: cgroup_subsys->fork() should be called after the task is added to css_set + +From: Tejun Heo + +commit 5edee61edeaaebafe584f8fb7074c1ef4658596b upstream. + +cgroup core has a bug which violates a basic rule about event +notifications - when a new entity needs to be added, you add that to +the notification list first and then make the new entity conform to +the current state. If done in the reverse order, an event happening +inbetween will be lost. + +cgroup_subsys->fork() is invoked way before the new task is added to +the css_set. Currently, cgroup_freezer is the only user of ->fork() +and uses it to make new tasks conform to the current state of the +freezer. If FROZEN state is requested while fork is in progress +between cgroup_fork_callbacks() and cgroup_post_fork(), the child +could escape freezing - the cgroup isn't frozen when ->fork() is +called and the freezer couldn't see the new task on the css_set. + +This patch moves cgroup_subsys->fork() invocation to +cgroup_post_fork() after the new task is added to the css_set. +cgroup_fork_callbacks() is removed. + +Because now a task may be migrated during cgroup_subsys->fork(), +freezer_fork() is updated so that it adheres to the usual RCU locking +and the rather pointless comment on why locking can be different there +is removed (if it doesn't make anything simpler, why even bother?). + +Signed-off-by: Tejun Heo +Cc: Oleg Nesterov +Cc: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/cgroup.h | 1 + kernel/cgroup.c | 62 +++++++++++++++++++++++------------------------- + kernel/cgroup_freezer.c | 13 +++------- + kernel/fork.c | 9 ------ + 4 files changed, 35 insertions(+), 50 deletions(-) + +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -34,7 +34,6 @@ extern int cgroup_lock_is_held(void); + extern bool cgroup_lock_live_group(struct cgroup *cgrp); + extern void cgroup_unlock(void); + extern void cgroup_fork(struct task_struct *p); +-extern void cgroup_fork_callbacks(struct task_struct *p); + extern void cgroup_post_fork(struct task_struct *p); + extern void cgroup_exit(struct task_struct *p, int run_callbacks); + extern int cgroupstats_build(struct cgroupstats *stats, +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -4832,44 +4832,19 @@ void cgroup_fork(struct task_struct *chi + } + + /** +- * cgroup_fork_callbacks - run fork callbacks +- * @child: the new task +- * +- * Called on a new task very soon before adding it to the +- * tasklist. No need to take any locks since no-one can +- * be operating on this task. +- */ +-void cgroup_fork_callbacks(struct task_struct *child) +-{ +- if (need_forkexit_callback) { +- int i; +- for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) { +- struct cgroup_subsys *ss = subsys[i]; +- +- /* +- * forkexit callbacks are only supported for +- * builtin subsystems. +- */ +- if (!ss || ss->module) +- continue; +- +- if (ss->fork) +- ss->fork(child); +- } +- } +-} +- +-/** + * cgroup_post_fork - called on a new task after adding it to the task list + * @child: the task in question + * +- * Adds the task to the list running through its css_set if necessary. +- * Has to be after the task is visible on the task list in case we race +- * with the first call to cgroup_iter_start() - to guarantee that the +- * new task ends up on its list. ++ * Adds the task to the list running through its css_set if necessary and ++ * call the subsystem fork() callbacks. Has to be after the task is ++ * visible on the task list in case we race with the first call to ++ * cgroup_iter_start() - to guarantee that the new task ends up on its ++ * list. + */ + void cgroup_post_fork(struct task_struct *child) + { ++ int i; ++ + /* + * use_task_css_set_links is set to 1 before we walk the tasklist + * under the tasklist_lock and we read it here after we added the child +@@ -4889,7 +4864,30 @@ void cgroup_post_fork(struct task_struct + task_unlock(child); + write_unlock(&css_set_lock); + } ++ ++ /* ++ * Call ss->fork(). This must happen after @child is linked on ++ * css_set; otherwise, @child might change state between ->fork() ++ * and addition to css_set. ++ */ ++ if (need_forkexit_callback) { ++ for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) { ++ struct cgroup_subsys *ss = subsys[i]; ++ ++ /* ++ * fork/exit callbacks are supported only for ++ * builtin subsystems and we don't need further ++ * synchronization as they never go away. ++ */ ++ if (!ss || ss->module) ++ continue; ++ ++ if (ss->fork) ++ ss->fork(child); ++ } ++ } + } ++ + /** + * cgroup_exit - detach cgroup from exiting task + * @tsk: pointer to task_struct of exiting process +--- a/kernel/cgroup_freezer.c ++++ b/kernel/cgroup_freezer.c +@@ -186,23 +186,15 @@ static void freezer_fork(struct task_str + { + struct freezer *freezer; + +- /* +- * No lock is needed, since the task isn't on tasklist yet, +- * so it can't be moved to another cgroup, which means the +- * freezer won't be removed and will be valid during this +- * function call. Nevertheless, apply RCU read-side critical +- * section to suppress RCU lockdep false positives. +- */ + rcu_read_lock(); + freezer = task_freezer(task); +- rcu_read_unlock(); + + /* + * The root cgroup is non-freezable, so we can skip the + * following check. + */ + if (!freezer->css.cgroup->parent) +- return; ++ goto out; + + spin_lock_irq(&freezer->lock); + BUG_ON(freezer->state == CGROUP_FROZEN); +@@ -210,7 +202,10 @@ static void freezer_fork(struct task_str + /* Locking avoids race with FREEZING -> THAWED transitions. */ + if (freezer->state == CGROUP_FREEZING) + freeze_task(task); ++ + spin_unlock_irq(&freezer->lock); ++out: ++ rcu_read_unlock(); + } + + /* +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1135,7 +1135,6 @@ static struct task_struct *copy_process( + { + int retval; + struct task_struct *p; +- int cgroup_callbacks_done = 0; + + if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) + return ERR_PTR(-EINVAL); +@@ -1393,12 +1392,6 @@ static struct task_struct *copy_process( + INIT_LIST_HEAD(&p->thread_group); + p->task_works = NULL; + +- /* Now that the task is set up, run cgroup callbacks if +- * necessary. We need to run them before the task is visible +- * on the tasklist. */ +- cgroup_fork_callbacks(p); +- cgroup_callbacks_done = 1; +- + /* Need tasklist lock for parent etc handling! */ + write_lock_irq(&tasklist_lock); + +@@ -1503,7 +1496,7 @@ bad_fork_cleanup_cgroup: + #endif + if (clone_flags & CLONE_THREAD) + threadgroup_change_end(current); +- cgroup_exit(p, cgroup_callbacks_done); ++ cgroup_exit(p, 0); + delayacct_tsk_free(p); + module_put(task_thread_info(p)->exec_domain->module); + bad_fork_cleanup_count: diff --git a/queue-3.7/cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch b/queue-3.7/cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch new file mode 100644 index 00000000000..b99cfbf612b --- /dev/null +++ b/queue-3.7/cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch @@ -0,0 +1,69 @@ +From 175431635ec09b1d1bba04979b006b99e8305a83 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 19 Nov 2012 08:13:35 -0800 +Subject: cgroup: remove incorrect dget/dput() pair in cgroup_create_dir() + +From: Tejun Heo + +commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream. + +cgroup_create_dir() does weird dancing with dentry refcnt. On +success, it gets and then puts it achieving nothing. On failure, it +puts but there isn't no matching get anywhere leading to the following +oops if cgroup_create_file() fails for whatever reason. + + ------------[ cut here ]------------ + kernel BUG at /work/os/work/fs/dcache.c:552! + invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC + Modules linked in: + CPU 2 + Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs + RIP: 0010:[] [] dput+0x1dc/0x1e0 + RSP: 0018:ffff88001a3ebef8 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403 + RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58 + RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001 + R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea + R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60 + FS: 00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080) + Stack: + ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000 + ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8 + ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8 + Call Trace: + [] done_path_create+0x19/0x50 + [] sys_mkdirat+0x59/0x80 + [] sys_mkdir+0x19/0x20 + [] system_call_fastpath+0x16/0x1b + Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41 + RIP [] dput+0x1dc/0x1e0 + RSP + ---[ end trace 1277bcfd9561ddb0 ]--- + +Fix it by dropping the unnecessary dget/dput() pair. + +Signed-off-by: Tejun Heo +Acked-by: Li Zefan +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2744,9 +2744,7 @@ static int cgroup_create_dir(struct cgro + dentry->d_fsdata = cgrp; + inc_nlink(parent->d_inode); + rcu_assign_pointer(cgrp->dentry, dentry); +- dget(dentry); + } +- dput(dentry); + + return error; + } diff --git a/queue-3.7/cgroup_rm_file-don-t-delete-the-uncreated-files.patch b/queue-3.7/cgroup_rm_file-don-t-delete-the-uncreated-files.patch new file mode 100644 index 00000000000..cf14e962234 --- /dev/null +++ b/queue-3.7/cgroup_rm_file-don-t-delete-the-uncreated-files.patch @@ -0,0 +1,53 @@ +From f33fddc2b9573d8359f1007d4bbe5cd587a0c093 Mon Sep 17 00:00:00 2001 +From: Gao feng +Date: Thu, 6 Dec 2012 14:38:57 +0800 +Subject: cgroup_rm_file: don't delete the uncreated files + +From: Gao feng + +commit f33fddc2b9573d8359f1007d4bbe5cd587a0c093 upstream. + +in cgroup_add_file,when creating files for cgroup, +some of creation may be skipped. So we need to avoid +deleting these uncreated files in cgroup_rm_file, +otherwise the warning msg will be triggered. + +"cgroup_addrm_files: failed to remove memory_pressure_enabled, err=-2" + +Signed-off-by: Gao feng +Acked-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2789,12 +2789,6 @@ static int cgroup_add_file(struct cgroup + + simple_xattrs_init(&cft->xattrs); + +- /* does @cft->flags tell us to skip creation on @cgrp? */ +- if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent) +- return 0; +- if ((cft->flags & CFTYPE_ONLY_ON_ROOT) && cgrp->parent) +- return 0; +- + if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) { + strcpy(name, subsys->name); + strcat(name, "."); +@@ -2835,6 +2829,12 @@ static int cgroup_addrm_files(struct cgr + int err, ret = 0; + + for (cft = cfts; cft->name[0] != '\0'; cft++) { ++ /* does cft->flags tell us to skip this file on @cgrp? */ ++ if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent) ++ continue; ++ if ((cft->flags & CFTYPE_ONLY_ON_ROOT) && cgrp->parent) ++ continue; ++ + if (is_add) + err = cgroup_add_file(cgrp, subsys, cft); + else diff --git a/queue-3.7/freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch b/queue-3.7/freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch new file mode 100644 index 00000000000..1f867c36c2b --- /dev/null +++ b/queue-3.7/freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch @@ -0,0 +1,107 @@ +From dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 16 Oct 2012 15:03:14 -0700 +Subject: freezer: add missing mb's to freezer_count() and freezer_should_skip() + +From: Tejun Heo + +commit dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 upstream. + +A task is considered frozen enough between freezer_do_not_count() and +freezer_count() and freezers use freezer_should_skip() to test this +condition. This supposedly works because freezer_count() always calls +try_to_freezer() after clearing %PF_FREEZER_SKIP. + +However, there currently is nothing which guarantees that +freezer_count() sees %true freezing() after clearing %PF_FREEZER_SKIP +when freezing is in progress, and vice-versa. A task can escape the +freezing condition in effect by freezer_count() seeing !freezing() and +freezer_should_skip() seeing %PF_FREEZER_SKIP. + +This patch adds smp_mb()'s to freezer_count() and +freezer_should_skip() such that either %true freezing() is visible to +freezer_count() or !PF_FREEZER_SKIP is visible to +freezer_should_skip(). + +Signed-off-by: Tejun Heo +Cc: Oleg Nesterov +Cc: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/freezer.h | 50 ++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 42 insertions(+), 8 deletions(-) + +--- a/include/linux/freezer.h ++++ b/include/linux/freezer.h +@@ -75,28 +75,62 @@ static inline bool cgroup_freezing(struc + */ + + +-/* Tell the freezer not to count the current task as freezable. */ ++/** ++ * freezer_do_not_count - tell freezer to ignore %current ++ * ++ * Tell freezers to ignore the current task when determining whether the ++ * target frozen state is reached. IOW, the current task will be ++ * considered frozen enough by freezers. ++ * ++ * The caller shouldn't do anything which isn't allowed for a frozen task ++ * until freezer_cont() is called. Usually, freezer[_do_not]_count() pair ++ * wrap a scheduling operation and nothing much else. ++ */ + static inline void freezer_do_not_count(void) + { + current->flags |= PF_FREEZER_SKIP; + } + +-/* +- * Tell the freezer to count the current task as freezable again and try to +- * freeze it. ++/** ++ * freezer_count - tell freezer to stop ignoring %current ++ * ++ * Undo freezer_do_not_count(). It tells freezers that %current should be ++ * considered again and tries to freeze if freezing condition is already in ++ * effect. + */ + static inline void freezer_count(void) + { + current->flags &= ~PF_FREEZER_SKIP; ++ /* ++ * If freezing is in progress, the following paired with smp_mb() ++ * in freezer_should_skip() ensures that either we see %true ++ * freezing() or freezer_should_skip() sees !PF_FREEZER_SKIP. ++ */ ++ smp_mb(); + try_to_freeze(); + } + +-/* +- * Check if the task should be counted as freezable by the freezer ++/** ++ * freezer_should_skip - whether to skip a task when determining frozen ++ * state is reached ++ * @p: task in quesion ++ * ++ * This function is used by freezers after establishing %true freezing() to ++ * test whether a task should be skipped when determining the target frozen ++ * state is reached. IOW, if this function returns %true, @p is considered ++ * frozen enough. + */ +-static inline int freezer_should_skip(struct task_struct *p) ++static inline bool freezer_should_skip(struct task_struct *p) + { +- return !!(p->flags & PF_FREEZER_SKIP); ++ /* ++ * The following smp_mb() paired with the one in freezer_count() ++ * ensures that either freezer_count() sees %true freezing() or we ++ * see cleared %PF_FREEZER_SKIP and return %false. This makes it ++ * impossible for a task to slip frozen state testing after ++ * clearing %PF_FREEZER_SKIP. ++ */ ++ smp_mb(); ++ return p->flags & PF_FREEZER_SKIP; + } + + /* diff --git a/queue-3.7/genirq-always-force-thread-affinity.patch b/queue-3.7/genirq-always-force-thread-affinity.patch new file mode 100644 index 00000000000..5d7293520ed --- /dev/null +++ b/queue-3.7/genirq-always-force-thread-affinity.patch @@ -0,0 +1,83 @@ +From 04aa530ec04f61875b99c12721162e2964e3318c Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Sat, 3 Nov 2012 11:52:09 +0100 +Subject: genirq: Always force thread affinity + +From: Thomas Gleixner + +commit 04aa530ec04f61875b99c12721162e2964e3318c upstream. + +Sankara reported that the genirq core code fails to adjust the +affinity of an interrupt thread in several cases: + + 1) On request/setup_irq() the call to setup_affinity() happens before + the new action is registered, so the new thread is not notified. + + 2) For secondary shared interrupts nothing notifies the new thread to + change its affinity. + + 3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving + the thread either. + +Fix this by setting the thread affinity flag right on thread creation +time. This ensures that under all circumstances the thread moves to +the right place. Requires a check in irq_thread_check_affinity for an +existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y) + +Reported-and-tested-by: Sankara Muthukrishnan +Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/manage.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -716,6 +716,7 @@ static void + irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action) + { + cpumask_var_t mask; ++ bool valid = true; + + if (!test_and_clear_bit(IRQTF_AFFINITY, &action->thread_flags)) + return; +@@ -730,10 +731,18 @@ irq_thread_check_affinity(struct irq_des + } + + raw_spin_lock_irq(&desc->lock); +- cpumask_copy(mask, desc->irq_data.affinity); ++ /* ++ * This code is triggered unconditionally. Check the affinity ++ * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out. ++ */ ++ if (desc->irq_data.affinity) ++ cpumask_copy(mask, desc->irq_data.affinity); ++ else ++ valid = false; + raw_spin_unlock_irq(&desc->lock); + +- set_cpus_allowed_ptr(current, mask); ++ if (valid) ++ set_cpus_allowed_ptr(current, mask); + free_cpumask_var(mask); + } + #else +@@ -936,6 +945,16 @@ __setup_irq(unsigned int irq, struct irq + */ + get_task_struct(t); + new->thread = t; ++ /* ++ * Tell the thread to set its affinity. This is ++ * important for shared interrupt handlers as we do ++ * not invoke setup_affinity() for the secondary ++ * handlers as everything is already set up. Even for ++ * interrupts marked with IRQF_NO_BALANCE this is ++ * correct as we want the thread to move to the cpu(s) ++ * on which the requesting code placed the interrupt. ++ */ ++ set_bit(IRQTF_AFFINITY, &new->thread_flags); + } + + if (!alloc_cpumask_var(&mask, GFP_KERNEL)) { diff --git a/queue-3.7/input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch b/queue-3.7/input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch new file mode 100644 index 00000000000..8e247acfe72 --- /dev/null +++ b/queue-3.7/input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch @@ -0,0 +1,53 @@ +From e324ce61ef483dd26d03502d35666ad48a2e1b33 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 24 Dec 2012 09:32:46 -0800 +Subject: Input: gpio_keys - defer probing if GPIO probing is deferred + +From: Dmitry Torokhov + +commit e324ce61ef483dd26d03502d35666ad48a2e1b33 upstream. + +If of_get_gpio_flags() returns an error (as in case when GPIO probe is +deferred) the driver would attempt to claim invalid GPIO. It should +propagate the error code up the stack instead so that the probe either +fails or will be retried later (in case of -EPROBE_DEFER). + +Reported-by: Gabor Juhos +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/gpio_keys.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/input/keyboard/gpio_keys.c ++++ b/drivers/input/keyboard/gpio_keys.c +@@ -587,6 +587,7 @@ gpio_keys_get_devtree_pdata(struct devic + + i = 0; + for_each_child_of_node(node, pp) { ++ int gpio; + enum of_gpio_flags flags; + + if (!of_find_property(pp, "gpios", NULL)) { +@@ -595,9 +596,19 @@ gpio_keys_get_devtree_pdata(struct devic + continue; + } + ++ gpio = of_get_gpio_flags(pp, 0, &flags); ++ if (gpio < 0) { ++ error = gpio; ++ if (error != -EPROBE_DEFER) ++ dev_err(dev, ++ "Failed to get gpio flags, error: %d\n", ++ error); ++ goto err_free_pdata; ++ } ++ + button = &pdata->buttons[i++]; + +- button->gpio = of_get_gpio_flags(pp, 0, &flags); ++ button->gpio = gpio; + button->active_low = flags & OF_GPIO_ACTIVE_LOW; + + if (of_property_read_u32(pp, "linux,code", &button->code)) { diff --git a/queue-3.7/input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch b/queue-3.7/input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch new file mode 100644 index 00000000000..02f5ac4714c --- /dev/null +++ b/queue-3.7/input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch @@ -0,0 +1,57 @@ +From d46329a708c1a3301e272a029266b69339c0877f Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Sun, 23 Dec 2012 01:54:58 -0800 +Subject: Input: gpio_keys_polled - defer probing if GPIO probing is deferred + +From: Gabor Juhos + +commit d46329a708c1a3301e272a029266b69339c0877f upstream. + +If GPIO probing is deferred, the driver tries to claim an invalid GPIO line +which leads to an error message like this: + + gpio-keys-polled buttons.2: unable to claim gpio 4294966779, err=-22 + gpio-keys-polled: probe of buttons.2 failed with error -22 + +We should make sure that error code returned by of_get_gpio_flags (including +-EPROBE_DEFER) is propagated up the stack. + +Signed-off-by: Gabor Juhos +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/gpio_keys_polled.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/input/keyboard/gpio_keys_polled.c ++++ b/drivers/input/keyboard/gpio_keys_polled.c +@@ -136,6 +136,7 @@ gpio_keys_polled_get_devtree_pdata(struc + + i = 0; + for_each_child_of_node(node, pp) { ++ int gpio; + enum of_gpio_flags flags; + + if (!of_find_property(pp, "gpios", NULL)) { +@@ -144,9 +145,19 @@ gpio_keys_polled_get_devtree_pdata(struc + continue; + } + ++ gpio = of_get_gpio_flags(pp, 0, &flags); ++ if (gpio < 0) { ++ error = gpio; ++ if (error != -EPROBE_DEFER) ++ dev_err(dev, ++ "Failed to get gpio flags, error: %d\n", ++ error); ++ goto err_free_pdata; ++ } ++ + button = &pdata->buttons[i++]; + +- button->gpio = of_get_gpio_flags(pp, 0, &flags); ++ button->gpio = gpio; + button->active_low = flags & OF_GPIO_ACTIVE_LOW; + + if (of_property_read_u32(pp, "linux,code", &button->code)) { diff --git a/queue-3.7/input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch b/queue-3.7/input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch new file mode 100644 index 00000000000..7a2047ecec7 --- /dev/null +++ b/queue-3.7/input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch @@ -0,0 +1,34 @@ +From a25461659050b913e114d282bf58823682eb56b6 Mon Sep 17 00:00:00 2001 +From: Christophe TORDEUX +Date: Mon, 24 Dec 2012 09:20:40 -0800 +Subject: Input: sentelic - only report position of first finger as ST coordinates + +From: Christophe TORDEUX + +commit a25461659050b913e114d282bf58823682eb56b6 upstream. + +Report only the position of the first finger as absolute non-MT coordinates, +instead of reporting both fingers alternatively. Actual MT events are +unaffected. + +This fixes horizontal and improves vertical scrolling with the touchpad. + +Signed-off-by: Christophe TORDEUX +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/sentelic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/mouse/sentelic.c ++++ b/drivers/input/mouse/sentelic.c +@@ -791,7 +791,7 @@ static psmouse_ret_t fsp_process_byte(st + fsp_set_slot(dev, 0, fgrs > 0, abs_x, abs_y); + fsp_set_slot(dev, 1, false, 0, 0); + } +- if (fgrs > 0) { ++ if (fgrs == 1 || (fgrs == 2 && !(packet[0] & FSP_PB0_MFMC_FGR2))) { + input_report_abs(dev, ABS_X, abs_x); + input_report_abs(dev, ABS_Y, abs_y); + } diff --git a/queue-3.7/input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch b/queue-3.7/input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch new file mode 100644 index 00000000000..2ed67423a18 --- /dev/null +++ b/queue-3.7/input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch @@ -0,0 +1,37 @@ +From e12b3cecf221644ccab64d7c30a6df58b7630cb0 Mon Sep 17 00:00:00 2001 +From: Diego Calleja +Date: Mon, 3 Dec 2012 21:16:11 -0800 +Subject: Input: wacom - fix touch support for Bamboo Fun CTH-461 + +From: Diego Calleja + +commit e12b3cecf221644ccab64d7c30a6df58b7630cb0 upstream. + +Commit f393ee2b814e3291c12565000210b3cf10aa5c1d forgot to add the +touch_max property for Wacom Bamboo Fun CTH-461/S, ID 056a:00d2. + +This broke the touch functionality for that device. This patch, +(done with help of Ping Cheng), adds the correct value and makes +touch work again. + +Signed-off-by: Diego Calleja +Reviewed-by: Ping Cheng +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/tablet/wacom_wac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/input/tablet/wacom_wac.c ++++ b/drivers/input/tablet/wacom_wac.c +@@ -2034,7 +2034,8 @@ static const struct wacom_features wacom + .touch_max = 2 }; + static const struct wacom_features wacom_features_0xD2 = + { "Wacom Bamboo Craft", WACOM_PKGLEN_BBFUN, 14720, 9200, 1023, +- 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES }; ++ 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, ++ .touch_max = 2 }; + static const struct wacom_features wacom_features_0xD3 = + { "Wacom Bamboo 2FG 6x8", WACOM_PKGLEN_BBFUN, 21648, 13700, 1023, + 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, diff --git a/queue-3.7/input-walkera0701-fix-crash-on-startup.patch b/queue-3.7/input-walkera0701-fix-crash-on-startup.patch new file mode 100644 index 00000000000..cf568286bad --- /dev/null +++ b/queue-3.7/input-walkera0701-fix-crash-on-startup.patch @@ -0,0 +1,58 @@ +From a455e2985f57e2a71566bb8850094af38b2c932d Mon Sep 17 00:00:00 2001 +From: Peter Popovec +Date: Fri, 14 Dec 2012 22:57:25 -0800 +Subject: Input: walkera0701 - fix crash on startup + +From: Peter Popovec + +commit a455e2985f57e2a71566bb8850094af38b2c932d upstream. + +The driver's timer must be set up before enabling IRQ handler, otherwise +bad things may happen. + +Reported-and-tested-by: Fengguang Wu +Signed-off-by: Peter Popovec +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/walkera0701.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/input/joystick/walkera0701.c ++++ b/drivers/input/joystick/walkera0701.c +@@ -196,6 +196,7 @@ static void walkera0701_close(struct inp + struct walkera_dev *w = input_get_drvdata(dev); + + parport_disable_irq(w->parport); ++ hrtimer_cancel(&w->timer); + } + + static int walkera0701_connect(struct walkera_dev *w, int parport) +@@ -224,6 +225,9 @@ static int walkera0701_connect(struct wa + if (parport_claim(w->pardevice)) + goto init_err1; + ++ hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++ w->timer.function = timer_handler; ++ + w->input_dev = input_allocate_device(); + if (!w->input_dev) + goto init_err2; +@@ -254,8 +258,6 @@ static int walkera0701_connect(struct wa + if (err) + goto init_err3; + +- hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); +- w->timer.function = timer_handler; + return 0; + + init_err3: +@@ -271,7 +273,6 @@ static int walkera0701_connect(struct wa + + static void walkera0701_disconnect(struct walkera_dev *w) + { +- hrtimer_cancel(&w->timer); + input_unregister_device(w->input_dev); + parport_release(w->pardevice); + parport_unregister_device(w->pardevice); diff --git a/queue-3.7/mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch b/queue-3.7/mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch new file mode 100644 index 00000000000..38344a26581 --- /dev/null +++ b/queue-3.7/mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch @@ -0,0 +1,131 @@ +From 7179e7bf4592ac5a7b30257a7df6259ee81e51da Mon Sep 17 00:00:00 2001 +From: Jianguo Wu +Date: Tue, 18 Dec 2012 14:23:19 -0800 +Subject: mm/hugetlb: create hugetlb cgroup file in hugetlb_init + +From: Jianguo Wu + +commit 7179e7bf4592ac5a7b30257a7df6259ee81e51da upstream. + +Build kernel with CONFIG_HUGETLBFS=y,CONFIG_HUGETLB_PAGE=y and +CONFIG_CGROUP_HUGETLB=y, then specify hugepagesz=xx boot option, system +will fail to boot. + +This failure is caused by following code path: + + setup_hugepagesz + hugetlb_add_hstate + hugetlb_cgroup_file_init + cgroup_add_cftypes + kzalloc <--slab is *not available* yet + +For this path, slab is not available yet, so memory allocated will be +failed, and cause WARN_ON() in hugetlb_cgroup_file_init(). + +So I move hugetlb_cgroup_file_init() into hugetlb_init(). + +[akpm@linux-foundation.org: tweak coding-style, remove pointless __init on inlined function] +[akpm@linux-foundation.org: fix warning] +Signed-off-by: Jianguo Wu +Signed-off-by: Jiang Liu +Reviewed-by: Aneesh Kumar K.V +Acked-by: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/hugetlb_cgroup.h | 5 ++--- + mm/hugetlb.c | 11 +---------- + mm/hugetlb_cgroup.c | 19 +++++++++++++++++-- + 3 files changed, 20 insertions(+), 15 deletions(-) + +--- a/include/linux/hugetlb_cgroup.h ++++ b/include/linux/hugetlb_cgroup.h +@@ -62,7 +62,7 @@ extern void hugetlb_cgroup_uncharge_page + struct page *page); + extern void hugetlb_cgroup_uncharge_cgroup(int idx, unsigned long nr_pages, + struct hugetlb_cgroup *h_cg); +-extern int hugetlb_cgroup_file_init(int idx) __init; ++extern void hugetlb_cgroup_file_init(void) __init; + extern void hugetlb_cgroup_migrate(struct page *oldhpage, + struct page *newhpage); + +@@ -111,9 +111,8 @@ hugetlb_cgroup_uncharge_cgroup(int idx, + return; + } + +-static inline int __init hugetlb_cgroup_file_init(int idx) ++static inline void hugetlb_cgroup_file_init(void) + { +- return 0; + } + + static inline void hugetlb_cgroup_migrate(struct page *oldhpage, +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1906,14 +1906,12 @@ static int __init hugetlb_init(void) + default_hstate.max_huge_pages = default_hstate_max_huge_pages; + + hugetlb_init_hstates(); +- + gather_bootmem_prealloc(); +- + report_hugepages(); + + hugetlb_sysfs_init(); +- + hugetlb_register_all_nodes(); ++ hugetlb_cgroup_file_init(); + + return 0; + } +@@ -1943,13 +1941,6 @@ void __init hugetlb_add_hstate(unsigned + h->next_nid_to_free = first_node(node_states[N_HIGH_MEMORY]); + snprintf(h->name, HSTATE_NAME_LEN, "hugepages-%lukB", + huge_page_size(h)/1024); +- /* +- * Add cgroup control files only if the huge page consists +- * of more than two normal pages. This is because we use +- * page[2].lru.next for storing cgoup details. +- */ +- if (order >= HUGETLB_CGROUP_MIN_ORDER) +- hugetlb_cgroup_file_init(hugetlb_max_hstate - 1); + + parsed_hstate = h; + } +--- a/mm/hugetlb_cgroup.c ++++ b/mm/hugetlb_cgroup.c +@@ -340,7 +340,7 @@ static char *mem_fmt(char *buf, int size + return buf; + } + +-int __init hugetlb_cgroup_file_init(int idx) ++static void __init __hugetlb_cgroup_file_init(int idx) + { + char buf[32]; + struct cftype *cft; +@@ -382,7 +382,22 @@ int __init hugetlb_cgroup_file_init(int + + WARN_ON(cgroup_add_cftypes(&hugetlb_subsys, h->cgroup_files)); + +- return 0; ++ return; ++} ++ ++void __init hugetlb_cgroup_file_init(void) ++{ ++ struct hstate *h; ++ ++ for_each_hstate(h) { ++ /* ++ * Add cgroup control files only if the huge page consists ++ * of more than two normal pages. This is because we use ++ * page[2].lru.next for storing cgroup details. ++ */ ++ if (huge_page_order(h) >= HUGETLB_CGROUP_MIN_ORDER) ++ __hugetlb_cgroup_file_init(hstate_index(h)); ++ } + } + + /* diff --git a/queue-3.7/revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch b/queue-3.7/revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch new file mode 100644 index 00000000000..d912dc4ac30 --- /dev/null +++ b/queue-3.7/revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch @@ -0,0 +1,38 @@ +From d75542263a0b005876d112bbf9ffb23180cc3149 Mon Sep 17 00:00:00 2001 +From: Afzal Mohammed +Date: Tue, 6 Nov 2012 20:47:24 +0530 +Subject: Revert "usb: musb: dsps: remove explicit NOP device creation" + +From: Afzal Mohammed + +commit d75542263a0b005876d112bbf9ffb23180cc3149 upstream. + +This reverts commit d8c3ef256f88b7c6ecd673d03073b5645be9c5e4. + +Above mentioned change was made along with multi usb phy change and +adding DT support for nop transceiver. But other two changes did not +make it to mainline. This in effect makes dsps musb wrapper unusable +even for single instance. + +Hence revert it so that at least single instance can be supported. + +Signed-off-by: Afzal Mohammed +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_dsps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/musb/musb_dsps.c ++++ b/drivers/usb/musb/musb_dsps.c +@@ -377,7 +377,8 @@ static int dsps_musb_init(struct musb *m + /* mentor core register starts at offset of 0x400 from musb base */ + musb->mregs += wrp->musb_core_offset; + +- /* Get the NOP PHY */ ++ /* NOP driver needs change if supporting dual instance */ ++ usb_nop_xceiv_register(); + musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2); + if (IS_ERR_OR_NULL(musb->xceiv)) + return -ENODEV; diff --git a/queue-3.7/series b/queue-3.7/series index 888d09b2a5e..20aa401f201 100644 --- a/queue-3.7/series +++ b/queue-3.7/series @@ -52,3 +52,25 @@ pnfs-increase-the-refcount-when-layoutget-fails-the-first-time.patch nfs-fix-null-checking-in-nfs_get_option_str.patch nfs-ensure-that-we-free-the-rpc_task-after-read-and-write-cleanups-are-done.patch nfs-avoid-dereferencing-null-pointer-in-initiate_bulk_draining.patch +vfs-d_obtain_alias-needs-to-use-as-default-name.patch +input-walkera0701-fix-crash-on-startup.patch +input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch +input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch +input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch +input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch +genirq-always-force-thread-affinity.patch +usb-musb-cppi_dma-export-cppi_interrupt.patch +revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch +xhci-fix-conditional-check-in-bandwidth-calculation.patch +xhci-fix-td-size-calculation-on-1.0-hosts.patch +xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch +usb-fix-endpoint-disabling-for-failed-config-changes.patch +usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch +xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch +cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch +cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch +cgroup_rm_file-don-t-delete-the-uncreated-files.patch +mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch +staging-drm-omap-fix-include-error-during-make.patch +smb3-mounts-fail-with-access-denied-to-some-servers.patch +freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch diff --git a/queue-3.7/smb3-mounts-fail-with-access-denied-to-some-servers.patch b/queue-3.7/smb3-mounts-fail-with-access-denied-to-some-servers.patch new file mode 100644 index 00000000000..26452662738 --- /dev/null +++ b/queue-3.7/smb3-mounts-fail-with-access-denied-to-some-servers.patch @@ -0,0 +1,39 @@ +From 52c0f4ad8ed462d81f1d37f56a74a71dc0c9bf0f Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Tue, 4 Dec 2012 16:56:37 -0600 +Subject: SMB3 mounts fail with access denied to some servers + +From: Steve French + +commit 52c0f4ad8ed462d81f1d37f56a74a71dc0c9bf0f upstream. + +We were checking incorrectly if signatures were required to be sent, +so were always sending signatures after the initial session establishment. +For SMB3 mounts (vers=3.0) this was a problem because we were putting +SMB2 signatures in SMB3 requests which would cause access denied +on mount (the tree connection would fail). + +This might also be worth considering for stable (for 3.7), as the +error message on mount (access denied) is confusing to users and +there is no workaround if the server is configured to only +support smb3.0. I am ok either way. + +Signed-off-by: Steve French +Reviewed-by: Jeff Layton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -425,7 +425,7 @@ SMB2_negotiate(const unsigned int xid, s + } + + cFYI(1, "sec_flags 0x%x", sec_flags); +- if (sec_flags & CIFSSEC_MUST_SIGN) { ++ if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) { + cFYI(1, "Signing required"); + if (!(server->sec_mode & (SMB2_NEGOTIATE_SIGNING_REQUIRED | + SMB2_NEGOTIATE_SIGNING_ENABLED))) { diff --git a/queue-3.7/staging-drm-omap-fix-include-error-during-make.patch b/queue-3.7/staging-drm-omap-fix-include-error-during-make.patch new file mode 100644 index 00000000000..92c9cb45cae --- /dev/null +++ b/queue-3.7/staging-drm-omap-fix-include-error-during-make.patch @@ -0,0 +1,29 @@ +From b9ed9f0ecf1b5675c64d069e9b53effe276b6f01 Mon Sep 17 00:00:00 2001 +From: Andy Gross +Date: Tue, 16 Oct 2012 00:17:40 -0500 +Subject: staging: drm/omap: Fix include error during make + +From: Andy Gross + +commit b9ed9f0ecf1b5675c64d069e9b53effe276b6f01 upstream. + +Fixed include error for drm_mode.h + +Signed-off-by: Andy Gross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/omapdrm/omap_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/omapdrm/omap_crtc.c ++++ b/drivers/staging/omapdrm/omap_crtc.c +@@ -19,7 +19,7 @@ + + #include "omap_drv.h" + +-#include "drm_mode.h" ++#include + #include "drm_crtc.h" + #include "drm_crtc_helper.h" + diff --git a/queue-3.7/usb-fix-endpoint-disabling-for-failed-config-changes.patch b/queue-3.7/usb-fix-endpoint-disabling-for-failed-config-changes.patch new file mode 100644 index 00000000000..084aaa0329b --- /dev/null +++ b/queue-3.7/usb-fix-endpoint-disabling-for-failed-config-changes.patch @@ -0,0 +1,104 @@ +From 36caff5d795429c572443894e8789c2150dd796b Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 7 Nov 2012 10:31:30 -0500 +Subject: USB: fix endpoint-disabling for failed config changes + +From: Alan Stern + +commit 36caff5d795429c572443894e8789c2150dd796b upstream. + +This patch (as1631) fixes a bug that shows up when a config change +fails for a device under an xHCI controller. The controller needs to +be told to disable the endpoints that have been enabled for the new +config. The existing code does this, but before storing the +information about which endpoints were enabled! As a result, any +second attempt to install the new config is doomed to fail because +xhci-hcd will refuse to enable an endpoint that is already enabled. + +The patch optimistically initializes the new endpoints' device +structures before asking the device to switch to the new config. If +the request fails then the endpoint information is already stored, so +we can use usb_hcd_alloc_bandwidth() to disable the endpoints with no +trouble. The rest of the error path is slightly more complex now; we +have to disable the new interfaces and call put_device() rather than +simply deallocating them. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Matthias Schniedermeyer +CC: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 54 +++++++++++++++++++++++++-------------------- + 1 file changed, 31 insertions(+), 23 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1806,29 +1806,8 @@ free_interfaces: + goto free_interfaces; + } + +- ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), +- USB_REQ_SET_CONFIGURATION, 0, configuration, 0, +- NULL, 0, USB_CTRL_SET_TIMEOUT); +- if (ret < 0) { +- /* All the old state is gone, so what else can we do? +- * The device is probably useless now anyway. +- */ +- cp = NULL; +- } +- +- dev->actconfig = cp; +- if (!cp) { +- usb_set_device_state(dev, USB_STATE_ADDRESS); +- usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); +- /* Leave LPM disabled while the device is unconfigured. */ +- mutex_unlock(hcd->bandwidth_mutex); +- usb_autosuspend_device(dev); +- goto free_interfaces; +- } +- mutex_unlock(hcd->bandwidth_mutex); +- usb_set_device_state(dev, USB_STATE_CONFIGURED); +- +- /* Initialize the new interface structures and the ++ /* ++ * Initialize the new interface structures and the + * hc/hcd/usbcore interface/endpoint state. + */ + for (i = 0; i < nintf; ++i) { +@@ -1872,6 +1851,35 @@ free_interfaces: + } + kfree(new_interfaces); + ++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ++ USB_REQ_SET_CONFIGURATION, 0, configuration, 0, ++ NULL, 0, USB_CTRL_SET_TIMEOUT); ++ if (ret < 0 && cp) { ++ /* ++ * All the old state is gone, so what else can we do? ++ * The device is probably useless now anyway. ++ */ ++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); ++ for (i = 0; i < nintf; ++i) { ++ usb_disable_interface(dev, cp->interface[i], true); ++ put_device(&cp->interface[i]->dev); ++ cp->interface[i] = NULL; ++ } ++ cp = NULL; ++ } ++ ++ dev->actconfig = cp; ++ mutex_unlock(hcd->bandwidth_mutex); ++ ++ if (!cp) { ++ usb_set_device_state(dev, USB_STATE_ADDRESS); ++ ++ /* Leave LPM disabled while the device is unconfigured. */ ++ usb_autosuspend_device(dev); ++ return ret; ++ } ++ usb_set_device_state(dev, USB_STATE_CONFIGURED); ++ + if (cp->string == NULL && + !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS)) + cp->string = usb_cache_string(dev, cp->desc.iConfiguration); diff --git a/queue-3.7/usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch b/queue-3.7/usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch new file mode 100644 index 00000000000..21ce7532715 --- /dev/null +++ b/queue-3.7/usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch @@ -0,0 +1,36 @@ +From b0e4e606ff6ff26da0f60826e75577b56ba4e463 Mon Sep 17 00:00:00 2001 +From: "Alexis R. Cortes" +Date: Thu, 8 Nov 2012 16:59:27 -0600 +Subject: usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch + +From: "Alexis R. Cortes" + +commit b0e4e606ff6ff26da0f60826e75577b56ba4e463 upstream. + +This minor patch creates a more stricter conditional for the Z1 sytems for applying +the Compliance Mode Patch, this to avoid the quirk to be applied to models that +contain a "Z1" in their dmi product string but are different from Z1 systems. + +This patch should be backported to stable kernels as old as 3.2, that +contain the commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 "usb: host: +xhci: Fix Compliance Mode on SN65LVPE502CP Hardware" + +Signed-off-by: Alexis R. Cortes +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -480,7 +480,7 @@ static bool compliance_mode_recovery_tim + if (strstr(dmi_product_name, "Z420") || + strstr(dmi_product_name, "Z620") || + strstr(dmi_product_name, "Z820") || +- strstr(dmi_product_name, "Z1")) ++ strstr(dmi_product_name, "Z1 Workstation")) + return true; + + return false; diff --git a/queue-3.7/usb-musb-cppi_dma-export-cppi_interrupt.patch b/queue-3.7/usb-musb-cppi_dma-export-cppi_interrupt.patch new file mode 100644 index 00000000000..4d220fc9c5f --- /dev/null +++ b/queue-3.7/usb-musb-cppi_dma-export-cppi_interrupt.patch @@ -0,0 +1,30 @@ +From 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Mon, 5 Nov 2012 22:26:40 +0300 +Subject: usb: musb: cppi_dma: export cppi_interrupt() + +From: Sergei Shtylyov + +commit 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 upstream. + +Now that DaVinci glue layer can be modular, we must export cppi_interrupt() +that it may call... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/cppi_dma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/cppi_dma.c ++++ b/drivers/usb/musb/cppi_dma.c +@@ -1314,6 +1314,7 @@ irqreturn_t cppi_interrupt(int irq, void + + return IRQ_HANDLED; + } ++EXPORT_SYMBOL_GPL(cppi_interrupt); + + /* Instantiate a software object representing a DMA controller. */ + struct dma_controller *__devinit diff --git a/queue-3.7/vfs-d_obtain_alias-needs-to-use-as-default-name.patch b/queue-3.7/vfs-d_obtain_alias-needs-to-use-as-default-name.patch new file mode 100644 index 00000000000..10a8d486f75 --- /dev/null +++ b/queue-3.7/vfs-d_obtain_alias-needs-to-use-as-default-name.patch @@ -0,0 +1,48 @@ +From b911a6bdeef5848c468597d040e3407e0aee04ce Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 8 Nov 2012 16:09:37 -0800 +Subject: vfs: d_obtain_alias() needs to use "/" as default name. + +From: NeilBrown + +commit b911a6bdeef5848c468597d040e3407e0aee04ce upstream. + +NFS appears to use d_obtain_alias() to create the root dentry rather than +d_make_root. This can cause 'prepend_path()' to complain that the root +has a weird name if an NFS filesystem is lazily unmounted. e.g. if +"/mnt" is an NFS mount then + + { cd /mnt; umount -l /mnt ; ls -l /proc/self/cwd; } + +will cause a WARN message like + WARNING: at /home/git/linux/fs/dcache.c:2624 prepend_path+0x1d7/0x1e0() + ... + Root dentry has weird name <> + +to appear in kernel logs. + +So change d_obtain_alias() to use "/" rather than "" as the anonymous +name. + +Signed-off-by: NeilBrown +Cc: Trond Myklebust +Cc: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/dcache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1583,7 +1583,7 @@ EXPORT_SYMBOL(d_find_any_alias); + */ + struct dentry *d_obtain_alias(struct inode *inode) + { +- static const struct qstr anonstring = { .name = "" }; ++ static const struct qstr anonstring = QSTR_INIT("/", 1); + struct dentry *tmp; + struct dentry *res; + diff --git a/queue-3.7/xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch b/queue-3.7/xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch new file mode 100644 index 00000000000..88c2ed4b94f --- /dev/null +++ b/queue-3.7/xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch @@ -0,0 +1,57 @@ +From bb1e5dd7113d2fd178d3af9aca8f480ae0468edf Mon Sep 17 00:00:00 2001 +From: Russell Webb +Date: Fri, 9 Nov 2012 13:58:49 -0800 +Subject: xhci: Add Lynx Point LP to list of Intel switchable hosts + +From: Russell Webb + +commit bb1e5dd7113d2fd178d3af9aca8f480ae0468edf upstream. + +Like Lynx Point, Lynx Point LP is also switchable. See +1c12443ab8eba71a658fae4572147e56d1f84f66 for more details. + +This patch should be backported to stable kernels as old as 3.0, +that contain commit 69e848c2090aebba5698a1620604c7dccb448684 +"Intel xhci: Support EHCI/xHCI port switching." + +Signed-off-by: Russell Webb +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-pci.c | 3 ++- + drivers/usb/host/pci-quirks.c | 4 +++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -334,7 +334,8 @@ static bool usb_is_intel_switchable_ehci + pdev->vendor == PCI_VENDOR_ID_INTEL && + (pdev->device == 0x1E26 || + pdev->device == 0x8C2D || +- pdev->device == 0x8C26); ++ pdev->device == 0x8C26 || ++ pdev->device == 0x9C26); + } + + static void ehci_enable_xhci_companion(void) +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -723,6 +723,7 @@ static int handshake(void __iomem *ptr, + } + + #define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI 0x8C31 ++#define PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI 0x9C31 + + bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev) + { +@@ -736,7 +737,8 @@ bool usb_is_intel_lpt_switchable_xhci(st + { + return pdev->class == PCI_CLASS_SERIAL_USB_XHCI && + pdev->vendor == PCI_VENDOR_ID_INTEL && +- pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI; ++ (pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI); + } + + bool usb_is_intel_switchable_xhci(struct pci_dev *pdev) diff --git a/queue-3.7/xhci-fix-conditional-check-in-bandwidth-calculation.patch b/queue-3.7/xhci-fix-conditional-check-in-bandwidth-calculation.patch new file mode 100644 index 00000000000..5fdc4b8c039 --- /dev/null +++ b/queue-3.7/xhci-fix-conditional-check-in-bandwidth-calculation.patch @@ -0,0 +1,52 @@ +From 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Thu, 25 Oct 2012 13:44:12 -0700 +Subject: xhci: Fix conditional check in bandwidth calculation. + +From: Sarah Sharp + +commit 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 upstream. + +David reports that at drivers/usb/host/xhci.c:2257: + +static bool xhci_is_sync_in_ep(unsigned int ep_type) +{ + return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP); +} + +The static analyser cppcheck says + +[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true. + +Maybe the original programmer intention was something like + +static bool xhci_is_sync_in_ep(unsigned int ep_type) +{ + return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP); +} + +Fix this. + +This patch should be backported to stable kernels as old as 3.2, that +contain the commit 2b69899934c63b7b9432568584fb4c4a2924f40c "xhci: USB +3.0 BW checking." + +Signed-off-by: Sarah Sharp +Reported-by: David Binderman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -2254,7 +2254,7 @@ static bool xhci_is_async_ep(unsigned in + + static bool xhci_is_sync_in_ep(unsigned int ep_type) + { +- return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP); ++ return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP); + } + + static unsigned int xhci_get_ss_bw_consumed(struct xhci_bw_info *ep_bw) diff --git a/queue-3.7/xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch b/queue-3.7/xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch new file mode 100644 index 00000000000..ca4b440c92e --- /dev/null +++ b/queue-3.7/xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch @@ -0,0 +1,64 @@ +From 68e5254adb88bede68285f11fb442a4d34fb550c Mon Sep 17 00:00:00 2001 +From: Julius Werner +Date: Thu, 1 Nov 2012 12:47:59 -0700 +Subject: xhci: fix null-pointer dereference when destroying half-built segment rings + +From: Julius Werner + +commit 68e5254adb88bede68285f11fb442a4d34fb550c upstream. + +xhci_alloc_segments_for_ring() builds a list of xhci_segments and links +the tail to head at the end (forming a ring). When it bails out for OOM +reasons half-way through, it tries to destroy its half-built list with +xhci_free_segments_for_ring(), even though it is not a ring yet. This +causes a null-pointer dereference upon hitting the last element. + +Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes +the output parameters to be valid upon this kind of OOM failure, and +calls xhci_ring_free() on them. Since the (incomplete) list/ring should +already be destroyed in that case, this would lead to a use after free. + +This patch fixes those issues by having xhci_alloc_segments_for_ring() +destroy its half-built, non-circular list manually and destroying the +invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree(). + +This patch should be backported to kernels as old as 2.6.31, that +contains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 "USB: xhci: +Ring allocation and initialization." + +A separate patch will need to be developed for kernels older than 3.4, +since the ring allocation code was refactored in that kernel. + +Signed-off-by: Julius Werner +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -205,7 +205,12 @@ static int xhci_alloc_segments_for_ring( + + next = xhci_segment_alloc(xhci, cycle_state, flags); + if (!next) { +- xhci_free_segments_for_ring(xhci, *first); ++ prev = *first; ++ while (prev) { ++ next = prev->next; ++ xhci_segment_free(xhci, prev); ++ prev = next; ++ } + return -ENOMEM; + } + xhci_link_segments(xhci, prev, next, type); +@@ -258,7 +263,7 @@ static struct xhci_ring *xhci_ring_alloc + return ring; + + fail: +- xhci_ring_free(xhci, ring); ++ kfree(ring); + return NULL; + } + diff --git a/queue-3.7/xhci-fix-td-size-calculation-on-1.0-hosts.patch b/queue-3.7/xhci-fix-td-size-calculation-on-1.0-hosts.patch new file mode 100644 index 00000000000..8c658c3d212 --- /dev/null +++ b/queue-3.7/xhci-fix-td-size-calculation-on-1.0-hosts.patch @@ -0,0 +1,156 @@ +From 4525c0a10dff7ad3669763c28016c7daffc3900e Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Thu, 25 Oct 2012 15:56:40 -0700 +Subject: xHCI: Fix TD Size calculation on 1.0 hosts. + +From: Sarah Sharp + +commit 4525c0a10dff7ad3669763c28016c7daffc3900e upstream. + +The xHCI 1.0 specification made a change to the TD Size field in TRBs. +The value is now the number of packets that remain to be sent in the TD, +not including this TRB. The TD Size value for the last TRB in a TD must +always be zero. + +The xHCI function xhci_v1_0_td_remainder() attempts to calculate this, +but it gets it wrong. First, it erroneously reuses the old +xhci_td_remainder function, which will right shift the value by 10. The +xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10. +Second, it does not set the TD size for the last TRB in a TD to zero. + +Third, it uses roundup instead of DIV_ROUND_UP. The total packet count +is supposed to be the total number of bytes in this TD, divided by the +max packet size, rounded up. DIV_ROUND_UP is the right function to use +in that case. + +With the old code, a TD on an endpoint with max packet size 1024 would +be set up like so: +TRB 1, TRB length = 600 bytes, TD size = 0 +TRB 1, TRB length = 200 bytes, TD size = 0 +TRB 1, TRB length = 100 bytes, TD size = 0 + +With the new code, the TD would be set up like this: +TRB 1, TRB length = 600 bytes, TD size = 1 +TRB 1, TRB length = 200 bytes, TD size = 1 +TRB 1, TRB length = 100 bytes, TD size = 0 + +This commit should be backported to kernels as old as 3.0, that contain +the commit 4da6e6f247a2601ab9f1e63424e4d944ed4124f3 "xhci 1.0: Update TD +size field format." + +Signed-off-by: Sarah Sharp +Reported-by: Chintan Mehta +Reported-by: Shimmer Huang +Tested-by: Bhavik Kothari +Tested-by: Shimmer Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 32 +++++++++++++++++++------------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3071,11 +3071,11 @@ static u32 xhci_td_remainder(unsigned in + } + + /* +- * For xHCI 1.0 host controllers, TD size is the number of packets remaining in +- * the TD (*not* including this TRB). ++ * For xHCI 1.0 host controllers, TD size is the number of max packet sized ++ * packets remaining in the TD (*not* including this TRB). + * + * Total TD packet count = total_packet_count = +- * roundup(TD size in bytes / wMaxPacketSize) ++ * DIV_ROUND_UP(TD size in bytes / wMaxPacketSize) + * + * Packets transferred up to and including this TRB = packets_transferred = + * rounddown(total bytes transferred including this TRB / wMaxPacketSize) +@@ -3083,15 +3083,16 @@ static u32 xhci_td_remainder(unsigned in + * TD size = total_packet_count - packets_transferred + * + * It must fit in bits 21:17, so it can't be bigger than 31. ++ * The last TRB in a TD must have the TD size set to zero. + */ +- + static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len, +- unsigned int total_packet_count, struct urb *urb) ++ unsigned int total_packet_count, struct urb *urb, ++ unsigned int num_trbs_left) + { + int packets_transferred; + + /* One TRB with a zero-length data packet. */ +- if (running_total == 0 && trb_buff_len == 0) ++ if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0)) + return 0; + + /* All the TRB queueing functions don't count the current TRB in +@@ -3100,7 +3101,9 @@ static u32 xhci_v1_0_td_remainder(int ru + packets_transferred = (running_total + trb_buff_len) / + usb_endpoint_maxp(&urb->ep->desc); + +- return xhci_td_remainder(total_packet_count - packets_transferred); ++ if ((total_packet_count - packets_transferred) > 31) ++ return 31 << 17; ++ return (total_packet_count - packets_transferred) << 17; + } + + static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, +@@ -3127,7 +3130,7 @@ static int queue_bulk_sg_tx(struct xhci_ + + num_trbs = count_sg_trbs_needed(xhci, urb); + num_sgs = urb->num_mapped_sgs; +- total_packet_count = roundup(urb->transfer_buffer_length, ++ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length, + usb_endpoint_maxp(&urb->ep->desc)); + + trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id], +@@ -3210,7 +3213,8 @@ static int queue_bulk_sg_tx(struct xhci_ + running_total); + } else { + remainder = xhci_v1_0_td_remainder(running_total, +- trb_buff_len, total_packet_count, urb); ++ trb_buff_len, total_packet_count, urb, ++ num_trbs - 1); + } + length_field = TRB_LEN(trb_buff_len) | + remainder | +@@ -3318,7 +3322,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd * + start_cycle = ep_ring->cycle_state; + + running_total = 0; +- total_packet_count = roundup(urb->transfer_buffer_length, ++ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length, + usb_endpoint_maxp(&urb->ep->desc)); + /* How much data is in the first TRB? */ + addr = (u64) urb->transfer_dma; +@@ -3364,7 +3368,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd * + running_total); + } else { + remainder = xhci_v1_0_td_remainder(running_total, +- trb_buff_len, total_packet_count, urb); ++ trb_buff_len, total_packet_count, urb, ++ num_trbs - 1); + } + length_field = TRB_LEN(trb_buff_len) | + remainder | +@@ -3627,7 +3632,7 @@ static int xhci_queue_isoc_tx(struct xhc + addr = start_addr + urb->iso_frame_desc[i].offset; + td_len = urb->iso_frame_desc[i].length; + td_remain_len = td_len; +- total_packet_count = roundup(td_len, ++ total_packet_count = DIV_ROUND_UP(td_len, + usb_endpoint_maxp(&urb->ep->desc)); + /* A zero-length transfer still involves at least one packet. */ + if (total_packet_count == 0) +@@ -3706,7 +3711,8 @@ static int xhci_queue_isoc_tx(struct xhc + } else { + remainder = xhci_v1_0_td_remainder( + running_total, trb_buff_len, +- total_packet_count, urb); ++ total_packet_count, urb, ++ (trbs_per_td - j - 1)); + } + length_field = TRB_LEN(trb_buff_len) | + remainder | -- 2.47.3