--- /dev/null
+From aa0850e1d56623845b46350ffd971afa9241886d Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Mon, 26 Oct 2015 18:58:14 -0200
+Subject: [media] airspy: increase USB control message buffer size
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit aa0850e1d56623845b46350ffd971afa9241886d upstream.
+
+Driver requested device firmware version string during probe using
+only 24 byte long buffer. That buffer is too small for newer firmware
+versions, which causes device firmware hang - device stops responding
+to any commands after that. Increase buffer size to 128 which should
+be enough for any current and future version strings.
+
+Link: https://github.com/airspy/host/issues/27
+
+Reported-by: Benjamin Vernoux <bvernoux@gmail.com>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/airspy/airspy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/airspy/airspy.c
++++ b/drivers/media/usb/airspy/airspy.c
+@@ -132,7 +132,7 @@ struct airspy {
+ int urbs_submitted;
+
+ /* USB control message buffer */
+- #define BUF_SIZE 24
++ #define BUF_SIZE 128
+ u8 buf[BUF_SIZE];
+
+ /* Current configuration */
--- /dev/null
+From e73694d871867cae8471d2350ce89acb38bc2b63 Mon Sep 17 00:00:00 2001
+From: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
+Date: Wed, 23 Dec 2015 14:18:05 +0000
+Subject: ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
+
+From: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
+
+commit e73694d871867cae8471d2350ce89acb38bc2b63 upstream.
+
+For a sample rate of 12kHz the bclk was taken from the 44.1kHz table as
+we test for a multiple of 8kHz. This patch fixes this issue by testing
+for multiples of 4kHz instead.
+
+Signed-off-by: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/arizona.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/arizona.c
++++ b/sound/soc/codecs/arizona.c
+@@ -1499,7 +1499,7 @@ static int arizona_hw_params(struct snd_
+ bool reconfig;
+ unsigned int aif_tx_state, aif_rx_state;
+
+- if (params_rate(params) % 8000)
++ if (params_rate(params) % 4000)
+ rates = &arizona_44k1_bclk_rates[0];
+ else
+ rates = &arizona_48k_bclk_rates[0];
--- /dev/null
+From a1068045883ed4a18363a4ebad0c3d55e473b716 Mon Sep 17 00:00:00 2001
+From: Vinod Koul <vinod.koul@intel.com>
+Date: Thu, 7 Jan 2016 21:48:14 +0530
+Subject: ASoC: compress: Fix compress device direction check
+
+From: Vinod Koul <vinod.koul@intel.com>
+
+commit a1068045883ed4a18363a4ebad0c3d55e473b716 upstream.
+
+The detection of direction for compress was only taking into account codec
+capabilities and not CPU ones. Fix this by checking the CPU side capabilities
+as well
+
+Tested-by: Ashish Panwar <ashish.panwar@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-compress.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -623,6 +623,7 @@ int soc_new_compress(struct snd_soc_pcm_
+ struct snd_pcm *be_pcm;
+ char new_name[64];
+ int ret = 0, direction = 0;
++ int playback = 0, capture = 0;
+
+ if (rtd->num_codecs > 1) {
+ dev_err(rtd->card->dev, "Multicodec not supported for compressed stream\n");
+@@ -634,11 +635,27 @@ int soc_new_compress(struct snd_soc_pcm_
+ rtd->dai_link->stream_name, codec_dai->name, num);
+
+ if (codec_dai->driver->playback.channels_min)
++ playback = 1;
++ if (codec_dai->driver->capture.channels_min)
++ capture = 1;
++
++ capture = capture && cpu_dai->driver->capture.channels_min;
++ playback = playback && cpu_dai->driver->playback.channels_min;
++
++ /*
++ * Compress devices are unidirectional so only one of the directions
++ * should be set, check for that (xor)
++ */
++ if (playback + capture != 1) {
++ dev_err(rtd->card->dev, "Invalid direction for compress P %d, C %d\n",
++ playback, capture);
++ return -EINVAL;
++ }
++
++ if(playback)
+ direction = SND_COMPRESS_PLAYBACK;
+- else if (codec_dai->driver->capture.channels_min)
+- direction = SND_COMPRESS_CAPTURE;
+ else
+- return -EINVAL;
++ direction = SND_COMPRESS_CAPTURE;
+
+ compr = kzalloc(sizeof(*compr), GFP_KERNEL);
+ if (compr == NULL) {
--- /dev/null
+From e2a0c9fa80227be5ee017b5476638829dd41cb39 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 11 Dec 2015 13:06:24 +0200
+Subject: ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit e2a0c9fa80227be5ee017b5476638829dd41cb39 upstream.
+
+The condition for checking for XDAT being cleared was not correct.
+
+Fixes: 36bcecd0a73eb ("ASoC: davinci-mcasp: Correct TX start sequence")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/davinci/davinci-mcasp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -222,8 +222,8 @@ static void mcasp_start_tx(struct davinc
+
+ /* wait for XDATA to be cleared */
+ cnt = 0;
+- while (!(mcasp_get_reg(mcasp, DAVINCI_MCASP_TXSTAT_REG) &
+- ~XRDATA) && (cnt < 100000))
++ while ((mcasp_get_reg(mcasp, DAVINCI_MCASP_TXSTAT_REG) & XRDATA) &&
++ (cnt < 100000))
+ cnt++;
+
+ /* Release TX state machine */
--- /dev/null
+From 84ebac4d04d25ac5c1b1dc3ae621fd465eb38f4e Mon Sep 17 00:00:00 2001
+From: John Keeping <john@metanate.com>
+Date: Wed, 9 Dec 2015 11:38:13 +0000
+Subject: ASoC: es8328: Fix deemphasis values
+
+From: John Keeping <john@metanate.com>
+
+commit 84ebac4d04d25ac5c1b1dc3ae621fd465eb38f4e upstream.
+
+This is using completely the wrong mask and value when updating the
+register. Since the correct values are already defined in the header,
+switch to using a table with explicit constants rather than shifting the
+array index.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/es8328.c | 25 +++++++++++++++++--------
+ sound/soc/codecs/es8328.h | 1 +
+ 2 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -85,7 +85,15 @@ static const DECLARE_TLV_DB_SCALE(pga_tl
+ static const DECLARE_TLV_DB_SCALE(bypass_tlv, -1500, 300, 0);
+ static const DECLARE_TLV_DB_SCALE(mic_tlv, 0, 300, 0);
+
+-static const int deemph_settings[] = { 0, 32000, 44100, 48000 };
++static const struct {
++ int rate;
++ unsigned int val;
++} deemph_settings[] = {
++ { 0, ES8328_DACCONTROL6_DEEMPH_OFF },
++ { 32000, ES8328_DACCONTROL6_DEEMPH_32k },
++ { 44100, ES8328_DACCONTROL6_DEEMPH_44_1k },
++ { 48000, ES8328_DACCONTROL6_DEEMPH_48k },
++};
+
+ static int es8328_set_deemph(struct snd_soc_codec *codec)
+ {
+@@ -97,21 +105,22 @@ static int es8328_set_deemph(struct snd_
+ * rate.
+ */
+ if (es8328->deemph) {
+- best = 1;
+- for (i = 2; i < ARRAY_SIZE(deemph_settings); i++) {
+- if (abs(deemph_settings[i] - es8328->playback_fs) <
+- abs(deemph_settings[best] - es8328->playback_fs))
++ best = 0;
++ for (i = 1; i < ARRAY_SIZE(deemph_settings); i++) {
++ if (abs(deemph_settings[i].rate - es8328->playback_fs) <
++ abs(deemph_settings[best].rate - es8328->playback_fs))
+ best = i;
+ }
+
+- val = best << 1;
++ val = deemph_settings[best].val;
+ } else {
+- val = 0;
++ val = ES8328_DACCONTROL6_DEEMPH_OFF;
+ }
+
+ dev_dbg(codec->dev, "Set deemphasis %d\n", val);
+
+- return snd_soc_update_bits(codec, ES8328_DACCONTROL6, 0x6, val);
++ return snd_soc_update_bits(codec, ES8328_DACCONTROL6,
++ ES8328_DACCONTROL6_DEEMPH_MASK, val);
+ }
+
+ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
+--- a/sound/soc/codecs/es8328.h
++++ b/sound/soc/codecs/es8328.h
+@@ -153,6 +153,7 @@ int es8328_probe(struct device *dev, str
+ #define ES8328_DACCONTROL6_CLICKFREE (1 << 3)
+ #define ES8328_DACCONTROL6_DAC_INVR (1 << 4)
+ #define ES8328_DACCONTROL6_DAC_INVL (1 << 5)
++#define ES8328_DACCONTROL6_DEEMPH_MASK (3 << 6)
+ #define ES8328_DACCONTROL6_DEEMPH_OFF (0 << 6)
+ #define ES8328_DACCONTROL6_DEEMPH_32k (1 << 6)
+ #define ES8328_DACCONTROL6_DEEMPH_44_1k (2 << 6)
--- /dev/null
+From 24338722cfa23fdf4e08c6189a11f7e3a902d86a Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Wed, 6 Jan 2016 15:15:37 +0000
+Subject: ASoC: wm5110: Fix PGA clear when disabling DRE
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 24338722cfa23fdf4e08c6189a11f7e3a902d86a upstream.
+
+We don't want to use a bypassed write in wm5110_clear_pga_volume,
+we might disable the DRE whilst the CODEC is powered down. A
+normal regmap_write will always go to the hardware (when not on
+cache_only) even if the written value matches the cache. As using
+a normal write will still achieve the desired behaviour of bring
+the cache and hardware in sync, this patch updates the function
+to use a normal write, which avoids issues when the CODEC is
+powered down.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm5110.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -354,15 +354,13 @@ static int wm5110_hp_ev(struct snd_soc_d
+
+ static int wm5110_clear_pga_volume(struct arizona *arizona, int output)
+ {
+- struct reg_sequence clear_pga = {
+- ARIZONA_OUTPUT_PATH_CONFIG_1L + output * 4, 0x80
+- };
++ unsigned int reg = ARIZONA_OUTPUT_PATH_CONFIG_1L + output * 4;
+ int ret;
+
+- ret = regmap_multi_reg_write_bypassed(arizona->regmap, &clear_pga, 1);
++ ret = regmap_write(arizona->regmap, reg, 0x80);
+ if (ret)
+ dev_err(arizona->dev, "Failed to clear PGA (0x%x): %d\n",
+- clear_pga.reg, ret);
++ reg, ret);
+
+ return ret;
+ }
--- /dev/null
+From 1ea5998afe903384ddc16391d4c023cd4c867bea Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Fri, 11 Dec 2015 11:27:08 +0000
+Subject: ASoC: wm8974: set cache type for regmap
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit 1ea5998afe903384ddc16391d4c023cd4c867bea upstream.
+
+Attempting to use this codec driver triggers a BUG() in regcache_sync()
+since no cache type is set. The register map of this device is fairly
+small and has few holes so a flat cache is suitable.
+
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8974.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -574,6 +574,7 @@ static const struct regmap_config wm8974
+ .max_register = WM8974_MONOMIX,
+ .reg_defaults = wm8974_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(wm8974_reg_defaults),
++ .cache_type = REGCACHE_FLAT,
+ };
+
+ static int wm8974_probe(struct snd_soc_codec *codec)
asoc-rt286-fix-run-time-error-while-modifying-const-data.patch
asoc-rsnd-fixup-scu_sys_int_en1-address.patch
asoc-wm8962-correct-addresses-for-hpf_c_0-1.patch
+asoc-es8328-fix-deemphasis-values.patch
+asoc-wm8974-set-cache-type-for-regmap.patch
+asoc-davinci-mcasp-fix-xdata-check-in-mcasp_start_tx.patch
+asoc-arizona-fix-bclk-for-sample-rates-that-are-multiple-of-4khz.patch
+asoc-wm5110-fix-pga-clear-when-disabling-dre.patch
+asoc-compress-fix-compress-device-direction-check.patch
+usb-xhci-fix-config-fail-of-fs-hub-behind-a-hs-hub-with-mtt.patch
+airspy-increase-usb-control-message-buffer-size.patch
+usb-fix-invalid-memory-access-in-hub_activate.patch
+usb-ipaq.c-fix-a-timeout-loop.patch
+usb-cp210x-add-id-for-elv-marble-sound-board-1.patch
+usb-core-lpm-fix-usb3_hardware_lpm-sysfs-node.patch
+xhci-refuse-loading-if-nousb-is-used.patch
--- /dev/null
+From bf5ce5bf3cc7136fd7fe5e8999a580bc93a9c8f6 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Sat, 14 Nov 2015 16:26:32 +0800
+Subject: usb: core: lpm: fix usb3_hardware_lpm sysfs node
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit bf5ce5bf3cc7136fd7fe5e8999a580bc93a9c8f6 upstream.
+
+Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3
+hardware LPM") introduced usb3_hardware_lpm sysfs node. This
+doesn't show the correct status of USB3 U1 and U2 LPM status.
+
+This patch fixes this by replacing usb3_hardware_lpm with two
+nodes, usb3_hardware_lpm_u1 (for U1) and usb3_hardware_lpm_u2
+(for U2), and recording the U1/U2 LPM status in right places.
+
+This patch should be back-ported to kernels as old as 4.3,
+that contains Commit 655fe4effe0f ("usbcore: add sysfs support
+to xHCI usb3 hardware LPM").
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/sysfs-bus-usb | 16 +++++++------
+ Documentation/usb/power-management.txt | 11 ++++-----
+ drivers/usb/core/hub.c | 39 ++++++++++++++++++++++++--------
+ drivers/usb/core/sysfs.c | 31 +++++++++++++++++++++----
+ include/linux/usb.h | 4 +++
+ 5 files changed, 75 insertions(+), 26 deletions(-)
+
+--- a/Documentation/ABI/testing/sysfs-bus-usb
++++ b/Documentation/ABI/testing/sysfs-bus-usb
+@@ -114,19 +114,21 @@ Description:
+ enabled for the device. Developer can write y/Y/1 or n/N/0 to
+ the file to enable/disable the feature.
+
+-What: /sys/bus/usb/devices/.../power/usb3_hardware_lpm
+-Date: June 2015
++What: /sys/bus/usb/devices/.../power/usb3_hardware_lpm_u1
++ /sys/bus/usb/devices/.../power/usb3_hardware_lpm_u2
++Date: November 2015
+ Contact: Kevin Strasser <kevin.strasser@linux.intel.com>
++ Lu Baolu <baolu.lu@linux.intel.com>
+ Description:
+ If CONFIG_PM is set and a USB 3.0 lpm-capable device is plugged
+ in to a xHCI host which supports link PM, it will check if U1
+ and U2 exit latencies have been set in the BOS descriptor; if
+- the check is is passed and the host supports USB3 hardware LPM,
++ the check is passed and the host supports USB3 hardware LPM,
+ USB3 hardware LPM will be enabled for the device and the USB
+- device directory will contain a file named
+- power/usb3_hardware_lpm. The file holds a string value (enable
+- or disable) indicating whether or not USB3 hardware LPM is
+- enabled for the device.
++ device directory will contain two files named
++ power/usb3_hardware_lpm_u1 and power/usb3_hardware_lpm_u2. These
++ files hold a string value (enable or disable) indicating whether
++ or not USB3 hardware LPM U1 or U2 is enabled for the device.
+
+ What: /sys/bus/usb/devices/.../removable
+ Date: February 2012
+--- a/Documentation/usb/power-management.txt
++++ b/Documentation/usb/power-management.txt
+@@ -537,17 +537,18 @@ relevant attribute files are usb2_hardwa
+ can write y/Y/1 or n/N/0 to the file to enable/disable
+ USB2 hardware LPM manually. This is for test purpose mainly.
+
+- power/usb3_hardware_lpm
++ power/usb3_hardware_lpm_u1
++ power/usb3_hardware_lpm_u2
+
+ When a USB 3.0 lpm-capable device is plugged in to a
+ xHCI host which supports link PM, it will check if U1
+ and U2 exit latencies have been set in the BOS
+ descriptor; if the check is is passed and the host
+ supports USB3 hardware LPM, USB3 hardware LPM will be
+- enabled for the device and this file will be created.
+- The file holds a string value (enable or disable)
+- indicating whether or not USB3 hardware LPM is
+- enabled for the device.
++ enabled for the device and these files will be created.
++ The files hold a string value (enable or disable)
++ indicating whether or not USB3 hardware LPM U1 or U2
++ is enabled for the device.
+
+ USB Port Power Control
+ ----------------------
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3886,17 +3886,30 @@ static void usb_enable_link_state(struct
+ return;
+ }
+
+- if (usb_set_lpm_timeout(udev, state, timeout))
++ if (usb_set_lpm_timeout(udev, state, timeout)) {
+ /* If we can't set the parent hub U1/U2 timeout,
+ * device-initiated LPM won't be allowed either, so let the xHCI
+ * host know that this link state won't be enabled.
+ */
+ hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
++ } else {
++ /* Only a configured device will accept the Set Feature
++ * U1/U2_ENABLE
++ */
++ if (udev->actconfig)
++ usb_set_device_initiated_lpm(udev, state, true);
+
+- /* Only a configured device will accept the Set Feature U1/U2_ENABLE */
+- else if (udev->actconfig)
+- usb_set_device_initiated_lpm(udev, state, true);
+-
++ /* As soon as usb_set_lpm_timeout(timeout) returns 0, the
++ * hub-initiated LPM is enabled. Thus, LPM is enabled no
++ * matter the result of usb_set_device_initiated_lpm().
++ * The only difference is whether device is able to initiate
++ * LPM.
++ */
++ if (state == USB3_LPM_U1)
++ udev->usb3_lpm_u1_enabled = 1;
++ else if (state == USB3_LPM_U2)
++ udev->usb3_lpm_u2_enabled = 1;
++ }
+ }
+
+ /*
+@@ -3936,6 +3949,18 @@ static int usb_disable_link_state(struct
+ dev_warn(&udev->dev, "Could not disable xHCI %s timeout, "
+ "bus schedule bandwidth may be impacted.\n",
+ usb3_lpm_names[state]);
++
++ /* As soon as usb_set_lpm_timeout(0) return 0, hub initiated LPM
++ * is disabled. Hub will disallows link to enter U1/U2 as well,
++ * even device is initiating LPM. Hence LPM is disabled if hub LPM
++ * timeout set to 0, no matter device-initiated LPM is disabled or
++ * not.
++ */
++ if (state == USB3_LPM_U1)
++ udev->usb3_lpm_u1_enabled = 0;
++ else if (state == USB3_LPM_U2)
++ udev->usb3_lpm_u2_enabled = 0;
++
+ return 0;
+ }
+
+@@ -3970,8 +3995,6 @@ int usb_disable_lpm(struct usb_device *u
+ if (usb_disable_link_state(hcd, udev, USB3_LPM_U2))
+ goto enable_lpm;
+
+- udev->usb3_lpm_enabled = 0;
+-
+ return 0;
+
+ enable_lpm:
+@@ -4029,8 +4052,6 @@ void usb_enable_lpm(struct usb_device *u
+
+ usb_enable_link_state(hcd, udev, USB3_LPM_U1);
+ usb_enable_link_state(hcd, udev, USB3_LPM_U2);
+-
+- udev->usb3_lpm_enabled = 1;
+ }
+ EXPORT_SYMBOL_GPL(usb_enable_lpm);
+
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -531,7 +531,7 @@ static ssize_t usb2_lpm_besl_store(struc
+ }
+ static DEVICE_ATTR_RW(usb2_lpm_besl);
+
+-static ssize_t usb3_hardware_lpm_show(struct device *dev,
++static ssize_t usb3_hardware_lpm_u1_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct usb_device *udev = to_usb_device(dev);
+@@ -539,7 +539,7 @@ static ssize_t usb3_hardware_lpm_show(st
+
+ usb_lock_device(udev);
+
+- if (udev->usb3_lpm_enabled)
++ if (udev->usb3_lpm_u1_enabled)
+ p = "enabled";
+ else
+ p = "disabled";
+@@ -548,7 +548,26 @@ static ssize_t usb3_hardware_lpm_show(st
+
+ return sprintf(buf, "%s\n", p);
+ }
+-static DEVICE_ATTR_RO(usb3_hardware_lpm);
++static DEVICE_ATTR_RO(usb3_hardware_lpm_u1);
++
++static ssize_t usb3_hardware_lpm_u2_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct usb_device *udev = to_usb_device(dev);
++ const char *p;
++
++ usb_lock_device(udev);
++
++ if (udev->usb3_lpm_u2_enabled)
++ p = "enabled";
++ else
++ p = "disabled";
++
++ usb_unlock_device(udev);
++
++ return sprintf(buf, "%s\n", p);
++}
++static DEVICE_ATTR_RO(usb3_hardware_lpm_u2);
+
+ static struct attribute *usb2_hardware_lpm_attr[] = {
+ &dev_attr_usb2_hardware_lpm.attr,
+@@ -562,7 +581,8 @@ static struct attribute_group usb2_hardw
+ };
+
+ static struct attribute *usb3_hardware_lpm_attr[] = {
+- &dev_attr_usb3_hardware_lpm.attr,
++ &dev_attr_usb3_hardware_lpm_u1.attr,
++ &dev_attr_usb3_hardware_lpm_u2.attr,
+ NULL,
+ };
+ static struct attribute_group usb3_hardware_lpm_attr_group = {
+@@ -592,7 +612,8 @@ static int add_power_attributes(struct d
+ if (udev->usb2_hw_lpm_capable == 1)
+ rc = sysfs_merge_group(&dev->kobj,
+ &usb2_hardware_lpm_attr_group);
+- if (udev->lpm_capable == 1)
++ if (udev->speed == USB_SPEED_SUPER &&
++ udev->lpm_capable == 1)
+ rc = sysfs_merge_group(&dev->kobj,
+ &usb3_hardware_lpm_attr_group);
+ }
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -507,6 +507,8 @@ struct usb3_lpm_parameters {
+ * @usb2_hw_lpm_enabled: USB2 hardware LPM is enabled
+ * @usb2_hw_lpm_allowed: Userspace allows USB 2.0 LPM to be enabled
+ * @usb3_lpm_enabled: USB3 hardware LPM enabled
++ * @usb3_lpm_u1_enabled: USB3 hardware U1 LPM enabled
++ * @usb3_lpm_u2_enabled: USB3 hardware U2 LPM enabled
+ * @string_langid: language ID for strings
+ * @product: iProduct string, if present (static)
+ * @manufacturer: iManufacturer string, if present (static)
+@@ -580,6 +582,8 @@ struct usb_device {
+ unsigned usb2_hw_lpm_enabled:1;
+ unsigned usb2_hw_lpm_allowed:1;
+ unsigned usb3_lpm_enabled:1;
++ unsigned usb3_lpm_u1_enabled:1;
++ unsigned usb3_lpm_u2_enabled:1;
+ int string_langid;
+
+ /* static strings from the device */
--- /dev/null
+From f7d7f59ab124748156ea551edf789994f05da342 Mon Sep 17 00:00:00 2001
+From: Oliver Freyermuth <o.freyermuth@googlemail.com>
+Date: Mon, 28 Dec 2015 18:37:38 +0100
+Subject: USB: cp210x: add ID for ELV Marble Sound Board 1
+
+From: Oliver Freyermuth <o.freyermuth@googlemail.com>
+
+commit f7d7f59ab124748156ea551edf789994f05da342 upstream.
+
+Add the USB device ID for ELV Marble Sound Board 1.
+
+Signed-off-by: Oliver Freyermuth <o.freyermuth@googlemail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -160,6 +160,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
--- /dev/null
+From e50293ef9775c5f1cf3fcc093037dd6a8c5684ea Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 16 Dec 2015 13:32:38 -0500
+Subject: USB: fix invalid memory access in hub_activate()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea upstream.
+
+Commit 8520f38099cc ("USB: change hub initialization sleeps to
+delayed_work") changed the hub_activate() routine to make part of it
+run in a workqueue. However, the commit failed to take a reference to
+the usb_hub structure or to lock the hub interface while doing so. As
+a result, if a hub is plugged in and quickly unplugged before the work
+routine can run, the routine will try to access memory that has been
+deallocated. Or, if the hub is unplugged while the routine is
+running, the memory may be deallocated while it is in active use.
+
+This patch fixes the problem by taking a reference to the usb_hub at
+the start of hub_activate() and releasing it at the end (when the work
+is finished), and by locking the hub interface while the work routine
+is running. It also adds a check at the start of the routine to see
+if the hub has already been disconnected, in which nothing should be
+done.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Alexandru Cornea <alexandru.cornea@intel.com>
+Tested-by: Alexandru Cornea <alexandru.cornea@intel.com>
+Fixes: 8520f38099cc ("USB: change hub initialization sleeps to delayed_work")
+CC: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1035,10 +1035,20 @@ static void hub_activate(struct usb_hub
+ unsigned delay;
+
+ /* Continue a partial initialization */
+- if (type == HUB_INIT2)
+- goto init2;
+- if (type == HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ device_lock(hub->intfdev);
++
++ /* Was the hub disconnected while we were waiting? */
++ if (hub->disconnected) {
++ device_unlock(hub->intfdev);
++ kref_put(&hub->kref, hub_release);
++ return;
++ }
++ if (type == HUB_INIT2)
++ goto init2;
+ goto init3;
++ }
++ kref_get(&hub->kref);
+
+ /* The superspeed hub except for root hub has to use Hub Depth
+ * value as an offset into the route string to locate the bits
+@@ -1236,6 +1246,7 @@ static void hub_activate(struct usb_hub
+ queue_delayed_work(system_power_efficient_wq,
+ &hub->init_work,
+ msecs_to_jiffies(delay));
++ device_unlock(hub->intfdev);
+ return; /* Continues at init3: below */
+ } else {
+ msleep(delay);
+@@ -1257,6 +1268,11 @@ static void hub_activate(struct usb_hub
+ /* Allow autosuspend if it was suppressed */
+ if (type <= HUB_INIT3)
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
++
++ if (type == HUB_INIT2 || type == HUB_INIT3)
++ device_unlock(hub->intfdev);
++
++ kref_put(&hub->kref, hub_release);
+ }
+
+ /* Implement the continuations for the delays above */
--- /dev/null
+From abdc9a3b4bac97add99e1d77dc6d28623afe682b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 16 Dec 2015 14:06:37 +0300
+Subject: USB: ipaq.c: fix a timeout loop
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit abdc9a3b4bac97add99e1d77dc6d28623afe682b upstream.
+
+The code expects the loop to end with "retries" set to zero but, because
+it is a post-op, it will end set to -1. I have fixed this by moving the
+decrement inside the loop.
+
+Fixes: 014aa2a3c32e ('USB: ipaq: minor ipaq_open() cleanup.')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ipaq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ipaq.c
++++ b/drivers/usb/serial/ipaq.c
+@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *
+ * through. Since this has a reasonably high failure rate, we retry
+ * several times.
+ */
+- while (retries--) {
++ while (retries) {
++ retries--;
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
+ 0x1, 0, NULL, 0, 100);
--- /dev/null
+From 096b110a3dd3c868e4610937c80d2e3f3357c1a9 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 4 Dec 2015 15:53:43 +0200
+Subject: usb: xhci: fix config fail of FS hub behind a HS hub with MTT
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit 096b110a3dd3c868e4610937c80d2e3f3357c1a9 upstream.
+
+if a full speed hub connects to a high speed hub which
+supports MTT, the MTT field of its slot context will be set
+to 1 when xHCI driver setups an xHCI virtual device in
+xhci_setup_addressable_virt_dev(); once usb core fetch its
+hub descriptor, and need to update the xHC's internal data
+structures for the device, the HUB field of its slot context
+will be set to 1 too, meanwhile MTT is also set before,
+this will cause configure endpoint command fail, so in the
+case, we should clear MTT to 0 for full speed hub according
+to section 6.2.2
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4778,8 +4778,16 @@ int xhci_update_hub_device(struct usb_hc
+ ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
+ slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
+ slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
++ /*
++ * refer to section 6.2.2: MTT should be 0 for full speed hub,
++ * but it may be already set to 1 when setup an xHCI virtual
++ * device, so clear it anyway.
++ */
+ if (tt->multi)
+ slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
++ else if (hdev->speed == USB_SPEED_FULL)
++ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
++
+ if (xhci->hci_version > 0x95) {
+ xhci_dbg(xhci, "xHCI version %x needs hub "
+ "TT think time and number of ports\n",
--- /dev/null
+From 1eaf35e4dd592c59041bc1ed3248c46326da1f5f Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 3 Dec 2015 15:03:34 +0100
+Subject: xhci: refuse loading if nousb is used
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 1eaf35e4dd592c59041bc1ed3248c46326da1f5f upstream.
+
+The module should fail to load.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -5042,6 +5042,10 @@ static int __init xhci_hcd_init(void)
+ BUILD_BUG_ON(sizeof(struct xhci_intr_reg) != 8*32/8);
+ /* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */
+ BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8);
++
++ if (usb_disabled())
++ return -ENODEV;
++
+ return 0;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
