/[linux-patches]/genpatches-2.6/trunk/3.4/1012_linux-3.4.13.patch
Gentoo

Contents of /genpatches-2.6/trunk/3.4/1012_linux-3.4.13.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2254 - (show annotations) (download)
Wed Dec 19 19:51:16 2012 UTC (19 months, 1 week ago) by mpagano
File size: 62065 byte(s)
Linux patches 3.4.12 through and including 3.4.24
1 diff --git a/Makefile b/Makefile
2 index bcf5bc4..75b37ce 100644
3 --- a/Makefile
4 +++ b/Makefile
5 @@ -1,6 +1,6 @@
6 VERSION = 3
7 PATCHLEVEL = 4
8 -SUBLEVEL = 12
9 +SUBLEVEL = 13
10 EXTRAVERSION =
11 NAME = Saber-toothed Squirrel
12
13 diff --git a/arch/arm/plat-omap/include/plat/omap-serial.h b/arch/arm/plat-omap/include/plat/omap-serial.h
14 index 9ff4444..c369c9d 100644
15 --- a/arch/arm/plat-omap/include/plat/omap-serial.h
16 +++ b/arch/arm/plat-omap/include/plat/omap-serial.h
17 @@ -42,10 +42,10 @@
18 #define OMAP_UART_WER_MOD_WKUP 0X7F
19
20 /* Enable XON/XOFF flow control on output */
21 -#define OMAP_UART_SW_TX 0x04
22 +#define OMAP_UART_SW_TX 0x8
23
24 /* Enable XON/XOFF flow control on input */
25 -#define OMAP_UART_SW_RX 0x04
26 +#define OMAP_UART_SW_RX 0x2
27
28 #define OMAP_UART_SYSC_RESET 0X07
29 #define OMAP_UART_TCR_TRIG 0X0F
30 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
31 index 73ef56c..bda833c 100644
32 --- a/arch/x86/kernel/alternative.c
33 +++ b/arch/x86/kernel/alternative.c
34 @@ -160,7 +160,7 @@ static const unsigned char * const k7_nops[ASM_NOP_MAX+2] =
35 #endif
36
37 #ifdef P6_NOP1
38 -static const unsigned char __initconst_or_module p6nops[] =
39 +static const unsigned char p6nops[] =
40 {
41 P6_NOP1,
42 P6_NOP2,
43 diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
44 index 46b77ed..a7c6d6a 100644
45 --- a/drivers/char/ttyprintk.c
46 +++ b/drivers/char/ttyprintk.c
47 @@ -67,7 +67,7 @@ static int tpk_printk(const unsigned char *buf, int count)
48 tmp[tpk_curr + 1] = '\0';
49 printk(KERN_INFO "%s%s", tpk_tag, tmp);
50 tpk_curr = 0;
51 - if (buf[i + 1] == '\n')
52 + if ((i + 1) < count && buf[i + 1] == '\n')
53 i++;
54 break;
55 case '\n':
56 diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
57 index 47408e8..d10c987 100644
58 --- a/drivers/firmware/efivars.c
59 +++ b/drivers/firmware/efivars.c
60 @@ -435,12 +435,23 @@ efivar_attr_read(struct efivar_entry *entry, char *buf)
61 if (status != EFI_SUCCESS)
62 return -EIO;
63
64 - if (var->Attributes & 0x1)
65 + if (var->Attributes & EFI_VARIABLE_NON_VOLATILE)
66 str += sprintf(str, "EFI_VARIABLE_NON_VOLATILE\n");
67 - if (var->Attributes & 0x2)
68 + if (var->Attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)
69 str += sprintf(str, "EFI_VARIABLE_BOOTSERVICE_ACCESS\n");
70 - if (var->Attributes & 0x4)
71 + if (var->Attributes & EFI_VARIABLE_RUNTIME_ACCESS)
72 str += sprintf(str, "EFI_VARIABLE_RUNTIME_ACCESS\n");
73 + if (var->Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD)
74 + str += sprintf(str, "EFI_VARIABLE_HARDWARE_ERROR_RECORD\n");
75 + if (var->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
76 + str += sprintf(str,
77 + "EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS\n");
78 + if (var->Attributes &
79 + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)
80 + str += sprintf(str,
81 + "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS\n");
82 + if (var->Attributes & EFI_VARIABLE_APPEND_WRITE)
83 + str += sprintf(str, "EFI_VARIABLE_APPEND_WRITE\n");
84 return str - buf;
85 }
86
87 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
88 index 3974c29..69b23c2 100644
89 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
90 +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
91 @@ -148,7 +148,7 @@ static int ipoib_stop(struct net_device *dev)
92
93 netif_stop_queue(dev);
94
95 - ipoib_ib_dev_down(dev, 0);
96 + ipoib_ib_dev_down(dev, 1);
97 ipoib_ib_dev_stop(dev, 0);
98
99 if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
100 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
101 index 20ebc6f..213965d 100644
102 --- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
103 +++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
104 @@ -190,7 +190,9 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
105
106 mcast->mcmember = *mcmember;
107
108 - /* Set the cached Q_Key before we attach if it's the broadcast group */
109 + /* Set the multicast MTU and cached Q_Key before we attach if it's
110 + * the broadcast group.
111 + */
112 if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
113 sizeof (union ib_gid))) {
114 spin_lock_irq(&priv->lock);
115 @@ -198,10 +200,17 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
116 spin_unlock_irq(&priv->lock);
117 return -EAGAIN;
118 }
119 + priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
120 priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
121 spin_unlock_irq(&priv->lock);
122 priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
123 set_qkey = 1;
124 +
125 + if (!ipoib_cm_admin_enabled(dev)) {
126 + rtnl_lock();
127 + dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
128 + rtnl_unlock();
129 + }
130 }
131
132 if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
133 @@ -589,14 +598,6 @@ void ipoib_mcast_join_task(struct work_struct *work)
134 return;
135 }
136
137 - priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
138 -
139 - if (!ipoib_cm_admin_enabled(dev)) {
140 - rtnl_lock();
141 - dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
142 - rtnl_unlock();
143 - }
144 -
145 ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
146
147 clear_bit(IPOIB_MCAST_RUN, &priv->flags);
148 diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
149 index 1b5b0c7..922d845 100644
150 --- a/drivers/infiniband/ulp/srp/ib_srp.c
151 +++ b/drivers/infiniband/ulp/srp/ib_srp.c
152 @@ -638,9 +638,9 @@ static void srp_reset_req(struct srp_target_port *target, struct srp_request *re
153 struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
154
155 if (scmnd) {
156 + srp_free_req(target, req, scmnd, 0);
157 scmnd->result = DID_RESET << 16;
158 scmnd->scsi_done(scmnd);
159 - srp_free_req(target, req, scmnd, 0);
160 }
161 }
162
163 @@ -1687,6 +1687,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
164 SRP_TSK_ABORT_TASK);
165 srp_free_req(target, req, scmnd, 0);
166 scmnd->result = DID_ABORT << 16;
167 + scmnd->scsi_done(scmnd);
168
169 return SUCCESS;
170 }
171 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
172 index 2e227fb..f220a69 100644
173 --- a/drivers/md/dm-table.c
174 +++ b/drivers/md/dm-table.c
175 @@ -1351,17 +1351,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
176 return q && blk_queue_nonrot(q);
177 }
178
179 -static bool dm_table_is_nonrot(struct dm_table *t)
180 +static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
181 + sector_t start, sector_t len, void *data)
182 +{
183 + struct request_queue *q = bdev_get_queue(dev->bdev);
184 +
185 + return q && !blk_queue_add_random(q);
186 +}
187 +
188 +static bool dm_table_all_devices_attribute(struct dm_table *t,
189 + iterate_devices_callout_fn func)
190 {
191 struct dm_target *ti;
192 unsigned i = 0;
193
194 - /* Ensure that all underlying device are non-rotational. */
195 while (i < dm_table_get_num_targets(t)) {
196 ti = dm_table_get_target(t, i++);
197
198 if (!ti->type->iterate_devices ||
199 - !ti->type->iterate_devices(ti, device_is_nonrot, NULL))
200 + !ti->type->iterate_devices(ti, func, NULL))
201 return 0;
202 }
203
204 @@ -1393,7 +1401,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
205 if (!dm_table_discard_zeroes_data(t))
206 q->limits.discard_zeroes_data = 0;
207
208 - if (dm_table_is_nonrot(t))
209 + /* Ensure that all underlying devices are non-rotational. */
210 + if (dm_table_all_devices_attribute(t, device_is_nonrot))
211 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
212 else
213 queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
214 @@ -1401,6 +1410,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
215 dm_table_set_integrity(t);
216
217 /*
218 + * Determine whether or not this queue's I/O timings contribute
219 + * to the entropy pool, Only request-based targets use this.
220 + * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
221 + * have it set.
222 + */
223 + if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
224 + queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
225 +
226 + /*
227 * QUEUE_FLAG_STACKABLE must be set after all queue settings are
228 * visible to other CPUs because, once the flag is set, incoming bios
229 * are processed by request-based dm, which refers to the queue
230 diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
231 index fa365d3..68bf5c3 100644
232 --- a/drivers/md/dm-verity.c
233 +++ b/drivers/md/dm-verity.c
234 @@ -718,8 +718,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
235 v->hash_dev_block_bits = ffs(num) - 1;
236
237 if (sscanf(argv[5], "%llu%c", &num_ll, &dummy) != 1 ||
238 - num_ll << (v->data_dev_block_bits - SECTOR_SHIFT) !=
239 - (sector_t)num_ll << (v->data_dev_block_bits - SECTOR_SHIFT)) {
240 + (sector_t)(num_ll << (v->data_dev_block_bits - SECTOR_SHIFT))
241 + >> (v->data_dev_block_bits - SECTOR_SHIFT) != num_ll) {
242 ti->error = "Invalid data blocks";
243 r = -EINVAL;
244 goto bad;
245 @@ -733,8 +733,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
246 }
247
248 if (sscanf(argv[6], "%llu%c", &num_ll, &dummy) != 1 ||
249 - num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT) !=
250 - (sector_t)num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT)) {
251 + (sector_t)(num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT))
252 + >> (v->hash_dev_block_bits - SECTOR_SHIFT) != num_ll) {
253 ti->error = "Invalid hash start";
254 r = -EINVAL;
255 goto bad;
256 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
257 index e24143c..9ff3019 100644
258 --- a/drivers/md/dm.c
259 +++ b/drivers/md/dm.c
260 @@ -865,10 +865,14 @@ static void dm_done(struct request *clone, int error, bool mapped)
261 {
262 int r = error;
263 struct dm_rq_target_io *tio = clone->end_io_data;
264 - dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
265 + dm_request_endio_fn rq_end_io = NULL;
266
267 - if (mapped && rq_end_io)
268 - r = rq_end_io(tio->ti, clone, error, &tio->info);
269 + if (tio->ti) {
270 + rq_end_io = tio->ti->type->rq_end_io;
271 +
272 + if (mapped && rq_end_io)
273 + r = rq_end_io(tio->ti, clone, error, &tio->info);
274 + }
275
276 if (r <= 0)
277 /* The target wants to complete the I/O */
278 @@ -1566,15 +1570,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
279 int r, requeued = 0;
280 struct dm_rq_target_io *tio = clone->end_io_data;
281
282 - /*
283 - * Hold the md reference here for the in-flight I/O.
284 - * We can't rely on the reference count by device opener,
285 - * because the device may be closed during the request completion
286 - * when all bios are completed.
287 - * See the comment in rq_completed() too.
288 - */
289 - dm_get(md);
290 -
291 tio->ti = ti;
292 r = ti->type->map_rq(ti, clone, &tio->info);
293 switch (r) {
294 @@ -1606,6 +1601,26 @@ static int map_request(struct dm_target *ti, struct request *clone,
295 return requeued;
296 }
297
298 +static struct request *dm_start_request(struct mapped_device *md, struct request *orig)
299 +{
300 + struct request *clone;
301 +
302 + blk_start_request(orig);
303 + clone = orig->special;
304 + atomic_inc(&md->pending[rq_data_dir(clone)]);
305 +
306 + /*
307 + * Hold the md reference here for the in-flight I/O.
308 + * We can't rely on the reference count by device opener,
309 + * because the device may be closed during the request completion
310 + * when all bios are completed.
311 + * See the comment in rq_completed() too.
312 + */
313 + dm_get(md);
314 +
315 + return clone;
316 +}
317 +
318 /*
319 * q->request_fn for request-based dm.
320 * Called with the queue lock held.
321 @@ -1635,14 +1650,21 @@ static void dm_request_fn(struct request_queue *q)
322 pos = blk_rq_pos(rq);
323
324 ti = dm_table_find_target(map, pos);
325 - BUG_ON(!dm_target_is_valid(ti));
326 + if (!dm_target_is_valid(ti)) {
327 + /*
328 + * Must perform setup, that dm_done() requires,
329 + * before calling dm_kill_unmapped_request
330 + */
331 + DMERR_LIMIT("request attempted access beyond the end of device");
332 + clone = dm_start_request(md, rq);
333 + dm_kill_unmapped_request(clone, -EIO);
334 + continue;
335 + }
336
337 if (ti->type->busy && ti->type->busy(ti))
338 goto delay_and_out;
339
340 - blk_start_request(rq);
341 - clone = rq->special;
342 - atomic_inc(&md->pending[rq_data_dir(clone)]);
343 + clone = dm_start_request(md, rq);
344
345 spin_unlock(q->queue_lock);
346 if (map_request(ti, clone, md))
347 @@ -1662,8 +1684,6 @@ delay_and_out:
348 blk_delay_queue(q, HZ / 10);
349 out:
350 dm_table_put(map);
351 -
352 - return;
353 }
354
355 int dm_underlying_device_busy(struct request_queue *q)
356 diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
357 index 0fde9fc..83bab2c 100644
358 --- a/drivers/mtd/ubi/build.c
359 +++ b/drivers/mtd/ubi/build.c
360 @@ -816,6 +816,11 @@ static int autoresize(struct ubi_device *ubi, int vol_id)
361 struct ubi_volume *vol = ubi->volumes[vol_id];
362 int err, old_reserved_pebs = vol->reserved_pebs;
363
364 + if (ubi->ro_mode) {
365 + ubi_warn("skip auto-resize because of R/O mode");
366 + return 0;
367 + }
368 +
369 /*
370 * Clear the auto-resize flag in the volume in-memory copy of the
371 * volume table, and 'ubi_resize_volume()' will propagate this change
372 diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
373 index 5caa572..957f000 100644
374 --- a/drivers/net/can/mscan/mpc5xxx_can.c
375 +++ b/drivers/net/can/mscan/mpc5xxx_can.c
376 @@ -181,7 +181,7 @@ static u32 __devinit mpc512x_can_get_clock(struct platform_device *ofdev,
377
378 if (!clock_name || !strcmp(clock_name, "sys")) {
379 sys_clk = clk_get(&ofdev->dev, "sys_clk");
380 - if (!sys_clk) {
381 + if (IS_ERR(sys_clk)) {
382 dev_err(&ofdev->dev, "couldn't get sys_clk\n");
383 goto exit_unmap;
384 }
385 @@ -204,7 +204,7 @@ static u32 __devinit mpc512x_can_get_clock(struct platform_device *ofdev,
386
387 if (clocksrc < 0) {
388 ref_clk = clk_get(&ofdev->dev, "ref_clk");
389 - if (!ref_clk) {
390 + if (IS_ERR(ref_clk)) {
391 dev_err(&ofdev->dev, "couldn't get ref_clk\n");
392 goto exit_unmap;
393 }
394 diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
395 index e44097a..0e7d6c1 100644
396 --- a/drivers/net/wireless/ath/ath9k/pci.c
397 +++ b/drivers/net/wireless/ath/ath9k/pci.c
398 @@ -122,8 +122,9 @@ static void ath_pci_aspm_init(struct ath_common *common)
399 if (!parent)
400 return;
401
402 - if (ath9k_hw_get_btcoex_scheme(ah) != ATH_BTCOEX_CFG_NONE) {
403 - /* Bluetooth coexistance requires disabling ASPM. */
404 + if ((ath9k_hw_get_btcoex_scheme(ah) != ATH_BTCOEX_CFG_NONE) &&
405 + (AR_SREV_9285(ah))) {
406 + /* Bluetooth coexistance requires disabling ASPM for AR9285. */
407 pci_read_config_byte(pdev, pos + PCI_EXP_LNKCTL, &aspm);
408 aspm &= ~(PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
409 pci_write_config_byte(pdev, pos + PCI_EXP_LNKCTL, aspm);
410 diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
411 index a98db30..0f30c07 100644
412 --- a/drivers/net/wireless/b43legacy/main.c
413 +++ b/drivers/net/wireless/b43legacy/main.c
414 @@ -3892,6 +3892,8 @@ static void b43legacy_remove(struct ssb_device *dev)
415 cancel_work_sync(&wl->firmware_load);
416
417 B43legacy_WARN_ON(!wl);
418 + if (!wldev->fw.ucode)
419 + return; /* NULL if fw never loaded */
420 if (wl->current_dev == wldev)
421 ieee80211_unregister_hw(wl->hw);
422
423 diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
424 index f8d818a..811ff72 100644
425 --- a/drivers/remoteproc/Kconfig
426 +++ b/drivers/remoteproc/Kconfig
427 @@ -5,6 +5,7 @@ config REMOTEPROC
428 tristate
429 depends on EXPERIMENTAL
430 select FW_CONFIG
431 + select VIRTIO
432
433 config OMAP_REMOTEPROC
434 tristate "OMAP remoteproc support"
435 diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
436 index 7591b97..837cc40 100644
437 --- a/drivers/remoteproc/remoteproc_core.c
438 +++ b/drivers/remoteproc/remoteproc_core.c
439 @@ -643,17 +643,10 @@ static int rproc_handle_carveout(struct rproc *rproc,
440 dev_dbg(dev, "carveout rsc: da %x, pa %x, len %x, flags %x\n",
441 rsc->da, rsc->pa, rsc->len, rsc->flags);
442
443 - mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
444 - if (!mapping) {
445 - dev_err(dev, "kzalloc mapping failed\n");
446 - return -ENOMEM;
447 - }
448 -
449 carveout = kzalloc(sizeof(*carveout), GFP_KERNEL);
450 if (!carveout) {
451 dev_err(dev, "kzalloc carveout failed\n");
452 - ret = -ENOMEM;
453 - goto free_mapping;
454 + return -ENOMEM;
455 }
456
457 va = dma_alloc_coherent(dev, rsc->len, &dma, GFP_KERNEL);
458 @@ -683,11 +676,18 @@ static int rproc_handle_carveout(struct rproc *rproc,
459 * physical address in this case.
460 */
461 if (rproc->domain) {
462 + mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
463 + if (!mapping) {
464 + dev_err(dev, "kzalloc mapping failed\n");
465 + ret = -ENOMEM;
466 + goto dma_free;
467 + }
468 +
469 ret = iommu_map(rproc->domain, rsc->da, dma, rsc->len,
470 rsc->flags);
471 if (ret) {
472 dev_err(dev, "iommu_map failed: %d\n", ret);
473 - goto dma_free;
474 + goto free_mapping;
475 }
476
477 /*
478 @@ -728,12 +728,12 @@ static int rproc_handle_carveout(struct rproc *rproc,
479
480 return 0;
481
482 +free_mapping:
483 + kfree(mapping);
484 dma_free:
485 dma_free_coherent(dev, rsc->len, va, dma);
486 free_carv:
487 kfree(carveout);
488 -free_mapping:
489 - kfree(mapping);
490 return ret;
491 }
492
493 diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
494 index 04c5cea..3a8ba3e 100644
495 --- a/drivers/scsi/device_handler/scsi_dh_alua.c
496 +++ b/drivers/scsi/device_handler/scsi_dh_alua.c
497 @@ -583,8 +583,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_dh_data *h)
498 h->state = TPGS_STATE_STANDBY;
499 break;
500 case TPGS_STATE_OFFLINE:
501 - case TPGS_STATE_UNAVAILABLE:
502 - /* Path unusable for unavailable/offline */
503 + /* Path unusable */
504 err = SCSI_DH_DEV_OFFLINED;
505 break;
506 default:
507 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
508 index 7c49e0a..8a5e25d 100644
509 --- a/drivers/scsi/hpsa.c
510 +++ b/drivers/scsi/hpsa.c
511 @@ -2943,7 +2943,7 @@ static void fill_cmd(struct CommandList *c, u8 cmd, struct ctlr_info *h,
512 c->Request.Timeout = 0; /* Don't time out */
513 memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
514 c->Request.CDB[0] = cmd;
515 - c->Request.CDB[1] = 0x03; /* Reset target above */
516 + c->Request.CDB[1] = HPSA_RESET_TYPE_LUN;
517 /* If bytes 4-7 are zero, it means reset the */
518 /* LunID device */
519 c->Request.CDB[4] = 0x00;
520 diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
521 index 3a6c474..337e8b3 100644
522 --- a/drivers/scsi/ibmvscsi/ibmvscsi.c
523 +++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
524 @@ -1541,6 +1541,9 @@ static int ibmvscsi_do_host_config(struct ibmvscsi_host_data *hostdata,
525
526 host_config = &evt_struct->iu.mad.host_config;
527
528 + /* The transport length field is only 16-bit */
529 + length = min(0xffff, length);
530 +
531 /* Set up a lun reset SRP command */
532 memset(host_config, 0x00, sizeof(*host_config));
533 host_config->common.type = VIOSRP_HOST_CONFIG_TYPE;
534 diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
535 index bc6cf88..4c150df 100644
536 --- a/drivers/scsi/isci/init.c
537 +++ b/drivers/scsi/isci/init.c
538 @@ -481,7 +481,6 @@ static int __devinit isci_pci_probe(struct pci_dev *pdev, const struct pci_devic
539 orom->hdr.version)) {
540 dev_warn(&pdev->dev,
541 "[%d]: invalid oem parameters detected, falling back to firmware\n", i);
542 - devm_kfree(&pdev->dev, orom);
543 orom = NULL;
544 break;
545 }
546 diff --git a/drivers/scsi/isci/probe_roms.c b/drivers/scsi/isci/probe_roms.c
547 index 9b8117b..4c66f46 100644
548 --- a/drivers/scsi/isci/probe_roms.c
549 +++ b/drivers/scsi/isci/probe_roms.c
550 @@ -104,7 +104,6 @@ struct isci_orom *isci_request_oprom(struct pci_dev *pdev)
551
552 if (i >= len) {
553 dev_err(&pdev->dev, "oprom parse error\n");
554 - devm_kfree(&pdev->dev, rom);
555 rom = NULL;
556 }
557 pci_unmap_biosrom(oprom);
558 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
559 index bb7c482..08d48a3 100644
560 --- a/drivers/scsi/scsi_sysfs.c
561 +++ b/drivers/scsi/scsi_sysfs.c
562 @@ -1023,33 +1023,31 @@ static void __scsi_remove_target(struct scsi_target *starget)
563 void scsi_remove_target(struct device *dev)
564 {
565 struct Scsi_Host *shost = dev_to_shost(dev->parent);
566 - struct scsi_target *starget, *found;
567 + struct scsi_target *starget, *last = NULL;
568 unsigned long flags;
569
570 - restart:
571 - found = NULL;
572 + /* remove targets being careful to lookup next entry before
573 + * deleting the last
574 + */
575 spin_lock_irqsave(shost->host_lock, flags);
576 list_for_each_entry(starget, &shost->__targets, siblings) {
577 if (starget->state == STARGET_DEL)
578 continue;
579 if (starget->dev.parent == dev || &starget->dev == dev) {
580 - found = starget;
581 - found->reap_ref++;
582 - break;
583 + /* assuming new targets arrive at the end */
584 + starget->reap_ref++;
585 + spin_unlock_irqrestore(shost->host_lock, flags);
586 + if (last)
587 + scsi_target_reap(last);
588 + last = starget;
589 + __scsi_remove_target(starget);
590 + spin_lock_irqsave(shost->host_lock, flags);
591 }
592 }
593 spin_unlock_irqrestore(shost->host_lock, flags);
594
595 - if (found) {
596 - __scsi_remove_target(found);
597 - scsi_target_reap(found);
598 - /* in the case where @dev has multiple starget children,
599 - * continue removing.
600 - *
601 - * FIXME: does such a case exist?
602 - */
603 - goto restart;
604 - }
605 + if (last)
606 + scsi_target_reap(last);
607 }
608 EXPORT_SYMBOL(scsi_remove_target);
609
610 diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
611 index a796964..b719460 100644
612 --- a/drivers/staging/comedi/comedi_fops.c
613 +++ b/drivers/staging/comedi/comedi_fops.c
614 @@ -843,7 +843,7 @@ static int parse_insn(struct comedi_device *dev, struct comedi_insn *insn,
615 ret = -EAGAIN;
616 break;
617 }
618 - ret = s->async->inttrig(dev, s, insn->data[0]);
619 + ret = s->async->inttrig(dev, s, data[0]);
620 if (ret >= 0)
621 ret = 1;
622 break;
623 @@ -1088,7 +1088,6 @@ static int do_cmd_ioctl(struct comedi_device *dev,
624 goto cleanup;
625 }
626
627 - kfree(async->cmd.chanlist);
628 async->cmd = user_cmd;
629 async->cmd.data = NULL;
630 /* load channel/gain list */
631 @@ -1833,6 +1832,8 @@ void do_become_nonbusy(struct comedi_device *dev, struct comedi_subdevice *s)
632 if (async) {
633 comedi_reset_async_buf(async);
634 async->inttrig = NULL;
635 + kfree(async->cmd.chanlist);
636 + async->cmd.chanlist = NULL;
637 } else {
638 printk(KERN_ERR
639 "BUG: (?) do_become_nonbusy called with async=0\n");
640 diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
641 index 6a79ba1..d7e6341 100644
642 --- a/drivers/staging/comedi/drivers/jr3_pci.c
643 +++ b/drivers/staging/comedi/drivers/jr3_pci.c
644 @@ -905,7 +905,7 @@ static int jr3_pci_attach(struct comedi_device *dev,
645 }
646
647 /* Reset DSP card */
648 - devpriv->iobase->channel[0].reset = 0;
649 + writel(0, &devpriv->iobase->channel[0].reset);
650
651 result = comedi_load_firmware(dev, "jr3pci.idm", jr3_download_firmware);
652 dev_dbg(dev->hw_dev, "Firmare load %d\n", result);
653 diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
654 index 23fc64b..c72128f 100644
655 --- a/drivers/staging/comedi/drivers/s626.c
656 +++ b/drivers/staging/comedi/drivers/s626.c
657 @@ -2370,7 +2370,7 @@ static int s626_enc_insn_config(struct comedi_device *dev,
658 /* (data==NULL) ? (Preloadvalue=0) : (Preloadvalue=data[0]); */
659
660 k->SetMode(dev, k, Setup, TRUE);
661 - Preload(dev, k, *(insn->data));
662 + Preload(dev, k, data[0]);
663 k->PulseIndex(dev, k);
664 SetLatchSource(dev, k, valueSrclatch);
665 k->SetEnable(dev, k, (uint16_t) (enab != 0));
666 diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
667 index fa6dc9c..887a807 100644
668 --- a/drivers/staging/rtl8712/rtl8712_recv.c
669 +++ b/drivers/staging/rtl8712/rtl8712_recv.c
670 @@ -1126,6 +1126,9 @@ static void recv_tasklet(void *priv)
671 recvbuf2recvframe(padapter, pskb);
672 skb_reset_tail_pointer(pskb);
673 pskb->len = 0;
674 - skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
675 + if (!skb_cloned(pskb))
676 + skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
677 + else
678 + consume_skb(pskb);
679 }
680 }
681 diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
682 index 42cdafe..b5130c8 100644
683 --- a/drivers/staging/speakup/speakup_soft.c
684 +++ b/drivers/staging/speakup/speakup_soft.c
685 @@ -40,7 +40,7 @@ static int softsynth_is_alive(struct spk_synth *synth);
686 static unsigned char get_index(void);
687
688 static struct miscdevice synth_device;
689 -static int initialized;
690 +static int init_pos;
691 static int misc_registered;
692
693 static struct var_t vars[] = {
694 @@ -194,7 +194,7 @@ static int softsynth_close(struct inode *inode, struct file *fp)
695 unsigned long flags;
696 spk_lock(flags);
697 synth_soft.alive = 0;
698 - initialized = 0;
699 + init_pos = 0;
700 spk_unlock(flags);
701 /* Make sure we let applications go before leaving */
702 speakup_start_ttys();
703 @@ -239,13 +239,8 @@ static ssize_t softsynth_read(struct file *fp, char *buf, size_t count,
704 ch = '\x18';
705 } else if (synth_buffer_empty()) {
706 break;
707 - } else if (!initialized) {
708 - if (*init) {
709 - ch = *init;
710 - init++;
711 - } else {
712 - initialized = 1;
713 - }
714 + } else if (init[init_pos]) {
715 + ch = init[init_pos++];
716 } else {
717 ch = synth_buffer_getc();
718 }
719 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
720 index c43b683..90dff82 100644
721 --- a/drivers/tty/n_gsm.c
722 +++ b/drivers/tty/n_gsm.c
723 @@ -875,7 +875,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
724
725 /* dlci->skb is locked by tx_lock */
726 if (dlci->skb == NULL) {
727 - dlci->skb = skb_dequeue(&dlci->skb_list);
728 + dlci->skb = skb_dequeue_tail(&dlci->skb_list);
729 if (dlci->skb == NULL)
730 return 0;
731 first = 1;
732 @@ -899,8 +899,11 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
733
734 /* FIXME: need a timer or something to kick this so it can't
735 get stuck with no work outstanding and no buffer free */
736 - if (msg == NULL)
737 + if (msg == NULL) {
738 + skb_queue_tail(&dlci->skb_list, dlci->skb);
739 + dlci->skb = NULL;
740 return -ENOMEM;
741 + }
742 dp = msg->data;
743
744 if (dlci->adaption == 4) { /* Interruptible framed (Packetised Data) */
745 @@ -971,16 +974,19 @@ static void gsm_dlci_data_sweep(struct gsm_mux *gsm)
746 static void gsm_dlci_data_kick(struct gsm_dlci *dlci)
747 {
748 unsigned long flags;
749 + int sweep;
750
751 spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
752 /* If we have nothing running then we need to fire up */
753 + sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO);
754 if (dlci->gsm->tx_bytes == 0) {
755 if (dlci->net)
756 gsm_dlci_data_output_framed(dlci->gsm, dlci);
757 else
758 gsm_dlci_data_output(dlci->gsm, dlci);
759 - } else if (dlci->gsm->tx_bytes < TX_THRESH_LO)
760 - gsm_dlci_data_sweep(dlci->gsm);
761 + }
762 + if (sweep)
763 + gsm_dlci_data_sweep(dlci->gsm);
764 spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags);
765 }
766
767 @@ -1190,6 +1196,8 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
768 u8 *data, int clen)
769 {
770 u8 buf[1];
771 + unsigned long flags;
772 +
773 switch (command) {
774 case CMD_CLD: {
775 struct gsm_dlci *dlci = gsm->dlci[0];
776 @@ -1215,7 +1223,9 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
777 gsm->constipated = 0;
778 gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
779 /* Kick the link in case it is idling */
780 + spin_lock_irqsave(&gsm->tx_lock, flags);
781 gsm_data_kick(gsm);
782 + spin_unlock_irqrestore(&gsm->tx_lock, flags);
783 break;
784 case CMD_MSC:
785 /* Out of band modem line change indicator for a DLCI */
786 @@ -2377,12 +2387,12 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
787
788 /* Queue poll */
789 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
790 + spin_lock_irqsave(&gsm->tx_lock, flags);
791 gsm_data_kick(gsm);
792 if (gsm->tx_bytes < TX_THRESH_LO) {
793 - spin_lock_irqsave(&gsm->tx_lock, flags);
794 gsm_dlci_data_sweep(gsm);
795 - spin_unlock_irqrestore(&gsm->tx_lock, flags);
796 }
797 + spin_unlock_irqrestore(&gsm->tx_lock, flags);
798 }
799
800 /**
801 @@ -2889,6 +2899,10 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
802 gsm = gsm_mux[mux];
803 if (gsm->dead)
804 return -EL2HLT;
805 + /* If DLCI 0 is not yet fully open return an error. This is ok from a locking
806 + perspective as we don't have to worry about this if DLCI0 is lost */
807 + if (gsm->dlci[0] && gsm->dlci[0]->state != DLCI_OPEN)
808 + return -EL2NSYNC;
809 dlci = gsm->dlci[line];
810 if (dlci == NULL)
811 dlci = gsm_dlci_alloc(gsm, line);
812 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
813 index 94b6eda..2303a02 100644
814 --- a/drivers/tty/n_tty.c
815 +++ b/drivers/tty/n_tty.c
816 @@ -1727,7 +1727,8 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
817
818 do_it_again:
819
820 - BUG_ON(!tty->read_buf);
821 + if (WARN_ON(!tty->read_buf))
822 + return -EAGAIN;
823
824 c = job_control(tty, file);
825 if (c < 0)
826 diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
827 index 3614973..40747fe 100644
828 --- a/drivers/tty/serial/8250/8250_pci.c
829 +++ b/drivers/tty/serial/8250/8250_pci.c
830 @@ -1125,6 +1125,8 @@ pci_xr17c154_setup(struct serial_private *priv,
831 #define PCI_SUBDEVICE_ID_OCTPRO422 0x0208
832 #define PCI_SUBDEVICE_ID_POCTAL232 0x0308
833 #define PCI_SUBDEVICE_ID_POCTAL422 0x0408
834 +#define PCI_SUBDEVICE_ID_SIIG_DUAL_00 0x2500
835 +#define PCI_SUBDEVICE_ID_SIIG_DUAL_30 0x2530
836 #define PCI_VENDOR_ID_ADVANTECH 0x13fe
837 #define PCI_DEVICE_ID_INTEL_CE4100_UART 0x2e66
838 #define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620
839 @@ -3187,8 +3189,11 @@ static struct pci_device_id serial_pci_tbl[] = {
840 * For now just used the hex ID 0x950a.
841 */
842 { PCI_VENDOR_ID_OXSEMI, 0x950a,
843 - PCI_SUBVENDOR_ID_SIIG, PCI_SUBDEVICE_ID_SIIG_DUAL_SERIAL, 0, 0,
844 - pbn_b0_2_115200 },
845 + PCI_SUBVENDOR_ID_SIIG, PCI_SUBDEVICE_ID_SIIG_DUAL_00,
846 + 0, 0, pbn_b0_2_115200 },
847 + { PCI_VENDOR_ID_OXSEMI, 0x950a,
848 + PCI_SUBVENDOR_ID_SIIG, PCI_SUBDEVICE_ID_SIIG_DUAL_30,
849 + 0, 0, pbn_b0_2_115200 },
850 { PCI_VENDOR_ID_OXSEMI, 0x950a,
851 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
852 pbn_b0_2_1130000 },
853 diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
854 index 3d569cd..b69356c 100644
855 --- a/drivers/tty/serial/amba-pl011.c
856 +++ b/drivers/tty/serial/amba-pl011.c
857 @@ -1654,13 +1654,26 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
858 old_cr &= ~ST_UART011_CR_OVSFACT;
859 }
860
861 + /*
862 + * Workaround for the ST Micro oversampling variants to
863 + * increase the bitrate slightly, by lowering the divisor,
864 + * to avoid delayed sampling of start bit at high speeds,
865 + * else we see data corruption.
866 + */
867 + if (uap->vendor->oversampling) {
868 + if ((baud >= 3000000) && (baud < 3250000) && (quot > 1))
869 + quot -= 1;
870 + else if ((baud > 3250000) && (quot > 2))
871 + quot -= 2;
872 + }
873 /* Set baud rate */
874 writew(quot & 0x3f, port->membase + UART011_FBRD);
875 writew(quot >> 6, port->membase + UART011_IBRD);
876
877 /*
878 * ----------v----------v----------v----------v-----
879 - * NOTE: MUST BE WRITTEN AFTER UARTLCR_M & UARTLCR_L
880 + * NOTE: lcrh_tx and lcrh_rx MUST BE WRITTEN AFTER
881 + * UART011_FBRD & UART011_IBRD.
882 * ----------^----------^----------^----------^-----
883 */
884 writew(lcr_h, port->membase + uap->lcrh_rx);
885 diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
886 index d00b38e..6189923 100644
887 --- a/drivers/tty/serial/omap-serial.c
888 +++ b/drivers/tty/serial/omap-serial.c
889 @@ -649,19 +649,19 @@ serial_omap_configure_xonxoff
890
891 /*
892 * IXON Flag:
893 - * Enable XON/XOFF flow control on output.
894 - * Transmit XON1, XOFF1
895 + * Flow control for OMAP.TX
896 + * OMAP.RX should listen for XON/XOFF
897 */
898 if (termios->c_iflag & IXON)
899 - up->efr |= OMAP_UART_SW_TX;
900 + up->efr |= OMAP_UART_SW_RX;
901
902 /*
903 * IXOFF Flag:
904 - * Enable XON/XOFF flow control on input.
905 - * Receiver compares XON1, XOFF1.
906 + * Flow control for OMAP.RX
907 + * OMAP.TX should send XON/XOFF
908 */
909 if (termios->c_iflag & IXOFF)
910 - up->efr |= OMAP_UART_SW_RX;
911 + up->efr |= OMAP_UART_SW_TX;
912
913 serial_out(up, UART_EFR, up->efr | UART_EFR_ECB);
914 serial_out(up, UART_LCR, UART_LCR_CONF_MODE_A);
915 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
916 index 3b0c4e3..a6d5d51 100644
917 --- a/drivers/tty/vt/keyboard.c
918 +++ b/drivers/tty/vt/keyboard.c
919 @@ -1053,13 +1053,10 @@ static int kbd_update_leds_helper(struct input_handle *handle, void *data)
920 */
921 int vt_get_leds(int console, int flag)
922 {
923 - unsigned long flags;
924 struct kbd_struct * kbd = kbd_table + console;
925 int ret;
926
927 - spin_lock_irqsave(&kbd_event_lock, flags);
928 ret = vc_kbd_led(kbd, flag);
929 - spin_unlock_irqrestore(&kbd_event_lock, flags);
930
931 return ret;
932 }
933 diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
934 index 170cbe8..2d277a2 100644
935 --- a/drivers/usb/gadget/dummy_hcd.c
936 +++ b/drivers/usb/gadget/dummy_hcd.c
937 @@ -2505,10 +2505,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
938 hs_hcd->has_tt = 1;
939
940 retval = usb_add_hcd(hs_hcd, 0, 0);
941 - if (retval != 0) {
942 - usb_put_hcd(hs_hcd);
943 - return retval;
944 - }
945 + if (retval)
946 + goto put_usb2_hcd;
947
948 if (mod_data.is_super_speed) {
949 ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
950 @@ -2527,6 +2525,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
951 put_usb3_hcd:
952 usb_put_hcd(ss_hcd);
953 dealloc_usb2_hcd:
954 + usb_remove_hcd(hs_hcd);
955 +put_usb2_hcd:
956 usb_put_hcd(hs_hcd);
957 the_controller.hs_hcd = the_controller.ss_hcd = NULL;
958 return retval;
959 diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
960 index 6b90824..cbed50a 100644
961 --- a/drivers/usb/host/xhci-mem.c
962 +++ b/drivers/usb/host/xhci-mem.c
963 @@ -1772,6 +1772,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
964 {
965 struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
966 struct dev_info *dev_info, *next;
967 + struct xhci_cd *cur_cd, *next_cd;
968 unsigned long flags;
969 int size;
970 int i, j, num_ports;
971 @@ -1793,6 +1794,11 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
972 xhci_ring_free(xhci, xhci->cmd_ring);
973 xhci->cmd_ring = NULL;
974 xhci_dbg(xhci, "Freed command ring\n");
975 + list_for_each_entry_safe(cur_cd, next_cd,
976 + &xhci->cancel_cmd_list, cancel_cmd_list) {
977 + list_del(&cur_cd->cancel_cmd_list);
978 + kfree(cur_cd);
979 + }
980
981 for (i = 1; i < MAX_HC_SLOTS; ++i)
982 xhci_free_virt_device(xhci, i);
983 @@ -2338,6 +2344,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
984 xhci->cmd_ring = xhci_ring_alloc(xhci, 1, 1, TYPE_COMMAND, flags);
985 if (!xhci->cmd_ring)
986 goto fail;
987 + INIT_LIST_HEAD(&xhci->cancel_cmd_list);
988 xhci_dbg(xhci, "Allocated command ring at %p\n", xhci->cmd_ring);
989 xhci_dbg(xhci, "First segment DMA is 0x%llx\n",
990 (unsigned long long)xhci->cmd_ring->first_seg->dma);
991 diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
992 index f152740..4211017 100644
993 --- a/drivers/usb/host/xhci-pci.c
994 +++ b/drivers/usb/host/xhci-pci.c
995 @@ -99,6 +99,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
996 * PPT chipsets.
997 */
998 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
999 + xhci->quirks |= XHCI_AVOID_BEI;
1000 }
1001 if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
1002 pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
1003 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
1004 index 203ba31..a23d71b 100644
1005 --- a/drivers/usb/host/xhci-ring.c
1006 +++ b/drivers/usb/host/xhci-ring.c
1007 @@ -280,12 +280,123 @@ static inline int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
1008 /* Ring the host controller doorbell after placing a command on the ring */
1009 void xhci_ring_cmd_db(struct xhci_hcd *xhci)
1010 {
1011 + if (!(xhci->cmd_ring_state & CMD_RING_STATE_RUNNING))
1012 + return;
1013 +
1014 xhci_dbg(xhci, "// Ding dong!\n");
1015 xhci_writel(xhci, DB_VALUE_HOST, &xhci->dba->doorbell[0]);
1016 /* Flush PCI posted writes */
1017 xhci_readl(xhci, &xhci->dba->doorbell[0]);
1018 }
1019
1020 +static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
1021 +{
1022 + u64 temp_64;
1023 + int ret;
1024 +
1025 + xhci_dbg(xhci, "Abort command ring\n");
1026 +
1027 + if (!(xhci->cmd_ring_state & CMD_RING_STATE_RUNNING)) {
1028 + xhci_dbg(xhci, "The command ring isn't running, "
1029 + "Have the command ring been stopped?\n");
1030 + return 0;
1031 + }
1032 +
1033 + temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
1034 + if (!(temp_64 & CMD_RING_RUNNING)) {
1035 + xhci_dbg(xhci, "Command ring had been stopped\n");
1036 + return 0;
1037 + }
1038 + xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
1039 + xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
1040 + &xhci->op_regs->cmd_ring);
1041 +
1042 + /* Section 4.6.1.2 of xHCI 1.0 spec says software should
1043 + * time the completion od all xHCI commands, including
1044 + * the Command Abort operation. If software doesn't see
1045 + * CRR negated in a timely manner (e.g. longer than 5
1046 + * seconds), then it should assume that the there are
1047 + * larger problems with the xHC and assert HCRST.
1048 + */
1049 + ret = handshake(xhci, &xhci->op_regs->cmd_ring,
1050 + CMD_RING_RUNNING, 0, 5 * 1000 * 1000);
1051 + if (ret < 0) {
1052 + xhci_err(xhci, "Stopped the command ring failed, "
1053 + "maybe the host is dead\n");
1054 + xhci->xhc_state |= XHCI_STATE_DYING;
1055 + xhci_quiesce(xhci);
1056 + xhci_halt(xhci);
1057 + return -ESHUTDOWN;
1058 + }
1059 +
1060 + return 0;
1061 +}
1062 +
1063 +static int xhci_queue_cd(struct xhci_hcd *xhci,
1064 + struct xhci_command *command,
1065 + union xhci_trb *cmd_trb)
1066 +{
1067 + struct xhci_cd *cd;
1068 + cd = kzalloc(sizeof(struct xhci_cd), GFP_ATOMIC);
1069 + if (!cd)
1070 + return -ENOMEM;
1071 + INIT_LIST_HEAD(&cd->cancel_cmd_list);
1072 +
1073 + cd->command = command;
1074 + cd->cmd_trb = cmd_trb;
1075 + list_add_tail(&cd->cancel_cmd_list, &xhci->cancel_cmd_list);
1076 +
1077 + return 0;
1078 +}
1079 +
1080 +/*
1081 + * Cancel the command which has issue.
1082 + *
1083 + * Some commands may hang due to waiting for acknowledgement from
1084 + * usb device. It is outside of the xHC's ability to control and
1085 + * will cause the command ring is blocked. When it occurs software
1086 + * should intervene to recover the command ring.
1087 + * See Section 4.6.1.1 and 4.6.1.2
1088 + */
1089 +int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
1090 + union xhci_trb *cmd_trb)
1091 +{
1092 + int retval = 0;
1093 + unsigned long flags;
1094 +
1095 + spin_lock_irqsave(&xhci->lock, flags);
1096 +
1097 + if (xhci->xhc_state & XHCI_STATE_DYING) {
1098 + xhci_warn(xhci, "Abort the command ring,"
1099 + " but the xHCI is dead.\n");
1100 + retval = -ESHUTDOWN;
1101 + goto fail;
1102 + }
1103 +
1104 + /* queue the cmd desriptor to cancel_cmd_list */
1105 + retval = xhci_queue_cd(xhci, command, cmd_trb);
1106 + if (retval) {
1107 + xhci_warn(xhci, "Queuing command descriptor failed.\n");
1108 + goto fail;
1109 + }
1110 +
1111 + /* abort command ring */
1112 + retval = xhci_abort_cmd_ring(xhci);
1113 + if (retval) {
1114 + xhci_err(xhci, "Abort command ring failed\n");
1115 + if (unlikely(retval == -ESHUTDOWN)) {
1116 + spin_unlock_irqrestore(&xhci->lock, flags);
1117 + usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
1118 + xhci_dbg(xhci, "xHCI host controller is dead.\n");
1119 + return retval;
1120 + }
1121 + }
1122 +
1123 +fail:
1124 + spin_unlock_irqrestore(&xhci->lock, flags);
1125 + return retval;
1126 +}
1127 +
1128 void xhci_ring_ep_doorbell(struct xhci_hcd *xhci,
1129 unsigned int slot_id,
1130 unsigned int ep_index,
1131 @@ -1059,6 +1170,20 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci,
1132 }
1133 }
1134
1135 +/* Complete the command and detele it from the devcie's command queue.
1136 + */
1137 +static void xhci_complete_cmd_in_cmd_wait_list(struct xhci_hcd *xhci,
1138 + struct xhci_command *command, u32 status)
1139 +{
1140 + command->status = status;
1141 + list_del(&command->cmd_list);
1142 + if (command->completion)
1143 + complete(command->completion);
1144 + else
1145 + xhci_free_command(xhci, command);
1146 +}
1147 +
1148 +
1149 /* Check to see if a command in the device's command queue matches this one.
1150 * Signal the completion or free the command, and return 1. Return 0 if the
1151 * completed command isn't at the head of the command list.
1152 @@ -1077,15 +1202,144 @@ static int handle_cmd_in_cmd_wait_list(struct xhci_hcd *xhci,
1153 if (xhci->cmd_ring->dequeue != command->command_trb)
1154 return 0;
1155
1156 - command->status = GET_COMP_CODE(le32_to_cpu(event->status));
1157 - list_del(&command->cmd_list);
1158 - if (command->completion)
1159 - complete(command->completion);
1160 - else
1161 - xhci_free_command(xhci, command);
1162 + xhci_complete_cmd_in_cmd_wait_list(xhci, command,
1163 + GET_COMP_CODE(le32_to_cpu(event->status)));
1164 return 1;
1165 }
1166
1167 +/*
1168 + * Finding the command trb need to be cancelled and modifying it to
1169 + * NO OP command. And if the command is in device's command wait
1170 + * list, finishing and freeing it.
1171 + *
1172 + * If we can't find the command trb, we think it had already been
1173 + * executed.
1174 + */
1175 +static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
1176 +{
1177 + struct xhci_segment *cur_seg;
1178 + union xhci_trb *cmd_trb;
1179 + u32 cycle_state;
1180 +
1181 + if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
1182 + return;
1183 +
1184 + /* find the current segment of command ring */
1185 + cur_seg = find_trb_seg(xhci->cmd_ring->first_seg,
1186 + xhci->cmd_ring->dequeue, &cycle_state);
1187 +
1188 + /* find the command trb matched by cd from command ring */
1189 + for (cmd_trb = xhci->cmd_ring->dequeue;
1190 + cmd_trb != xhci->cmd_ring->enqueue;
1191 + next_trb(xhci, xhci->cmd_ring, &cur_seg, &cmd_trb)) {
1192 + /* If the trb is link trb, continue */
1193 + if (TRB_TYPE_LINK_LE32(cmd_trb->generic.field[3]))
1194 + continue;
1195 +
1196 + if (cur_cd->cmd_trb == cmd_trb) {
1197 +
1198 + /* If the command in device's command list, we should
1199 + * finish it and free the command structure.
1200 + */
1201 + if (cur_cd->command)
1202 + xhci_complete_cmd_in_cmd_wait_list(xhci,
1203 + cur_cd->command, COMP_CMD_STOP);
1204 +
1205 + /* get cycle state from the origin command trb */
1206 + cycle_state = le32_to_cpu(cmd_trb->generic.field[3])
1207 + & TRB_CYCLE;
1208 +
1209 + /* modify the command trb to NO OP command */
1210 + cmd_trb->generic.field[0] = 0;
1211 + cmd_trb->generic.field[1] = 0;
1212 + cmd_trb->generic.field[2] = 0;
1213 + cmd_trb->generic.field[3] = cpu_to_le32(
1214 + TRB_TYPE(TRB_CMD_NOOP) | cycle_state);
1215 + break;
1216 + }
1217 + }
1218 +}
1219 +
1220 +static void xhci_cancel_cmd_in_cd_list(struct xhci_hcd *xhci)
1221 +{
1222 + struct xhci_cd *cur_cd, *next_cd;
1223 +
1224 + if (list_empty(&xhci->cancel_cmd_list))
1225 + return;
1226 +
1227 + list_for_each_entry_safe(cur_cd, next_cd,
1228 + &xhci->cancel_cmd_list, cancel_cmd_list) {
1229 + xhci_cmd_to_noop(xhci, cur_cd);
1230 + list_del(&cur_cd->cancel_cmd_list);
1231 + kfree(cur_cd);
1232 + }
1233 +}
1234 +
1235 +/*
1236 + * traversing the cancel_cmd_list. If the command descriptor according
1237 + * to cmd_trb is found, the function free it and return 1, otherwise
1238 + * return 0.
1239 + */
1240 +static int xhci_search_cmd_trb_in_cd_list(struct xhci_hcd *xhci,
1241 + union xhci_trb *cmd_trb)
1242 +{
1243 + struct xhci_cd *cur_cd, *next_cd;
1244 +
1245 + if (list_empty(&xhci->cancel_cmd_list))
1246 + return 0;
1247 +
1248 + list_for_each_entry_safe(cur_cd, next_cd,
1249 + &xhci->cancel_cmd_list, cancel_cmd_list) {
1250 + if (cur_cd->cmd_trb == cmd_trb) {
1251 + if (cur_cd->command)
1252 + xhci_complete_cmd_in_cmd_wait_list(xhci,
1253 + cur_cd->command, COMP_CMD_STOP);
1254 + list_del(&cur_cd->cancel_cmd_list);
1255 + kfree(cur_cd);
1256 + return 1;
1257 + }
1258 + }
1259 +
1260 + return 0;
1261 +}
1262 +
1263 +/*
1264 + * If the cmd_trb_comp_code is COMP_CMD_ABORT, we just check whether the
1265 + * trb pointed by the command ring dequeue pointer is the trb we want to
1266 + * cancel or not. And if the cmd_trb_comp_code is COMP_CMD_STOP, we will
1267 + * traverse the cancel_cmd_list to trun the all of the commands according
1268 + * to command descriptor to NO-OP trb.
1269 + */
1270 +static int handle_stopped_cmd_ring(struct xhci_hcd *xhci,
1271 + int cmd_trb_comp_code)
1272 +{
1273 + int cur_trb_is_good = 0;
1274 +
1275 + /* Searching the cmd trb pointed by the command ring dequeue
1276 + * pointer in command descriptor list. If it is found, free it.
1277 + */
1278 + cur_trb_is_good = xhci_search_cmd_trb_in_cd_list(xhci,
1279 + xhci->cmd_ring->dequeue);
1280 +
1281 + if (cmd_trb_comp_code == COMP_CMD_ABORT)
1282 + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
1283 + else if (cmd_trb_comp_code == COMP_CMD_STOP) {
1284 + /* traversing the cancel_cmd_list and canceling
1285 + * the command according to command descriptor
1286 + */
1287 + xhci_cancel_cmd_in_cd_list(xhci);
1288 +
1289 + xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
1290 + /*
1291 + * ring command ring doorbell again to restart the
1292 + * command ring
1293 + */
1294 + if (xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue)
1295 + xhci_ring_cmd_db(xhci);
1296 + }
1297 + return cur_trb_is_good;
1298 +}
1299 +
1300 static void handle_cmd_completion(struct xhci_hcd *xhci,
1301 struct xhci_event_cmd *event)
1302 {
1303 @@ -1111,6 +1365,22 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
1304 xhci->error_bitmask |= 1 << 5;
1305 return;
1306 }
1307 +
1308 + if ((GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_ABORT) ||
1309 + (GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_STOP)) {
1310 + /* If the return value is 0, we think the trb pointed by
1311 + * command ring dequeue pointer is a good trb. The good
1312 + * trb means we don't want to cancel the trb, but it have
1313 + * been stopped by host. So we should handle it normally.
1314 + * Otherwise, driver should invoke inc_deq() and return.
1315 + */
1316 + if (handle_stopped_cmd_ring(xhci,
1317 + GET_COMP_CODE(le32_to_cpu(event->status)))) {
1318 + inc_deq(xhci, xhci->cmd_ring);
1319 + return;
1320 + }
1321 + }
1322 +
1323 switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
1324 & TRB_TYPE_BITMASK) {
1325 case TRB_TYPE(TRB_ENABLE_SLOT):
1326 @@ -3400,7 +3670,9 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
1327 } else {
1328 td->last_trb = ep_ring->enqueue;
1329 field |= TRB_IOC;
1330 - if (xhci->hci_version == 0x100) {
1331 + if (xhci->hci_version == 0x100 &&
1332 + !(xhci->quirks &
1333 + XHCI_AVOID_BEI)) {
1334 /* Set BEI bit except for the last td */
1335 if (i < num_tds - 1)
1336 field |= TRB_BEI;
1337 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
1338 index 6467d79..f756231 100644
1339 --- a/drivers/usb/host/xhci.c
1340 +++ b/drivers/usb/host/xhci.c
1341 @@ -52,7 +52,7 @@ MODULE_PARM_DESC(link_quirk, "Don't clear the chain bit on a link TRB");
1342 * handshake done). There are two failure modes: "usec" have passed (major
1343 * hardware flakeout), or the register reads as all-ones (hardware removed).
1344 */
1345 -static int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
1346 +int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
1347 u32 mask, u32 done, int usec)
1348 {
1349 u32 result;
1350 @@ -105,9 +105,10 @@ int xhci_halt(struct xhci_hcd *xhci)
1351
1352 ret = handshake(xhci, &xhci->op_regs->status,
1353 STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC);
1354 - if (!ret)
1355 + if (!ret) {
1356 xhci->xhc_state |= XHCI_STATE_HALTED;
1357 - else
1358 + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
1359 + } else
1360 xhci_warn(xhci, "Host not halted after %u microseconds.\n",
1361 XHCI_MAX_HALT_USEC);
1362 return ret;
1363 @@ -470,6 +471,8 @@ static bool compliance_mode_recovery_timer_quirk_check(void)
1364
1365 dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
1366 dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
1367 + if (!dmi_product_name || !dmi_sys_vendor)
1368 + return false;
1369
1370 if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
1371 return false;
1372 @@ -581,6 +584,7 @@ static int xhci_run_finished(struct xhci_hcd *xhci)
1373 return -ENODEV;
1374 }
1375 xhci->shared_hcd->state = HC_STATE_RUNNING;
1376 + xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
1377
1378 if (xhci->quirks & XHCI_NEC_HOST)
1379 xhci_ring_cmd_db(xhci);
1380 @@ -886,7 +890,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
1381 command &= ~CMD_RUN;
1382 xhci_writel(xhci, command, &xhci->op_regs->command);
1383 if (handshake(xhci, &xhci->op_regs->status,
1384 - STS_HALT, STS_HALT, 100*100)) {
1385 + STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC)) {
1386 xhci_warn(xhci, "WARN: xHC CMD_RUN timeout\n");
1387 spin_unlock_irq(&xhci->lock);
1388 return -ETIMEDOUT;
1389 @@ -2521,6 +2525,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
1390 struct completion *cmd_completion;
1391 u32 *cmd_status;
1392 struct xhci_virt_device *virt_dev;
1393 + union xhci_trb *cmd_trb;
1394
1395 spin_lock_irqsave(&xhci->lock, flags);
1396 virt_dev = xhci->devs[udev->slot_id];
1397 @@ -2566,6 +2571,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
1398 }
1399 init_completion(cmd_completion);
1400
1401 + cmd_trb = xhci->cmd_ring->dequeue;
1402 if (!ctx_change)
1403 ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
1404 udev->slot_id, must_succeed);
1405 @@ -2587,14 +2593,17 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
1406 /* Wait for the configure endpoint command to complete */
1407 timeleft = wait_for_completion_interruptible_timeout(
1408 cmd_completion,
1409 - USB_CTRL_SET_TIMEOUT);
1410 + XHCI_CMD_DEFAULT_TIMEOUT);
1411 if (timeleft <= 0) {
1412 xhci_warn(xhci, "%s while waiting for %s command\n",
1413 timeleft == 0 ? "Timeout" : "Signal",
1414 ctx_change == 0 ?
1415 "configure endpoint" :
1416 "evaluate context");
1417 - /* FIXME cancel the configure endpoint command */
1418 + /* cancel the configure endpoint command */
1419 + ret = xhci_cancel_cmd(xhci, command, cmd_trb);
1420 + if (ret < 0)
1421 + return ret;
1422 return -ETIME;
1423 }
1424
1425 @@ -3543,8 +3552,10 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
1426 unsigned long flags;
1427 int timeleft;
1428 int ret;
1429 + union xhci_trb *cmd_trb;
1430
1431 spin_lock_irqsave(&xhci->lock, flags);
1432 + cmd_trb = xhci->cmd_ring->dequeue;
1433 ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
1434 if (ret) {
1435 spin_unlock_irqrestore(&xhci->lock, flags);
1436 @@ -3556,12 +3567,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
1437
1438 /* XXX: how much time for xHC slot assignment? */
1439 timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
1440 - USB_CTRL_SET_TIMEOUT);
1441 + XHCI_CMD_DEFAULT_TIMEOUT);
1442 if (timeleft <= 0) {
1443 xhci_warn(xhci, "%s while waiting for a slot\n",
1444 timeleft == 0 ? "Timeout" : "Signal");
1445 - /* FIXME cancel the enable slot request */
1446 - return 0;
1447 + /* cancel the enable slot request */
1448 + return xhci_cancel_cmd(xhci, NULL, cmd_trb);
1449 }
1450
1451 if (!xhci->slot_id) {
1452 @@ -3622,6 +3633,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
1453 struct xhci_slot_ctx *slot_ctx;
1454 struct xhci_input_control_ctx *ctrl_ctx;
1455 u64 temp_64;
1456 + union xhci_trb *cmd_trb;
1457
1458 if (!udev->slot_id) {
1459 xhci_dbg(xhci, "Bad Slot ID %d\n", udev->slot_id);
1460 @@ -3660,6 +3672,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
1461 xhci_dbg_ctx(xhci, virt_dev->in_ctx, 2);
1462
1463 spin_lock_irqsave(&xhci->lock, flags);
1464 + cmd_trb = xhci->cmd_ring->dequeue;
1465 ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
1466 udev->slot_id);
1467 if (ret) {
1468 @@ -3672,7 +3685,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
1469
1470 /* ctrl tx can take up to 5 sec; XXX: need more time for xHC? */
1471 timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
1472 - USB_CTRL_SET_TIMEOUT);
1473 + XHCI_CMD_DEFAULT_TIMEOUT);
1474 /* FIXME: From section 4.3.4: "Software shall be responsible for timing
1475 * the SetAddress() "recovery interval" required by USB and aborting the
1476 * command on a timeout.
1477 @@ -3680,7 +3693,10 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
1478 if (timeleft <= 0) {
1479 xhci_warn(xhci, "%s while waiting for address device command\n",
1480 timeleft == 0 ? "Timeout" : "Signal");
1481 - /* FIXME cancel the address device command */
1482 + /* cancel the address device command */
1483 + ret = xhci_cancel_cmd(xhci, NULL, cmd_trb);
1484 + if (ret < 0)
1485 + return ret;
1486 return -ETIME;
1487 }
1488
1489 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
1490 index 6e77f3b..5361fd8 100644
1491 --- a/drivers/usb/host/xhci.h
1492 +++ b/drivers/usb/host/xhci.h
1493 @@ -1252,6 +1252,16 @@ struct xhci_td {
1494 union xhci_trb *last_trb;
1495 };
1496
1497 +/* xHCI command default timeout value */
1498 +#define XHCI_CMD_DEFAULT_TIMEOUT (5 * HZ)
1499 +
1500 +/* command descriptor */
1501 +struct xhci_cd {
1502 + struct list_head cancel_cmd_list;
1503 + struct xhci_command *command;
1504 + union xhci_trb *cmd_trb;
1505 +};
1506 +
1507 struct xhci_dequeue_state {
1508 struct xhci_segment *new_deq_seg;
1509 union xhci_trb *new_deq_ptr;
1510 @@ -1417,6 +1427,11 @@ struct xhci_hcd {
1511 /* data structures */
1512 struct xhci_device_context_array *dcbaa;
1513 struct xhci_ring *cmd_ring;
1514 + unsigned int cmd_ring_state;
1515 +#define CMD_RING_STATE_RUNNING (1 << 0)
1516 +#define CMD_RING_STATE_ABORTED (1 << 1)
1517 +#define CMD_RING_STATE_STOPPED (1 << 2)
1518 + struct list_head cancel_cmd_list;
1519 unsigned int cmd_ring_reserved_trbs;
1520 struct xhci_ring *event_ring;
1521 struct xhci_erst erst;
1522 @@ -1488,6 +1503,7 @@ struct xhci_hcd {
1523 #define XHCI_TRUST_TX_LENGTH (1 << 10)
1524 #define XHCI_SPURIOUS_REBOOT (1 << 13)
1525 #define XHCI_COMP_MODE_QUIRK (1 << 14)
1526 +#define XHCI_AVOID_BEI (1 << 15)
1527 unsigned int num_active_eps;
1528 unsigned int limit_active_eps;
1529 /* There are two roothubs to keep track of bus suspend info for */
1530 @@ -1694,6 +1710,8 @@ static inline void xhci_unregister_plat(void)
1531
1532 /* xHCI host controller glue */
1533 typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *);
1534 +int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
1535 + u32 mask, u32 done, int usec);
1536 void xhci_quiesce(struct xhci_hcd *xhci);
1537 int xhci_halt(struct xhci_hcd *xhci);
1538 int xhci_reset(struct xhci_hcd *xhci);
1539 @@ -1784,6 +1802,8 @@ void xhci_queue_config_ep_quirk(struct xhci_hcd *xhci,
1540 unsigned int slot_id, unsigned int ep_index,
1541 struct xhci_dequeue_state *deq_state);
1542 void xhci_stop_endpoint_command_watchdog(unsigned long arg);
1543 +int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
1544 + union xhci_trb *cmd_trb);
1545 void xhci_ring_ep_doorbell(struct xhci_hcd *xhci, unsigned int slot_id,
1546 unsigned int ep_index, unsigned int stream_id);
1547
1548 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
1549 index 4d2b7d3..25bb935 100644
1550 --- a/drivers/usb/serial/ftdi_sio.c
1551 +++ b/drivers/usb/serial/ftdi_sio.c
1552 @@ -584,6 +584,8 @@ static struct usb_device_id id_table_combined [] = {
1553 { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
1554 { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
1555 { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
1556 + { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID),
1557 + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
1558 /*
1559 * ELV devices:
1560 */
1561 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
1562 index 41fe582..57c12ef 100644
1563 --- a/drivers/usb/serial/ftdi_sio_ids.h
1564 +++ b/drivers/usb/serial/ftdi_sio_ids.h
1565 @@ -517,6 +517,11 @@
1566 */
1567 #define FTDI_TAVIR_STK500_PID 0xFA33 /* STK500 AVR programmer */
1568
1569 +/*
1570 + * TIAO product ids (FTDI_VID)
1571 + * http://www.tiaowiki.com/w/Main_Page
1572 + */
1573 +#define FTDI_TIAO_UMPA_PID 0x8a98 /* TIAO/DIYGADGET USB Multi-Protocol Adapter */
1574
1575
1576 /********************************/
1577 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
1578 index a49099d..57de734 100644
1579 --- a/drivers/usb/serial/option.c
1580 +++ b/drivers/usb/serial/option.c
1581 @@ -870,7 +870,8 @@ static const struct usb_device_id option_ids[] = {
1582 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
1583 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
1584 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
1585 - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
1586 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff),
1587 + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
1588 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
1589 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
1590 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
1591 diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
1592 index 9662456..b223381 100644
1593 --- a/drivers/usb/serial/qcaux.c
1594 +++ b/drivers/usb/serial/qcaux.c
1595 @@ -36,8 +36,6 @@
1596 #define UTSTARCOM_PRODUCT_UM175_V1 0x3712
1597 #define UTSTARCOM_PRODUCT_UM175_V2 0x3714
1598 #define UTSTARCOM_PRODUCT_UM175_ALLTEL 0x3715
1599 -#define PANTECH_PRODUCT_UML190_VZW 0x3716
1600 -#define PANTECH_PRODUCT_UML290_VZW 0x3718
1601
1602 /* CMOTECH devices */
1603 #define CMOTECH_VENDOR_ID 0x16d8
1604 @@ -68,11 +66,9 @@ static struct usb_device_id id_table[] = {
1605 { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
1606 { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
1607 { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
1608 - { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xff, 0xff) },
1609 - { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xfe, 0xff) },
1610 - { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfd, 0xff) }, /* NMEA */
1611 - { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfe, 0xff) }, /* WMC */
1612 - { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) }, /* DIAG */
1613 + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfd, 0xff) }, /* NMEA */
1614 + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfe, 0xff) }, /* WMC */
1615 + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xff, 0xff) }, /* DIAG */
1616 { },
1617 };
1618 MODULE_DEVICE_TABLE(usb, id_table);
1619 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
1620 index 16f7354..a009b9e 100644
1621 --- a/fs/binfmt_elf.c
1622 +++ b/fs/binfmt_elf.c
1623 @@ -1698,30 +1698,19 @@ static int elf_note_info_init(struct elf_note_info *info)
1624 return 0;
1625 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1626 if (!info->psinfo)
1627 - goto notes_free;
1628 + return 0;
1629 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1630 if (!info->prstatus)
1631 - goto psinfo_free;
1632 + return 0;
1633 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1634 if (!info->fpu)
1635 - goto prstatus_free;
1636 + return 0;
1637 #ifdef ELF_CORE_COPY_XFPREGS
1638 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1639 if (!info->xfpu)
1640 - goto fpu_free;
1641 + return 0;
1642 #endif
1643 return 1;
1644 -#ifdef ELF_CORE_COPY_XFPREGS
1645 - fpu_free:
1646 - kfree(info->fpu);
1647 -#endif
1648 - prstatus_free:
1649 - kfree(info->prstatus);
1650 - psinfo_free:
1651 - kfree(info->psinfo);
1652 - notes_free:
1653 - kfree(info->notes);
1654 - return 0;
1655 }
1656
1657 static int fill_note_info(struct elfhdr *elf, int phdrs,
1658 diff --git a/fs/dcache.c b/fs/dcache.c
1659 index 10fab26..f104945 100644
1660 --- a/fs/dcache.c
1661 +++ b/fs/dcache.c
1662 @@ -1116,6 +1116,8 @@ positive:
1663 return 1;
1664
1665 rename_retry:
1666 + if (locked)
1667 + goto again;
1668 locked = 1;
1669 write_seqlock(&rename_lock);
1670 goto again;
1671 @@ -1218,6 +1220,8 @@ out:
1672 rename_retry:
1673 if (found)
1674 return found;
1675 + if (locked)
1676 + goto again;
1677 locked = 1;
1678 write_seqlock(&rename_lock);
1679 goto again;
1680 @@ -2963,6 +2967,8 @@ resume:
1681 return;
1682
1683 rename_retry:
1684 + if (locked)
1685 + goto again;
1686 locked = 1;
1687 write_seqlock(&rename_lock);
1688 goto again;
1689 diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
1690 index 19ca550..bf7934f 100644
1691 --- a/include/linux/pci_ids.h
1692 +++ b/include/linux/pci_ids.h
1693 @@ -1846,7 +1846,6 @@
1694 #define PCI_DEVICE_ID_SIIG_8S_20x_650 0x2081
1695 #define PCI_DEVICE_ID_SIIG_8S_20x_850 0x2082
1696 #define PCI_SUBDEVICE_ID_SIIG_QUARTET_SERIAL 0x2050
1697 -#define PCI_SUBDEVICE_ID_SIIG_DUAL_SERIAL 0x2530
1698
1699 #define PCI_VENDOR_ID_RADISYS 0x1331
1700
1701 diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
1702 index 5737238..1d6bf24 100644
1703 --- a/security/yama/yama_lsm.c
1704 +++ b/security/yama/yama_lsm.c
1705 @@ -138,7 +138,7 @@ static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
1706 if (arg2 == 0) {
1707 yama_ptracer_del(NULL, myself);
1708 rc = 0;
1709 - } else if (arg2 == PR_SET_PTRACER_ANY) {
1710 + } else if (arg2 == PR_SET_PTRACER_ANY || (int)arg2 == -1) {
1711 rc = yama_ptracer_add(NULL, myself);
1712 } else {
1713 struct task_struct *tracer;
1714 diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
1715 index d9834b3..2984ffb 100644
1716 --- a/tools/hv/hv_kvp_daemon.c
1717 +++ b/tools/hv/hv_kvp_daemon.c
1718 @@ -106,7 +106,7 @@ static void kvp_acquire_lock(int pool)
1719
1720 if (fcntl(kvp_file_info[pool].fd, F_SETLKW, &fl) == -1) {
1721 syslog(LOG_ERR, "Failed to acquire the lock pool: %d", pool);
1722 - exit(-1);
1723 + exit(EXIT_FAILURE);
1724 }
1725 }
1726
1727 @@ -118,7 +118,7 @@ static void kvp_release_lock(int pool)
1728 if (fcntl(kvp_file_info[pool].fd, F_SETLK, &fl) == -1) {
1729 perror("fcntl");
1730 syslog(LOG_ERR, "Failed to release the lock pool: %d", pool);
1731 - exit(-1);
1732 + exit(EXIT_FAILURE);
1733 }
1734 }
1735
1736 @@ -137,14 +137,19 @@ static void kvp_update_file(int pool)
1737 if (!filep) {
1738 kvp_release_lock(pool);
1739 syslog(LOG_ERR, "Failed to open file, pool: %d", pool);
1740 - exit(-1);
1741 + exit(EXIT_FAILURE);
1742 }
1743
1744 bytes_written = fwrite(kvp_file_info[pool].records,
1745 sizeof(struct kvp_record),
1746 kvp_file_info[pool].num_records, filep);
1747
1748 - fflush(filep);
1749 + if (ferror(filep) || fclose(filep)) {
1750 + kvp_release_lock(pool);
1751 + syslog(LOG_ERR, "Failed to write file, pool: %d", pool);
1752 + exit(EXIT_FAILURE);
1753 + }
1754 +
1755 kvp_release_lock(pool);
1756 }
1757
1758 @@ -163,14 +168,19 @@ static void kvp_update_mem_state(int pool)
1759 if (!filep) {
1760 kvp_release_lock(pool);
1761 syslog(LOG_ERR, "Failed to open file, pool: %d", pool);
1762 - exit(-1);
1763 + exit(EXIT_FAILURE);
1764 }
1765 - while (!feof(filep)) {
1766 + for (;;) {
1767 readp = &record[records_read];
1768 records_read += fread(readp, sizeof(struct kvp_record),
1769 ENTRIES_PER_BLOCK * num_blocks,
1770 filep);
1771
1772 + if (ferror(filep)) {
1773 + syslog(LOG_ERR, "Failed to read file, pool: %d", pool);
1774 + exit(EXIT_FAILURE);
1775 + }
1776 +
1777 if (!feof(filep)) {
1778 /*
1779 * We have more data to read.
1780 @@ -180,7 +190,7 @@ static void kvp_update_mem_state(int pool)
1781
1782 if (record == NULL) {
1783 syslog(LOG_ERR, "malloc failed");
1784 - exit(-1);
1785 + exit(EXIT_FAILURE);
1786 }
1787 continue;
1788 }
1789 @@ -191,6 +201,7 @@ static void kvp_update_mem_state(int pool)
1790 kvp_file_info[pool].records = record;
1791 kvp_file_info[pool].num_records = records_read;
1792
1793 + fclose(filep);
1794 kvp_release_lock(pool);
1795 }
1796 static int kvp_file_init(void)
1797 @@ -208,7 +219,7 @@ static int kvp_file_init(void)
1798 if (access("/var/opt/hyperv", F_OK)) {
1799 if (mkdir("/var/opt/hyperv", S_IRUSR | S_IWUSR | S_IROTH)) {
1800 syslog(LOG_ERR, " Failed to create /var/opt/hyperv");
1801 - exit(-1);
1802 + exit(EXIT_FAILURE);
1803 }
1804 }
1805
1806 @@ -232,12 +243,18 @@ static int kvp_file_init(void)
1807 fclose(filep);
1808 return 1;
1809 }
1810 - while (!feof(filep)) {
1811 + for (;;) {
1812 readp = &record[records_read];
1813 records_read += fread(readp, sizeof(struct kvp_record),
1814 ENTRIES_PER_BLOCK,
1815 filep);
1816
1817 + if (ferror(filep)) {
1818 + syslog(LOG_ERR, "Failed to read file, pool: %d",
1819 + i);
1820 + exit(EXIT_FAILURE);
1821 + }
1822 +
1823 if (!feof(filep)) {
1824 /*
1825 * We have more data to read.
1826 @@ -657,13 +674,13 @@ int main(void)
1827
1828 if (kvp_file_init()) {
1829 syslog(LOG_ERR, "Failed to initialize the pools");
1830 - exit(-1);
1831 + exit(EXIT_FAILURE);
1832 }
1833
1834 fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
1835 if (fd < 0) {
1836 syslog(LOG_ERR, "netlink socket creation failed; error:%d", fd);
1837 - exit(-1);
1838 + exit(EXIT_FAILURE);
1839 }
1840 addr.nl_family = AF_NETLINK;
1841 addr.nl_pad = 0;
1842 @@ -675,7 +692,7 @@ int main(void)
1843 if (error < 0) {
1844 syslog(LOG_ERR, "bind failed; error:%d", error);
1845 close(fd);
1846 - exit(-1);
1847 + exit(EXIT_FAILURE);
1848 }
1849 sock_opt = addr.nl_groups;
1850 setsockopt(fd, 270, 1, &sock_opt, sizeof(sock_opt));
1851 @@ -695,7 +712,7 @@ int main(void)
1852 if (len < 0) {
1853 syslog(LOG_ERR, "netlink_send failed; error:%d", len);
1854 close(fd);
1855 - exit(-1);
1856 + exit(EXIT_FAILURE);
1857 }
1858
1859 pfd.fd = fd;
1860 @@ -863,7 +880,7 @@ kvp_done:
1861 len = netlink_send(fd, incoming_cn_msg);
1862 if (len < 0) {
1863 syslog(LOG_ERR, "net_link send failed; error:%d", len);
1864 - exit(-1);
1865 + exit(EXIT_FAILURE);
1866 }
1867 }
1868

  ViewVC Help
Powered by ViewVC 1.1.20