-----BEGIN PGP SIGNATURE-----
iQIcBAABAgAGBQJZ/kCIAAoJEE44bZycYXAvRXwQAIZY4bXFnlvl8qJZLd8GV6gT
8FErDT14eHKBXZUe1a4TFFJ4FU/dVWfPEPJf2k/aotqjwEysxy5MhOApun12ZbF4
nL6ahNemhNxdIRQFVKBw6HCLyqNwbeBSD3ycLd6FNio4Xxz+3UHO1hoVEbTPSGOf
XD+100wsV3CHvoCnkmoGXH4PiD1zaNVPwJEh4Fu6yVJQPXDilszTNZgVv4oujhsZ
zp7Si3SpttfojkOcWgyqrV7jg2ALZxagf4SZ0KbbpwM/5fKEpYtC3sDDE3HyvcVm
CN0ApTIg7xnuaPsDMwHU9EGLVwlAZEAeiWtR2Byg1YoRQ7mEP9PfkP9xJv9YPxvP
Ovy7CqezRFjjscVsvrWScFaVtsdYbnT9e5uw2N3yLimHEKy+37x333gLCpbr+/0c
gsJMJMYTiq1MYUTpa+qf+rB0lQVo972+7FsjOs4ovdy+IJrpgMnKaL6U8drOns7t
Nmyf1cZTC6YPELnEA8LiRCRsi26HHA6Tknu8Nu2/uOEjeYD0y9iVivptwDB2W35Q
cECNGSJ85qCob73WDYB5ErGQCTwIm0PTdjzEvjCTxRooT164uhzfr0BdIWhIsdV5
uPNnkTYj3PkDlMGHhjVARI32In/VQyuf7hsugpVPn4/wKZV3jGJ/rMugAR2eSfTn
TFrKUsUdH0DYPZKgIhh8
=wa9B
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqfQ0ACgkQmXOSYMts
txZ98RAAjyab1BYfLJMVklDBqzIIWnBqniRPOCReTZ3f+4KDwFVPl5wVT89DHci/
ooIonHqI1BKKuYDIgTL7idK6vGTFo6bTpUT8FZvsjU0V3mFYySA4Yo9aC5G6nXW9
w/dkaOpX1jtkMTukiAqENryBDs7gYXZ0sbqxnq7pgrnnDepVUStZ7ncoWYdxOADG
E6Mirskj5fE/MHsVAenYtVmJVFDlvj6P04MT5bGL9e5EIz5CP3ekOqasdsBWj6rE
yg1JOaH6eOsgSCsP7M9dGxYglKH9nfkJHRnlU3HbXrRdSupTRvs8zC6u9W0DDI2g
XlrDTIM2UAM1hhRFMhly41o+8zpGHTi8puLJsNYL6bRM33V678dNrnEr/xnzNGpR
QwC38JWJYymGTkUtW7J1T/GVlWbsF17/fJ5EBG9hSHphrtSjP0nF1i1dAo/MI6hb
IY+MxVzO3CTZ22Bwjg9DNz56V+RUg56xy//sHSz3GoI6kuFt4tYzwNmLf0Fkj5VJ
lEI6vDYW/YTlWFFGdNaycvVwj+uETKepx0MIPx2Xt/mY3YNPwMUA2EBfjew+6709
cbTkn/XxcIZTzZmqKsZ/wZkDK7hKatdlxbcqI2tzidL03MfC3nK83L3YGrJnpbXd
TU/kR3CWWFVgG574B24ssutT4nrYeHUBp+xGDcQSnwbmihig6NU=
=pENk
-----END PGP SIGNATURE-----
Merge 3.10.108 into android-msm-bullhead-3.10-oreo-m5
Changes in 3.10.108: (141 commits)
ipvs: SNAT packet replies only for NATed connections
net: reduce skb_warn_bad_offload() noise
net: skb_needs_check() accepts CHECKSUM_NONE for tx
Staging: comedi: comedi_fops: Avoid orphaned proc entry
udp: consistently apply ufo or fragmentation
Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket
Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
tcp: introduce tcp_rto_delta_us() helper for xmit timer fix
tcp: enable xmit timer fix by having TLP use time when RTO should fire
tcp: fix xmit timer to only be reset if data ACKed/SACKed
mm/page_alloc: Remove kernel address exposure in free_reserved_area()
leak in O_DIRECT readv past the EOF
usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle
usb: renesas_usbhs: fix the sequence in xfer_work()
usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
fs/exec.c: account for argv/envp pointers
rxrpc: Fix several cases where a padded len isn't checked in ticket decode
xfrm: policy: check policy direction value
nl80211: check for the required netlink attributes presence
ALSA: seq: Fix use-after-free at creating a port
MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
serial: ifx6x60: fix use-after-free on module unload
KEYS: fix dereferencing NULL payload with nonzero length
usb: chipidea: debug: check before accessing ci_role
cpufreq: conservative: Allow down_threshold to take values from 1 to 10
powerpc/kprobes: Pause function_graph tracing during jprobes handling
staging: comedi: fix clean-up of comedi_class in comedi_init()
brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
vt: fix unchecked __put_user() in tioclinux ioctls
crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
PM / Domains: Fix unsafe iteration over modified list of device links
powerpc/64: Fix atomic64_inc_not_zero() to return an int
powerpc: Fix emulation of mfocrf in emulate_step()
powerpc/asm: Mark cr0 as clobbered in mftb()
usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
MIPS: Fix unaligned PC interpretation in `compute_return_epc'
MIPS: math-emu: Prevent wrong ISA mode instruction emulation
libata: array underflow in ata_find_dev()
workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
ext4: fix overflow caused by missing cast in ext4_resize_fs()
media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
target: Avoid mappedlun symlink creation during lun shutdown
fuse: initialize the flock flag in fuse_file on allocation
scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled
scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path
scsi: zfcp: fix missing trace records for early returns in TMF eh handlers
scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records
scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
iommu/amd: Finish TLB flush in amd_iommu_unmap()
direct-io: Prevent NULL pointer access in submit_page_section
USB: serial: console: fix use-after-free after failed setup
KEYS: don't let add_key() update an uninstantiated key
FS-Cache: fix dereference of NULL user_key_payload
ext4: keep existing extra fields when inode expands
MIPS: Fix mips_atomic_set() retry condition
KEYS: prevent creating a different user's keyrings
KEYS: encrypted: fix dereference of NULL user_key_payload
md/bitmap: disable bitmap_resize for file-backed bitmaps.
lib/digsig: fix dereference of NULL user_key_payload
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
md/raid10: submit bio directly to replacement disk
md: fix super_offset endianness in super_1_rdev_size_change
lib/cmdline.c: fix get_options() overflow while parsing ranges
ext4: fix SEEK_HOLE
net: prevent sign extension in dev_get_stats()
kernel/extable.c: mark core_kernel_text notrace
wext: handle NULL extra data in iwe_stream_add_point better
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
ext4: avoid deadlock when expanding inode size
sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
tcp: disallow cwnd undo when switching congestion control
netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
tcp: reset sk_rx_dst in tcp_disconnect()
tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states
tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
net/packet: check length in getsockopt() called with PACKET_HDRLEN
net: Set sk_prot_creator when cloning sockets to the right proto
net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs
net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl
kvm: async_pf: fix rcu_irq_enter() with irqs enabled
net: ping: do not abuse udp_poll()
scsi: qla2xxx: don't disable a not previously enabled PCI device
drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
net: xilinx_emaclite: fix receive buffer overflow
serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
pvrusb2: reduce stack usage pvr2_eeprom_analyze()
usb: r8a66597-hcd: select a different endpoint on timeout
usb: r8a66597-hcd: decrease timeout
drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
net: phy: fix marvell phy status reading
net: korina: Fix NAPI versus resources freeing
xfrm: NULL dereference on allocation failure
xfrm: Oops on error in pfkey_msg2xfrm_state()
cpufreq: s3c2416: double free on driver init error path
KVM: x86: zero base3 of unusable segments
KEYS: Fix an error code in request_master_key()
ipv6: avoid unregistering inet6_dev for loopback
cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
cfg80211: Check if PMKID attribute is of expected size
mm: fix overflow check in expand_upwards()
crypto: caam - fix signals handling
ir-core: fix gcc-7 warning on bool arithmetic
udf: Fix deadlock between writeback and udf_setsize()
perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
net/mlx4: Remove BUG_ON from ICM allocation routine
ipv4: initialize fib_trie prior to register_netdev_notifier call.
workqueue: implicit ordered attribute should be overridable
packet: fix tp_reserve race in packet_set_ring
staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
ALSA: core: Fix unexpected error at replacing user TLV
ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal
qlge: avoid memcpy buffer overflow
ipv6: fix memory leak with multiple tables during netns destruction
ipv6: fix typo in fib6_net_exit()
ip6_gre: fix endianness errors in ip6gre_err
crypto: AF_ALG - remove SGL terminator indicator when chaining
scsi: qla2xxx: Fix an integer overflow in sysfs code
tracing: Apply trace_clock changes to instance max buffer
tracing: Erase irqsoff trace with empty write
btrfs: prevent to set invalid default subvolid
IB/ipoib: rtnl_unlock can not come after free_netdev
team: fix memory leaks
IB/qib: fix false-postive maybe-uninitialized warning
KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
scsi: scsi_dh_emc: return success in clariion_std_inquiry()
can: esd_usb2: Fix can_dlc value for received RTR, frames
x86/apic: fix build breakage caused by incomplete backport to 3.10
Linux 3.10.108
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQIcBAABAgAGBQJYnZNdAAoJEE44bZycYXAvJv0P/jpPc+jKb+D0FVUOiYDkY5Rw
jxsZ3oeruTIeSFAAIzusVMLm9moBJA6DThuTHU5Kt68mRaKB2lgmqwkkvQAPTSYh
tnDQwlrF7dOSVmPczJFHalpaLpRdXdQP9r8y+38PibaFZPssKdnZr3BBfdOdi5DT
lj029AGKfG7co6Hb/iAhsxuAFfPmvGHY4QNwJ2FRbU1m6MDtmCTbXzF0fc6X5AW1
qrtaWwPulJtZ/5MPk7aFyNpuCpNvIaTEqNaQsZbuz3bHfzDQVLerWze98vgHC0QM
2YOTP6TnEiHhxHGMb9SywUgSV1ylx0X542YDfxmcfyxBWRr0khlxQh1gpX+waqE3
pqdSlvN7AFzifw6kubbG2/XjkNvFtJcDTgrL3qco4utIezSijXmoOsDpKNnJuzk/
kSD5WYd+Q1CSHOkqZX29QPw1Dl/7Ftm7GPfxu7Pis1OBuPByqtRkEfmn9DpiKSs5
Aja0ljZYiQ3jy3fH+WlEzo6PVSxx0ZxKg0fOShlpgjj8KjMUdGfl9cB1OZxyWnNH
UiQ9iIWd3tJci7WbsBOfawsQpq3EIJxZKjyUmLYpBht5/YenYxOBDCr/CLJDQBGI
IQUPAs/E1JGDxGTUY3AmsaMVrcX2yOfhLzjrsVJGqSdote0um+2PdTLZHE4MMiz2
Dh6CbUVYWS1KNgmQ8T8L
=k5mW
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqeiwACgkQmXOSYMts
txaBAQ/+KqZh90YZI+gRHGdczbo3XnlryHMdpp+DTIFtN3zU+2LM352oP+haoJfr
YhNsixcMhW5TX0is5fg4SkIc0B3ooGKZLVKOPIRw+1NLBAVG5yVuYxW7I1faJgk6
F37+4rvq7KAOPCNMjAEXRt7GqZ4WZjgvgKy+u5wzKh3k5kUylqDwlP2qdgx2L5Rc
IxyxgOuaVGV6dZTyAyRlRMild5Tlz+SMY4pWoMe0sulDDXhd5/5PnGNVIgh+XqB6
m0AGkIIzPVe+wmg6n1iYs93dQO0Jmu6DL47Zv4f3ASZNL/XVSLvU9ie63FyWGZXG
e52qAPtztXInEOo15vPQSAAq7McZHDTzhHhsU/ZtkBT+LeSUU+rsxXddJ2EO5UgC
O3cVm11x1FWMzbBtFNFtkqeri2Y2OxvU4O81mfNP1oOUQBTMeSHTzQ8psbCdXeEr
ktSOtI+nakPmDE3aq4YSaz7BwSgt2tU/vZehkrTxtAQJxt0b88r2xFfThy5WScT1
v6muoqxlprjjvFld7v99P8cXxJq4QrxKUxXtEBTdB79Q5xtCC29OAcTelpPFDCED
/KpgZflubzH/Z872AW9Ru8OL9PYty6hBNDOP4aHLSFWfCu3KQxL6BMEeqi5qBjBX
mJ8JT0dCQYP6xONIWq6a3fICroNMazhNFxdpPSfsQFRhujhjGPg=
=zhKv
-----END PGP SIGNATURE-----
Merge 3.10.105 into android-msm-bullhead-3.10-oreo-m5
Changes in 3.10.105: (315 commits)
sched/core: Fix a race between try_to_wake_up() and a woken up task
sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule()
crypto: algif_skcipher - Require setkey before accept(2)
crypto: af_alg - Disallow bind/setkey/... after accept(2)
crypto: af_alg - Add nokey compatibility path
crypto: algif_skcipher - Add nokey compatibility path
crypto: hash - Add crypto_ahash_has_setkey
crypto: shash - Fix has_key setting
crypto: algif_hash - Require setkey before accept(2)
crypto: skcipher - Add crypto_skcipher_has_setkey
crypto: algif_skcipher - Add key check exception for cipher_null
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
crypto: algif_hash - Remove custom release parent function
crypto: algif_skcipher - Remove custom release parent function
crypto: af_alg - Forbid bind(2) when nokey child sockets are present
crypto: algif_hash - Fix race condition in hash_check_key
crypto: algif_skcipher - Fix race condition in skcipher_check_key
crypto: algif_skcipher - Load TX SG list after waiting
crypto: cryptd - initialize child shash_desc on import
crypto: skcipher - Fix blkcipher walk OOM crash
crypto: gcm - Fix IV buffer size in crypto_gcm_setkey
MIPS: KVM: Fix unused variable build warning
KVM: MIPS: Precalculate MMIO load resume PC
KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write
KVM: MIPS: Make ERET handle ERL before EXL
KVM: x86: fix wbinvd_dirty_mask use-after-free
KVM: x86: fix missed SRCU usage in kvm_lapic_set_vapic_addr
KVM: Disable irq while unregistering user notifier
PM / devfreq: Fix incorrect type issue.
ppp: defer netns reference release for ppp channel
x86/mm/xen: Suppress hugetlbfs in PV guests
xen: Add RING_COPY_REQUEST()
xen-netback: don't use last request to determine minimum Tx credit
xen-netback: use RING_COPY_REQUEST() throughout
xen-blkback: only read request operation from shared ring once
xen/pciback: Save xen_pci_op commands before processing it
xen/pciback: Save the number of MSI-X entries to be copied later.
xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled
xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
xen/pciback: Do not install an IRQ handler for MSI interrupts.
xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled.
xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.
xen-pciback: Add name prefix to global 'permissive' variable
x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()
x86/traps: Ignore high word of regs->cs in early_idt_handler_common
x86/mm: Disable preemption during CR3 read+write
x86/apic: Do not init irq remapping if ioapic is disabled
x86/mm/pat, /dev/mem: Remove superfluous error message
x86/paravirt: Do not trace _paravirt_ident_*() functions
x86/build: Build compressed x86 kernels as PIE
x86/um: reuse asm-generic/barrier.h
iommu/amd: Update Alias-DTE in update_device_table()
iommu/amd: Free domain id when free a domain of struct dma_ops_domain
ARM: 8616/1: dt: Respect property size when parsing CPUs
ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7
ARM: sa1100: clear reset status prior to reboot
ARM: sa1111: fix pcmcia suspend/resume
arm64: avoid returning from bad_mode
arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb()
arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP
MIPS: Malta: Fix IOCU disable switch read for MIPS64
MIPS: ptrace: Fix regs_return_value for kernel context
powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET
powerpc/vdso64: Use double word compare on pointers
powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data()
powerpc/64: Fix incorrect return value from __copy_tofrom_user
powerpc/nvram: Fix an incorrect partition merge
avr32: fix copy_from_user()
avr32: fix 'undefined reference to `___copy_from_user'
avr32: off by one in at32_init_pio()
s390/dasd: fix hanging device after clear subchannel
parisc: Ensure consistent state when switching to kernel stack at syscall entry
microblaze: fix __get_user()
microblaze: fix copy_from_user()
mn10300: failing __get_user() and get_user() should zero
m32r: fix __get_user()
sh64: failing __get_user() should zero
score: fix __get_user/get_user
s390: get_user() should zero on failure
ARC: uaccess: get_user to zero out dest in cause of fault
asm-generic: make get_user() clear the destination on errors
frv: fix clear_user()
cris: buggered copy_from_user/copy_to_user/clear_user
blackfin: fix copy_from_user()
score: fix copy_from_user() and friends
sh: fix copy_from_user()
hexagon: fix strncpy_from_user() error return
mips: copy_from_user() must zero the destination on access_ok() failure
asm-generic: make copy_from_user() zero the destination properly
alpha: fix copy_from_user()
metag: copy_from_user() should zero the destination on access_ok() failure
parisc: fix copy_from_user()
openrisc: fix copy_from_user()
openrisc: fix the fix of copy_from_user()
mn10300: copy_from_user() should zero on access_ok() failure...
sparc32: fix copy_from_user()
ppc32: fix copy_from_user()
ia64: copy_from_user() should zero the destination on access_ok() failure
fix fault_in_multipages_...() on architectures with no-op access_ok()
fix memory leaks in tracing_buffers_splice_read()
arc: don't leak bits of kernel stack into coredump
Fix potential infoleak in older kernels
swapfile: fix memory corruption via malformed swapfile
coredump: fix unfreezable coredumping task
usb: dwc3: gadget: increment request->actual once
USB: validate wMaxPacketValue entries in endpoint descriptors
USB: fix typo in wMaxPacketSize validation
usb: xhci: Fix panic if disconnect
USB: serial: fix memleak in driver-registration error path
USB: kobil_sct: fix non-atomic allocation in write path
USB: serial: mos7720: fix non-atomic allocation in write path
USB: serial: mos7840: fix non-atomic allocation in write path
usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition
USB: change bInterval default to 10 ms
usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()
USB: serial: cp210x: fix hardware flow-control disable
usb: misc: legousbtower: Fix NULL pointer deference
usb: gadget: function: u_ether: don't starve tx request queue
USB: serial: cp210x: fix tiocmget error handling
usb: gadget: u_ether: remove interrupt throttling
usb: chipidea: move the lock initialization to core file
Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
ALSA: rawmidi: Fix possible deadlock with virmidi registration
ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
ALSA: timer: fix NULL pointer dereference on memory allocation failure
ALSA: ali5451: Fix out-of-bound position reporting
ALSA: pcm : Call kill_fasync() in stream lock
zfcp: fix fc_host port_type with NPIV
zfcp: fix ELS/GS request&response length for hardware data router
zfcp: close window with unblocked rport during rport gone
zfcp: retain trace level for SCSI and HBA FSF response records
zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace
zfcp: trace on request for open and close of WKA port
zfcp: restore tracing of handle for port and LUN with HBA records
zfcp: fix D_ID field with actual value on tracing SAN responses
zfcp: fix payload trace length for SAN request&response
zfcp: trace full payload of all SAN records (req,resp,iels)
scsi: zfcp: spin_lock_irqsave() is not nestable
scsi: mpt3sas: Fix secure erase premature termination
scsi: mpt3sas: Unblock device after controller reset
scsi: mpt3sas: fix hang on ata passthrough commands
mpt2sas: Fix secure erase premature termination
scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices
scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression
scsi: ibmvfc: Fix I/O hang when port is not mapped
scsi: Fix use-after-free
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded
scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware
ext4: validate that metadata blocks do not overlap superblock
ext4: avoid modifying checksum fields directly during checksum verification
ext4: use __GFP_NOFAIL in ext4_free_blocks()
ext4: reinforce check of i_dtime when clearing high fields of uid and gid
ext4: allow DAX writeback for hole punch
ext4: sanity check the block and cluster size at mount time
reiserfs: fix "new_insert_key may be used uninitialized ..."
reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
xfs: fix superblock inprogress check
libxfs: clean up _calc_dquots_per_chunk
btrfs: ensure that file descriptor used with subvol ioctls is a dir
ocfs2/dlm: fix race between convert and migration
ocfs2: fix start offset to ocfs2_zero_range_for_truncate()
ubifs: Fix assertion in layout_in_gaps()
ubifs: Fix xattr_names length in exit paths
UBIFS: Fix possible memory leak in ubifs_readdir()
ubifs: Abort readdir upon error
ubifs: Fix regression in ubifs_readdir()
UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header
NFSv4.x: Fix a refcount leak in nfs_callback_up_net
NFSD: Using free_conn free connection
NFS: Don't drop CB requests with invalid principals
NFSv4: Open state recovery must account for file permission changes
fs/seq_file: fix out-of-bounds read
fs/super.c: fix race between freeze_super() and thaw_super()
isofs: Do not return EACCES for unknown filesystems
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
driver core: Delete an unnecessary check before the function call "put_device"
driver core: fix race between creating/querying glue dir and its cleanup
drm/radeon: fix radeon_move_blit on 32bit systems
drm: Reject page_flip for !DRIVER_MODESET
drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
qxl: check for kmap failures
Input: i8042 - break load dependency between atkbd/psmouse and i8042
Input: i8042 - set up shared ps2_cmd_mutex for AUX ports
Input: ili210x - fix permissions on "calibrate" attribute
hwrng: exynos - Disable runtime PM on probe failure
hwrng: omap - Fix assumption that runtime_get_sync will always succeed
hwrng: omap - Only fail if pm_runtime_get_sync returns < 0
i2c-eg20t: fix race between i2c init and interrupt enable
em28xx-i2c: rt_mutex_trylock() returns zero on failure
i2c: core: fix NULL pointer dereference under race condition
i2c: at91: fix write transfers by clearing pending interrupt first
iio: accel: kxsd9: Fix raw read return
iio: accel: kxsd9: Fix scaling bug
thermal: hwmon: Properly report critical temperature in sysfs
cdc-acm: fix wrong pipe type on rx interrupt xfers
timers: Use proper base migration in add_timer_on()
EDAC: Increment correct counter in edac_inc_ue_error()
IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
IB/core: Fix use after free in send_leave function
IB/ipoib: Don't allow MC joins during light MC flush
IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV
IB/mlx4: Fix create CQ error flow
IB/uverbs: Fix leak of XRC target QPs
IB/cm: Mark stale CM id's whenever the mad agent was unregistered
mtd: blkdevs: fix potential deadlock + lockdep warnings
mtd: pmcmsp-flash: Allocating too much in init_msp_flash()
mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl
perf symbols: Fixup symbol sizes before picking best ones
perf: Tighten (and fix) the grouping condition
tty: Prevent ldisc drivers from re-using stale tty fields
tty: limit terminal size to 4M chars
tty: vt, fix bogus division in csi_J
vt: clear selection before resizing
drivers/vfio: Rework offsetofend()
include/stddef.h: Move offsetofend() from vfio.h to a generic kernel header
stddef.h: move offsetofend inside #ifndef/#endif guard, neaten
ipv6: don't call fib6_run_gc() until routing is ready
ipv6: split duplicate address detection and router solicitation timer
ipv6: move DAD and addrconf_verify processing to workqueue
ipv6: addrconf: fix dev refcont leak when DAD failed
ipv6: fix rtnl locking in setsockopt for anycast and multicast
ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
ipv6: correctly add local routes when lo goes up
ipv6: dccp: fix out of bound access in dccp_v6_err()
ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped
ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
ip6_tunnel: disable caching when the traffic class is inherited
net/irda: handle iriap_register_lsap() allocation failure
tcp: fix use after free in tcp_xmit_retransmit_queue()
tcp: properly scale window in tcp_v[46]_reqsk_send_ack()
tcp: fix overflow in __tcp_retransmit_skb()
tcp: fix wrong checksum calculation on MTU probing
tcp: take care of truncations done by sk_filter()
bonding: Fix bonding crash
net: ratelimit warnings about dst entry refcount underflow or overflow
mISDN: Support DR6 indication in mISDNipac driver
mISDN: Fixing missing validation in base_sock_bind()
net: disable fragment reassembly if high_thresh is set to zero
ipvs: count pre-established TCP states as active
iwlwifi: pcie: fix access to scratch buffer
svc: Avoid garbage replies when pc_func() returns rpc_drop_reply
brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()
brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()
pstore: Fix buffer overflow while write offset equal to buffer size
net/mlx4_core: Allow resetting VF admin mac to zero
firewire: net: guard against rx buffer overflows
firewire: net: fix fragmented datagram_size off-by-one
netfilter: fix namespace handling in nf_log_proc_dostring
can: bcm: fix warning in bcm_connect/proc_register
net: fix sk_mem_reclaim_partial()
net: avoid sk_forward_alloc overflows
ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
packet: call fanout_release, while UNREGISTERING a netdev
net: sctp, forbid negative length
sctp: validate chunk len before actually using it
net: clear sk_err_soft in sk_clone_lock()
net: mangle zero checksum in skb_checksum_help()
dccp: do not send reset to already closed sockets
dccp: fix out of bound access in dccp_v4_err()
sctp: assign assoc_id earlier in __sctp_connect
neigh: check error pointer instead of NULL for ipv4_neigh_lookup()
ipv4: use new_gw for redirect neigh lookup
mac80211: fix purging multicast PS buffer queue
mac80211: discard multicast and 4-addr A-MSDUs
cfg80211: limit scan results cache size
mwifiex: printk() overflow with 32-byte SSIDs
ipv4: Set skb->protocol properly for local output
net: sky2: Fix shutdown crash
kaweth: fix firmware download
tracing: Move mutex to protect against resetting of seq data
kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd
Revert "ipc/sem.c: optimize sem_lock()"
cfq: fix starvation of asynchronous writes
drbd: Fix kernel_sendmsg() usage - potential NULL deref
lib/genalloc.c: start search from start of chunk
tools/vm/slabinfo: fix an unintentional printf
rcu: Fix soft lockup for rcu_nocb_kthread
ratelimit: fix bug in time interval by resetting right begin time
mfd: core: Fix device reference leak in mfd_clone_cell
PM / sleep: fix device reference leak in test_suspend
mmc: mxs: Initialize the spinlock prior to using it
mmc: block: don't use CMD23 with very old MMC cards
pstore/core: drop cmpxchg based updates
pstore/ram: Use memcpy_toio instead of memcpy
pstore/ram: Use memcpy_fromio() to save old buffer
mb86a20s: fix the locking logic
mb86a20s: fix demod settings
cx231xx: don't return error on success
cx231xx: fix GPIOs for Pixelview SBTVD hybrid
gpio: mpc8xxx: Correct irq handler function
uio: fix dmem_region_start computation
KEYS: Fix short sprintf buffer in /proc/keys show function
hv: do not lose pending heartbeat vmbus packets
staging: iio: ad5933: avoid uninitialized variable in error case
mei: bus: fix received data size check in NFC fixup
ACPI / APEI: Fix incorrect return value of ghes_proc()
PCI: Handle read-only BARs on AMD CS553x devices
tile: avoid using clocksource_cyc2ns with absolute cycle count
dm flakey: fix reads to be issued if drop_writes configured
mm,ksm: fix endless looping in allocating memory when ksm enable
can: dev: fix deadlock reported after bus-off
hwmon: (adt7411) set bit 3 in CFG1 register
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
mfd: 88pm80x: Double shifting bug in suspend/resume
ASoC: omap-mcpdm: Fix irq resource handling
regulator: tps65910: Work around silicon erratum SWCZ010
dm: mark request_queue dead before destroying the DM device
fbdev/efifb: Fix 16 color palette entry calculation
metag: Only define atomic_dec_if_positive conditionally
Linux 3.10.105
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Conflicts:
arch/arm/mach-sa1100/generic.c
arch/arm64/kernel/traps.c
crypto/blkcipher.c
drivers/devfreq/devfreq.c
drivers/usb/dwc3/gadget.c
drivers/usb/gadget/u_ether.c
fs/ubifs/dir.c
include/net/if_inet6.h
lib/genalloc.c
net/ipv6/addrconf.c
net/ipv6/tcp_ipv6.c
net/wireless/scan.c
sound/core/timer.c
commit 0340ff83cd4475261e7474033a381bc125b45244 upstream.
ci_role BUGs when the role is >= CI_ROLE_END.
Cc: stable@vger.kernel.org #v3.10+
Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
As the newer targets will be using pinctrl framework for gpio
configuration, our drivers need to be compatible with both set of targets
the one which do not use pinctrl and one which do. Add support for both
these cases. ci13xxx driver can configure wake gpio.
Change-Id: Ibd73b5cd9e8dc38b7d306002c4a5a97b24daa2cd
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
commit 5bf5dbeda2454296f1984adfbfc8e6f5965ac389 upstream.
ENDPTFLUSH and ENDPTPRIME registers are set by software and clear
by hardware. There is a bit for each endpoint. When we are setting
a bit for an endpoint we should make sure we do not touch other
endpoint bit. There is a race condition if the hardware clear the
bit between the read and the write in hw_write.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Matthieu CASTET <matthieu.castet@parrot.com>
Tested-by: Michael Grzeschik <mgrzeschik@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
As part of moving the headers from mach directory
to a common location compilation issues are arising.
Make the changes which are relevant for USB with
its own header files and also dependent header
files.
Change-Id: Ieef7d04ffdfda249f434e0676fec6da8d8b9cf2c
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
When issue a transfer to the usb hardware core, the prime bit is set
for the desired endpoint. After the hardware finish processing the
transfer it reset the prime bit of that endpoint. In order to debug cases
in which this bit is not reset by the core, a timer was set for 1 second
after issuing the transfer for checking the prime bit status and print
debug messages in case of abnormal state.
However, this mechanism introduced a bug, in which the timer of ep0
was expired after cable disconnect. Therefore the prime bit was checked,
while the hardware is in low power mode, so reading the bit caused a crash.
Fix this by ensuring that the timer will be canceled whenever all the
requests of an endpoint are dequeued, including for the case of ep0.
Also added a warning and protection for such cases when an endpoint
timer expires after core in low power mode.
CRs-Fixed: 505686
Change-Id: I7336ec7372714a4cd04bf94eb31ce230ee0a4241
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
Link Power Management (a.k.a. L1) is similar to the existing usb bus
suspend/resume/remote-wakeup, but has transitional latencies of tens
of microseconds between power states (instead of three to greater than
20 millisecond latencies of the USB 2.0 suspend/resume).
Change-Id: I8ae493534702e658c24f384a6b705b08e9ea9d05
Signed-off-by: Shimrit Malichi <smalichi@codeaurora.org>
This change fixes the way ci13xxx_msm driver is probed. The
driver will not be created by device tree, but will be created
by the msm_otg.
Change-Id: I82f9b0ccb601f12364c3b6e3c681dc607d3f9af5
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Allow setting ITC value provided from device tree. In case no value
provided from device tree, check the CI13XXX_ZERO_ITC flag, and
if set use the value of 0 as the ITC.
Change-Id: I9333124913b7ae737eabc8eb5d154d99ac184ee8
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Rmnet and dun function drivers are designed to start fresh upon MODEM
restart. The current code is flushing endpoints without freeing
requests. New requests are allocated again after MODEM is powered up.
All accumulated requests are freed only upon cable disconnect. If
MODEM is restarted multiple times without disconnecting the cable, we
are running low memory issues.
A pending request can not be freed without dequeuing it. Dequeuing
all requests in a loop is a heavy operation and involves changing
multiple function drivers. All pending requests are retired upon
disabling an endpoint. But an endpoint can not be disabled in
configured state. Hence retire pending requests while flushing an
endpoint.
CRs-Fixed: 489047
Change-Id: I3440a204ad8c4beb043b1068cb1d3965be96e9b7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
The commit b0ad433 (USB: ci13xxx_udc: Fix kernel panic during
composition switch) adds ep_nuke() function in gadget_stop_activity().
_ep_nuke() releases and re-acquires spinlock on every entry of the
function. Acquiring spinlock before calling _ep_nuke() is necessary,
else it may end up in unlocking the lock twice, as it is already
unlocked before calling _ep_nuke(), which may lead to crash.
Hence, acquire spinlocks before calling _ep_nuke() function.
CRs-Fixed: 486502
Change-Id: Ia80b9facb8e592f8fb41879dc08f9f1a04a20b48
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Commit 037476 "lib: spinlock_debug: Avoid livelock in
do_raw_spin_lock" reduced timeout value in spin_try_lock from
1sec to 62msec. Once this timeout happens, system would then
crash detecting spinlock lockup.
USB driver is currently using 100msec as timeout during busywait
loops with spinlock acquired. It may result in above spin lockup
crash whenever timeout happens due to some hardware issue.
Fix this by reducing timeout to 25msec as confirmed by h/w team.
CRs-Fixed: 487591
Change-Id: Idadcbe4b21fea456256586657ef07dfcb578f5c1
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
mdm9x15 currently does not support tracepoints so trying to
register a tracepoint would result in udc_probe failure.
This fix allows udc_probe to return success even if registering
the trace fails.
Change-Id: I8a616fc79de5c34c19fc9d19b66a0cdde76db990
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
As a part of usb enumeration, udc driver is currently notifying the pmic
to draw 0mA of current during usb reset. The pmic driver notifies the
charger driver that usb is in suspend state if <=2mA is notified.
In 8930 targets with real battery connected, USB-CV Enumeration tests
fail after some iterations. The failure logs show an error in SOF frame
number and unexpected chirp sequence.
As a part of USB Reset, instead of notifying PMIC to draw 0mA current,
if we notify to draw 100mA current, then the USB-CV Ch-9 Enumeration
failures are not seen. It seems there is some interference when PMIC stops
charging during USB reset and causing the unexpected chirp sequence
during USB Reset.
In any case, as a part of USB reset or unconfigured state, device can draw
upto 100mA of current from USB bus. Hence notify charging driver with
100mA current draw as a part of USB reset interrupt.
CRs-Fixed: 477655
Change-Id: I2658bd570c500c62705e0c07384d6b5c900f407d
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
The control endpoint requests are not nuked properly during
composition switch. The stale request is getting completed
during enumeration of the new composition. Kernel panics if
completion handler access already freed data. This is happening
with RNDIS interface.
The Android composite driver dequeue the control request before
removing the composition. The current code returns immediately
if the queue is empty. The control endpoint queues are handled
differently. The EP0 IN endpoint is only exposed to the composite
driver. The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction. When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.
When USB bus is reset, nuke the control endpoints. Flushing the
endpoint will not call completion handler.
Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.
CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB controller may access the dTD one more time after clearing the active
bit in token field. There is a possibility of software freeing it in this
window. When this happens, USB controller may access incorrect memory and
leads to system level issues.
dTDs are freed when requests are freed by function drivers during
disconnect or unbind. The above race condition will come into effect only
for zero length packets. dTDs are dynamically created for sending zero
length packets on IN endpoints. These dTDs are immediately freed after
active bit is cleared. Defer this to next dTD completion. It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.
Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically. Use one request for both cases and allocate it during bind.
CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
The endpoint must be flushed before retiring pending requests. The
current code skips flushing an endpoint if there are no pending
requests. Flushing ep0 for every setup packet is some how resolving
the race between transfer completion interrupt and transfer descriptors
updates to the system memory in the controller. Always allow flushing
ep0 endpoint. This patch resolves USB disconnect issue during RNDIS
high bandwidth tests.
CRs-Fixed: 466538
Change-Id: Ia89b2dc8ff831641dafb91196e3af5271ac66cfd
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Some platforms may have configuration to allow USB controller
work with any of the two HSPHYs present. By default driver
configures USB core to use primary HSPHY. Add support to allow
user select 2nd HSPHY using DT parameter.
Change-Id: I605aadf8109db385644a690fc945f482331bb347
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB is accessing an invalid memory which results in EBI error.
To find the endpoint information and the address being accessed,
dump all the usb request info required for debugging memory access
violation issue from APP's proc using the trace framework.
CRs-Fixed: 430455
Change-Id: Ie99c31f43dfa9858a9ec2756903574888629e341
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
VBUS is not routed to USB PHY on recent platforms and USB controller
must see VBUS in order to pull-up DP when setting RS bit. Hence
configure USB PHY and LINK registers sense vbus and enable manual
pullup on D+ line.
Change-Id: I140f6de958fb18731dbedded40226192cd3a12f8
Signed-off-by: Vamsi Krishna <vskrishn@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Spanning large request into multiple dTDs will fail with short
packets. Instead queue one dTD at a time. This patch has
the following limitations.
1. Large requests are supported only on Bulk OUT endpoints. This
feature is mainly required for MTP driver to achieve better write
throughputs. The VFS performs well with larger buffers.
2. To keep it simple, don't allow queuing while processing large
request. Don't allow larger request queuing while the queue is
busy.
CRs-Fixed: 449733
Change-Id: I262a62af3316d673a97f11842290609092c6e7df
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
RNDIS control path completion handlers are getting called after setting
cdev to NULL during disconnect as part of composition switch and this
is leading to a crash. Avoid this crash, by checking, if cdev is NULL
before accessing. Also don't queue request's to DCD, if composition switch
is in progress.
CRs-Fixed: 433534
Change-Id: Ic0790415ec3eaf866af2895370249e45adcbba5d
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Flushing an endpoint involve polling ENDPTFLUSH and ENDPTSTAT
registers. The worst case timeout is 100 msec for each endpoint.
The reason for failure is unknown. When flushing an endpoint
fails, successive flushing of remaining endpoints are also failing.
Hence skip flushing remaining endpoints. Reset this condition
upon USB bus reset.
CRs-Fixed: 445916
Change-Id: I9feeeb434dc180f1df859275ef1364c7dd829d78
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
The endpoint must be flushed prior to retiring pending requests.
This is done during disabling an endpoint. Don't flush an endpoint
if there are no pending requests. According databook flushing
endpoint may take large amount of time. This optimization will
make USB disconnect/reset processing a little bit faster.
CRs-Fixed: 445916
Change-Id: I035b624dbac4529bbe33a67f9e7e1916d4772d6f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Flushing and disabling all endpoints during disconnect in controller
driver is simply wasteful and unnecessary. Flushing endpoints before
notifying disconnect to composite driver will have side effects too.
The active endpoints will be disabled by function drivers when they
notified about disconnect.
The current code use 100 msec timeout for flush operation. If controller
driver flush and disable all endpoints, the worst case timeout will be
added up to several seconds. This is leading to watch dog timeout.
CRs-Fixed: 431623
Change-Id: If6a2e87006cda367c2eb4def616e9672e13eadf5
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
There are scenarios where the USB BAM has to be reset.
For example, when the peer BAM is being reset, the USB BAM
must be reset as well, otherwise the BAM-BAM connection will
go out of sync.
In order to reset the USB BAM, the USB controller has to disable
the BAM first. After the USB BAM reset is completed, the USB
controller has to re-enable the USB BAM.
So this change adds the support for USB BAM enable/disable.
This is done by adding an API to ci13xxx_msm. A function driver can
ask for BAM enable/disable by calling this API.
This change doesn't add the support for the USB BAM reset sequence.
CRs-Fixed: 424867
Change-Id: Ib5518fafe3765f86bb09d1ce10723ec733543b35
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Currently completion of endpoint flush operation is checked after
setting that endpoint bit with ENDPTFLUSH register and polling the
same to get it clear. It has been observed that sometime this flush
operation takes huge amount of time which results into watchdog
timeout issue due to this busy loop without any time-out. Hence add
time-out of 100ms for endpoint flush operation completion and also
add 100us delay before checking ENDPTFLUSH register for endpoint bit
clear or not.
Also print important usb status register and flushed endpoint dtds
at the time of issue.
CRs-Fixed: 409382
Change-Id: I7ae57cc436077f8a03051b92750bdca9a571da2b
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
The controller always does posted writes to transfer descriptors.
A transfer completion interrupt may be generated before dTD is
updated in system memory. A software workaround is already in
place to give 10usec delay after receiving the completion interrupt
if the first dTD in the queue is still active. But this delay
is given only for OUT endpoints. In theory this problem is applicable
to both IN and OUT endpoints. But none of the function drivers indicate
any problem with IN endpoints. Hence delay is not given for IN
endpoints.
The status phase of a control transfer may get stuck if the above
issue is hit for EP0 IN endpoint. Hence apply the software workaround
for EP0 IN endpoint.
CRs-fixed: 409573
Change-Id: Ic07a4421c0066645459d2cc566f0df6691084a43
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
while queueing requests to USB HW, waiting till EP PRIME bit
get cleared after setting it leads to wathdog timeout. Fix
this by implementing timer based solution instead of infinite
PRIME check loop.
CRs-Fixed: 397907
Change-Id: I74e9acbfdfcd2030896d1fa813e66803ece7d5bd
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Currently not setting QMULT for ISO endpoints. Set this
value appropriately to indicate to the USB controller the
number of transactions to be done in microframe.
Change-Id: If80c003464024f8dfebcda13fefb33744618d043
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
This module enhances the USB audio function driver with
record functionality and adapts descriptors structures
to support compatibility with Win7.
CRs-Fixed: 363272
Change-Id: Ic30944ea117ee96e07eb5769ed5d58bfa53b4769
Signed-off-by: Anna Perel <aperel@codeaurora.org>
Hsic can enter to low power mode only after bus suspend when
connected to host. Since there is no disconnect state in hsic,
hsic remaines resumed even not activated by the gadget driver.
Therefore hsic still votes for some resources, such as clocks,
that prevent from power save modes to occur, as Vdd minimization.
This fix suspends the hsic by default, right after hsic udc driver
Initializations take place, and only on activation by the gadget
driver,aka pullup, resume the hsic device.
Change-Id: I22ecbbd66e76e28161428287e6a8b44cf42a1325
CRs-Fixed: 400263
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
When receiving reset interrupt from the usb controller, check if the bus
is suspended. If so then first resume the bus and only then reset
the usb controller.
This fixes a case of race condition when reset
interrupt is happening right after suspend interrupt. In this case
there might be a race in which the msm_otg will execute the suspend
event in the work queue after the reset interrupt finished. In this case
the bus will be suspended after the reset and no further event
(resume/reset) will arrive from host, keeping the device in LPM forever.
Change-Id: Ifd4bee52eb42c3313821a799a935539d1789d42e
CRs-Fixed: 381806, 386464
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
Flush control endpoints from ep_dequeue and set request completion
to NULL once calling completion handler of function driver. This will
make sure that all control endpoint requests are flushed in disconnect.
CRs-Fixed: 373672
Change-Id: I7506c2e53d13f137ae6f222a06fbcc0dee77f68e
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
The current code is calling cancel_delayed_work_sync() from interrupt
handler which is causing scheduling while atomic bug.
If host sends reset or cable is disconnected, before the remote wakeup
work is scheduled, we may end up sending wakeup signaling. But this
work can not be canceled from interrupt handler as it involves sleeping.
Check wakeup conditions before initiating the remote wakeup in work
function.
Change-Id: I150ecadfd6669ec5a01b65298d330183596ba2c7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
This change triggers remote wakeup upon queuing a transfer
for a suspended device.
Change-Id: I895e7dce6a013f2b329020591b6201bdc0fa1c90
CRs-Fixed: 367423
Signed-off-by: Amit Blay <ablay@codeaurora.org>
This patch fixes a possible interrupt storm condition by
the USB wake IRQ, which can cause a dog timeout crash.
The USB wake IRQ detects USB bus suspend on USB D+ line.
This can be done by a rising edge triggered interrupt,
rather than level triggered interrupt.
Change-Id: Ia5451c3847285d38dde893856680a011674bd1e3
Signed-off-by: Amit Blay <ablay@codeaurora.org>
As part of kernel 3.4 merge, this driver was modified such
that TRB of size 0 points to DMA_ADDR_INVALID. This causes
infinite SPS transfer to fail after a single transfer.
The fix changes the TRB to point to 0.
Change-Id: I772631f79582db69dccc7aa1801e69695505b958
Signed-off-by: Amit Blay <ablay@codeaurora.org>
This is a workaround to MDM9x15 HW limitation of failure
to wake up from XO shutdown by USB RESUME signal.
To overcome this, a board rework is needed, so the CPU
can wake up directly from D+ line. A GPIO IRQ is used for
that purpose, and the ci13xxx_msm registers for this IRQ.
CRs-Fixed: 359272
Change-Id: Ica148bc4c4eea5b0c1feed396afd617fdb19a9dc
Signed-off-by: Amit Blay <ablay@codeaurora.org>
[sboyd: Drop board-file changes]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
This change adds the ability of the msm_otg to go to LPM when
USB cable is connected and bus is suspended.
This ability is enabled by a board file parameter.
The msm_otg is notified about SUSPEND/RESUME events via the
UDC layer. New event for RESUME was defined for that.
Change-Id: Ic508f1898cc3b57ab76eccd379bea38ed363570b
Signed-off-by: Amit Blay <ablay@codeaurora.org>
[sboyd: Only take ci13xxx_udc part]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
When the gadget initiates remote-wakeup, raise an event to
the component that handles power management, so it can trigger
a runtime resume, if needed.
Change-Id: Ia3ed500b96ed09347e594d1e74209fdfef554263
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Failed test "Halt Endpoint". The reasons for failure were
reconnecting the bam2bam at set_alt and fauilre to halt
endless transfer.No reconnecting of bam2bam will take
place on set_alt or set_halt.
CRs-Fixed: 344801
Change-Id: I027676bb8d98d20cf0b6c82c688ac9e36dcbfe64
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
[sboyd: Take ci13xxx_udc part]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Add HSIC power management to support HSIC core Low Power Mode and
integrate it with System PM and Runtime PM mechanisms.
Change-Id: Id87d5740e7f229e599f8f6bb17a70ac1d8078bf4
Signed-off-by: Ofir Cohen <ofirc@codeaurora.org>
[sboyd: Only take ci13xxx_udc part]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Add support in HSIC peripheral(device).
Only one USB core can be use - currently
HSUSB is enabled by default.
To enable HSIC core defconfig file should be changed.
Change-Id: I02413658e28f799de2a083db7847fb8b01d04eac
Signed-off-by: Ofir Cohen <ofirc@codeaurora.org>
[sboyd: take the ci13xxx_udc bits]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Device controller driver transfers the ownership of usb request buffer
memory to device DMA by making call to dma_map_single. CPU regains the
access only after making call to dma_unmap_single.
Upon request completion USB driver is performing dma_unmap_single and
accessing the memory.
Perform dma_unmap_single upon cable disconnect also while flushing the USB
requests.
Change-Id: Ic180c2b1158c93c5b187607c364f0fd5056cc52f
CRs-fixed: 327466
Signed-off-by: Anji jonnala <anjir@codeaurora.org>
Adding new support to enable USB-Peripheral
BAM-to-BAM transactions.
Changes were added to the UDC to support
"legacy/regular" USB transfers and
endless BAM-to-BAM transfers.
To avoid adding new vendor specific UDC file
to support the new feature and keep the UDC
as a generic as possiblea, USB request holds
a vendor specific data that distinguish between
the two transfer types.
USB BAM will be added in seperate commit.
Change-Id: I3211a122fe5236cda2dbe844b44f52a2b2063baf
Signed-off-by: Ofir Cohen <ofirc@codeaurora.org>
Signed-off-by: Amit Blay <ablay@codeaurora.org>
[sboyd: only take ci13xxx_udc part]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Nathan Chancellor