diff options
| author | Zefan Li <lizefan@huawei.com> | 2015-07-16 09:46:11 +0800 |
|---|---|---|
| committer | Zefan Li <lizefan@huawei.com> | 2015-07-16 09:46:11 +0800 |
| commit | 1716ad83892192fb0abc3f6d7394a2f841bd3852 (patch) | |
| tree | d383715ce7195d0b324fd5aa830ec018415f9dfe | |
| parent | 6dd0d040b71c98e6a88b081a5c015167524bcdad (diff) | |
| download | linux-3.4.y-queue-1716ad83892192fb0abc3f6d7394a2f841bd3852.tar.gz | |
Add commits to 3.4.y, up to 4.1-rc5
32 files changed, 1777 insertions, 0 deletions
diff --git a/patches/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch b/patches/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch new file mode 100644 index 0000000..2f6e97d --- /dev/null +++ b/patches/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch @@ -0,0 +1,56 @@ +From b9a5e5e18fbf223502c0b2264c15024e393da928 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> +Date: Thu, 7 May 2015 21:19:39 +0200 +Subject: ACPI / init: Fix the ordering of acpi_reserve_resources() + +commit b9a5e5e18fbf223502c0b2264c15024e393da928 upstream. + +Since acpi_reserve_resources() is defined as a device_initcall(), +there's no guarantee that it will be executed in the right order +with respect to the rest of the ACPI initialization code. On some +systems this leads to breakage if, for example, the address range +that should be reserved for the ACPI fixed registers is given to +the PCI host bridge instead if the race is won by the wrong code +path. + +Fix this by turning acpi_reserve_resources() into a void function +and calling it directly from within the ACPI initialization sequence. + +Reported-and-tested-by: George McCollister <george.mccollister@gmail.com> +Link: http://marc.info/?t=143092384600002&r=1&w=2 +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/acpi/osl.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -174,7 +174,7 @@ static void __init acpi_request_region ( + request_mem_region(addr, length, desc); + } + +-static int __init acpi_reserve_resources(void) ++static void __init acpi_reserve_resources(void) + { + acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, + "ACPI PM1a_EVT_BLK"); +@@ -203,10 +203,7 @@ static int __init acpi_reserve_resources + if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) + acpi_request_region(&acpi_gbl_FADT.xgpe1_block, + acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); +- +- return 0; + } +-device_initcall(acpi_reserve_resources); + + void acpi_os_printf(const char *fmt, ...) + { +@@ -1542,6 +1539,7 @@ acpi_status __init acpi_os_initialize(vo + + acpi_status __init acpi_os_initialize1(void) + { ++ acpi_reserve_resources(); + kacpid_wq = alloc_workqueue("kacpid", 0, 1); + kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); + kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1); diff --git a/patches/ahci-avoton-port-disable-reset-quirk.patch b/patches/ahci-avoton-port-disable-reset-quirk.patch new file mode 100644 index 0000000..c262e21 --- /dev/null +++ b/patches/ahci-avoton-port-disable-reset-quirk.patch @@ -0,0 +1,168 @@ +From dbfe8ef5599a5370abc441fcdbb382b656563eb4 Mon Sep 17 00:00:00 2001 +From: Dan Williams <dan.j.williams@intel.com> +Date: Fri, 8 May 2015 15:23:55 -0400 +Subject: ahci: avoton port-disable reset-quirk + +commit dbfe8ef5599a5370abc441fcdbb382b656563eb4 upstream. + +Avoton AHCI occasionally sees drive probe timeouts at driver load time. +When this happens SCR_STATUS indicates device detected, but no D2H FIS +reception. Reset the internal link state machines by bouncing +port-enable in the PCS register when this occurs. + +Signed-off-by: Dan Williams <dan.j.williams@intel.com> +Signed-off-by: Tejun Heo <tj@kernel.org> +[lizf: Backported to 3.4: + - adjust context + - use ahci_start_engine() instead of hpriv->start_engine()] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/ata/ahci.c | 102 ++++++++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 94 insertions(+), 8 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -67,6 +67,7 @@ enum board_ids { + board_ahci_yes_fbs, + + /* board IDs for specific chipsets in alphabetical order */ ++ board_ahci_avn, + board_ahci_mcp65, + board_ahci_mcp77, + board_ahci_mcp89, +@@ -85,6 +86,8 @@ enum board_ids { + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); + static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); + #ifdef CONFIG_PM +@@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p + .hardreset = ahci_p5wdh_hardreset, + }; + ++static struct ata_port_operations ahci_avn_ops = { ++ .inherits = &ahci_ops, ++ .hardreset = ahci_avn_hardreset, ++}; ++ + static const struct ata_port_info ahci_port_info[] = { + /* by features */ + [board_ahci] = +@@ -154,6 +162,12 @@ static const struct ata_port_info ahci_p + .port_ops = &ahci_ops, + }, + /* by chipsets */ ++ [board_ahci_avn] = { ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_avn_ops, ++ }, + [board_ahci_mcp65] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP | +@@ -300,14 +314,14 @@ static const struct pci_device_id ahci_p + { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */ + { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */ + { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */ +@@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct a + return rc; + } + ++/* ++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports. ++ * ++ * It has been observed with some SSDs that the timing of events in the ++ * link synchronization phase can leave the port in a state that can not ++ * be recovered by a SATA-hard-reset alone. The failing signature is ++ * SStatus.DET stuck at 1 ("Device presence detected but Phy ++ * communication not established"). It was found that unloading and ++ * reloading the driver when this problem occurs allows the drive ++ * connection to be recovered (DET advanced to 0x3). The critical ++ * component of reloading the driver is that the port state machines are ++ * reset by bouncing "port enable" in the AHCI PCS configuration ++ * register. So, reproduce that effect by bouncing a port whenever we ++ * see DET==1 after a reset. ++ */ ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context); ++ struct ata_port *ap = link->ap; ++ struct ahci_port_priv *pp = ap->private_data; ++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG; ++ unsigned long tmo = deadline - jiffies; ++ struct ata_taskfile tf; ++ bool online; ++ int rc, i; ++ ++ DPRINTK("ENTER\n"); ++ ++ ahci_stop_engine(ap); ++ ++ for (i = 0; i < 2; i++) { ++ u16 val; ++ u32 sstatus; ++ int port = ap->port_no; ++ struct ata_host *host = ap->host; ++ struct pci_dev *pdev = to_pci_dev(host->dev); ++ ++ /* clear D2H reception area to properly wait for D2H FIS */ ++ ata_tf_init(link->device, &tf); ++ tf.command = ATA_BUSY; ++ ata_tf_to_fis(&tf, 0, 0, d2h_fis); ++ ++ rc = sata_link_hardreset(link, timing, deadline, &online, ++ ahci_check_ready); ++ ++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 || ++ (sstatus & 0xf) != 1) ++ break; ++ ++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n", ++ port); ++ ++ pci_read_config_word(pdev, 0x92, &val); ++ val &= ~(1 << port); ++ pci_write_config_word(pdev, 0x92, val); ++ ata_msleep(ap, 1000); ++ val |= 1 << port; ++ pci_write_config_word(pdev, 0x92, val); ++ deadline += tmo; ++ } ++ ++ ahci_start_engine(ap); ++ ++ if (online) ++ *class = ahci_dev_classify(ap); ++ ++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class); ++ return rc; ++} ++ ++ + #ifdef CONFIG_PM + static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg) + { diff --git a/patches/ahci-un-staticize-ahci_dev_classify.patch b/patches/ahci-un-staticize-ahci_dev_classify.patch new file mode 100644 index 0000000..4b5dba1 --- /dev/null +++ b/patches/ahci-un-staticize-ahci_dev_classify.patch @@ -0,0 +1,47 @@ +From bbb4ab43f82adf02c8b4d0d7e7b7e79d24204b05 Mon Sep 17 00:00:00 2001 +From: Rob Herring <rob.herring@calxeda.com> +Date: Fri, 17 Aug 2012 09:51:50 -0500 +Subject: ahci: un-staticize ahci_dev_classify + +commit bbb4ab43f82adf02c8b4d0d7e7b7e79d24204b05 upstream. + +Make ahci_dev_classify available to the ahci platform driver for custom +hard reset function. + +Signed-off-by: Rob Herring <rob.herring@calxeda.com> +Signed-off-by: Jeff Garzik <jgarzik@redhat.com> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/ata/ahci.h | 1 + + drivers/ata/libahci.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sde + extern struct ata_port_operations ahci_ops; + extern struct ata_port_operations ahci_pmp_retry_srst_ops; + ++unsigned int ahci_dev_classify(struct ata_port *ap); + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts); + void ahci_save_initial_config(struct device *dev, +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_d + } + } + +-static unsigned int ahci_dev_classify(struct ata_port *ap) ++unsigned int ahci_dev_classify(struct ata_port *ap) + { + void __iomem *port_mmio = ahci_port_base(ap); + struct ata_taskfile tf; +@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(st + + return ata_dev_classify(&tf); + } ++EXPORT_SYMBOL_GPL(ahci_dev_classify); + + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts) diff --git a/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch b/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch new file mode 100644 index 0000000..887c809 --- /dev/null +++ b/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch @@ -0,0 +1,46 @@ +From 6ffc0898b29a2811a6c0569c5dd9b581980110df Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Wed, 13 May 2015 13:28:54 +0200 +Subject: ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 + +commit 6ffc0898b29a2811a6c0569c5dd9b581980110df upstream. + +This patch adds support for Conexant HD Audio codecs +CX20721, CX20722, CX20723 and CX20724. + +BugLink: https://bugs.launchpad.net/bugs/1454656 +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + sound/pci/hda/patch_conexant.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd + .patch = patch_conexant_auto }, + { .id = 0x14f150b9, .name = "CX20665", + .patch = patch_conexant_auto }, ++ { .id = 0x14f150f1, .name = "CX20721", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f2, .name = "CX20722", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f3, .name = "CX20723", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f4, .name = "CX20724", ++ .patch = patch_conexant_auto }, + { .id = 0x14f1510f, .name = "CX20751/2", + .patch = patch_conexant_auto }, + { .id = 0x14f15110, .name = "CX20751/2", +@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab" + MODULE_ALIAS("snd-hda-codec-id:14f150ac"); + MODULE_ALIAS("snd-hda-codec-id:14f150b8"); + MODULE_ALIAS("snd-hda-codec-id:14f150b9"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f1"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f2"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f3"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f4"); + MODULE_ALIAS("snd-hda-codec-id:14f1510f"); + MODULE_ALIAS("snd-hda-codec-id:14f15110"); + MODULE_ALIAS("snd-hda-codec-id:14f15111"); diff --git a/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch b/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch new file mode 100644 index 0000000..1b5cf0a --- /dev/null +++ b/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch @@ -0,0 +1,93 @@ +From 0b59d8806a31bb0267b3a461e8fef20c727bdbf6 Mon Sep 17 00:00:00 2001 +From: Nicolas Schichan <nschichan@freebox.fr> +Date: Thu, 7 May 2015 17:14:21 +0200 +Subject: ARM: net: delegate filter to kernel interpreter when imm_offset() + return value can't fit into 12bits. + +commit 0b59d8806a31bb0267b3a461e8fef20c727bdbf6 upstream. + +The ARM JIT code emits "ldr rX, [pc, #offset]" to access the literal +pool. #offset maximum value is 4095 and if the generated code is too +large, the #offset value can overflow and not point to the expected +slot in the literal pool. Additionally, when overflow occurs, bits of +the overflow can end up changing the destination register of the ldr +instruction. + +Fix that by detecting the overflow in imm_offset() and setting a flag +that is checked for each BPF instructions converted in +build_body(). As of now it can only be detected in the second pass. As +a result the second build_body() call can now fail, so add the +corresponding cleanup code in that case. + +Using multiple literal pools in the JITed code is going to require +lots of intrusive changes to the JIT code (which would better be done +as a feature instead of fix), just delegating to the kernel BPF +interpreter in that case is a more straight forward, minimal fix and +easy to backport. + +Fixes: ddecdfcea0ae ("ARM: 7259/3: net: JIT compiler for packet filters") +Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> +Acked-by: Daniel Borkmann <daniel@iogearbox.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + arch/arm/net/bpf_jit_32.c | 27 ++++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -52,6 +52,7 @@ + #define SEEN_DATA (1 << (BPF_MEMWORDS + 3)) + + #define FLAG_NEED_X_RESET (1 << 0) ++#define FLAG_IMM_OVERFLOW (1 << 1) + + struct jit_ctx { + const struct sk_filter *skf; +@@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ + /* PC in ARM mode == address of the instruction + 8 */ + imm = offset - (8 + ctx->idx * 4); + ++ if (imm & ~0xfff) { ++ /* ++ * literal pool is too far, signal it into flags. we ++ * can only detect it on the second pass unfortunately. ++ */ ++ ctx->flags |= FLAG_IMM_OVERFLOW; ++ return 0; ++ } ++ + return imm; + } + +@@ -817,6 +827,14 @@ b_epilogue: + default: + return -1; + } ++ ++ if (ctx->flags & FLAG_IMM_OVERFLOW) ++ /* ++ * this instruction generated an overflow when ++ * trying to access the literal pool, so ++ * delegate this filter to the kernel interpreter. ++ */ ++ return -1; + } + + /* compute offsets only during the first pass */ +@@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *f + + ctx.idx = 0; + build_prologue(&ctx); +- build_body(&ctx); ++ if (build_body(&ctx) < 0) { ++#if __LINUX_ARM_ARCH__ < 7 ++ if (ctx.imm_count) ++ kfree(ctx.imms); ++#endif ++ bpf_jit_binary_free(header); ++ goto out; ++ } + build_epilogue(&ctx); + + flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx)); diff --git a/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch b/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch new file mode 100644 index 0000000..556d3d6 --- /dev/null +++ b/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch @@ -0,0 +1,29 @@ +From 85e36a1f4a735d991ba5106781ea48e89a0b8901 Mon Sep 17 00:00:00 2001 +From: Zidan Wang <zidan.wang@freescale.com> +Date: Tue, 12 May 2015 14:58:36 +0800 +Subject: ASoC: wm8960: fix "RINPUT3" audio route error + +commit 85e36a1f4a735d991ba5106781ea48e89a0b8901 upstream. + +It should be "RINPUT3" instead of "LINPUT3" route to "Right Input +Mixer". + +Signed-off-by: Zidan Wang <zidan.wang@freescale.com> +Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> +Signed-off-by: Mark Brown <broonie@kernel.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + sound/soc/codecs/wm8960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route a + { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, + { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ + { "Right Input Mixer", NULL, "RINPUT2" }, +- { "Right Input Mixer", NULL, "LINPUT3" }, ++ { "Right Input Mixer", NULL, "RINPUT3" }, + + { "Left ADC", NULL, "Left Input Mixer" }, + { "Right ADC", NULL, "Right Input Mixer" }, diff --git a/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch b/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch new file mode 100644 index 0000000..c89ef19 --- /dev/null +++ b/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch @@ -0,0 +1,29 @@ +From 17fc2e0a3db11889e942c5ab15a1fcb876638f25 Mon Sep 17 00:00:00 2001 +From: Zidan Wang <zidan.wang@freescale.com> +Date: Tue, 12 May 2015 14:58:50 +0800 +Subject: ASoC: wm8994: correct BCLK DIV 348 to 384 + +commit 17fc2e0a3db11889e942c5ab15a1fcb876638f25 upstream. + +According to the RM of wm8958, BCLK DIV 348 doesn't exist, correct it +to 384. + +Signed-off-by: Zidan Wang <zidan.wang@freescale.com> +Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> +Signed-off-by: Mark Brown <broonie@kernel.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + sound/soc/codecs/wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2636,7 +2636,7 @@ static struct { + }; + + static int fs_ratios[] = { +- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 ++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 + }; + + static int bclk_divs[] = { diff --git a/patches/bridge-fix-parsing-of-mldv2-reports.patch b/patches/bridge-fix-parsing-of-mldv2-reports.patch new file mode 100644 index 0000000..c5af918 --- /dev/null +++ b/patches/bridge-fix-parsing-of-mldv2-reports.patch @@ -0,0 +1,61 @@ +From 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 Mon Sep 17 00:00:00 2001 +From: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> +Date: Fri, 22 May 2015 12:18:59 -0300 +Subject: bridge: fix parsing of MLDv2 reports + +commit 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 upstream. + +When more than a multicast address is present in a MLDv2 report, all but +the first address is ignored, because the code breaks out of the loop if +there has not been an error adding that address. + +This has caused failures when two guests connected through the bridge +tried to communicate using IPv6. Neighbor discoveries would not be +transmitted to the other guest when both used a link-local address and a +static address. + +This only happens when there is a MLDv2 querier in the network. + +The fix will only break out of the loop when there is a failure adding a +multicast address. + +The mdb before the patch: + +dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp +dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp +dev ovirtmgmt port bond0.86 grp ff02::2 temp + +After the patch: + +dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp +dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp +dev ovirtmgmt port bond0.86 grp ff02::fb temp +dev ovirtmgmt port bond0.86 grp ff02::2 temp +dev ovirtmgmt port bond0.86 grp ff02::d temp +dev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp +dev ovirtmgmt port bond0.86 grp ff02::16 temp +dev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp +dev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp +dev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp + +Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.") +Reported-by: Rik Theys <Rik.Theys@esat.kuleuven.be> +Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> +Tested-by: Rik Theys <Rik.Theys@esat.kuleuven.be> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + net/bridge/br_multicast.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report( + } + + err = br_ip6_multicast_add_group(br, port, &grec->grec_mca); +- if (!err) ++ if (err) + break; + } + diff --git a/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch b/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch new file mode 100644 index 0000000..ae11608 --- /dev/null +++ b/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch @@ -0,0 +1,119 @@ +From a1cae34e23b1293eccbcc8ee9b39298039c3952a Mon Sep 17 00:00:00 2001 +From: Harald Freudenberger <freude@linux.vnet.ibm.com> +Date: Thu, 21 May 2015 10:01:11 +0200 +Subject: crypto: s390/ghash - Fix incorrect ghash icv buffer handling. + +commit a1cae34e23b1293eccbcc8ee9b39298039c3952a upstream. + +Multitheaded tests showed that the icv buffer in the current ghash +implementation is not handled correctly. A move of this working ghash +buffer value to the descriptor context fixed this. Code is tested and +verified with an multithreaded application via af_alg interface. + +Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com> +Signed-off-by: Gerald Schaefer <geraldsc@linux.vnet.ibm.com> +Reported-by: Herbert Xu <herbert@gondor.apana.org.au> +Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> +[lizf: Backported to 3.4: + - adjust context + - drop the change to memcpy()] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + arch/s390/crypto/ghash_s390.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -16,11 +16,12 @@ + #define GHASH_DIGEST_SIZE 16 + + struct ghash_ctx { +- u8 icv[16]; +- u8 key[16]; ++ u8 key[GHASH_BLOCK_SIZE]; + }; + + struct ghash_desc_ctx { ++ u8 icv[GHASH_BLOCK_SIZE]; ++ u8 key[GHASH_BLOCK_SIZE]; + u8 buffer[GHASH_BLOCK_SIZE]; + u32 bytes; + }; +@@ -28,8 +29,10 @@ struct ghash_desc_ctx { + static int ghash_init(struct shash_desc *desc) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + + memset(dctx, 0, sizeof(*dctx)); ++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_sh + } + + memcpy(ctx->key, key, GHASH_BLOCK_SIZE); +- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -54,7 +56,6 @@ static int ghash_update(struct shash_des + const u8 *src, unsigned int srclen) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + unsigned int n; + u8 *buf = dctx->buffer; + int ret; +@@ -70,7 +71,7 @@ static int ghash_update(struct shash_des + src += n; + + if (!dctx->bytes) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, + GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); + } +@@ -78,7 +79,7 @@ static int ghash_update(struct shash_des + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); + BUG_ON(ret != n); + src += n; + srclen -= n; +@@ -92,7 +93,7 @@ static int ghash_update(struct shash_des + return 0; + } + +-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -102,19 +103,18 @@ static void ghash_flush(struct ghash_ctx + + memset(pos, 0, dctx->bytes); + +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); +- } + +- dctx->bytes = 0; ++ dctx->bytes = 0; ++ } + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + +- ghash_flush(ctx, dctx); ++ ghash_flush(dctx); + memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); + + return 0; diff --git a/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch b/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch new file mode 100644 index 0000000..a5fe67f --- /dev/null +++ b/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch @@ -0,0 +1,91 @@ +From 607d48063512707a414e346972e2210dc71ab491 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com> +Date: Tue, 12 May 2015 14:56:17 +0200 +Subject: drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 607d48063512707a414e346972e2210dc71ab491 upstream. + +The mapping range is inclusive between starting and ending addresses. + +Signed-off-by: Christian König <christian.koenig@amd.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +[lizf: Backported to 3.4: + - adjust context + - drop the change to clk.c + - drop the second change in cayman_pcie_gart_enable()] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/gpu/drm/radeon/evergreen.c | 2 +- + drivers/gpu/drm/radeon/ni.c | 2 +- + drivers/gpu/drm/radeon/r600.c | 2 +- + drivers/gpu/drm/radeon/rv770.c | 2 +- + drivers/gpu/drm/radeon/si.c | 4 ++-- + 5 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct ra + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeo + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_ + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_de + L2_CACHE_BIGK_FRAGMENT_SIZE(0)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_de + */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + for (i = 1; i < 16; i++) { + if (i < 8) + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), diff --git a/patches/ext4-check-for-zero-length-extent-explicitly.patch b/patches/ext4-check-for-zero-length-extent-explicitly.patch new file mode 100644 index 0000000..72e83cd --- /dev/null +++ b/patches/ext4-check-for-zero-length-extent-explicitly.patch @@ -0,0 +1,33 @@ +From 2f974865ffdfe7b9f46a9940836c8b167342563d Mon Sep 17 00:00:00 2001 +From: Eryu Guan <guaneryu@gmail.com> +Date: Thu, 14 May 2015 19:00:45 -0400 +Subject: ext4: check for zero length extent explicitly + +commit 2f974865ffdfe7b9f46a9940836c8b167342563d upstream. + +The following commit introduced a bug when checking for zero length extent + +5946d08 ext4: check for overlapping extents in ext4_valid_extent_entries() + +Zero length extent could pass the check if lblock is zero. + +Adding the explicit check for zero length back. + +Signed-off-by: Eryu Guan <guaneryu@gmail.com> +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + fs/ext4/extents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inod + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); + ext4_lblk_t last = lblock + len - 1; + +- if (lblock > last) ++ if (len == 0 || lblock > last) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } diff --git a/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch b/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch new file mode 100644 index 0000000..0f71b8d --- /dev/null +++ b/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch @@ -0,0 +1,35 @@ +From 3c0213d17a09601e0c6c0ae0e27caf70d988290f Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires <benjamin.tissoires@redhat.com> +Date: Thu, 23 Apr 2015 09:08:43 -0700 +Subject: Input: elantech - fix semi-mt protocol for v3 HW + +commit 3c0213d17a09601e0c6c0ae0e27caf70d988290f upstream. + +When the v3 hardware sees more than one finger, it uses the semi-mt +protocol to report the touches. However, it currently works when +num_fingers is 0, 1 or 2, but when it is 3 and above, it sends only 1 +finger as if num_fingers was 1. + +This confuses userspace which knows how to deal with extra fingers +when all the slots are used, but not when some are missing. + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90101 + +Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> +Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/input/mouse/elantech.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* diff --git a/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch b/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch new file mode 100644 index 0000000..38a94f4 --- /dev/null +++ b/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch @@ -0,0 +1,51 @@ +From f30bf2a5cac6c60ab366c4bc6db913597bf4d6ab Mon Sep 17 00:00:00 2001 +From: Tommi Rantala <tt.rantala@gmail.com> +Date: Thu, 7 May 2015 15:12:21 +0300 +Subject: ipvs: fix memory leak in ip_vs_ctl.c + +commit f30bf2a5cac6c60ab366c4bc6db913597bf4d6ab upstream. + +Fix memory leak introduced in commit a0840e2e165a ("IPVS: netns, +ip_vs_ctl local vars moved to ipvs struct."): + +unreferenced object 0xffff88005785b800 (size 2048): + comm "(-localed)", pid 1434, jiffies 4294755650 (age 1421.089s) + hex dump (first 32 bytes): + bb 89 0b 83 ff ff ff ff b0 78 f0 4e 00 88 ff ff .........x.N.... + 04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<ffffffff8262ea8e>] kmemleak_alloc+0x4e/0xb0 + [<ffffffff811fba74>] __kmalloc_track_caller+0x244/0x430 + [<ffffffff811b88a0>] kmemdup+0x20/0x50 + [<ffffffff823276b7>] ip_vs_control_net_init+0x1f7/0x510 + [<ffffffff8231d630>] __ip_vs_init+0x100/0x250 + [<ffffffff822363a1>] ops_init+0x41/0x190 + [<ffffffff82236583>] setup_net+0x93/0x150 + [<ffffffff82236cc2>] copy_net_ns+0x82/0x140 + [<ffffffff810ab13d>] create_new_namespaces+0xfd/0x190 + [<ffffffff810ab49a>] unshare_nsproxy_namespaces+0x5a/0xc0 + [<ffffffff810833e3>] SyS_unshare+0x173/0x310 + [<ffffffff8265cbd7>] system_call_fastpath+0x12/0x6f + [<ffffffffffffffff>] 0xffffffffffffffff + +Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.") +Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> +Acked-by: Julian Anastasov <ja@ssi.bg> +Signed-off-by: Simon Horman <horms@verge.net.au> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + net/netfilter/ipvs/ip_vs_ctl.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanu + cancel_delayed_work_sync(&ipvs->defense_work); + cancel_work_sync(&ipvs->defense_work.work); + unregister_net_sysctl_table(ipvs->sysctl_hdr); ++ ++ if (!net_eq(net, &init_net)) ++ kfree(ipvs->sysctl_tbl); + } + + #else diff --git a/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch b/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch new file mode 100644 index 0000000..5c8270d --- /dev/null +++ b/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch @@ -0,0 +1,30 @@ +From 898761158be7682082955e3efa4ad24725305fc7 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini <pbonzini@redhat.com> +Date: Thu, 2 Apr 2015 11:04:05 +0200 +Subject: KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages + +commit 898761158be7682082955e3efa4ad24725305fc7 upstream. + +smep_andnot_wp is initialized in kvm_init_shadow_mmu and shadow pages +should not be reused for different values of it. Thus, it has to be +added to the mask in kvm_mmu_pte_write. + +Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> +[lizf: Backported to 3.4: adjust context] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + arch/x86/kvm/mmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu * + ++vcpu->kvm->stat.mmu_pte_write; + kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); + +- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; ++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; + for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) { + if (detect_write_misaligned(sp, gpa, bytes) || + detect_write_flooding(sp)) { diff --git a/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch b/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch new file mode 100644 index 0000000..4237d7a --- /dev/null +++ b/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch @@ -0,0 +1,69 @@ +From 8393b811f38acdf7fd8da2028708edad3e68ce1f Mon Sep 17 00:00:00 2001 +From: Gabriele Mazzotta <gabriele.mzt@gmail.com> +Date: Sat, 25 Apr 2015 19:52:36 +0200 +Subject: libata: Add helper to determine when PHY events should be ignored + +commit 8393b811f38acdf7fd8da2028708edad3e68ce1f upstream. + +This is a preparation commit that will allow to add other criteria +according to which PHY events should be dropped. + +Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com> +Signed-off-by: Tejun Heo <tj@kernel.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/ata/libahci.c | 3 +-- + drivers/ata/libata-core.c | 19 +++++++++++++++++++ + include/linux/libata.h | 1 + + 3 files changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1670,8 +1670,7 @@ static void ahci_port_intr(struct ata_po + if (unlikely(resetting)) + status &= ~PORT_IRQ_BAD_PMP; + +- /* if LPM is enabled, PHYRDY doesn't mean anything */ +- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { ++ if (sata_lpm_ignore_phy_events(&ap->link)) { + status &= ~PORT_IRQ_PHYRDY; + ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); + } +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6657,6 +6657,25 @@ u32 ata_wait_register(struct ata_port *a + return tmp; + } + ++/** ++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored ++ * @link: Link receiving the event ++ * ++ * Test whether the received PHY event has to be ignored or not. ++ * ++ * LOCKING: ++ * None: ++ * ++ * RETURNS: ++ * True if the event has to be ignored. ++ */ ++bool sata_lpm_ignore_phy_events(struct ata_link *link) ++{ ++ /* if LPM is enabled, PHYRDY doesn't mean anything */ ++ return !!(link->lpm_policy > ATA_LPM_MAX_POWER); ++} ++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); ++ + /* + * Dummy port_ops + */ +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1065,6 +1065,7 @@ extern struct ata_device *ata_dev_pair(s + extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); + extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); + extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); ++extern bool sata_lpm_ignore_phy_events(struct ata_link *link); + + extern int ata_cable_40wire(struct ata_port *ap); + extern int ata_cable_80wire(struct ata_port *ap); diff --git a/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch b/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch new file mode 100644 index 0000000..c33059e --- /dev/null +++ b/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch @@ -0,0 +1,94 @@ +From 09c5b4803a80a5451d950d6a539d2eb311dc0fb1 Mon Sep 17 00:00:00 2001 +From: Gabriele Mazzotta <gabriele.mzt@gmail.com> +Date: Sat, 25 Apr 2015 19:52:37 +0200 +Subject: libata: Ignore spurious PHY event on LPM policy change + +commit 09c5b4803a80a5451d950d6a539d2eb311dc0fb1 upstream. + +When the LPM policy is set to ATA_LPM_MAX_POWER, the device might +generate a spurious PHY event that cuases errors on the link. +Ignore this event if it occured within 10s after the policy change. + +The timeout was chosen observing that on a Dell XPS13 9333 these +spurious events can occur up to roughly 6s after the policy change. + +Link: http://lkml.kernel.org/g/3352987.ugV1Ipy7Z5@xps13 +Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com> +Signed-off-by: Tejun Heo <tj@kernel.org> +[lizf: Backported to 3.4: adjust context] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/ata/libata-core.c | 15 ++++++++++++++- + drivers/ata/libata-eh.c | 3 +++ + include/linux/libata.h | 9 +++++++++ + 3 files changed, 26 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6671,8 +6671,21 @@ u32 ata_wait_register(struct ata_port *a + */ + bool sata_lpm_ignore_phy_events(struct ata_link *link) + { ++ unsigned long lpm_timeout = link->last_lpm_change + ++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); ++ + /* if LPM is enabled, PHYRDY doesn't mean anything */ +- return !!(link->lpm_policy > ATA_LPM_MAX_POWER); ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) ++ return true; ++ ++ /* ignore the first PHY event after the LPM policy changed ++ * as it is might be spurious ++ */ ++ if ((link->flags & ATA_LFLAG_CHANGED) && ++ time_before(jiffies, lpm_timeout)) ++ return true; ++ ++ return false; + } + EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_lin + } + } + ++ link->last_lpm_change = jiffies; ++ link->flags |= ATA_LFLAG_CHANGED; ++ + return 0; + + fail: +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -182,6 +182,7 @@ enum { + ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */ + ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ + ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ ++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ + + /* struct ata_port flags */ + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ +@@ -285,6 +286,12 @@ enum { + */ + ATA_TMOUT_PMP_SRST_WAIT = 5000, + ++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might ++ * be a spurious PHY event, so ignore the first PHY event that ++ * occurs within 10s after the policy change. ++ */ ++ ATA_TMOUT_SPURIOUS_PHY = 10000, ++ + /* ATA bus states */ + BUS_UNKNOWN = 0, + BUS_DMA = 1, +@@ -727,6 +734,8 @@ struct ata_link { + struct ata_eh_context eh_context; + + struct ata_device device[ATA_MAX_DEVICES]; ++ ++ unsigned long last_lpm_change; /* when last LPM change happened */ + }; + #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) + #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) diff --git a/patches/mac80211-move-wep-tailroom-size-check.patch b/patches/mac80211-move-wep-tailroom-size-check.patch new file mode 100644 index 0000000..7cfbdc1 --- /dev/null +++ b/patches/mac80211-move-wep-tailroom-size-check.patch @@ -0,0 +1,58 @@ +From 47b4e1fc4972cc43a19121bc2608a60aef3bf216 Mon Sep 17 00:00:00 2001 +From: Janusz Dziedzic <janusz.dziedzic@tieto.com> +Date: Mon, 11 May 2015 11:31:15 +0200 +Subject: mac80211: move WEP tailroom size check + +commit 47b4e1fc4972cc43a19121bc2608a60aef3bf216 upstream. + +Remove checking tailroom when adding IV as it uses only +headroom, and move the check to the ICV generation that +actually needs the tailroom. + +In other case I hit such warning and datapath don't work, +when testing: +- IBSS + WEP +- ath9k with hw crypt enabled +- IPv6 data (ping6) + +WARNING: CPU: 3 PID: 13301 at net/mac80211/wep.c:102 ieee80211_wep_add_iv+0x129/0x190 [mac80211]() +[...] +Call Trace: +[<ffffffff817bf491>] dump_stack+0x45/0x57 +[<ffffffff8107746a>] warn_slowpath_common+0x8a/0xc0 +[<ffffffff8107755a>] warn_slowpath_null+0x1a/0x20 +[<ffffffffc09ae109>] ieee80211_wep_add_iv+0x129/0x190 [mac80211] +[<ffffffffc09ae7ab>] ieee80211_crypto_wep_encrypt+0x6b/0xd0 [mac80211] +[<ffffffffc09d3fb1>] invoke_tx_handlers+0xc51/0xf30 [mac80211] +[...] + +Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +[lizf: Backported to 3.4: s/IEEE80211_WEP/_WEP/g] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + net/mac80211/wep.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct i + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + +- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || +- skb_headroom(skb) < WEP_IV_LEN)) ++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) + return NULL; + + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee802 + size_t len; + u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + ++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) ++ return -1; ++ + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); + if (!iv) + return -1; diff --git a/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch b/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch new file mode 100644 index 0000000..189a0e0 --- /dev/null +++ b/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch @@ -0,0 +1,37 @@ +From 6e9eac2dcee5e19f125967dd2be3e36558c42fff Mon Sep 17 00:00:00 2001 +From: NeilBrown <neilb@suse.de> +Date: Fri, 8 May 2015 18:19:34 +1000 +Subject: md/raid5: don't record new size if resize_stripes fails. + +commit 6e9eac2dcee5e19f125967dd2be3e36558c42fff upstream. + +If any memory allocation in resize_stripes fails we will return +-ENOMEM, but in some cases we update conf->pool_size anyway. + +This means that if we try again, the allocations will be assumed +to be larger than they are, and badness results. + +So only update pool_size if there is no error. + +This bug was introduced in 2.6.17 and the patch is suitable for +-stable. + +Fixes: ad01c9e3752f ("[PATCH] md: Allow stripes to be expanded in preparation for expanding an array") +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/md/raid5.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf + + conf->slab_cache = sc; + conf->active_name = 1-conf->active_name; +- conf->pool_size = newsize; ++ if (!err) ++ conf->pool_size = newsize; + return err; + } + diff --git a/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch b/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch new file mode 100644 index 0000000..f65689c --- /dev/null +++ b/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch @@ -0,0 +1,42 @@ +From 60c8f783a18feb95ad967c87e9660caf09fb4700 Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches <ludovic.desroches@atmel.com> +Date: Wed, 6 May 2015 15:16:46 +0200 +Subject: mmc: atmel-mci: fix bad variable type for clkdiv + +commit 60c8f783a18feb95ad967c87e9660caf09fb4700 upstream. + +clkdiv is declared as an u32 but it can be set to a negative value +causing a huge divisor value. Change its type to int to avoid this case. + +Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> +Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/mmc/host/atmel-mci.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_hos + + if (ios->clock) { + unsigned int clock_min = ~0U; +- u32 clkdiv; ++ int clkdiv; + + spin_lock_bh(&host->lock); + if (!host->mode_reg) { +@@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_hos + /* Calculate clock divider */ + if (host->caps.has_odd_clk_div) { + clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; +- if (clkdiv > 511) { ++ if (clkdiv < 0) { ++ dev_warn(&mmc->class_dev, ++ "clock %u too fast; using %lu\n", ++ clock_min, host->bus_hz / 2); ++ clkdiv = 0; ++ } else if (clkdiv > 511) { + dev_warn(&mmc->class_dev, + "clock %u too slow; using %lu\n", + clock_min, host->bus_hz / (511 + 2)); diff --git a/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch b/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch new file mode 100644 index 0000000..2db289f --- /dev/null +++ b/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch @@ -0,0 +1,65 @@ +From ebe9cb3bb13e7b9b281969cd279ce70834f7500f Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig <hch@lst.de> +Date: Tue, 28 Apr 2015 15:41:15 +0200 +Subject: nfsd: fix the check for confirmed openowner in + nfs4_preprocess_stateid_op + +commit ebe9cb3bb13e7b9b281969cd279ce70834f7500f upstream. + +If we find a non-confirmed openowner we jump to exit the function, but do +not set an error value. Fix this by factoring out a helper to do the +check and properly set the error from nfsd4_validate_stateid. + +Signed-off-by: Christoph Hellwig <hch@lst.de> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +[lizf: adjust the changes for nfsd4_validate_stateid()] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + fs/nfsd/nfs4state.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3364,10 +3364,17 @@ static int check_stateid_generation(stat + return nfserr_old_stateid; + } + ++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols) ++{ ++ if (ols->st_stateowner->so_is_open_owner && ++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ return nfserr_bad_stateid; ++ return nfs_ok; ++} ++ + __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + { + struct nfs4_stid *s; +- struct nfs4_ol_stateid *ols; + __be32 status; + + if (STALE_STATEID(stateid)) +@@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4 + return status; + if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID))) + return nfs_ok; +- ols = openlockstateid(s); +- if (ols->st_stateowner->so_is_open_owner +- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) +- return nfserr_bad_stateid; +- return nfs_ok; ++ return nfsd4_check_openowner_confirmed(openlockstateid(s)); + } + + static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s) +@@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_ + status = nfs4_check_fh(current_fh, stp); + if (status) + goto out; +- if (stp->st_stateowner->so_is_open_owner +- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ status = nfsd4_check_openowner_confirmed(stp); ++ if (status) + goto out; + status = nfs4_check_openmode(stp, flags); + if (status) diff --git a/patches/powerpc-align-toc-to-256-bytes.patch b/patches/powerpc-align-toc-to-256-bytes.patch new file mode 100644 index 0000000..9aadea5 --- /dev/null +++ b/patches/powerpc-align-toc-to-256-bytes.patch @@ -0,0 +1,31 @@ +From 5e95235ccd5442d4a4fe11ec4eb99ba1b7959368 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard <anton@samba.org> +Date: Thu, 14 May 2015 14:45:40 +1000 +Subject: powerpc: Align TOC to 256 bytes + +commit 5e95235ccd5442d4a4fe11ec4eb99ba1b7959368 upstream. + +Recent toolchains force the TOC to be 256 byte aligned. We need +to enforce this alignment in our linker script, otherwise pointers +to our TOC variables (__toc_start, __prom_init_toc_start) could +be incorrect. + +If they are bad, we die a few hundred instructions into boot. + +Signed-off-by: Anton Blanchard <anton@samba.org> +Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + arch/powerpc/kernel/vmlinux.lds.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -213,6 +213,7 @@ SECTIONS + *(.opd) + } + ++ . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; + *(.got) diff --git a/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch b/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch new file mode 100644 index 0000000..ec651ad --- /dev/null +++ b/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch @@ -0,0 +1,36 @@ +From 414b7e3b9ce8b0577f613e656fdbc36b34b444dd Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Fri, 24 Apr 2015 11:03:37 -0500 +Subject: rtlwifi: rtl8192cu: Fix kernel deadlock + +commit 414b7e3b9ce8b0577f613e656fdbc36b34b444dd upstream. + +The USB mini-driver in rtlwifi, which is used by rtl8192cu, issues a call to +usb_control_msg() with a timeout value of 0. In some instances where the +interface is shutting down, this infinite wait results in a CPU deadlock. A +one second timeout fixes this problem without affecting any normal operations. + +This bug is reported at https://bugzilla.novell.com/show_bug.cgi?id=927786. + +Reported-by: Bernhard Wiedemann <bwiedemann@suse.com> +Tested-by: Bernhard Wiedemann <bwiedemann@suse.com> +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Cc: Bernhard Wiedemann <bwiedemann@suse.com> +Cc: Takashi Iwai<tiwai@suse.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/net/wireless/rtlwifi/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read( + + do { + status = usb_control_msg(udev, pipe, request, reqtype, value, +- index, pdata, len, 0); /*max. timeout*/ ++ index, pdata, len, 1000); + if (status < 0) { + /* firmware download is checksumed, don't retry */ + if ((value >= FW_8192C_START_ADDRESS && diff --git a/patches/sd-disable-support-for-256-byte-sector-disks.patch b/patches/sd-disable-support-for-256-byte-sector-disks.patch new file mode 100644 index 0000000..e94d0bc --- /dev/null +++ b/patches/sd-disable-support-for-256-byte-sector-disks.patch @@ -0,0 +1,70 @@ +From 74856fbf441929918c49ff262ace9835048e4e6a Mon Sep 17 00:00:00 2001 +From: Mark Hounschell <dmarkh@cfl.rr.com> +Date: Wed, 13 May 2015 10:49:09 +0200 +Subject: sd: Disable support for 256 byte/sector disks + +commit 74856fbf441929918c49ff262ace9835048e4e6a upstream. + +256 bytes per sector support has been broken since 2.6.X, +and no-one stepped up to fix this. +So disable support for it. + +Signed-off-by: Mark Hounschell <dmarkh@cfl.rr.com> +Signed-off-by: Hannes Reinecke <hare@suse.de> +Signed-off-by: James Bottomley <JBottomley@Odin.com> +[lizf: Backported to 3.4: adjust context] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/scsi/sd.c | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(s + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(s + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- u64 factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ factor = scmd->device->sector_size / 512; ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -1984,8 +1979,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -2034,8 +2028,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); diff --git a/patches/series b/patches/series index dc0fa0a..a8f056a 100644 --- a/patches/series +++ b/patches/series @@ -76,3 +76,34 @@ xen-events-set-irq_info-evtchn-before-binding-the-channel-to-cpu-in-__startup_pi mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch +libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch +libata-ignore-spurious-phy-event-on-lpm-policy-change.patch +rtlwifi-rtl8192cu-fix-kernel-deadlock.patch +usb-cp210x-add-id-for-kcf-technologies-prn-device.patch +usb-pl2303-remove-support-for-samsung-i330.patch +usb-visor-match-i330-phone-more-precisely.patch +nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch +acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch +md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch +xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch +xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch +xhci-gracefully-handle-xhci_irq-dead-device.patch +usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch +ahci-un-staticize-ahci_dev_classify.patch +ahci-avoton-port-disable-reset-quirk.patch +arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch +drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch +ext4-check-for-zero-length-extent-explicitly.patch +ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch +mac80211-move-wep-tailroom-size-check.patch +kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch +asoc-wm8960-fix-rinput3-audio-route-error.patch +asoc-wm8994-correct-bclk-div-348-to-384.patch +input-elantech-fix-semi-mt-protocol-for-v3-hw.patch +powerpc-align-toc-to-256-bytes.patch +alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch +mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch +sd-disable-support-for-256-byte-sector-disks.patch +xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch +crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch +bridge-fix-parsing-of-mldv2-reports.patch diff --git a/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch b/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch new file mode 100644 index 0000000..e20b2e7 --- /dev/null +++ b/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch @@ -0,0 +1,27 @@ +From c735ed74d83f8ecb45c4c4c95a16853c9c3c8157 Mon Sep 17 00:00:00 2001 +From: Mark Edwards <sonofaforester@gmail.com> +Date: Tue, 14 Apr 2015 08:52:34 -0400 +Subject: USB: cp210x: add ID for KCF Technologies PRN device + +commit c735ed74d83f8ecb45c4c4c95a16853c9c3c8157 upstream. + +Added the USB serial console device ID for KCF Technologies PRN device +which has a USB port for its serial console. + +Signed-off-by: Mark Edwards <sonofaforester@gmail.com> +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -133,6 +133,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ ++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/patches/usb-pl2303-remove-support-for-samsung-i330.patch b/patches/usb-pl2303-remove-support-for-samsung-i330.patch new file mode 100644 index 0000000..3b9c872 --- /dev/null +++ b/patches/usb-pl2303-remove-support-for-samsung-i330.patch @@ -0,0 +1,42 @@ +From 48ef23a4f686b1e4519d4193c20d26834ff810ff Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" <Jason@zx2c4.com> +Date: Wed, 22 Apr 2015 14:35:08 +0200 +Subject: USB: pl2303: Remove support for Samsung I330 + +commit 48ef23a4f686b1e4519d4193c20d26834ff810ff upstream. + +This phone is already supported by the visor driver. + +Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold <johan@kernel.org> +[lizf: Backported to 3.4: adjust context] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/serial/pl2303.c | 1 - + drivers/usb/serial/pl2303.h | 4 ---- + 2 files changed, 5 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -67,7 +67,6 @@ static const struct usb_device_id id_tab + { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, + { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -62,10 +62,6 @@ + #define ALCATEL_VENDOR_ID 0x11f7 + #define ALCATEL_PRODUCT_ID 0x02df + +-/* Samsung I330 phone cradle */ +-#define SAMSUNG_VENDOR_ID 0x04e8 +-#define SAMSUNG_PRODUCT_ID 0x8001 +- + #define SIEMENS_VENDOR_ID 0x11f5 + #define SIEMENS_PRODUCT_ID_SX1 0x0001 + #define SIEMENS_PRODUCT_ID_X65 0x0003 diff --git a/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch b/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch new file mode 100644 index 0000000..95904d2 --- /dev/null +++ b/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch @@ -0,0 +1,33 @@ +From 172115090f5e739660b97694618a2ba86457063a Mon Sep 17 00:00:00 2001 +From: Hans de Goede <hdegoede@redhat.com> +Date: Thu, 30 Apr 2015 11:09:44 +0200 +Subject: usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices + +commit 172115090f5e739660b97694618a2ba86457063a upstream. + +Without this flag some versions of these enclosures do not work. + +Reported-and-tested-by: Christian Schaller <cschalle@redhat.com> +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported by Christian Schaller <cschalle@redhat.com> */ ++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, ++ "LaCie", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + /* Submitted by Joel Bourquard <numlock@freesurf.ch> + * Some versions of this device need the SubClass and Protocol overrides + * while others don't. diff --git a/patches/usb-visor-match-i330-phone-more-precisely.patch b/patches/usb-visor-match-i330-phone-more-precisely.patch new file mode 100644 index 0000000..97f219d --- /dev/null +++ b/patches/usb-visor-match-i330-phone-more-precisely.patch @@ -0,0 +1,42 @@ +From 82ee3aeb9295c5fc37fd2ddf20f13ac2b40ec97d Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" <Jason@zx2c4.com> +Date: Wed, 22 Apr 2015 14:35:09 +0200 +Subject: USB: visor: Match I330 phone more precisely + +commit 82ee3aeb9295c5fc37fd2ddf20f13ac2b40ec97d upstream. + +Samsung has just released a portable USB3 SSD, coming in a very small +and nice form factor. It's USB ID is 04e8:8001, which unfortunately is +already used by the Palm Visor driver for the Samsung I330 phone cradle. +Having pl2303 or visor pick up this device ID results in conflicts with +the usb-storage driver, which handles the newly released portable USB3 +SSD. + +To work around this conflict, I've dug up a mailing list post [1] from a +long time ago, in which a user posts the full USB descriptor +information. The most specific value in this appears to be the interface +class, which has value 255 (0xff). Since usb-storage requires an +interface class of 0x8, I believe it's correct to disambiguate the two +devices by matching on 0xff inside visor. + +[1] http://permalink.gmane.org/gmane.linux.usb.user/4264 + +Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/serial/visor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -101,7 +101,7 @@ static struct usb_device_id id_table [] + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), ++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, diff --git a/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch b/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch new file mode 100644 index 0000000..583f540 --- /dev/null +++ b/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch @@ -0,0 +1,90 @@ +From 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a Mon Sep 17 00:00:00 2001 +From: David Vrabel <david.vrabel@citrix.com> +Date: Tue, 19 May 2015 18:40:49 +0100 +Subject: xen/events: don't bind non-percpu VIRQs with percpu chip + +commit 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a upstream. + +A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different +VCPU than it is bound to. This can result in a race between +handle_percpu_irq() and removing the action in __free_irq() because +handle_percpu_irq() does not take desc->lock. The interrupt handler +sees a NULL action and oopses. + +Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER). + + # cat /proc/interrupts | grep virq + 40: 87246 0 xen-percpu-virq timer0 + 44: 0 0 xen-percpu-virq debug0 + 47: 0 20995 xen-percpu-virq timer1 + 51: 0 0 xen-percpu-virq debug1 + 69: 0 0 xen-dyn-virq xen-pcpu + 74: 0 0 xen-dyn-virq mce + 75: 29 0 xen-dyn-virq hvc_console + +Signed-off-by: David Vrabel <david.vrabel@citrix.com> +[lizf: Backported to 3.4: adjust filename] +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/tty/hvc/hvc_xen.c | 2 +- + drivers/xen/events.c | 12 ++++++++---- + include/xen/events.h | 2 +- + 3 files changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -290,7 +290,7 @@ static int xen_initial_domain_console_in + return -ENOMEM; + } + +- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + info->vtermno = HVC_COOKIE; + + spin_lock(&xencons_lock); +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, + return rc; + } + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, + if (irq == -1) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned i + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, diff --git a/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch b/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch new file mode 100644 index 0000000..25353c9 --- /dev/null +++ b/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch @@ -0,0 +1,43 @@ +From d104d0152a97fade389f47635b73a9ccc7295d0b Mon Sep 17 00:00:00 2001 +From: Mathias Nyman <mathias.nyman@linux.intel.com> +Date: Thu, 30 Apr 2015 17:16:02 +0300 +Subject: xhci: fix isoc endpoint dequeue from advancing too far on transaction + error + +commit d104d0152a97fade389f47635b73a9ccc7295d0b upstream. + +Isoc TDs usually consist of one TRB, sometimes two. When all goes well we +receive only one success event for a TD, and move the dequeue pointer to +the next TD. + +This fails if the TD consists of two TRBs and we get a transfer error +on the first TRB, we will then see two events for that TD. + +Fix this by making sure the event we get is for the last TRB in that TD +before moving the dequeue pointer to the next TD. This will resolve some +of the uvc and dvb issues with the +"ERROR Transfer event TRB DMA ptr not part of current TD" error message + +Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/host/xhci-ring.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_h + break; + case COMP_DEV_ERR: + case COMP_STALL: ++ frame->status = -EPROTO; ++ skip_td = true; ++ break; + case COMP_TX_ERR: + frame->status = -EPROTO; ++ if (event_trb != td->last_trb) ++ return 0; + skip_td = true; + break; + case COMP_STOP: diff --git a/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch b/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch new file mode 100644 index 0000000..58f2bd4 --- /dev/null +++ b/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch @@ -0,0 +1,30 @@ +From 948fa13504f80b9765d2b753691ab94c83a10341 Mon Sep 17 00:00:00 2001 +From: Joe Lawrence <joe.lawrence@stratus.com> +Date: Thu, 30 Apr 2015 17:16:04 +0300 +Subject: xhci: gracefully handle xhci_irq dead device + +commit 948fa13504f80b9765d2b753691ab94c83a10341 upstream. + +If the xHCI host controller has died (ie, device removed) or suffered +other serious fatal error (STS_FATAL), then xhci_irq should handle this +condition with IRQ_HANDLED instead of -ESHUTDOWN. + +Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com> +Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/host/xhci-ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2743,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd + xhci_halt(xhci); + hw_died: + spin_unlock(&xhci->lock); +- return -ESHUTDOWN; ++ return IRQ_HANDLED; + } + + /* diff --git a/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch b/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch new file mode 100644 index 0000000..b677c70 --- /dev/null +++ b/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch @@ -0,0 +1,49 @@ +From 18cc2f4cbbaf825a4fedcf2d60fd388d291e0a38 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman <mathias.nyman@linux.intel.com> +Date: Thu, 30 Apr 2015 17:16:03 +0300 +Subject: xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 + +commit 18cc2f4cbbaf825a4fedcf2d60fd388d291e0a38 upstream. + +Our event ring consists of only one segment, and we risk filling +the event ring in case we get isoc transfers with short intervals +such as webcams that fill a TD every microframe (125us) + +With 64 TRB segment size one usb camera could fill the event ring in 8ms. +A setup with several cameras and other devices can fill up the +event ring as it is shared between all devices. +This has occurred when uvcvideo queues 5 * 32TD URBs which then +get cancelled when the video mode changes. The cancelled URBs are returned +in the xhci interrupt context and blocks the interrupt handler from +handling the new events. + +A full event ring will block xhci from scheduling traffic and affect all +devices conneted to the xhci, will see errors such as Missed Service +Intervals for isoc devices, and and Split transaction errors for LS/FS +interrupt devices. + +Increasing the TRB_PER_SEGMENT will also increase the default endpoint ring +size, which is welcome as for most isoc transfer we had to dynamically +expand the endpoint ring anyway to be able to queue the 5 * 32TDs uvcvideo +queues. + +The default size used to be 64 TRBs per segment + +Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Zefan Li <lizefan@huawei.com> +--- + drivers/usb/host/xhci.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1233,7 +1233,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16) |